@vymalo/opencode-repo-auth 0.14.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 vymalo contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,81 @@
+# `@vymalo/opencode-repo-auth`
+
+[![npm](https://img.shields.io/npm/v/@vymalo/opencode-repo-auth?label=npm&color=CB3837&logo=npm)](https://www.npmjs.com/package/@vymalo/opencode-repo-auth)
+
+**Bill each gateway request to the git project you're working on** — the same repo-as-principal
+attribution CI already has, for local development. The developer logs in once as themselves, and
+every request from an enrolled repo carries a short-lived, **project-scoped** bearer minted by a
+single RFC 8693 token exchange presenting `project_id` (no `audience`, no mint step). See
+[ADR-0011](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/adr/0011-repo-auth-project-id-token-exchange.md).
+
+Part of the [OpenCode Toolbelt](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit).
+
+## How it works
+
+1. **Log in once** — `@vymalo/opencode-auth-core`'s `TokenRuntime` runs the configured OAuth flow
+   (`device_code` for headless, or `authorization_code` with PKCE) against `issuer`, producing a
+   human root token with `offline_access` for silent refresh.
+2. **Exchange per project** — `exchangeTo(projectId, humanToken, { project_id })`, an RFC 8693 token
+   exchange. The IdP resolves membership server-side and seals `{account_id, project_id}` into the
+   returned JWT. The project token is short-lived and carries no refresh token; renewal is always a
+   fresh exchange from the offline human root ("model b").
+3. **Inject per request** — a `chat.headers` hook stamps `Authorization: Bearer <project-token>` on
+   the opted-in providers only. **Fail-closed**: an exchange failure injects no header (the gateway
+   401s), so a request never runs under the wrong identity.
+
+## Install
+
+```sh
+npm install @vymalo/opencode-repo-auth
+```
+
+```jsonc
+// opencode.json
+{
+  "plugin": ["@vymalo/opencode-repo-auth"],
+  "provider": {
+    "gateway": {
+      "options": {
+        "baseURL": "https://api.example.com/v1",
+        "meta": {
+          "repoAuth": {
+            "projectId": "proj-123",
+            "issuer": "https://auth.example.com/realms/lightbridge",
+            "clientId": "opencode-cli",
+            "scopes": ["openid", "offline_access"],
+            "authFlow": "device_code"
+          }
+        }
+      }
+    }
+  }
+}
+```
+
+The plugin opts in **per provider** via `options.meta.repoAuth`; a missing or malformed block
+warns-and-skips that provider rather than aborting the whole config hook.
+
+## `projectId` is declared, not derived
+
+`projectId` comes from config — it is **never** derived from the git remote, because a repo may
+belong to many projects. The git `origin` (worktree-aware, hardened against odd `.git` pointers) is
+resolved for **logging only**. The exchanged token is cached per project, `0o600`, atomic-rename.
+
+## Don't stack it with `oauth2`
+
+`@vymalo/opencode-repo-auth` and `@vymalo/opencode-oauth2` both set `Authorization` — never enable
+both on the **same** provider (the plugin guards against this and logs a conflict). Need one
+credential across the gateway **and** OTEL export? Use the umbrella
+[`@vymalo/opencode-lightbridge`](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/tree/main/packages/opencode-lightbridge)
+instead of stacking plugins.
+
+## Full reference
+
+- [`docs/repo-auth.md`](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/repo-auth.md)
+  — every field, the model-b renewal, the git-hardening cases, troubleshooting.
+- [ADR-0011](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/adr/0011-repo-auth-project-id-token-exchange.md)
+  — why `project_id` exchange (not an audience-scoped Source), and the alternatives considered.
+
+## License
+
+MIT

package/dist/config.d.ts

@@ -0,0 +1,51 @@
+import type { AuthServerConfigInput } from "@vymalo/opencode-auth-core/lib";
+export declare const REPO_AUTH_META_KEY = "repoAuth";
+/**
+* Parsed outcome of inspecting one provider's `options.meta.repoAuth`:
+*   - `not_opted_in`        — no `meta.repoAuth` block at all (skip silently).
+*   - `missing_project_id`  — block present but no `projectId` (warn; never
+*                             crash — the no-op matrix in docs/repo-auth.md).
+*   - `opted_in`            — a valid, self-contained config to manage.
