@soleur/opencode 0.0.0-stage → 1.0.0

package/skills/community/scripts/hn-community.sh

@@ -0,0 +1,233 @@
+#!/usr/bin/env bash
+# hn-community.sh -- Hacker News Algolia API wrapper for community operations
+#
+# Usage: hn-community.sh <command> [args]
+# Commands:
+#   mentions [--query TERM] [--limit N]  - Search recent HN mentions
+#   trending [--limit N]                 - Current front-page stories
+#   thread ITEM_ID                       - Fetch item and comment tree
+#
+# Output: JSON to stdout
+# Errors: Messages to stderr, exit 1
+
+set -euo pipefail
+
+HN_API="https://hn.algolia.com/api/v1"
+
+# --- Dependency checks ---
+
+require_jq() {
+  if ! command -v jq &>/dev/null; then
+    echo "Error: jq is required but not installed." >&2
+    echo "Install it: https://jqlang.github.io/jq/download/" >&2
+    exit 1
+  fi
+}
+
+# --- Validation ---
+
+# An operand reaches a URL only AFTER this check. The message names the operand's
+# LABEL and never the offending value: agent runtimes surface stderr, and the value
+# is third-party-influenced text (#7122).
+require_uint() {
+  local label="$1"
+  if [[ ! "${2:-}" =~ ^(0|[1-9][0-9]*)$ ]]; then
+    echo "Error: ${label} must be a non-negative integer." >&2
+    exit 1
+  fi
+}
+
+# --- API helper ---
+
+hn_request() {
+  local url="$1"
+  local depth="${2:-0}"
+
+  if (( depth >= 3 )); then
+    echo "Error: HN Algolia rate limit exceeded after 3 retries." >&2
+    exit 2
+  fi
+
+  local response http_code body
+  response=$(curl -s -w "\n%{http_code}" --max-time 30 "$url" 2>/dev/null) || {
+    echo "Error: Failed to connect to HN Algolia API." >&2
+    exit 1
+  }
+  http_code=$(echo "$response" | tail -1)
+  body=$(echo "$response" | sed '$d')
+
+  case "$http_code" in
+    2[0-9][0-9])
+      if ! echo "$body" | jq empty 2>/dev/null; then
+        echo "Error: Invalid JSON response from HN Algolia API." >&2
+        exit 1
+      fi
+      echo "$body"
+      ;;
+    429)
+      local retry_after=5
+      local retry_int
+      retry_int=$(printf '%.0f' "$retry_after" 2>/dev/null || echo "5")
+      if (( retry_int < 1 )); then retry_after=1; fi
+      echo "Rate limited. Retrying after ${retry_after}s (attempt $((depth + 1))/3)..." >&2
+      sleep "$retry_after"
+      hn_request "$url" "$((depth + 1))"
+      ;;
+    *)
+      local msg
+      msg=$(echo "$body" | jq -r '.message // empty' 2>/dev/null || true)
+      echo "Error: HN Algolia API returned HTTP ${http_code}${msg:+: $msg}" >&2
+      exit 1
+      ;;
+  esac
+}
+
+# --- Commands ---
+
+cmd_mentions() {
+  local query="soleur"
+  local limit=20
+
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --query) query="${2:-}"; shift 2 ;;
+      --limit) limit="${2:-20}"; shift 2 ;;
+      *) echo "Error: Unknown option for mentions." >&2; exit 1 ;;
+    esac
+  done
+
+  if [[ -z "$query" ]]; then
+    echo "Error: --query requires a non-empty value." >&2
+    exit 1
+  fi
+  require_uint "--limit" "$limit"
+
+  # 7-day lookback for monitoring
+  local since
+  since=$(date -u -d "7 days ago" +%s 2>/dev/null || date -u -v-7d +%s 2>/dev/null)
+
+  local encoded_query
+  # The query is DATA: it reaches python through argv, never through the program text
+  # (interpolating it into `python3 -c "…'$query'…"` executed whatever the quote closed, #7122).
