@rallycry/conveyor-agent 10.3.1 → 10.4.0

package/dist/cli.js

@@ -25,12 +25,12 @@ import {
   runSetupCommand,
   runStartCommand,
   sampleKeyUsage
-} from "./chunk-HAH2S5AD.js";
+} from "./chunk-TZYEU4QE.js";
 import "./chunk-7TQO4ZF4.js";
 
 // src/cli.ts
 import { readFileSync } from "fs";
-import { join, dirname as dirname2 } from "path";
+import { join as join2, dirname as dirname3 } from "path";
 import { fileURLToPath } from "url";
 
 // src/setup/sidecars.ts
@@ -154,14 +154,14 @@ async function waitForSidecars(opts = {}) {
 
 // src/utils/session-identity.ts
 async function checkSessionTaskIdentity(params) {
-  const { sessionId, taskId, fetchSessionTaskId, logger: logger3 } = params;
+  const { sessionId, taskId, fetchSessionTaskId, logger: logger4 } = params;
   if (!sessionId || sessionId === taskId) return "skipped";
   let sessionTaskId;
   try {
     sessionTaskId = await fetchSessionTaskId(sessionId);
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    logger3.warn("Could not verify session/task identity \u2014 continuing (defense-in-depth only)", {
+    logger4.warn("Could not verify session/task identity \u2014 continuing (defense-in-depth only)", {
       sessionId,
       taskId,
       error: message
@@ -169,7 +169,7 @@ async function checkSessionTaskIdentity(params) {
     return "error";
   }
   if (sessionTaskId !== taskId) {
-    logger3.warn(
+    logger4.warn(
       "!!! CONVEYOR_SESSION_ID is bound to a different task than CONVEYOR_TASK_ID \u2014 server-side guards should still block mutations, but this indicates a misconfiguration or replayed token.",
       { sessionId, envTaskId: taskId, sessionTaskId }
     );
@@ -349,6 +349,95 @@ var ProjectSessionRunner = class {
   }
 };
 
+// src/harness/pty/adapters/opencode-auth.ts
+import { promises as fs } from "fs";
+import { dirname as dirname2, join } from "path";
+import { homedir } from "os";
+var logger = createServiceLogger("opencode-auth");
+var OPENCODE_CODEX_PLUGIN = "opencode-openai-codex-auth@4.4.0";
+var PLUGIN_PACKAGE = "opencode-openai-codex-auth";
+function opencodeAuthPath(env) {
+  const dataHome = env.XDG_DATA_HOME ?? join(env.HOME ?? homedir(), ".local", "share");
+  return join(dataHome, "opencode", "auth.json");
+}
+function opencodeConfigPath(env) {
+  const configHome = env.XDG_CONFIG_HOME ?? join(env.HOME ?? homedir(), ".config");
+  return join(configHome, "opencode", "opencode.json");
+}
+function parseOauthSeed(b64) {
+  if (!b64) return null;
+  try {
+    const parsed = JSON.parse(Buffer.from(b64, "base64").toString("utf8"));
+    if (typeof parsed.access === "string" && typeof parsed.refresh === "string" && typeof parsed.expires === "number") {
+      return { access: parsed.access, refresh: parsed.refresh, expires: parsed.expires };
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+function shouldSeed(existingEntry, seed) {
+  if (!existingEntry || typeof existingEntry !== "object") return true;
+  const entry = existingEntry;
+  if (entry.type !== "oauth") return true;
+  if (typeof entry.access !== "string" || typeof entry.refresh !== "string") return true;
+  if (typeof entry.expires !== "number") return true;
+  return entry.expires < seed.expires;
+}
+async function readJsonFile(path) {
+  try {
+    return JSON.parse(await fs.readFile(path, "utf8"));
+  } catch {
+    return {};
+  }
+}
+async function writeJsonFile(path, value) {
+  await fs.mkdir(dirname2(path), { recursive: true });
+  await fs.writeFile(path, `${JSON.stringify(value, null, 2)}
+`, { mode: 384 });
+}
+async function ensureAuthEntry(env, seed) {
+  const path = opencodeAuthPath(env);
+  const store = await readJsonFile(path);
+  if (!shouldSeed(store.openai, seed)) {
+    logger.info("opencode oauth store is fresher than the seed; leaving it alone");
+    return;
+  }
+  store.openai = {
+    type: "oauth",
+    access: seed.access,
+    refresh: seed.refresh,
+    expires: seed.expires
+  };
+  await writeJsonFile(path, store);
+  logger.info("seeded opencode oauth store entry");
