@quickchatai/quickreview 1.1.0 → 1.3.1

package/src/loginrefresh/lock.ts

@@ -1,5 +1,12 @@
 // The single-instance lock: an exclusive flock on a SEPARATE lock file
-// (`pihome/agent/auth.json.lock`), held for the refresher's whole life.
+// (`pihome/agent/loginrefresh.lock`), held for the refresher's whole life.
+//
+// Why not `auth.json.lock`: that path is pi's. pi guards auth.json with
+// proper-lockfile, whose lock is a DIRECTORY `<file>.lock` (mkdir; a stale one
+// is rmdir'd). A plain file at that path makes every pi CLI fail at startup
+// (`ENOTDIR: not a directory, rmdir '…/auth.json.lock'`), so this lock is named
+// for this process and never `<anything pi locks>.lock`. Earlier builds did use
+// `auth.json.lock`; `removeLegacyLockFile` clears what they left behind.
 //
 // Why not a lock on auth.json: every refresh replaces auth.json by rename
 // (atomic.ts), so a lock on it stays on the old inode, a second refresher could
@@ -12,8 +19,17 @@
 // lock lasts exactly as long as the pipe's write end does: release() closes it,
 // and a refresher that is killed in any way closes it too (the kernel closes its
 // descriptors), so a crash can never leave the lock held by an orphan.
-import { spawn } from "node:child_process";
-import { chmodSync, chownSync, closeSync, mkdirSync, openSync } from "node:fs";
+import { spawn, spawnSync } from "node:child_process";
+import {
+  chmodSync,
+  chownSync,
+  closeSync,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  unlinkSync,
+} from "node:fs";
 import { dirname } from "node:path";
 
 /** flock's exit status when the lock is held by someone else (-E). */
@@ -102,3 +118,56 @@ export function acquireLoginLock(
     });
   });
 }
+
+/** What `removeLegacyLockFile` found at the old lock path. */
+export type LegacyLockOutcome = "absent" | "not-a-file" | "removed" | "unremovable";
+
+/**
+ * Remove the plain lock FILE an earlier refresher left at `path` (the old
+ * `auth.json.lock`, which is pi's proper-lockfile path and breaks every pi CLI
+ * while it is a file). Only a regular file is removed: a directory there is
+ * pi's own live lock and a symlink is not ours, so both are left alone. Throws
+ * `LoginLockHeld` when a refresher of an earlier build still holds a flock on
+ * it (the two would otherwise run side by side on different lock files).
+ */
+export function removeLegacyLockFile(
+  path: string,
+  o: { flockBin?: string } = {},
+): LegacyLockOutcome {
+  let isFile: boolean;
+  try {
+    isFile = lstatSync(path).isFile();
+  } catch {
+    return "absent";
+  }
+  if (!isFile) return "not-a-file";
+  const probe = spawnSync(
+    o.flockBin ?? "flock",
+    ["-n", "-E", String(LOCK_HELD_EXIT), path, "true"],
+    { stdio: "ignore" },
+  );
+  if (probe.status === LOCK_HELD_EXIT) throw new LoginLockHeld(path);
+  try {
+    unlinkSync(path);
+    return "removed";
+  } catch (err) {
+    return (err as NodeJS.ErrnoException).code === "ENOENT" ? "absent" : "unremovable";
+  }
+}
+
+/**
+ * Does a refresher hold the lock at `path` now? true or false; null when it
+ * cannot be told (no flock on this machine, or flock failed). A probe, never a
+ * holder: no lock file is created where there is none (none: nobody holds it).
+ */
+export function loginLockHeld(path: string, o: { flockBin?: string } = {}): boolean | null {
+  if (!existsSync(path)) return false;
+  const probe = spawnSync(
+    o.flockBin ?? "flock",
+    ["-n", "-E", String(LOCK_HELD_EXIT), path, "true"],
+    { stdio: "ignore" },
+  );
+  if (probe.error) return null;
+  if (probe.status === LOCK_HELD_EXIT) return true;
+  return probe.status === 0 ? false : null;
+}