+  encoded_query=$(python3 -c 'import sys, urllib.parse; print(urllib.parse.quote(sys.argv[1]))' "$query" 2>/dev/null || echo "$query")
+
+  local url="${HN_API}/search_by_date?query=${encoded_query}&tags=%28story%2Ccomment%29&numericFilters=created_at_i%3E${since}&hitsPerPage=${limit}"
+
+  local result
+  result=$(hn_request "$url")
+
+  echo "$result" | jq '{
+    hits: [.hits[] | {
+      objectID,
+      type: .tags[0],
+      title: .title,
+      url: .url,
+      points: .points,
+      num_comments: .num_comments,
+      author: .author,
+      created_at: .created_at,
+      comment_text: .comment_text,
+      story_title: .story_title,
+      hn_url: ("https://news.ycombinator.com/item?id=" + .objectID)
+    }],
+    count: .nbHits,
+    exhaustive: .exhaustiveNbHits
+  }'
+}
+
+cmd_trending() {
+  local limit=30
+
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --limit) limit="${2:-30}"; shift 2 ;;
+      *) echo "Error: Unknown option for trending." >&2; exit 1 ;;
+    esac
+  done
+  require_uint "--limit" "$limit"
+
+  local url="${HN_API}/search?tags=front_page&hitsPerPage=${limit}"
+
+  local result
+  result=$(hn_request "$url")
+
+  echo "$result" | jq '{
+    stories: [.hits[] | {
+      objectID,
+      title: .title,
+      url: .url,
+      points: .points,
+      num_comments: .num_comments,
+      author: .author,
+      created_at: .created_at,
+      hn_url: ("https://news.ycombinator.com/item?id=" + .objectID)
+    }],
+    count: .nbHits
+  }'
+}
+
+cmd_thread() {
+  local item_id="${1:-}"
+
+  if [[ -z "$item_id" ]]; then
+    echo "Error: thread requires an ITEM_ID argument." >&2
+    echo "Usage: hn-community.sh thread ITEM_ID" >&2
+    exit 1
+  fi
+
+  if ! [[ "$item_id" =~ ^[0-9]+$ ]]; then
+    echo "Error: ITEM_ID must be numeric." >&2
+    exit 1
+  fi
+
+  local url="${HN_API}/items/${item_id}"
+
+  local result
+  result=$(hn_request "$url")
+
+  # Check for deleted/non-existent items (Algolia returns 200 with null fields)
+  local title author
+  title=$(echo "$result" | jq -r '.title // empty' 2>/dev/null)
+  author=$(echo "$result" | jq -r '.author // empty' 2>/dev/null)
+
+  if [[ -z "$title" && -z "$author" ]]; then
+    echo "Error: Item not found or has been deleted." >&2
+    exit 1
+  fi
+
+  echo "$result" | jq '. + {hn_url: ("https://news.ycombinator.com/item?id=" + (.id | tostring))}'
+}
+
+# --- Main ---
+
+main() {
+  local command="${1:-}"
+  shift || true
+
+  if [[ -z "$command" ]]; then
+    echo "Usage: hn-community.sh <command> [args]" >&2
+    echo "" >&2
+    echo "Commands:" >&2
+    echo "  mentions [--query TERM] [--limit N]  - Search recent HN mentions" >&2
+    echo "  trending [--limit N]                 - Current front-page stories" >&2
+    echo "  thread ITEM_ID                       - Fetch item and comment tree" >&2
+    exit 1
+  fi
+
+  require_jq
+
+  case "$command" in
+    mentions)  cmd_mentions "$@" ;;
+    trending)  cmd_trending "$@" ;;
+    thread)    cmd_thread "$@" ;;
+    *)
+      echo "Error: Unknown command." >&2
+      echo "Run 'hn-community.sh' without arguments for usage." >&2
+      exit 1
+      ;;
+  esac
+}
+
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
+  main "$@"
+fi

package/skills/community/scripts/lib/hmac-sha1-b64.sh

@@ -0,0 +1,126 @@
+#!/usr/bin/env bash
+# hmac-sha1-b64.sh -- RFC 2104 HMAC-SHA1 in bash, for OAuth 1.0a request signing.