+}
+async function ensurePluginConfig(env) {
+  const path = opencodeConfigPath(env);
+  const config = await readJsonFile(path);
+  const plugins = Array.isArray(config.plugin) ? config.plugin : [];
+  const isOurs = (p) => typeof p === "string" && (p === PLUGIN_PACKAGE || p.startsWith(`${PLUGIN_PACKAGE}@`));
+  const hasExactPin = plugins.includes(OPENCODE_CODEX_PLUGIN);
+  const hasStalePin = plugins.some((p) => isOurs(p) && p !== OPENCODE_CODEX_PLUGIN);
+  if (hasExactPin && !hasStalePin) return;
+  const kept = plugins.filter((p) => !isOurs(p));
+  config.plugin = [...kept, OPENCODE_CODEX_PLUGIN];
+  await writeJsonFile(path, config);
+  logger.info("ensured opencode codex-auth plugin in config");
+}
+async function seedOpenCodeOauth(env) {
+  const seed = parseOauthSeed(env.CONVEYOR_OPENCODE_OAUTH);
+  if (!seed) return;
+  try {
+    await ensureAuthEntry(env, seed);
+    await ensurePluginConfig(env);
+  } catch (err) {
+    logger.warn(
+      `failed to seed opencode oauth store: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+
 // src/harness/pty/adapters/opencode.ts
 var PROVIDER_KEY_ENV = {
   openai: "OPENAI_API_KEY",
@@ -380,16 +469,19 @@ var OpenCodeTuiAdapter = class {
   buildSpawn(input) {
     const env = { ...inheritedEnv() };
     delete env.CONVEYOR_AGENT_KEY;
+    delete env.CONVEYOR_OPENCODE_OAUTH;
+    const oauthActive = Boolean(this.env.CONVEYOR_OPENCODE_OAUTH);
     const key = this.env.CONVEYOR_AGENT_KEY;
     const provider = this.env.CONVEYOR_AGENT_PROVIDER ?? "openai";
     const keyEnvVar = PROVIDER_KEY_ENV[provider];
-    if (key && keyEnvVar) env[keyEnvVar] = key;
+    if (key && keyEnvVar && !oauthActive) env[keyEnvVar] = key;
     const model = this.env.CONVEYOR_AGENT_MODEL ?? input.options.model;
     const args = [];
     if (model) args.push("--model", model.includes("/") ? model : `${provider}/${model}`);
     return { file: this.resolveBinary(), args, env };
   }
   async prepareEnvironment() {
+    await seedOpenCodeOauth(this.env);
   }
   spawnFingerprint(input) {
     return JSON.stringify(["opencode", input.model, input.cwd]);
@@ -589,7 +681,7 @@ var AdhocSessionRunner = class {
 import { spawn as nodeSpawn, execFile } from "child_process";
 import { promisify } from "util";
 var execFileAsync = promisify(execFile);
-var logger = createServiceLogger("ReviewChild");
+var logger2 = createServiceLogger("ReviewChild");
 var SPAWN_FAILURE_GRACE_MS = 15e3;
 var KILL_WAIT_MS = 5e3;
 function buildReviewChildEnv(baseEnv, data) {
@@ -618,7 +710,7 @@ var ReviewChildSupervisor = class {
   childSessionId = null;
   /** Spawn (or replace) the review child for a `session:spawnReview` push. */
   async spawn(data) {
-    logger.info("Spawning same-pod review child", {
+    logger2.info("Spawning same-pod review child", {
       reviewSessionId: data.sessionId,
       branch: data.branch ?? void 0,
       prNumber: data.prNumber ?? void 0
@@ -661,7 +753,7 @@ var ReviewChildSupervisor = class {
       process.stderr.write(`[review-child] ${chunk.toString()}`);
     });
     child.on("error", (err) => {
-      logger.error("Review child spawn error", { error: err.message });
+      logger2.error("Review child spawn error", { error: err.message });
       if (this.child === child) {
         this.child = null;
         this.childSessionId = null;
@@ -674,7 +766,7 @@ var ReviewChildSupervisor = class {
         this.child = null;
         this.childSessionId = null;
       }
-      logger.info("Review child exited", { code, signal, reviewSessionId: data.sessionId });
+      logger2.info("Review child exited", { code, signal, reviewSessionId: data.sessionId });
       const withinGrace = Date.now() - spawnedAt < SPAWN_FAILURE_GRACE_MS;
       if (wasCurrent && withinGrace && code !== null && code !== 0) {
         reportOnce(`review child exited with code ${code} within startup grace`);
@@ -692,7 +784,7 @@ var ReviewChildSupervisor = class {
       this.childSessionId = null;
       return;
     }
