@thevinci/web 1.0.0

package/server/lib/opencode/auth-state-runtime.js

@@ -0,0 +1,88 @@
+export const createOpenCodeAuthStateRuntime = (dependencies) => {
+  const {
+    crypto,
+    process,
+    getAuthPassword,
+    setAuthPassword,
+    getAuthSource,
+    setAuthSource,
+    getUserProvidedPassword,
+    syncToHmrState,
+  } = dependencies;
+
+  const normalizeOpenCodePassword = (value) => {
+    if (typeof value !== 'string') {
+      return '';
+    }
+    return value.trim();
+  };
+
+  const isValidOpenCodePassword = (password) => typeof password === 'string' && password.trim().length > 0;
+
+  const generateSecureOpenCodePassword = () =>
+    crypto
+      .randomBytes(32)
+      .toString('base64')
+      .replace(/\+/g, '-')
+      .replace(/\//g, '_')
+      .replace(/=+$/g, '');
+
+  const setOpenCodeAuthState = (password, source) => {
+    const normalized = normalizeOpenCodePassword(password);
+    if (!isValidOpenCodePassword(normalized)) {
+      setAuthPassword(null);
+      setAuthSource(null);
+      delete process.env.OPENCODE_SERVER_PASSWORD;
+      syncToHmrState();
+      return null;
+    }
+
+    setAuthPassword(normalized);
+    setAuthSource(source);
+    process.env.OPENCODE_SERVER_PASSWORD = normalized;
+    syncToHmrState();
+    return normalized;
+  };
+
+  const getOpenCodeAuthHeaders = () => {
+    const password = normalizeOpenCodePassword(getAuthPassword() || process.env.OPENCODE_SERVER_PASSWORD || '');
+
+    if (!password) {
+      return {};
+    }
+
+    const credentials = Buffer.from(`opencode:${password}`).toString('base64');
+    return { Authorization: `Basic ${credentials}` };
+  };
+
+  const isOpenCodeConnectionSecure = () => Object.prototype.hasOwnProperty.call(getOpenCodeAuthHeaders(), 'Authorization');
+
+  const ensureLocalOpenCodeServerPassword = async ({ rotateManaged = false } = {}) => {
+    const userProvidedPassword = getUserProvidedPassword();
+    if (isValidOpenCodePassword(userProvidedPassword)) {
+      return setOpenCodeAuthState(userProvidedPassword, 'user-env');
+    }
+
+    if (rotateManaged) {
+      const rotatedPassword = setOpenCodeAuthState(generateSecureOpenCodePassword(), 'rotated');
+      console.log('Rotated secure password for managed local OpenCode instance');
+      return rotatedPassword;
+    }
+
+    const currentPassword = getAuthPassword();
+    const currentSource = getAuthSource();
+    if (isValidOpenCodePassword(currentPassword)) {
+      return setOpenCodeAuthState(currentPassword, currentSource || 'generated');
+    }
+
+    const generatedPassword = setOpenCodeAuthState(generateSecureOpenCodePassword(), 'generated');
+    console.log('Generated secure password for managed local OpenCode instance');
+    return generatedPassword;
+  };
+
+  return {
+    getOpenCodeAuthHeaders,
+    isOpenCodeConnectionSecure,
+    ensureLocalOpenCodeServerPassword,
+  };
+};

