@thegitai/cli 1.0.0-beta.1

package/dist/src/api/auth.js

@@ -0,0 +1,81 @@
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync, } from 'node:fs';
+import path from 'node:path';
+import { getClientStateDir } from '../client-state.js';
+import { authorizedJson, failureMessage, normalizeServerUrl, readJsonResponse, } from './http.js';
+export function getAuthConfigPath(env = process.env) {
+    const configured = String(env.THEGITAI_AUTH_CONFIG ?? '').trim();
+    if (configured) {
+        return path.resolve(configured);
+    }
+    return path.join(getClientStateDir(env), 'auth.json');
+}
+export function readCliAuthConfig(env = process.env) {
+    const filePath = getAuthConfigPath(env);
+    if (!existsSync(filePath))
+        return null;
+    const parsed = JSON.parse(readFileSync(filePath, 'utf8'));
+    const serverUrl = String(parsed.serverUrl ?? '').trim();
+    const token = String(parsed.token ?? '').trim();
+    const email = String(parsed.email ?? '').trim();
+    const customerType = parsed.customerType === 'ADMIN' || parsed.customerType === 'USER'
+        ? parsed.customerType
+        : undefined;
+    if (!serverUrl || !token || !email) {
+        return null;
+    }
+    return {
+        serverUrl,
+        token,
+        email,
+        ...(customerType ? { customerType } : {}),
+    };
+}
+export function writeCliAuthConfig(config, env = process.env) {
+    const filePath = getAuthConfigPath(env);
+    mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
+    writeFileSync(filePath, `${JSON.stringify({
+        serverUrl: normalizeServerUrl(config.serverUrl),
+        token: config.token,
+        email: config.email,
+        ...(config.customerType ? { customerType: config.customerType } : {}),
+    }, null, 2)}\n`, {
+        encoding: 'utf8',
+        mode: 0o600,
+    });
+}
+export function clearCliAuthConfig(env = process.env) {
+    rmSync(getAuthConfigPath(env), { force: true });
+}
+export async function fetchWhoami({ config, fetchImpl = globalThis.fetch, }) {
+    const data = await fetchWhoamiResponse({ config, fetchImpl });
+    return data.customer;
+}
+export async function fetchWhoamiResponse({ config, fetchImpl = globalThis.fetch, }) {
+    const data = (await authorizedJson({
+        config,
+        path: '/v1/auth/whoami',
+        fetchImpl,
+    }));
+    if (!data?.customer?.email) {
+        throw new Error('Server returned an invalid whoami response.');
+    }
+    return {
+        customer: data.customer,
+        debugUi: {
+            showSessionId: data.debugUi?.showSessionId === true,
+        },
+        ...(data.usage ? { usage: data.usage } : {}),
+    };
+}
+export async function logoutFromServer({ config, fetchImpl = globalThis.fetch, }) {
+    const response = await fetchImpl(`${normalizeServerUrl(config.serverUrl)}/v1/auth/logout`, {
+        method: 'POST',
+        headers: {
+            authorization: `Bearer ${config.token}`,
+        },
+    });
+    if (!response.ok && response.status !== 401) {
+        const data = (await readJsonResponse(response));
+        throw new Error(failureMessage(data, response.status));
+    }
+}