-    logger.info("Stopping review child", { reason, reviewSessionId: this.childSessionId });
+    logger2.info("Stopping review child", { reason, reviewSessionId: this.childSessionId });
     this.child = null;
     this.childSessionId = null;
     await new Promise((resolve) => {
@@ -734,7 +826,7 @@ var ReviewChildSupervisor = class {
         timeout: 3e4
       });
     } catch (err) {
-      logger.warn("Review checkout freshen skipped", {
+      logger2.warn("Review checkout freshen skipped", {
         branch,
         error: err instanceof Error ? err.message : String(err)
       });
@@ -744,13 +836,13 @@ var ReviewChildSupervisor = class {
 
 // src/cli.ts
 if (process.argv.includes("--version")) {
-  const __dirname = dirname2(fileURLToPath(import.meta.url));
-  const pkgPath = join(__dirname, "..", "package.json");
+  const __dirname = dirname3(fileURLToPath(import.meta.url));
+  const pkgPath = join2(__dirname, "..", "package.json");
   const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
   process.stdout.write(pkg.version + "\n");
   process.exit(0);
 }
-var logger2 = createServiceLogger("CLI");
+var logger3 = createServiceLogger("CLI");
 var exitContext = {};
 var exitLogged = false;
 function logAgentExit(reason, opts) {
@@ -764,12 +856,12 @@ function logAgentExit(reason, opts) {
     uptimeSec: process.uptime(),
     identity: exitContext
   });
-  logger2[exitLogLevel(reason)]("agent_exit", payload);
+  logger3[exitLogLevel(reason)]("agent_exit", payload);
 }
 async function bootstrapFromCodespace(apiUrl, instanceName) {
   const bootstrapToken = process.env.CONVEYOR_BOOTSTRAP_TOKEN;
   const apiUrlFromEnv = Boolean(process.env.CONVEYOR_API_URL);
-  logger2.info("Bootstrapping from codespace", {
+  logger3.info("Bootstrapping from codespace", {
     codespace: instanceName,
     apiUrl,
     apiUrlFromEnv,
@@ -781,7 +873,7 @@ async function bootstrapFromCodespace(apiUrl, instanceName) {
     bootstrapToken
   });
   if (!result.ok) {
-    logger2.error("Bootstrap failed after retries", {
+    logger3.error("Bootstrap failed after retries", {
       reason: result.reason,
       attempts: result.attempts,
       status: result.status,
@@ -794,7 +886,7 @@ async function bootstrapFromCodespace(apiUrl, instanceName) {
     process.exit(1);
   }
   applyBootstrapToEnv(result.config);
-  logger2.info("Bootstrap complete", {
+  logger3.info("Bootstrap complete", {
     taskId: result.config.taskId,
     attempts: result.attempts
   });
@@ -808,20 +900,20 @@ function isExpectedAbortError(error) {
 process.on("uncaughtException", (err) => {
   if (err.code === "EPIPE") return;
   if (isExpectedAbortError(err)) {
-    logger2.info("Ignored expected abort after shutdown", { error: err.message, code: err.code });
+    logger3.info("Ignored expected abort after shutdown", { error: err.message, code: err.code });
     return;
   }
-  logger2.error("Uncaught exception", { error: err.message, code: err.code });
+  logger3.error("Uncaught exception", { error: err.message, code: err.code });
   logAgentExit("uncaught_exception", { exitCode: 1 });
   process.exit(1);
 });
 process.on("unhandledRejection", (reason) => {
   const err = reason instanceof Error ? reason : new Error(String(reason));
   if (isExpectedAbortError(err)) {
-    logger2.info("Ignored expected abort rejection after shutdown", { error: err.message });
+    logger3.info("Ignored expected abort rejection after shutdown", { error: err.message });
     return;
   }
-  logger2.error("Unhandled rejection", { error: err.message });
+  logger3.error("Unhandled rejection", { error: err.message });
   logAgentExit("unhandled_rejection", { exitCode: 1 });
   process.exit(1);
 });
@@ -830,7 +922,7 @@ var conveyorApiUrl = process.env.CONVEYOR_API_URL || DEFAULT_CONVEYOR_API_URL;
 var INSTANCE_NAME = process.env.CODESPACE_NAME || process.env.CLAUDESPACE_NAME;
 if (INSTANCE_NAME && !process.env.CONVEYOR_TASK_TOKEN) {
   if (!conveyorApiUrl) {
-    logger2.error("Could not resolve CONVEYOR_API_URL for codespace bootstrap");