package/server/lib/opencode/auth.js

@@ -0,0 +1,83 @@
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
+
+const OPENCODE_DATA_DIR = process.env.OPENCODE_DATA_DIR
+  ? path.resolve(process.env.OPENCODE_DATA_DIR)
+  : path.join(os.homedir(), '.local', 'share', 'opencode');
+const AUTH_FILE = path.join(OPENCODE_DATA_DIR, 'auth.json');
+
+function readAuthFile() {
+  if (!fs.existsSync(AUTH_FILE)) {
+    return {};
+  }
+  try {
+    const content = fs.readFileSync(AUTH_FILE, 'utf8');
+    const trimmed = content.trim();
+    if (!trimmed) {
+      return {};
+    }
+    return JSON.parse(trimmed);
+  } catch (error) {
+    console.error('Failed to read auth file:', error);
+    throw new Error('Failed to read OpenCode auth configuration');
+  }
+}
+
+function writeAuthFile(auth) {
+  try {
+    if (!fs.existsSync(OPENCODE_DATA_DIR)) {
+      fs.mkdirSync(OPENCODE_DATA_DIR, { recursive: true });
+    }
+
+    if (fs.existsSync(AUTH_FILE)) {
+      const backupFile = `${AUTH_FILE}.vinci.backup`;
+      fs.copyFileSync(AUTH_FILE, backupFile);
+      console.log(`Created auth backup: ${backupFile}`);
+    }
+
+    fs.writeFileSync(AUTH_FILE, JSON.stringify(auth, null, 2), 'utf8');
+    console.log('Successfully wrote auth file');
+  } catch (error) {
+    console.error('Failed to write auth file:', error);
+    throw new Error('Failed to write OpenCode auth configuration');
+  }
+}
+
+function removeProviderAuth(providerId) {
+  if (!providerId || typeof providerId !== 'string') {
+    throw new Error('Provider ID is required');
+  }
+
+  const auth = readAuthFile();
+  
+  if (!auth[providerId]) {
+    console.log(`Provider ${providerId} not found in auth file, nothing to remove`);
+    return false;
+  }
+
+  delete auth[providerId];
+  writeAuthFile(auth);
+  console.log(`Removed provider auth: ${providerId}`);
+  return true;
+}
+
+function getProviderAuth(providerId) {
+  const auth = readAuthFile();
+  return auth[providerId] || null;
+}
+
+function listProviderAuths() {
+  const auth = readAuthFile();
+  return Object.keys(auth);
+}
+
+export {
+  readAuthFile,
+  writeAuthFile,
+  removeProviderAuth,
+  getProviderAuth,
+  listProviderAuths,
+  AUTH_FILE,
+  OPENCODE_DATA_DIR
+};

package/server/lib/opencode/bootstrap-runtime.js

@@ -0,0 +1,131 @@
+export const createBootstrapRuntime = (dependencies) => {
+  const {
+    createUiAuth,
+    registerServerStatusRoutes,
+    registerCommonRequestMiddleware,
+    registerAuthAndAccessRoutes,
+    registerTtsRoutes,
+    registerNotificationRoutes,
+    registerVinciRoutes,
+    express,
+  } = dependencies;
+
+  const setupBaseRoutes = (app, options) => {
+    const {
+      process,
+      vinciVersion,
+      runtimeName,
+      serverStartedAt,
+      gracefulShutdown,
+      getHealthSnapshot,
+      verboseRequestLogs,
+      uiPassword,
+      tunnelAuthController,
+      readSettingsFromDiskMigrated,
+      normalizeTunnelSessionTtlMs,
+      sayTTSCapability,
+      ensurePushInitialized,
+      ensureGlobalWatcherStarted,
+      getOrCreateVapidKeys,
+      getUiSessionTokenFromRequest,
+      writeSettingsToDisk,
+      addOrUpdatePushSubscription,
+      removePushSubscription,
+      updateUiVisibility,
+      isUiVisible,
+      getUiNotificationClients,
+      writeSseEvent,
+      sessionRuntime,
+      setPushInitialized,
+      fs,
+      os,
+      path,
+      server,
+      __dirname,
+      vinciDataDir,
+      modelsDevApiUrl,
+      modelsMetadataCacheTtl,
+      fetchFreeZenModels,
+      getCachedZenModels,
+      setAutoAcceptSession,
+    } = options;
+
+    registerServerStatusRoutes(app, {
+      express,
+      process,
+      vinciVersion,
+      runtimeName,
+      serverStartedAt,
+      gracefulShutdown,
+      getHealthSnapshot,
+    });
+
+    registerCommonRequestMiddleware(app, { express, verboseRequestLogs });
+
+    const uiAuthController = createUiAuth({
+      password: uiPassword,
+      readSettingsFromDiskMigrated,
+    });
+    if (uiAuthController.enabled) {
+      console.log('UI password protection enabled for browser sessions');
+    }
+
+    registerAuthAndAccessRoutes(app, {
+      tunnelAuthController,
+      uiAuthController,
+      readSettingsFromDiskMigrated,
+      normalizeTunnelSessionTtlMs,
+    });
+
+    registerTtsRoutes(app, { sayTTSCapability });
+
+    registerNotificationRoutes(app, {
+      uiAuthController,
+      ensurePushInitialized,
+      ensureGlobalWatcherStarted,
+      getOrCreateVapidKeys,
+      getUiSessionTokenFromRequest,
+      readSettingsFromDiskMigrated,
+      writeSettingsToDisk,
+      addOrUpdatePushSubscription,
+      removePushSubscription,
+      updateUiVisibility,
+      isUiVisible,
+      getUiNotificationClients,
+      writeSseEvent,
+      getSessionActivitySnapshot: sessionRuntime.getSessionActivitySnapshot,
+      getSessionStateSnapshot: sessionRuntime.getSessionStateSnapshot,
+      getSessionAttentionSnapshot: sessionRuntime.getSessionAttentionSnapshot,
+      getSessionState: sessionRuntime.getSessionState,
+      getSessionAttentionState: sessionRuntime.getSessionAttentionState,
+      markSessionViewed: sessionRuntime.markSessionViewed,
+      markSessionUnviewed: sessionRuntime.markSessionUnviewed,
+      markUserMessageSent: sessionRuntime.markUserMessageSent,
+      setPushInitialized,
+      setAutoAcceptSession,
+    });
+
+    registerVinciRoutes(app, {
+      fs,
+      os,
+      path,
+      process,
+      server,
+      __dirname,
+      vinciDataDir,
+      modelsDevApiUrl,
+      modelsMetadataCacheTtl,
+      readSettingsFromDiskMigrated,
+      fetchFreeZenModels,
+      getCachedZenModels,
+    });
+
+    return {
+      uiAuthController,
+    };
+  };
+
+  return {
+    setupBaseRoutes,
+  };
+};