package/dist/src/api/browser-login.js

@@ -0,0 +1,184 @@
+import crypto from 'node:crypto';
+import http from 'node:http';
+import os from 'node:os';
+import { openUrl } from '../core/open-url.js';
+import { failureMessage, normalizeServerUrl, readJsonResponse, } from './http.js';
+const DEFAULT_WEBSITE_URL = 'https://thegit.ai';
+const DEFAULT_DEV_WEBSITE_URL = 'http://localhost:3002';
+const DEFAULT_SERVER_URL = 'https://thegit.ai';
+const DEFAULT_TIMEOUT_MS = 5 * 60 * 1000;
+function shutDownServer(server) {
+    // Drop any lingering (keep-alive) connections so the event loop empties and
+    // the CLI exits instead of hanging after a successful login.
+    server.closeAllConnections?.();
+    server.close();
+}
+function isLocalhostUrl(url) {
+    if (!url)
+        return false;
+    try {
+        const host = new URL(url).hostname;
+        return host === 'localhost' || host === '127.0.0.1' || host === '::1';
+    }
+    catch {
+        return false;
+    }
+}
+export function resolveWebsiteUrl(websiteUrl, env = process.env, serverUrl) {
+    const explicit = String(websiteUrl ?? '').trim() ||
+        String(env.THEGITAI_WEBSITE_URL ?? '').trim();
+    // With no explicit override, point at production — unless we're clearly in
+    // local dev (talking to a localhost server), in which case default to the
+    // local website so `ai login` works without any flags or env vars.
+    const value = explicit || (isLocalhostUrl(serverUrl) ? DEFAULT_DEV_WEBSITE_URL : DEFAULT_WEBSITE_URL);
+    const normalized = value.replace(/\/+$/, '');
+    if (!/^https?:\/\//i.test(normalized)) {
+        throw new Error('Website URL must start with http:// or https://.');
+    }
+    return normalized;
+}
+function defaultDeviceName() {
+    try {
+        return `${os.userInfo().username}@${os.hostname()}`;
+    }
+    catch {
+        return os.hostname();
+    }
+}
+/** PKCE (RFC 7636, S256): a random verifier and its SHA-256 challenge. */
+export function generatePkce() {
+    const verifier = crypto.randomBytes(32).toString('base64url');
+    const challenge = crypto
+        .createHash('sha256')
+        .update(verifier, 'utf8')
+        .digest('base64url');
+    return { verifier, challenge };
+}
+function buildAuthUrl(websiteUrl, params) {
+    const url = new URL(`${websiteUrl}/cli-auth`);
+    url.searchParams.set('code_challenge', params.codeChallenge);
+    url.searchParams.set('device_name', params.deviceName);
+    if (params.redirectUri)
+        url.searchParams.set('redirect_uri', params.redirectUri);
+    if (params.state)
+        url.searchParams.set('state', params.state);
+    if (params.paste)
+        url.searchParams.set('mode', 'paste');
+    return url.toString();
+}
+const RESULT_PAGE = (heading, detail) => `<!doctype html><html><head><meta charset="utf-8"><title>TheGitAI CLI</title>` +
+    `<style>body{font-family:system-ui,sans-serif;background:#0c0d10;color:#e6e7ea;` +
+    `display:flex;min-height:100vh;align-items:center;justify-content:center;margin:0}` +
+    `.card{text-align:center;max-width:420px;padding:2rem}h1{font-size:1.4rem}` +
+    `p{color:#9aa0a6}</style></head><body><div class="card"><h1>${heading}</h1>` +
+    `<p>${detail}</p></div></body></html>`;
+async function exchangeCodeForToken({ serverUrl, code, codeVerifier, fetchImpl, }) {
+    const response = await fetchImpl(`${serverUrl}/v1/cli/auth/token`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ code, code_verifier: codeVerifier }),
+    });
+    const data = (await readJsonResponse(response));
+    if (!response.ok) {
+        throw new Error(failureMessage(data, response.status));
+    }
+    const token = String(data?.token ?? '').trim();
+    const customer = data?.customer;
+    if (!token || !customer?.email) {
+        throw new Error('Server returned an invalid login response.');
+    }
+    return {
+        serverUrl,
+        token,
+        email: customer.email,
+        customerType: customer.customer_type === 'ADMIN' ? 'ADMIN' : 'USER',
+        customer,
+    };
+}
+/**