package/src/loginrefresh/pirefresh.ts

@@ -20,6 +20,9 @@ const PI_AI = "@earendil-works/pi-ai";
 export const OAUTH_LOADERS: Readonly<Record<string, string>> = {
   anthropic: "loadAnthropicOAuth",
   "openai-codex": "loadOpenAICodexOAuth",
+  // pi 1.4's "Sign in with ChatGPT" (the provider `openai`, type oauth): a
+  // newer OpenAI login is refreshed by the same owner.
+  openai: "loadOpenAIChatGPTOAuth",
   "github-copilot": "loadGitHubCopilotOAuth",
   openrouter: "loadOpenRouterOAuth",
   "kimi-coding": "loadKimiCodingOAuth",

package/src/loginrefresh/refresher.ts

@@ -6,8 +6,18 @@
 // (main.ts) the daemon spawns and supervises by path, so the daemon imports
 // neither pi nor src/engine/.
 //
-//   Lock      an exclusive flock on `auth.json.lock` for its whole life (lock.ts);
-//             a second refresher is refused, before and after any refresh.
+//   Lock      an exclusive flock on `loginrefresh.lock` for its whole life (lock.ts);
+//             a second refresher is refused, before and after any refresh. Never
+//             `auth.json.lock`: that is pi's own proper-lockfile path (a
+//             directory), and a file there breaks every pi CLI. A plain file an
+//             earlier build left there is removed at start.
+//   pi lock   not taken: the refresher does not hold pi's proper-lockfile lock
+//             around its read-refresh-write (proper-lockfile is pi's dependency,
+//             not ours). It needs none while it is healthy: it refreshes far
+//             ahead of pi's own window, so a pi on this file has nothing to
+//             refresh, and a login goes through the entrypoint's pause below. A
+//             raw `pi` + `/login` that bypasses the pause can lose its new
+//             login to a refresh that lands in the same moment.
 //   Refresh   every 10 minutes, any OAuth entry that is inside pi's refresh
 //             window plus a margin longer than the longest worker cap is
 //             refreshed through `deps.refresh` (pi-ai's own, pirefresh.ts) and
@@ -26,11 +36,14 @@
 import { existsSync, readFileSync, statSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
 import { writeFileAtomic } from "./atomic.js";
-import { acquireLoginLock, type LoginLock } from "./lock.js";
+import { acquireLoginLock, removeLegacyLockFile, type LoginLock } from "./lock.js";
 import type { LoginRefreshFileStatus } from "./types.js";
 
 export const AUTH_FILE = "auth.json";
-export const LOCK_FILE = "auth.json.lock";
+/** The single-instance lock. Not `${AUTH_FILE}.lock`: that is pi's (lock.ts). */
+export const LOCK_FILE = "loginrefresh.lock";
+/** Where earlier builds kept the lock: pi's proper-lockfile path, cleared at start. */
+export const LEGACY_LOCK_FILE = "auth.json.lock";
 export const PAUSE_FILE = "auth.json.pause";
 export const STATUS_FILE = "loginrefresh.status.json";
 
@@ -134,10 +147,26 @@ export class LoginRefresher {
    * keep looking.
    */
   static async start(deps: RefresherDeps, o: { autoRun?: boolean } = {}): Promise<LoginRefresher> {
+    const flock = deps.flockBin ? { flockBin: deps.flockBin } : {};
     const lock = await acquireLoginLock(join(deps.agentDir, LOCK_FILE), {
-      ...(deps.flockBin ? { flockBin: deps.flockBin } : {}),
+      ...flock,
       gid: deps.gid,
     });
+    const legacy = join(deps.agentDir, LEGACY_LOCK_FILE);
+    let outcome: ReturnType<typeof removeLegacyLockFile>;
+    try {
+      outcome = removeLegacyLockFile(legacy, flock);
+    } catch (err) {
+      // a refresher of an earlier build still runs on the old lock
+      await lock.release();
+      throw err;
+    }
+    if (outcome === "removed")
+      deps.log(`login refresh: removed the old lock file ${legacy} (it is pi's lock path)`);
+    if (outcome === "unremovable")
+      deps.log(
+        `login refresh: could not remove the old lock file ${legacy}; pi fails until it goes`,
+      );
     const r = new LoginRefresher(deps, lock);
     r.publish();
     await r.tick();