package/server/lib/opencode/cli-entry-runtime.js

@@ -0,0 +1,43 @@
+export const runCliEntryIfMain = (dependencies) => {
+  const {
+    process,
+    currentFilename,
+    parseServeCliOptions,
+    defaultPort,
+    cloudflareProvider,
+    managedLocalMode,
+    setExitOnShutdown,
+    startServer,
+  } = dependencies;
+
+  const isCliExecution = process.argv[1] === currentFilename;
+  if (!isCliExecution) {
+    return;
+  }
+
+  const cliOptions = parseServeCliOptions({
+    argv: process.argv.slice(2),
+    env: process.env,
+    defaultPort,
+    cloudflareProvider,
+    managedLocalMode,
+  });
+
+  setExitOnShutdown(true);
+  startServer({
+    port: cliOptions.port,
+    host: cliOptions.host,
+    tryCfTunnel: cliOptions.tryCfTunnel,
+    tunnelProvider: cliOptions.tunnelProvider,
+    tunnelMode: cliOptions.tunnelMode,
+    tunnelConfigPath: cliOptions.tunnelConfigPath,
+    tunnelToken: cliOptions.tunnelToken,
+    tunnelHostname: cliOptions.tunnelHostname,
+    attachSignals: true,
+    exitOnShutdown: true,
+    uiPassword: cliOptions.uiPassword,
+  }).catch((error) => {
+    console.error('Failed to start server:', error);
+    process.exit(1);
+  });
+};