+ * Browser-based login. Starts a loopback server so the website can redirect the
+ * one-time code back automatically; the code is then exchanged for a token
+ * using the PKCE verifier. With `noBrowser`, the user pastes the code instead.
+ * The CLI never sees the user's credentials.
+ */
+export async function loginViaBrowser(options) {
+    const serverUrl = normalizeServerUrl(options.serverUrl ?? DEFAULT_SERVER_URL);
+    const websiteUrl = resolveWebsiteUrl(options.websiteUrl, process.env, serverUrl);
+    const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+    const openBrowser = options.openBrowser ?? openUrl;
+    const onUrl = options.onUrl ?? (() => { });
+    const deviceName = options.deviceName ?? defaultDeviceName();
+    const { verifier, challenge } = generatePkce();
+    if (options.noBrowser) {
+        const authUrl = buildAuthUrl(websiteUrl, {
+            codeChallenge: challenge,
+            deviceName,
+            paste: true,
+        });
+        // Headless mode: only print the URL for the user to open on another device.
+        // Never launch a browser here — that is the whole point of --no-browser.
+        onUrl(authUrl);
+        if (!options.promptCode) {
+            throw new Error('No way to read the authorization code in this context.');
+        }
+        const code = (await options.promptCode()).trim();
+        if (!code) {
+            throw new Error('No authorization code was entered.');
+        }
+        return exchangeCodeForToken({ serverUrl, code, codeVerifier: verifier, fetchImpl });
+    }
+    const state = crypto.randomBytes(16).toString('base64url');
+    const server = http.createServer();
+    const codePromise = new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            shutDownServer(server);
+            reject(new Error('Timed out waiting for the browser login to complete.'));
+        }, options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+        server.on('request', (req, res) => {
+            const requestUrl = new URL(req.url ?? '/', 'http://127.0.0.1');
+            if (requestUrl.pathname !== '/callback') {
+                res.writeHead(404, { 'content-type': 'text/plain' });
+                res.end('Not found');
+                return;
+            }
+            const code = requestUrl.searchParams.get('code') ?? '';
+            const returnedState = requestUrl.searchParams.get('state') ?? '';
+            // `Connection: close` plus closeAllConnections() ensures the browser's
+            // keep-alive socket is torn down so the process can exit after login.
+            if (!code || returnedState !== state) {
+                res.writeHead(400, { 'content-type': 'text/html', connection: 'close' });
+                res.end(RESULT_PAGE('Login failed', 'The request could not be verified. Please run ai login again.'));
+                clearTimeout(timer);
+                shutDownServer(server);
+                reject(new Error('The login callback could not be verified.'));
+                return;
+            }
+            res.writeHead(200, { 'content-type': 'text/html', connection: 'close' });
+            res.end(RESULT_PAGE('You are signed in', 'You can close this tab and return to your terminal.'));
+            clearTimeout(timer);
+            shutDownServer(server);
+            resolve(code);
+        });
+        server.on('error', (err) => {
+            clearTimeout(timer);
+            reject(err);
+        });
+    });
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(0, '127.0.0.1', resolve);
+    });
+    const port = server.address().port;
+    const redirectUri = `http://127.0.0.1:${port}/callback`;
+    const authUrl = buildAuthUrl(websiteUrl, {
+        codeChallenge: challenge,
+        deviceName,
+        redirectUri,
+        state,
+    });
+    onUrl(authUrl);
+    await openBrowser(authUrl).catch(() => false);
+    options.onWaiting?.();
+    const code = await codePromise;
+    return exchangeCodeForToken({ serverUrl, code, codeVerifier: verifier, fetchImpl });
+}