package/src/loginrefresh/supervisor.ts

@@ -21,7 +21,7 @@
 // second refresher would rotate the refresh token under them.
 import { existsSync, readFileSync } from "node:fs";
 import { spawn as nodeSpawn } from "node:child_process";
-import { join } from "node:path";
+import { isAbsolute, join } from "node:path";
 import {
   foldChildLines,
   restartDelayMs,
@@ -33,6 +33,28 @@ import {
 import { LOCK_HELD_EXIT } from "./lock.js";
 import type { LoginRefreshFileStatus, LoginRefreshStatus } from "./types.js";
 
+/** Names the login's dir when it is not pi's agent dir. The single box's
+ * shared login (one login per box): the home's switch-on mounts the
+ * host pi home's agent dir at CONTAINER_LOGIN_DIR (docker-compose.yml,
+ * QCR_PI_LOGIN_DIR in the project .env) and the compose file names it here.
+ * Only the login moves: the refresher keeps auth.json there and every worker
+ * borrows from there, while settings, models.json and the lens agents stay in
+ * the container's own agent dir, whose settings the entrypoint provisions and
+ * which must never be the person's own. */
+export const LOGIN_DIR_ENV = "QCR_LOGIN_DIR";
+/** Where docker-compose.yml mounts the host's login. */
+export const CONTAINER_LOGIN_DIR = "/opt/qcr/login";
+
+/** The login's dir: `QCR_LOGIN_DIR` when it is an absolute path, else pi's
+ * agent dir (the login volume, as before). */
+export function loginDirOf(
+  env: Readonly<Record<string, string | undefined>>,
+  agentDir: string,
+): string {
+  const set = (env[LOGIN_DIR_ENV] ?? "").trim();
+  return set !== "" && isAbsolute(set) ? set : agentDir;
+}
+
 /** The restart ladder, ms: a refresher that cannot start (lock held, config) is
  * retried slowly; one that crashed after a good run is retried at once. */
 export const LOGIN_RESTART_LADDER_MS = [2_000, 10_000, 60_000];
@@ -44,7 +66,8 @@ export const LOGIN_STATUS_POLL_MS = 5_000;
 export interface LoginRefreshSupervisorDeps {
   /** The checkout root: where `dist/src/loginrefresh/main.js` lives. */
   repoRoot: string;
-  /** pi's agent dir (the login volume's `agent/`). */
+  /** The login's dir: pi's agent dir (the login volume's `agent/`), or the
+   * single box's shared login (`loginDirOf`). */
   agentDir: string;
   marginMin: number;
   /** The login group, when the daemon knows it. */

package/src/npmverbs.ts

@@ -5,8 +5,13 @@
 //   qcr login [provider]  pi's own /login, in the pinned pi (src/picli.ts),
 //                         into the user's pi agent dir. pi's UI is the flow:
 //                         qcr types /login for the person and steps aside.
+//                         When auto-review's refresher holds that login, it
+//                         is paused first and released after, as the home's
+//                         re-login does (src/loginrefresh/handover.ts).
 //   qcr pi [args]         the pinned pi with the qcr plugin preloaded
-//                         (`-e <the plugin package's dir>`), args passed on.
+//                         (`-e <the plugin package's dir>`) and the app's
+//                         own /selfimprove beside it (`-e` its shim,
+//                         `APP_PI_EXTENSIONS`), args passed on.
 //   qcr update            the package manager that installed qcr (npm, pnpm or
 //                         bun) updates it globally. The release image keeps its
 //                         own route (a release), and a checkout its git.
@@ -15,11 +20,12 @@
 // `npmVerbDeps()` is the real assembly.
 import { spawnSync, type SpawnSyncOptions } from "node:child_process";
 import { existsSync, realpathSync } from "node:fs";
-import { homedir } from "node:os";
 import { delimiter, join } from "node:path";
 import { pluginPackageDir } from "./coreext.js";
 import { detectInstall, type Installer } from "./installkind.js";
+import type { RefresherHold } from "./loginrefresh/handover.js";
 import { readLogins } from "./loginhint.js";
+import { piAgentDir } from "./piagentdir.js";
 import { piCliPath } from "./picli.js";
 