+# Sourced by x-community.sh (lazily, inside oauth_sign at EACH signature (oauth_sign runs in a
+# command-substitution subshell, so nothing is cached between calls), so a trace-safe run with no
+# credentials set is never refused over this file) and by x-setup.sh (at load; its own prologue refuses
+# `bash -x` unconditionally). Defines ONE function and runs nothing.
+#
+# WHY THIS EXISTS (#9597). The signing key (the API secret and the token secret, joined
+# with an ampersand) used to be handed to `openssl dgst` as the operand of its key option,
+# so it sat in /proc/<pid>/cmdline, readable by every local user, for the life of the
+# process. The runner image has no python3 and x-community.sh runs hosted (the Inngest
+# community crons), so the python route the rest of the sweep uses is not available here;
+# the plugin depends only on bash, openssl, jq and curl, and this keeps it that way.
+#
+# HOW. The key lives only in bash builtins and pipes, never on an exec argument. The two 64-byte
+# pads are built as printf byte-ESCAPE TEXT (`\x36...`) in function-local variables (_hs_ip,
+# _hs_op, the key hex _hs_kh, the inner digest _hs_ih/_hs_oh) and emitted by the printf builtin
+# straight into a pipe; the variables hold escape text rather than raw bytes because a pad can
+# hold a NUL byte, which a bash variable cannot. `openssl dgst -sha1 -binary` reads stdin only;
+# its argument list is the constant `dgst -sha1 -binary`. No temp file, no here-string and no
+# heredoc is used on key-derived data (bash older than 5.1, including macOS 3.2, writes those to
+# a temp file).
+#
+# USAGE: the message arrives on STDIN; the KEY is passed by the NAME of the variable that
+# holds it (never as an expansion, so a traced call line shows only the name). The
+# function prints the base64 of the 20-byte digest, one line.
+#   signature=$(printf '%s' "$message" | hmac_sha1_b64 key_variable_name) || handle_failure
+#
+# CONTRACT:
+#   - returns 0 on success. Non-zero on any failure, with NOTHING on stdout:
+#       2  bad or unset variable name (an unset key is not an empty key; an empty key is valid)
+#       78 refused under xtrace (tracing would print the key)
+#       1  a tool failed (openssl, od, tr, base64 missing or erroring)
+#   - never calls the shell's exit builtin, and never prints the credential-refusal marker:
+#     the caller decides its own exit code and its own diagnostics.
+#   - the work runs in a subshell. Inside it allexport is turned off and the variable the caller
+#     NAMED (the derived signing key) is unexported, and this file's own working variables (all
+#     prefixed with _hs_) are never exported, so under a caller's `set -a` (a sourced .env)
+#     neither the derived key variable nor a _hs_ variable reaches the environment of openssl,
+#     od, tr or base64. What the function does NOT control: a variable the caller exported
+#     earlier. The raw API secret and token secret the key is built from stay in those children's
+#     environment when the caller exported them (a sourced .env, the hosted environment); that is
+#     readable by the same user and root only, and on no argument list. Nor does it control the
+#     functions the caller inherited: a caller that drops an inherited function NAMED
+#     hmac_sha1_b64 (`unset -f`) before sourcing this file stops it standing in for this one,
+#     but an exported function named od, tr, openssl, base64 or cat is still found first and
+#     receives the key on its stdin. That is the same exposure as the exported secret
+#     variables above, and no stronger claim is made. The caller's shell options are untouched.
+#   - LC_ALL=C inside, so every byte is one character.
+#   - portable to bash 3.2 and BSD od/base64: the shell features used are printf -v,
+#     substring expansion, indirect expansion and arithmetic; the external tools are
+#     openssl, od, tr and base64 (a digest is 28 characters, so GNU line wrapping never
+#     applies).