package/dist/src/api/chat.js

@@ -0,0 +1,346 @@
+import { createPromptCheckpoint, sanitizeSessionSafetyForServer, } from '../session-safety.js';
+import { applySessionSnapshot, snapshotFromSession, } from '../session-store.js';
+import { executeLocalToolCall } from '../tool-executor.js';
+import { normalizeServerUrl, readErrorResponse, } from './http.js';
+export class TurnCancelledError extends Error {
+    name = 'TurnCancelledError';
+    constructor(message = 'Turn cancelled.') {
+        super(message);
+    }
+}
+export class ChatTurnFailedError extends Error {
+    name = 'ChatTurnFailedError';
+    category;
+    retryable;
+    constructor(message, category = 'unknown_error', retryable = false) {
+        super(message);
+        this.category = category;
+        this.retryable = retryable;
+    }
+}
+export function isTurnCancelledError(error) {
+    return (error instanceof TurnCancelledError ||
+        (error instanceof Error &&
+            (error.name === 'AbortError' || error.name === 'TurnCancelledError')));
+}
+function parseSseBlock(block) {
+    let event = 'message';
+    const dataLines = [];
+    for (const line of block.split(/\r?\n/)) {
+        if (line.startsWith('event:')) {
+            event = line.slice('event:'.length).trim() || event;
+            continue;
+        }
+        if (line.startsWith('data:')) {
+            dataLines.push(line.slice('data:'.length).trimStart());
+        }
+    }
+    if (!dataLines.length)
+        return null;
+    const text = dataLines.join('\n');
+    try {
+        return { event, data: JSON.parse(text) };
+    }
+    catch {
+        return { event, data: text };
+    }
+}
+function toolStateFromSession(session) {
+    return {
+        autoYes: session.autoYes,
+        agentMode: session.agentMode,
+        editCounter: session.clientState.editCounter,
+        editJournal: session.clientState.editJournal,
+        stickyFilePaths: Array.from(session.clientState.stickyFilePaths),
+        safety: sanitizeSessionSafetyForServer(session.clientState.safety),
+    };
+}
+function snapshotForServer(session) {
+    const snapshot = snapshotFromSession(session);
+    snapshot.clientState.safety = sanitizeSessionSafetyForServer(snapshot.clientState.safety);
+    return snapshot;
+}
+function userHistoryText(entry) {
+    return (entry.parts ?? [])
+        .map((part) => (typeof part?.text === 'string' ? part.text : ''))
+        .filter(Boolean)
+        .join('\n')
+        .trim();
+}
+export function preserveCancelledTurnInput(session, input) {
+    const text = input.trim();
+    if (!text)
+        return;
+    for (let i = session.history.length - 1; i >= 0; i--) {
+        const entry = session.history[i];
+        if (!entry || entry.role !== 'user')
+            continue;
+        const prior = userHistoryText(entry);
+        if (!prior)
+            continue;
+        if (prior === text || prior.includes(text))
+            return;
+        break;
+    }
+    session.history.push({ role: 'user', parts: [{ text }], kind: 'turnStart' });
+}
+function preserveFailedTurnInput(session, input, category) {
+    const text = input.trim();
+    if (!text)
+        return;
+    session.history.push({ role: 'user', parts: [{ text }], kind: 'turnStart' });
+    session.history.push({
+        role: 'model',
+        parts: [{ text: `Turn failed before completion: ${category}.` }],
+    });
+}
+function historyHasToolCall(session, callId) {
+    return session.history.some((entry) => (entry.parts ?? []).some((part) => String(part?.functionCall?.id ?? '') === callId));
+}
+function preserveCancelledTurnToolResult(session, input, event, result) {
+    const callId = String(event.call.id ?? '').trim();
+    if (!callId || historyHasToolCall(session, callId))
+        return;
+    preserveCancelledTurnInput(session, input);
+    session.history.push({
+        role: 'model',
+        parts: [{ functionCall: event.call }],
+    });
+    session.history.push({
+        role: 'user',
+        parts: [
+            {
+                functionResponse: {
+                    id: callId,
+                    name: event.call.name,
+                    response: result,
+                },
+            },
+        ],
+    });
+}
+function publicStatusMessage(data) {
+    if (!data || typeof data !== 'object')
+        return null;
+    const event = data;
+    if (typeof event.publicText === 'string' &&
+        event.publicText.trim() &&
+        event.publicText.length <= 400) {
+        return event.publicText.trim();
+    }
+    const toolName = typeof event.toolName === 'string' && /^[a-z0-9_:-]+$/i.test(event.toolName)
+        ? event.toolName
+        : 'tool';
+    if (event.phase === 'thinking')
+        return 'Thinking...';
+    if (event.phase === 'running_tool')
+        return `Running ${toolName}...`;
+    if (event.phase === 'waiting_for_tool')
+        return `Running ${toolName} locally...`;
+    return null;
+}
+async function postToolResult({ config, turnId, event, result, session, fetchImpl, }) {
+    const payload = {
+        toolCallId: event.call.id,
+        result,
+        toolState: toolStateFromSession(session),
+    };
+    const response = await fetchImpl(`${normalizeServerUrl(config.serverUrl)}/v1/chat/turn/${encodeURIComponent(turnId)}/tool-result`, {
+        method: 'POST',
+        headers: {
+            authorization: `Bearer ${config.token}`,
+            'content-type': 'application/json',
+        },
+        body: JSON.stringify(payload),
+    });
+    if (response.status === 410) {
+        return;
+    }
+    if (!response.ok) {
+        throw await readErrorResponse(response);
+    }
+}
+async function executeAndPostToolResult({ config, projectIndex, session, event, input, fetchImpl, signal, }) {
+    const turnId = String(event?.turnId ?? '').trim();
+    if (!turnId || !event?.call?.id || !event.call.name) {
+        throw new Error('Server emitted an invalid tool-call event.');
+    }
+    if (signal?.aborted) {
+        throw new TurnCancelledError();
+    }
+    const previousTurnId = session.turnState.id;
+    const serverSessionTurnId = String(event.sessionTurnId ?? '').trim();
+    if (serverSessionTurnId) {
+        session.turnState.id = serverSessionTurnId;