 /** The npm package this CLI is published as. */
@@ -44,12 +50,9 @@ export function updateCommand(installer: Installer, pkg: string = CLI_PACKAGE):
   }
 }
 
-/** pi's agent dir: `$PI_CODING_AGENT_DIR`, else `~/.pi/agent`, as pi reads it. */
-export function piAgentDir(env: Readonly<Record<string, string | undefined>>): string {
-  const set = (env["PI_CODING_AGENT_DIR"] ?? "").trim();
-  if (set !== "") return set;
-  return join((env["HOME"] ?? "").trim() || homedir(), ".pi", "agent");
-}
+// pi's agent dir lives in a leaf of its own, so the home reads the same rule
+// without these verbs.
+export { piAgentDir };
 
 /** The providers pi holds a credential for in `agentDir`, from its auth.json;
  * empty when there is none or it cannot be read. Never a token. */
@@ -86,6 +89,9 @@ export interface NpmVerbDeps {
   err: (line: string) => void;
   /** `node`: the pinned pi's entry is a script, run by this node. */
   execPath: string;
+  /** Pause auto-review's login refresher of `agentDir` for a login, when one
+   * runs (src/loginrefresh/handover.ts `holdRefresher`). */
+  holdLogin: (agentDir: string) => Promise<RefresherHold>;
 }
 
 export function npmVerbDeps(pkgRoot: string): NpmVerbDeps {
@@ -103,10 +109,20 @@ export function npmVerbDeps(pkgRoot: string): NpmVerbDeps {
     out: (l) => console.log(l),
     err: (l) => console.error(l),
     execPath: process.execPath,
+    holdLogin: async (agentDir) => {
+      const { holdRefresher } = await import("./loginrefresh/handover.js");
+      return holdRefresher(agentDir);
+    },
   };
 }
 