+*/
+export type RepoAuthParseResult = {
+	kind: "not_opted_in";
+} | {
+	kind: "missing_project_id";
+} | {
+	kind: "opted_in";
+	config: RepoAuthConfig;
+};
+/** The per-provider opt-in: a `projectId` plus the IdP auth server config. */
+export interface RepoAuthConfig {
+	projectId: string;
+	auth: AuthServerConfigInput;
+}
+/**
+* Parse a provider's `options.meta.repoAuth` opt-in block (mirrors models-info's
+* `options.meta.modelsInfoUrl` pattern). Throws malformed-field errors with the
+* canonical config path (`provider.options.meta.repoAuth`) so a typo is
+* debuggable; the missing-`projectId` case is a distinct sentinel, not an
+* error, because the no-op matrix requires it to warn-and-skip rather than
+* crash.
+*/
+export declare function parseRepoAuthOptions(providerOptions: Record<string, unknown> | undefined): RepoAuthParseResult;
+type OpenCodeConfigLike = {
+	provider?: unknown;
+	pluginConfig?: unknown;
+};
+/**
+* Provider ids managed by `@vymalo/opencode-oauth2` via the
+* `pluginConfig.oauth2ModelSync.servers` channel. oauth2 registers those
+* providers under their server `id` without touching `options` at all, so a
+* per-`options` scan alone would miss them.
+*/
+export declare function oauth2ManagedProviderIds(config: OpenCodeConfigLike): Set<string>;
+/**
+* Detect whether a provider is (also) managed by `@vymalo/opencode-oauth2` —
+* either via the provider's own `options.oauth2` / `options.oauth2ModelSync`
+* blocks, or via the `pluginConfig.oauth2ModelSync.servers` channel (whose
+* provider ids are the server ids). The two plugins must never manage the same
+* provider — repo-auth skips (warn) rather than fight over headers.
+*/
+export declare function hasOAuth2Conflict(config: OpenCodeConfigLike, providerOptions: Record<string, unknown> | undefined, providerId?: string): boolean;
+export {};

package/dist/config.js

@@ -0,0 +1,156 @@
+export const REPO_AUTH_META_KEY = "repoAuth";
+function asRecord(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) {
+		return undefined;
+	}
+	return value;
+}
+function asString(value) {
+	return typeof value === "string" && value.trim().length > 0 ? value.trim() : undefined;
+}
+function asStringArray(value) {
+	if (Array.isArray(value)) {
+		const normalized = value.map((entry) => asString(entry)).filter((entry) => Boolean(entry));
+		return normalized.length > 0 ? normalized : undefined;
+	}
+	if (typeof value === "string") {
+		const normalized = value.split(/[\s,]+/g).map((entry) => entry.trim()).filter((entry) => entry.length > 0);
+		return normalized.length > 0 ? normalized : undefined;
+	}
+	return undefined;
+}
+function asAuthFlow(value, source) {
+	if (value === undefined || value === null) {
+		return undefined;
+	}
+	if (value === "authorization_code" || value === "device_code" || value === "client_credentials" || value === "jwt_bearer" || value === "token_exchange") {
+		return value;
+	}
+	throw new Error(`${source}.authFlow must be one of "authorization_code" | "device_code" | "client_credentials" | "jwt_bearer" | "token_exchange" (received ${JSON.stringify(value)})`);
+}
+function asClientSecret(value, source) {
+	if (value === undefined || value === null) {
+		return undefined;
+	}
+	if (typeof value !== "string" || value.length === 0) {
+		throw new Error(`${source}.clientSecret must be a non-empty string when provided`);
+	}
+	return value;
+}
+function asRedirectPort(value, source) {
+	if (value === undefined || value === null) {
+		return undefined;
+	}
+	if (typeof value === "number" && Number.isInteger(value) && value > 0 && value < 65536) {
+		return value;
+	}
+	throw new Error(`${source}.redirectPort must be an integer in [1, 65535] (received ${JSON.stringify(value)})`);
+}
+function asBoolean(value, source) {
+	if (value === undefined || value === null) {
+		return undefined;
+	}
+	if (typeof value !== "boolean") {
+		throw new Error(`${source} must be a boolean (received ${JSON.stringify(value)})`);
+	}
+	return value;
+}
+function asSubjectTokenSource(value) {
+	// Shallow pass-through; deep validation happens in auth-core's
+	// `validateAuthConfig` and its error messages reference the canonical path.
+	return value;
+}
+/**
+* Parse a provider's `options.meta.repoAuth` opt-in block (mirrors models-info's
+* `options.meta.modelsInfoUrl` pattern). Throws malformed-field errors with the
+* canonical config path (`provider.options.meta.repoAuth`) so a typo is
+* debuggable; the missing-`projectId` case is a distinct sentinel, not an
+* error, because the no-op matrix requires it to warn-and-skip rather than
+* crash.