+        if (!session.clientState.safety.checkpoints.some((checkpoint) => checkpoint.turnId === serverSessionTurnId)) {
+            createPromptCheckpoint(session.clientState.safety, 'prompt boundary', serverSessionTurnId);
+        }
+    }
+    try {
+        const rawResult = await executeLocalToolCall({ projectIndex }, session, event.call);
+        preserveCancelledTurnToolResult(session, input, event, rawResult);
+        if (signal?.aborted) {
+            throw new TurnCancelledError();
+        }
+        await postToolResult({
+            config,
+            turnId,
+            event,
+            result: rawResult,
+            session,
+            fetchImpl,
+        });
+    }
+    finally {
+        session.turnState.id = previousTurnId;
+    }
+}
+async function consumeTurnStream({ response, config, projectIndex, session, input, fetchImpl, signal, }) {
+    if (!response.body) {
+        throw new Error('Server returned an empty chat stream.');
+    }
+    const decoder = new TextDecoder();
+    const reader = response.body.getReader();
+    let buffer = '';
+    const finalResult = {
+        current: null,
+    };
+    async function handleEvent(event) {
+        if (event.event === 'status') {
+            const message = publicStatusMessage(event.data);
+            if (message)
+                session.onStatus(message);
+            return;
+        }
+        if (event.event === 'context') {
+            return;
+        }
+        if (event.event === 'tool-call') {
+            await executeAndPostToolResult({
+                config,
+                projectIndex,
+                session,
+                event: event.data,
+                input,
+                fetchImpl,
+                signal,
+            });
+            return;
+        }
+        if (event.event === 'tool-result') {
+            const data = event.data;
+            if (data?.call?.name) {
+                session.onToolEvent?.({ call: data.call, result: data.result });
+            }
+            return;
+        }
+        if (event.event === 'result') {
+            finalResult.current = event.data;
+            return;
+        }
+        if (event.event === 'cancelled' || event.event === 'error') {
+            const message = String(event.data?.message ?? 'Server chat failed.');
+            if (event.event === 'cancelled') {
+                throw new TurnCancelledError(message);
+            }
+            throw new ChatTurnFailedError(message, typeof event.data?.category === 'string' ? event.data.category : 'unknown_error', Boolean(event.data?.retryable));
+        }
+    }
+    while (true) {
+        if (signal?.aborted) {
+            await reader.cancel().catch(() => { });
+            throw new TurnCancelledError();
+        }
+        const read = await reader.read();
+        if (read.done)
+            break;
+        buffer += decoder.decode(read.value, { stream: true });
+        let separatorIndex = buffer.indexOf('\n\n');
+        while (separatorIndex !== -1) {
+            const block = buffer.slice(0, separatorIndex);
+            buffer = buffer.slice(separatorIndex + 2);
+            const event = parseSseBlock(block);
+            if (event)
+                await handleEvent(event);
+            separatorIndex = buffer.indexOf('\n\n');
+        }
+    }
+    buffer += decoder.decode();
+    const tail = buffer.trim();
+    if (tail) {
+        const event = parseSseBlock(tail);
+        if (event)
+            await handleEvent(event);
+    }
+    if (!finalResult.current?.snapshot) {
+        throw new Error('Server returned an invalid chat result.');
+    }
+    return finalResult.current;
+}
+export async function sendServerUserMessage({ config, projectIndex, session, input, imageAttachments = [], fetchImpl = globalThis.fetch, signal, }) {
+    const request = {
+        modelId: session.modelId,
+        session: snapshotForServer(session),
+        input,
+        imageAttachments,
+        maxToolSteps: session.maxToolSteps,
+        autoYes: session.autoYes,
+        agentMode: session.agentMode,
+    };
+    const preTurnHistoryLength = session.history.length;
+    const preserveOnAbort = () => preserveCancelledTurnInput(session, input);
+    if (signal?.aborted) {
+        preserveOnAbort();
+    }
+    else {
+        signal?.addEventListener('abort', preserveOnAbort, { once: true });
+    }
+    try {
+        const response = await fetchImpl(`${normalizeServerUrl(config.serverUrl)}/v1/chat/turn`, {
+            method: 'POST',
+            headers: {
+                accept: 'text/event-stream',
+                authorization: `Bearer ${config.token}`,
+                'content-type': 'application/json',
+            },
+            body: JSON.stringify(request),
+            signal,
+        });
+        if (!response.ok) {
+            throw await readErrorResponse(response);
+        }
+        const result = await consumeTurnStream({
+            response,
+            config,
+            projectIndex,
+            session,
+            input,
+            fetchImpl,
+            signal,
+        });
+        applySessionSnapshot(session, result.snapshot, { preserveAgentMode: true });
+        return {
+            text: result.text,
+            waitingForApproval: result.waitingForApproval,
+            toolBudgetReached: result.toolBudgetReached,
+            usageSummary: result.usageSummary,
+        };
+    }
+    catch (error) {
+        if (isTurnCancelledError(error)) {
+            preserveCancelledTurnInput(session, input);
+            throw error instanceof TurnCancelledError
+                ? error
+                : new TurnCancelledError();
+        }
+        // Non-cancel failures (e.g. upstream connection errors) must not leave
+        // speculative cancelled-turn entries in history — otherwise the next
+        // request replays a malformed transcript to the server.
+        session.history.length = preTurnHistoryLength;
+        preserveFailedTurnInput(session, input, error instanceof ChatTurnFailedError ? error.category : 'unknown_error');
+        throw error;
+    }
+    finally {
+        signal?.removeEventListener('abort', preserveOnAbort);
+    }
+}

