@resolflow/cli 0.0.0-stage → 0.1.0-beta.0

package/dist/agents/tools.js

@@ -0,0 +1,175 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AGENT_TOOLS = exports.CODEX_OPT_IN_ENV = void 0;
+exports.toolIdOf = toolIdOf;
+exports.findOnPath = findOnPath;
+exports.binaryOf = binaryOf;
+exports.toolVersion = toolVersion;
+exports.apiKeyFor = apiKeyFor;
+exports.describeKeySource = describeKeySource;
+exports.validateApiKeyShape = validateApiKeyShape;
+exports.optedIn = optedIn;
+exports.detectTools = detectTools;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const secrets_1 = require("../secrets");
+const auth_1 = require("./auth");
+/** Codex jobs from Resolflow run only when the person sets this on the device. */
+exports.CODEX_OPT_IN_ENV = 'RESOLFLOW_ALLOW_CODEX_JOBS';
+exports.AGENT_TOOLS = {
+    'claude-code': { id: 'claude-code', label: 'Claude Code', bins: ['claude'], keyEnv: ['ANTHROPIC_API_KEY'], supported: true },
+    codex: {
+        id: 'codex',
+        label: 'Codex CLI',
+        bins: ['codex'],
+        keyEnv: ['CODEX_API_KEY', 'OPENAI_API_KEY'],
+        supported: true,
+        optInEnv: exports.CODEX_OPT_IN_ENV,
+        optInNote: `off by default: Codex's read-only sandbox does not stop it reading files outside the job folder (for example ~/.ssh), so a job prompt could make it read and return them. Set ${exports.CODEX_OPT_IN_ENV}=1 to offer it anyway`,
+    },
+    antigravity: {
+        id: 'antigravity',
+        label: 'Antigravity CLI',
+        bins: ['agy', 'antigravity'],
+        keyEnv: ['GEMINI_API_KEY'],
+        supported: false,
+        note: 'not supported yet: no stable, officially documented headless JSON mode with an API key',
+    },
+};
+/** `claude`, `claude-code`, `codex`, `antigravity`, `agy`, `gemini` → the tool id. */
+function toolIdOf(name) {
+    const n = name.trim().toLowerCase();
+    if (n === 'claude' || n === 'claude-code')
+        return 'claude-code';
+    if (n === 'codex')
+        return 'codex';
+    if (n === 'antigravity' || n === 'agy' || n === 'gemini')
+        return 'antigravity';
+    return null;
+}
+/** Absolute path of an executable on PATH (no shell). */
+function findOnPath(names, env = process.env) {
+    const dirs = (env.PATH ?? '').split(path.delimiter).filter(Boolean);
+    const exts = process.platform === 'win32' ? (env.PATHEXT ?? '.EXE;.CMD;.BAT').split(';') : [''];
+    for (const name of names) {
+        for (const dir of dirs) {
+            for (const ext of exts) {
+                const p = path.join(dir, name + ext);
+                try {
+                    const st = fs.statSync(p);
+                    if (st.isFile()) {
+                        fs.accessSync(p, fs.constants.X_OK);
+                        return p;
+                    }
+                }
+                catch {
+                    /* next */
+                }
+            }
+        }
+    }
+    return null;
+}
+function binaryOf(def, env = process.env) {
+    const override = env[`RESOLFLOW_${def.id.toUpperCase().replace(/-/g, '_')}_BIN`];
+    if (override)
+        return path.isAbsolute(override) && fs.existsSync(override) ? override : null;
+    return findOnPath(def.bins, env);
+}
+/** `<tool> --version` (5 s, no shell); the first line, trimmed. */
+function toolVersion(bin, timeoutMs = 5_000) {
+    return new Promise((resolve) => {
+        (0, child_process_1.execFile)(bin, ['--version'], { timeout: timeoutMs, windowsHide: true, env: { PATH: process.env.PATH, HOME: process.env.HOME } }, (err, stdout) => {
+            if (err)
+                return resolve(null);
+            const line = String(stdout).split('\n').find((l) => l.trim());
+            resolve(line ? line.trim().slice(0, 80) : null);
+        });
+    });
+}
+/** Where the tool's API key would come from — never the key itself. */
+async function apiKeyFor(def, configDir, env = process.env) {
+    try {
+        const { store } = (0, secrets_1.chooseSecretStore)(configDir, env, (0, secrets_1.agentKeyEntry)(configDir, def.id));
+        const stored = await store.get();
+        if (stored)
+            return { key: stored, from: { source: 'keychain', store: store.kind } };
+    }
+    catch {
+        /* no store: fall back to the env */
+    }
+    for (const name of def.keyEnv) {
+        const v = env[name]?.trim();
+        if (v)
+            return { key: v, from: { source: 'env', name } };
+    }
+    return { key: null, from: { source: 'none' } };
+}
+function describeKeySource(k) {
+    if (k.source === 'keychain')
+        return k.store === 'file' ? 'configured (0600 file in the config directory, no OS keychain)' : 'configured (OS keychain)';
+    return k.source === 'env' ? `configured (env ${k.name})` : 'not configured';
+}
+/** Basic shape check of a pasted key (no vendor call): one token of safe characters. */
+function validateApiKeyShape(key) {
+    const k = key.trim();
+    if (!k)
+        return 'The key is empty';
+    if (!secrets_1.SAFE_SECRET.test(k))
+        return 'That does not look like an API key (one word of letters, digits, "-", "_" or ".")';
+    if (k.length < 16)
+        return 'That key is too short';
+    return null;
+}
+/** Whether the person opted in to a tool that needs it (optInEnv = "1"). */
+function optedIn(def, env = process.env) {
+    return !def.optInEnv || env[def.optInEnv] === '1';
+}
+async function detectTools(configDir, env = process.env, cfg = {}) {
+    const out = [];
+    for (const def of Object.values(exports.AGENT_TOOLS)) {
+        const bin = binaryOf(def, env);
+        const version = bin ? await toolVersion(bin) : null;
+        const { from } = await apiKeyFor(def, configDir, env);
+        const auth = def.supported ? (0, auth_1.authModeOf)(cfg, def.id) : 'api_key';
+        // login: no key needed (and none is passed) — the tool's own login; the device opt-in applies the same way
+        const usable = auth === 'login' ? !!bin : !!bin && def.supported && from.source !== 'none';
+        const opted = optedIn(def, env);
+        out.push({ def, bin, version, key: from, auth, ready: usable && opted, ...(usable && !opted ? { needsOptIn: true } : {}) });
+    }
+    return out;
+}