+
+case "$-" in
+  *x*)
+    # Load-time refusal, first in the file (the xtrace lint's prologue rule, #7797): sourcing
+    # this under `bash -x` and then calling it would print the key. It is UNCONDITIONAL because
+    # this file names its key indirectly (`${!1}`), so there is no literal credential name for a
+    # conditional `${VAR:+x}` hatch to test. That is why x-community.sh sources it lazily, at each
+    # signature, after its own conditional prologue has already allowed the run. A sourced
+    # file returns; the `|| exit` arm runs only if the file is EXECUTED instead of sourced. The
+    # refusal goes to STDOUT here, like the other prologues: agent runtimes surface stdout and
+    # swallow stderr. A caller that sources this inside a command substitution redirects the
+    # source command's stdout to its saved real stdout.
+    printf 'Refusing to load the HMAC helper under `bash -x`: tracing would print the signing key. Re-run without `bash -x`.\n'
+    return 78 2>/dev/null || exit 78
+    ;;
+esac
+
+hmac_sha1_b64() {
+  # Its own xtrace refusal at CALL time too: tracing can be switched on after this file was
+  # loaded. Refusal goes to stderr because stdout is the digest pipe.
+  case "$-" in
+    *x*)
+      printf 'Refusing to compute an HMAC under `bash -x`: tracing would print the signing key. Re-run without `bash -x`.\n' >&2
+      return 78
+      ;;
+  esac
+  case "${1-}" in
+    ''|[0-9]*|*[!A-Za-z0-9_]*) return 2 ;;
+  esac
+  [ -n "${!1+x}" ] || return 2
+  (
+    set +a
+    set +e
+    set -o pipefail
+    # shellcheck disable=SC2163
+    export -n -- "$1" 2>/dev/null
+    LC_ALL=C
+    export LC_ALL
+    # The key as hex text. A key longer than the 64-byte block is replaced by its digest.
+    _hs_kh=$(printf '%s' "${!1}" | od -An -v -tx1 | tr -d ' \n') || return 1
+    if (( ${#_hs_kh} > 128 )); then
+      _hs_kh=$(printf '%s' "${!1}" | openssl dgst -sha1 -binary | od -An -v -tx1 | tr -d ' \n') || return 1
+    fi
+    printf -v _hs_z '%0128d' 0
+    _hs_kh="${_hs_kh}${_hs_z:${#_hs_kh}}"
+    # The two pads as printf byte-escape strings (the key XOR 0x36 and XOR 0x5c).
+    _hs_i=0
+    _hs_ip=''
+    _hs_op=''
+    while (( _hs_i < 64 )); do
+      _hs_b=$((16#${_hs_kh:2*_hs_i:2}))
+      printf -v _hs_t '\\x%02x' $(( _hs_b ^ 54 ))
+      _hs_ip+=$_hs_t
+      printf -v _hs_t '\\x%02x' $(( _hs_b ^ 92 ))
+      _hs_op+=$_hs_t
+      _hs_i=$((_hs_i + 1))
+    done
+    # Inner digest over (inner pad, message); the message is this function's stdin.
+    # shellcheck disable=SC2059
+    _hs_ih=$( { printf -- "$_hs_ip"; cat; } | openssl dgst -sha1 -binary | od -An -v -tx1 | tr -d ' \n' ) || return 1
+    [ "${#_hs_ih}" -eq 40 ] || return 1
+    _hs_i=0
+    _hs_oh=''
+    while (( _hs_i < 20 )); do
+      printf -v _hs_t '\\x%s' "${_hs_ih:2*_hs_i:2}"
+      _hs_oh+=$_hs_t
+      _hs_i=$((_hs_i + 1))
+    done
+    # Outer digest over (outer pad, inner digest), as base64.
+    # shellcheck disable=SC2059
+    { printf -- "$_hs_op"; printf -- "$_hs_oh"; } | openssl dgst -sha1 -binary | base64
+  )
+}