package/dist/src/api/contracts.js

@@ -0,0 +1 @@
+export {};

package/dist/src/api/http.js

@@ -0,0 +1,44 @@
+const DEFAULT_SERVER_URL = 'https://thegit.ai';
+export function normalizeServerUrl(serverUrl) {
+    const normalized = String(serverUrl || DEFAULT_SERVER_URL)
+        .trim()
+        .replace(/\/+$/, '');
+    if (!/^https?:\/\//i.test(normalized)) {
+        throw new Error('Server URL must start with http:// or https://.');
+    }
+    return normalized;
+}
+export async function readJsonResponse(response) {
+    const text = await response.text();
+    if (!text.trim())
+        return null;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return { error: { message: text } };
+    }
+}
+export function failureMessage(data, status) {
+    return String(data?.error?.message ?? data?.message ?? `Request failed with ${status}`);
+}
+export async function readErrorResponse(response) {
+    const data = await readJsonResponse(response);
+    return new Error(failureMessage(data, response.status));
+}
+export async function authorizedJson({ config, path, method = 'GET', body = null, headers = {}, fetchImpl = globalThis.fetch, }) {
+    const response = await fetchImpl(`${normalizeServerUrl(config.serverUrl)}${path}`, {
+        method,
+        headers: {
+            authorization: `Bearer ${config.token}`,
+            ...headers,
+            ...(body === null ? {} : { 'content-type': 'application/json' }),
+        },
+        body: body === null ? undefined : JSON.stringify(body),
+    });
+    const data = await readJsonResponse(response);
+    if (!response.ok) {
+        throw new Error(failureMessage(data, response.status));
+    }
+    return data;
+}

package/dist/src/api/index.js

@@ -0,0 +1,11 @@
+import * as auth from './auth.js';
+import * as chat from './chat.js';
+import * as models from './models.js';
+import * as sessions from './sessions.js';
+export const ServerApi = {
+    auth,
+    chat,
+    models,
+    sessions,
+};
+export { auth, chat, models, sessions, };