package/dist/api.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiError = void 0;
+exports.pairDevice = pairDevice;
+exports.describeDevice = describeDevice;
+exports.unpairDevice = unpairDevice;
+const urls_1 = require("./urls");
+/** The few REST calls the CLI makes (pairing, own status, unpair). https only (see urls.ts), no redirects. */
+class ApiError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+exports.ApiError = ApiError;
+async function call(apiUrl, method, path, opts = {}) {
+    const base = (0, urls_1.normaliseApiUrl)(apiUrl);
+    let res;
+    try {
+        res = await fetch(`${base}/api${path}`, {
+            method,
+            headers: {
+                accept: 'application/json',
+                ...(opts.body !== undefined ? { 'content-type': 'application/json' } : {}),
+                ...(opts.token ? { authorization: `Bearer ${opts.token}` } : {}),
+            },
+            body: opts.body !== undefined ? JSON.stringify(opts.body) : undefined,
+            redirect: 'error',
+            signal: AbortSignal.timeout(15_000),
+        });
+    }
+    catch (err) {
+        throw new ApiError(0, `Cannot reach ${base} (${err.message})`);
+    }
+    const text = await res.text();
+    let json = null;
+    try {
+        json = text ? JSON.parse(text) : null;
+    }
+    catch {
+        /* not JSON */
+    }
+    if (!res.ok) {
+        const msg = Array.isArray(json?.message) ? json.message.join(', ') : json?.message;
+        throw new ApiError(res.status, String(msg || `HTTP ${res.status}`).slice(0, 300));
+    }
+    return json;
+}
+function pairDevice(apiUrl, code, device) {
+    return call(apiUrl, 'POST', '/cli/pair', { body: { code, ...device } });
+}
+function describeDevice(apiUrl, token) {
+    // policy (RF-90e75d6d): the administrator's CLI login switch per tool; absent on older servers
+    return call(apiUrl, 'GET', '/cli/device', { token });
+}
+function unpairDevice(apiUrl, token) {
+    return call(apiUrl, 'DELETE', '/cli/device', { token });
+}