-/** `qcr pi [args]`: the pinned pi with the plugin preloaded; pi's exit code. */
+/** The app's own extensions `qcr pi` loads beside the plugin, as paths under
+ * the CLI package's root: the commands that are the app's, not the plugin's
+ * (ADR 0001). */
+export const APP_PI_EXTENSIONS: readonly string[] = ["extensions/cli/selfimprove.ts"];
+
+/** `qcr pi [args]`: the pinned pi with the plugin and the app's own
+ * extensions preloaded; pi's exit code. */
 export function cmdPi(args: readonly string[], deps: NpmVerbDeps): number {
   let pi: string;
   let plugin: string;
@@ -117,7 +133,8 @@ export function cmdPi(args: readonly string[], deps: NpmVerbDeps): number {
     deps.err(`qcr pi: ${err instanceof Error ? err.message : String(err)}`);
     return 1;
   }
-  const r = deps.run(deps.execPath, [pi, "-e", plugin, ...args], {});
+  const app = APP_PI_EXTENSIONS.flatMap((e) => ["-e", join(deps.pkgRoot, e)]);
+  const r = deps.run(deps.execPath, [pi, "-e", plugin, ...app, ...args], {});
   if (r.error) {
     deps.err(`qcr pi: pi could not start: ${r.error.message}`);
     return 1;
@@ -144,8 +161,10 @@ export async function cmdLogin(args: readonly string[], deps: NpmVerbDeps): Prom
         "",
         "Opens pi's own /login in the pi qcr runs on, so the review sessions can use it.",
         "The login is kept in pi's agent dir ($PI_CODING_AGENT_DIR, default ~/.pi/agent).",
-        "The default review models run on a ChatGPT login (openai-codex); an API key in the",
-        "environment does not stand in for it: log in, or set the review's models in your qcr config.",
+        'Any OpenAI login serves the default review models: "OpenAI Codex (legacy)" or "OpenAI"',
+        '(Sign in with ChatGPT) under "Sign in with an account", or an OpenAI API key (at /login, or',
+        "OPENAI_API_KEY in the environment). A key for another provider does not stand in for it:",
+        "log in, or set the review's models in your qcr config.",
       ].join("\n"),
     );
     return 0;
@@ -167,6 +186,27 @@ export async function cmdLogin(args: readonly string[], deps: NpmVerbDeps): Prom
     return 1;
   }
   const agentDir = piAgentDir(deps.env);
+  // The refresher first, when one runs: a refresh that read the old grant and
+  // lands after the login would write it back over the new one.
+  const hold = await deps.holdLogin(agentDir);
+  if (!hold.ok) {
+    deps.err(`qcr login: ${hold.why}; nothing was changed.`);
+    return 1;
+  }
+  if (hold.held) deps.out("qcr login: auto-review's login refresher is paused while you log in.");
+  try {
+    return await runLogin(provider, pi, agentDir, deps);
+  } finally {
+    hold.release();
+  }
+}
+
+async function runLogin(
+  provider: string | undefined,
+  pi: string,
+  agentDir: string,
+  deps: NpmVerbDeps,
+): Promise<number> {
   const before = loggedInProviders(agentDir);
   let status: number | null;
   if (onPath("tmux", deps.env["PATH"])) {
@@ -194,7 +234,9 @@ export async function cmdLogin(args: readonly string[], deps: NpmVerbDeps): Prom
     deps.out(
       `qcr login: opening pi — type /login${provider ? ` ${provider}` : ""} and pick your provider, then quit pi (the login lands in ${agentDir}).`,
     );
-    const r = deps.run(deps.execPath, [pi], {});
+    // --no-approve as on the tmux route (src/pilogin.ts): a login needs
+    // nothing from this folder, so pi neither asks to trust it nor trusts it.
+    const r = deps.run(deps.execPath, [pi, "--no-approve"], {});
     if (r.error) {
       deps.err(`qcr login: pi could not start: ${r.error.message}`);
       return 1;

package/src/onboard/choices.ts

@@ -16,8 +16,7 @@
 //      record each key, and the test proves each named step really does — so a
 //      key that only ever gets read cannot survive review.
 //
-// A key private to one step — the go-live decision, the bring-up timestamp, the
-// vm-deploy record, the model prefix, the memory key-file path — stays a local
+// A key private to one step — the go-live decision, the vm-deploy record, the model prefix, the memory key-file path — stays a local
 // constant in that step. This file is about the handoffs.
 //
 // Nothing here imports a step (the steps import this), so there is no cycle and
@@ -41,6 +40,12 @@ export type IngressChoice = (typeof INGRESS_CHOICES)[number];
 export const AUTH_ROUTES = ["oauth", "api"] as const;
 export type AuthRoute = (typeof AUTH_ROUTES)[number];
 
+/** How the daemon authenticates to GitHub (`config.toml [github] auth`):
+ * "user" is the person's own account (polling only, no App), "app" a GitHub
+ * App. Answered as the github_account step's input; absent ⇒ unanswered. */
+export const GITHUB_AUTH_CHOICES = ["user", "app"] as const;
+export type GithubAuth = (typeof GITHUB_AUTH_CHOICES)[number];
+
 /** "owner/name" — the reviewed repo as the interview records it and the App
  * step parses it: no URL, no trailing `.git`. */
 export const REPO_SLUG_RE = /^([A-Za-z0-9._-]+)\/([A-Za-z0-9._-]+)$/;
@@ -59,6 +64,10 @@ export type MemoryChoice = (typeof MEMORY_CHOICE_IDS)[number];
 export const CHOICE_KEYS = {
   /** The operator's uid, captured by preflight: the containers run as it. */
   uid: "qcr_uid",
+  /** When the bring-up step last brought the stack up (an ISO timestamp).
+   * Written by bringup; read by the login-share step, which recreates a
+   * stack brought up before so the daemon gets its login mount. */
+  broughtUpAt: "stack_brought_up_at",
 