package/server/lib/opencode/cli-options.js

@@ -0,0 +1,128 @@
+export const parseServeCliOptions = ({
+  argv = [],
+  env = {},
+  defaultPort,
+  cloudflareProvider,
+  managedLocalMode,
+}) => {
+  const args = Array.isArray(argv) ? [...argv] : [];
+  const envPassword =
+    env.VINCI_UI_PASSWORD ||
+    env.OPENCODE_UI_PASSWORD ||
+    null;
+  const envCfTunnel = env.VINCI_TRY_CF_TUNNEL === 'true';
+  const envTunnelProvider = env.VINCI_TUNNEL_PROVIDER || undefined;
+  const envTunnelMode = env.VINCI_TUNNEL_MODE || undefined;
+  const envTunnelConfigRaw = env.VINCI_TUNNEL_CONFIG;
+  const envTunnelConfig = typeof envTunnelConfigRaw === 'string'
+    ? (envTunnelConfigRaw.trim().length > 0 ? envTunnelConfigRaw.trim() : null)
+    : undefined;
+  const envTunnelToken = env.VINCI_TUNNEL_TOKEN || undefined;
+  const envTunnelHostname = env.VINCI_TUNNEL_HOSTNAME || undefined;
+
+  const options = {
+    port: defaultPort,
+    host: undefined,
+    uiPassword: envPassword,
+    tryCfTunnel: envCfTunnel,
+    tunnelProvider: envTunnelProvider,
+    tunnelMode: envTunnelMode,
+    tunnelConfigPath: envTunnelConfig,
+    tunnelToken: envTunnelToken,
+    tunnelHostname: envTunnelHostname,
+  };
+
+  const consumeValue = (currentIndex, inlineValue) => {
+    if (typeof inlineValue === 'string') {
+      return { value: inlineValue, nextIndex: currentIndex };
+    }
+    const nextArg = args[currentIndex + 1];
+    if (typeof nextArg === 'string' && !nextArg.startsWith('--')) {
+      return { value: nextArg, nextIndex: currentIndex + 1 };
+    }
+    return { value: undefined, nextIndex: currentIndex };
+  };
+
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i];
+    if (!arg.startsWith('--')) {
+      continue;
+    }
+
+    const eqIndex = arg.indexOf('=');
+    const optionName = eqIndex >= 0 ? arg.slice(2, eqIndex) : arg.slice(2);
+    const inlineValue = eqIndex >= 0 ? arg.slice(eqIndex + 1) : undefined;
+
+    if (optionName === 'port' || optionName === 'p') {
+      const { value, nextIndex } = consumeValue(i, inlineValue);
+      i = nextIndex;
+      const parsedPort = parseInt(value ?? '', 10);
+      options.port = Number.isFinite(parsedPort) ? parsedPort : defaultPort;
+      continue;
+    }
+
+    if (optionName === 'host') {
+      const { value, nextIndex } = consumeValue(i, inlineValue);
+      i = nextIndex;
+      options.host = typeof value === 'string' && value.trim().length > 0 ? value.trim() : undefined;
+      continue;
+    }
+
+    if (optionName === 'ui-password') {
+      const { value, nextIndex } = consumeValue(i, inlineValue);
+      i = nextIndex;
+      options.uiPassword = typeof value === 'string' ? value : '';
+      continue;
+    }
+
+    if (optionName === 'try-cf-tunnel') {
+      options.tryCfTunnel = true;
+      continue;
+    }
+
+    if (optionName === 'tunnel-provider') {
+      const { value, nextIndex } = consumeValue(i, inlineValue);
+      i = nextIndex;
+      options.tunnelProvider = typeof value === 'string' ? value : options.tunnelProvider;
+      continue;
+    }
+
+    if (optionName === 'tunnel-mode') {
+      const { value, nextIndex } = consumeValue(i, inlineValue);
+      i = nextIndex;
+      options.tunnelMode = typeof value === 'string' ? value : options.tunnelMode;
+      continue;
+    }
+
+    if (optionName === 'tunnel-config') {
+      const { value, nextIndex } = consumeValue(i, inlineValue);
+      i = nextIndex;
+      options.tunnelConfigPath = typeof value === 'string' ? value : null;
+      continue;
+    }
+
+    if (optionName === 'tunnel-token') {
+      const { value, nextIndex } = consumeValue(i, inlineValue);
+      i = nextIndex;
+      options.tunnelToken = typeof value === 'string' ? value : options.tunnelToken;
+      continue;
+    }
+
+    if (optionName === 'tunnel-hostname') {
+      const { value, nextIndex } = consumeValue(i, inlineValue);
+      i = nextIndex;
+      options.tunnelHostname = typeof value === 'string' ? value : options.tunnelHostname;
+      continue;
+    }
+
+    if (optionName === 'tunnel') {
+      const { value, nextIndex } = consumeValue(i, inlineValue);
+      i = nextIndex;
+      options.tunnelProvider = cloudflareProvider;
+      options.tunnelMode = managedLocalMode;
+      options.tunnelConfigPath = typeof value === 'string' ? value : null;
+    }
+  }
+
+  return options;
+};