+    logger3.error("Could not resolve CONVEYOR_API_URL for codespace bootstrap");
     process.exit(1);
   }
   await bootstrapFromCodespace(conveyorApiUrl, INSTANCE_NAME);
@@ -848,7 +940,7 @@ exitContext.runnerMode = CONVEYOR_MODE;
 exitContext.sessionId = process.env.CONVEYOR_SESSION_ID ?? CONVEYOR_TASK_ID;
 var projectIdentity = resolveProjectRunnerIdentity(process.env);
 if (!CONVEYOR_TASK_ID && projectIdentity && CONVEYOR_MODE === "adhoc") {
-  logger2.info("Starting ad-hoc agent", { projectId: projectIdentity.projectId });
+  logger3.info("Starting ad-hoc agent", { projectId: projectIdentity.projectId });
   const adhocRunner = new AdhocSessionRunner(
     {
       connection: {
@@ -864,7 +956,7 @@ if (!CONVEYOR_TASK_ID && projectIdentity && CONVEYOR_MODE === "adhoc") {
     },
     {
       onEvent: (event) => {
-        logger2.info("Ad-hoc runner event", { eventType: event.type });
+        logger3.info("Ad-hoc runner event", { eventType: event.type });
       }
     }
   );
@@ -882,7 +974,7 @@ if (!CONVEYOR_TASK_ID && projectIdentity && CONVEYOR_MODE === "adhoc") {
   process.exit(adhocError ? 1 : 0);
 }
 if (!CONVEYOR_TASK_ID && projectIdentity) {
-  logger2.info("Starting project agent", { projectId: projectIdentity.projectId });
+  logger3.info("Starting project agent", { projectId: projectIdentity.projectId });
   const projectRunner = new ProjectSessionRunner(
     {
       connection: {
@@ -897,7 +989,7 @@ if (!CONVEYOR_TASK_ID && projectIdentity) {
     },
     {
       onEvent: (event) => {
-        logger2.info("Project runner event", { eventType: event.type });
+        logger3.info("Project runner event", { eventType: event.type });
       }
     }
   );
@@ -915,28 +1007,28 @@ if (!CONVEYOR_TASK_ID && projectIdentity) {
   process.exit(projectError ? 1 : 0);
 }
 if (!CONVEYOR_TASK_TOKEN || !CONVEYOR_TASK_ID) {
-  logger2.error("Missing required environment variables");
-  logger2.error("  CONVEYOR_TASK_TOKEN - JWT token for task authentication");
-  logger2.error("  CONVEYOR_TASK_ID - ID of the task to execute");
-  logger2.error("");
-  logger2.error("CONVEYOR_API_URL is provided via codespace secret or bootstrap.");
-  logger2.error("");
-  logger2.error("Optional:");
-  logger2.error("  CONVEYOR_MODE - Runner mode: 'task' (default), 'pack', or 'pm'");
-  logger2.error("  CONVEYOR_WORKSPACE - Working directory (defaults to cwd)");
-  logger2.error(
+  logger3.error("Missing required environment variables");
+  logger3.error("  CONVEYOR_TASK_TOKEN - JWT token for task authentication");
+  logger3.error("  CONVEYOR_TASK_ID - ID of the task to execute");
+  logger3.error("");
+  logger3.error("CONVEYOR_API_URL is provided via codespace secret or bootstrap.");
+  logger3.error("");
+  logger3.error("Optional:");
+  logger3.error("  CONVEYOR_MODE - Runner mode: 'task' (default), 'pack', or 'pm'");
+  logger3.error("  CONVEYOR_WORKSPACE - Working directory (defaults to cwd)");
+  logger3.error(
     "  Project pods instead require CONVEYOR_PROJECT_ID + CONVEYOR_SESSION_ID + CONVEYOR_MODE=pm"
   );
   process.exit(1);
 }
 if (CONVEYOR_MODE !== "task" && CONVEYOR_MODE !== "pm" && CONVEYOR_MODE !== "code-review" && CONVEYOR_MODE !== "adhoc" && CONVEYOR_MODE !== "pack") {
-  logger2.error("Invalid CONVEYOR_MODE", {
+  logger3.error("Invalid CONVEYOR_MODE", {
     mode: CONVEYOR_MODE,
     expected: ["task", "pm", "code-review", "adhoc", "pack"]
   });
   process.exit(1);
 }
-logger2.info("Starting agent", { mode: CONVEYOR_MODE });
+logger3.info("Starting agent", { mode: CONVEYOR_MODE });
 var lifecycleOverrides = process.env.CLAUDESPACE_NAME ? { idleTimeoutMs: 60 * 60 * 1e3 } : { gitFlushIntervalMs: 0 };
 var runner = new SessionRunner(
   {
@@ -956,12 +1048,12 @@ var runner = new SessionRunner(
   },
   {
     onStatusChange: (status) => {
-      logger2.info("Status changed", { status });
+      logger3.info("Status changed", { status });
     },
     onEvent: (event) => {