   /** `Topology`. Written by the topology step; read by everything that has to
    * know where the stack runs (transport selection, the VM-only steps). */
@@ -71,6 +80,20 @@ export const CHOICE_KEYS = {
   /** `AuthRoute`. Written by the LLM step; read by the interview's shape line. */
   authRoute: "llm_auth_route",
 
+  /** `GithubAuth`. Written by the github_account step (the operator's answer,
+   * defaulted to "user" where `gh auth token` works); read by everything that
+   * differs between the own-account route and the App route — which of
+   * github_account / github_app / app_slug_reconcile is enabled, the
+   * interview's App questions, the ingress shapes on offer, verification. */
+  githubAuth: "github_auth",
+  /** The person's GitHub login, from `GET /user` with their own token (own-
+   * account route). The interview's owner-login answer and `[github]
+   * bot_login` both come from it. */
+  accountLogin: "github_account_login",
+  /** "owner/name" the person picked from the repos their account reaches
+   * (own-account route). The interview reads it as its repo answer. */
+  accountRepo: "github_account_repo",
+
   /** "owner/name" of the reviewed repo. Written by the interview; read by the
    * GitHub App step and the proof round. */
   repo: "reviewed_repo",
@@ -144,6 +167,10 @@ export type ChoiceKey = (typeof CHOICE_KEYS)[ChoiceName];
  */
 export const CHOICE_WRITERS: Record<ChoiceName, readonly string[]> = {
   uid: ["preflight"],
+  broughtUpAt: ["bringup"],
+  githubAuth: ["github_account"],
+  accountLogin: ["github_account"],
+  accountRepo: ["github_account"],
   topology: ["topology"],
   sshAlias: ["topology"],
   sshUser: ["ssh_preflight"],
@@ -158,7 +185,7 @@ export const CHOICE_WRITERS: Record<ChoiceName, readonly string[]> = {
   dryRun: ["config_fill"],
   labels: ["config_fill"],
   appSlug: ["config_fill", "github_app", "app_slug_reconcile"],
-  botLogin: ["github_app", "app_slug_reconcile"],
+  botLogin: ["github_account", "github_app", "app_slug_reconcile"],
   appId: ["github_app"],
   appTarget: ["github_app"],
   appName: ["github_app"],
@@ -187,7 +214,6 @@ export const CHOICE_WRITERS: Record<ChoiceName, readonly string[]> = {
 export const PRIVATE_CHOICE_KEYS: Readonly<Record<string, string>> = {
   llm_model_prefix: "llm_auth",
   openviking_keys_file: "memory",
-  stack_brought_up_at: "bringup",
   go_live_decision: "go_live",
 };
 
@@ -216,6 +242,16 @@ export function authRouteOf(choices: Readonly<Record<string, unknown>>): AuthRou
   return memberOf(AUTH_ROUTES, raw(choices, CHOICE_KEYS.authRoute));
 }
 
+/** The recorded GitHub auth route, or null while unanswered. */
+export function githubAuthOf(choices: Readonly<Record<string, unknown>>): GithubAuth | null {
+  return memberOf(GITHUB_AUTH_CHOICES, raw(choices, CHOICE_KEYS.githubAuth));
+}
+
+/** Is the own-account route recorded? (Unanswered is NOT user mode.) */
+export function userAuthRecorded(choices: Readonly<Record<string, unknown>>): boolean {
+  return githubAuthOf(choices) === "user";
+}
+
 /** The recorded ingress shape, or null when the ingress step has not run. */
 export function ingressChoiceOf(choices: Readonly<Record<string, unknown>>): IngressChoice | null {
   return memberOf(INGRESS_CHOICES, raw(choices, CHOICE_KEYS.ingress));