       const detail = event.message ?? event.content ?? event.summary ?? "";
       if (detail) {
-        logger2.info(detail, { eventType: event.type });
+        logger3.info(detail, { eventType: event.type });
       }
     }
   }
@@ -969,7 +1061,7 @@ var runner = new SessionRunner(
 var reviewChildren = new ReviewChildSupervisor(runner.connection, CONVEYOR_WORKSPACE);
 var shutdownSignal;
 var shutdownAgent = (signal) => {
-  logger2.info(`Received ${signal}, flushing git and stopping agent`);
+  logger3.info(`Received ${signal}, flushing git and stopping agent`);
   shutdownSignal = signal;
   void (async () => {
     try {
@@ -983,8 +1075,8 @@ var shutdownAgent = (signal) => {
     }
   })();
   setTimeout(() => {
-    logger2.warn(`Forcing exit after ${signal} timeout`);
-    logger2.warn(
+    logger3.warn(`Forcing exit after ${signal} timeout`);
+    logger3.warn(
       "agent_exit",
       buildAgentExitLog({
         reason: "force_timeout",
@@ -1022,7 +1114,7 @@ var stopStartCommandChild = () => {
   }
 };
 var launchStartCommand = (command) => {
-  logger2.info("Running start command", { command });
+  logger3.info("Running start command", { command });
   runner.connection.sendEvent({ type: "start_command_started" });
   const child = runStartCommand(command, CONVEYOR_WORKSPACE, (stream, data) => {
     runner.connection.sendEvent({ type: "start_command_output", stream, data });
@@ -1032,7 +1124,7 @@ var launchStartCommand = (command) => {
   child.on("exit", (code, signal) => {
     if (startCommandChild === child) startCommandChild = null;
     if (expectedStartCommandStops.has(child)) return;
-    logger2.info("Start command exited", { code, signal });
+    logger3.info("Start command exited", { code, signal });
     runner.connection.sendEvent({
       type: "start_command_exited",
       code,
@@ -1048,7 +1140,7 @@ var launchStartCommand = (command) => {
   });
   child.on("error", (err) => {
     if (startCommandChild === child) startCommandChild = null;
-    logger2.error("Start command error", { error: err.message });
+    logger3.error("Start command error", { error: err.message });
     runner.connection.sendEvent({ type: "start_command_error", message: err.message });
   });
 };
@@ -1064,12 +1156,12 @@ void checkSessionTaskIdentity({
     const ctx = await runner.connection.call("getTaskContext", { sessionId });
     return ctx.id;
   },
-  logger: logger2
+  logger: logger3
 });
 if (CONVEYOR_MODE === "task") {
   runner.connection.onSpawnReview((data) => {
     void reviewChildren.spawn(data).catch((err) => {
-      logger2.error("Review child spawn threw", {
+      logger3.error("Review child spawn threw", {
         error: err instanceof Error ? err.message : String(err)
       });
       runner.connection.reportReviewSpawnFailure(
@@ -1109,15 +1201,15 @@ if (conveyorConfig) {
       startLazy: false
     });
     if (conveyorConfig.setupCommand) {
-      logger2.info("Running setup command (background)", {
+      logger3.info("Running setup command (background)", {
         command: conveyorConfig.setupCommand
       });
       try {
         await runSetupCommand(conveyorConfig.setupCommand, CONVEYOR_WORKSPACE, logSetupOutput);
-        logger2.info("Setup command completed");
+        logger3.info("Setup command completed");
       } catch (error) {
         const msg = error instanceof Error ? error.message : "Setup command failed";
-        logger2.error("Setup command failed", { error: msg });
+        logger3.error("Setup command failed", { error: msg });
         runner.connection.sendEvent({ type: "setup_error", message: msg });
       }
     }
@@ -1146,7 +1238,7 @@ runner.run().then(() => {
   process.exit(errored ? 1 : 0);
 }).catch((error) => {
   const msg = error instanceof Error ? error.message : String(error);
-  logger2.error("Agent runner failed", { error: msg });
+  logger3.error("Agent runner failed", { error: msg });
   logAgentExit("error", { exitCode: 1, finalState: runner.finalState ?? void 0 });
   process.exit(1);
 });