+*/
+export function parseRepoAuthOptions(providerOptions) {
+	if (!providerOptions) {
+		return { kind: "not_opted_in" };
+	}
+	const meta = asRecord(providerOptions.meta);
+	if (!meta) {
+		return { kind: "not_opted_in" };
+	}
+	const raw = asRecord(meta[REPO_AUTH_META_KEY]);
+	if (!raw) {
+		return { kind: "not_opted_in" };
+	}
+	const projectId = asString(raw.projectId);
+	if (!projectId) {
+		return { kind: "missing_project_id" };
+	}
+	const source = "provider.options.meta.repoAuth";
+	const issuer = asString(raw.issuer);
+	const clientId = asString(raw.clientId);
+	const scopes = asStringArray(raw.scopes);
+	if (!issuer || !clientId || !scopes) {
+		throw new Error(`${source} requires non-empty issuer, clientId and scopes (projectId=${projectId})`);
+	}
+	return {
+		kind: "opted_in",
+		config: {
+			projectId,
+			auth: {
+				id: REPO_AUTH_META_KEY,
+				issuer,
+				clientId,
+				clientSecret: asClientSecret(raw.clientSecret, source),
+				scopes,
+				authorizationEndpoint: asString(raw.authorizationEndpoint),
+				tokenEndpoint: asString(raw.tokenEndpoint),
+				deviceAuthorizationEndpoint: asString(raw.deviceAuthorizationEndpoint),
+				jwksUri: asString(raw.jwksUri),
+				redirectPort: asRedirectPort(raw.redirectPort, source),
+				authFlow: asAuthFlow(raw.authFlow, source),
+				pkce: asBoolean(raw.pkce, `${source}.pkce`),
+				subjectTokenSource: asSubjectTokenSource(raw.subjectTokenSource)
+			}
+		}
+	};
+}
+const OAUTH2_CONFLICT_KEYS = ["oauth2", "oauth2ModelSync"];
+/**
+* Provider ids managed by `@vymalo/opencode-oauth2` via the
+* `pluginConfig.oauth2ModelSync.servers` channel. oauth2 registers those
+* providers under their server `id` without touching `options` at all, so a
+* per-`options` scan alone would miss them.
+*/
+export function oauth2ManagedProviderIds(config) {
+	const ids = new Set();
+	const pluginConfig = asRecord(config.pluginConfig);
+	const oauth2ModelSync = asRecord(pluginConfig?.oauth2ModelSync);
+	const servers = asRecord(oauth2ModelSync)?.servers;
+	if (Array.isArray(servers)) {
+		for (const rawServer of servers) {
+			const entry = asRecord(rawServer);
+			const id = asString(entry?.id);
+			if (id) {
+				ids.add(id);
+			}
+		}
+	}
+	return ids;
+}
+/**
+* Detect whether a provider is (also) managed by `@vymalo/opencode-oauth2` —
+* either via the provider's own `options.oauth2` / `options.oauth2ModelSync`
+* blocks, or via the `pluginConfig.oauth2ModelSync.servers` channel (whose
+* provider ids are the server ids). The two plugins must never manage the same
+* provider — repo-auth skips (warn) rather than fight over headers.
+*/
+export function hasOAuth2Conflict(config, providerOptions, providerId) {
+	if (providerOptions && OAUTH2_CONFLICT_KEYS.some((key) => asRecord(providerOptions[key]) !== undefined)) {
+		return true;
+	}
+	if (providerId && oauth2ManagedProviderIds(config).has(providerId)) {
+		return true;
+	}
+	return false;
+}
+
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"mappings":"AAMA,OAAO,MAAM,qBAAqB;AAoBlC,SAAS,SAAS,OAAqD;CACrE,IAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;EAC/D,OAAO;CACT;CAEA,OAAO;AACT;AAEA,SAAS,SAAS,OAAoC;CACpD,OAAO,OAAO,UAAU,YAAY,MAAM,KAAK,CAAC,CAAC,SAAS,IAAI,MAAM,KAAK,IAAI;AAC/E;AAEA,SAAS,cAAc,OAAsC;CAC3D,IAAI,MAAM,QAAQ,KAAK,GAAG;EACxB,MAAM,aAAa,MAChB,KAAK,UAAU,SAAS,KAAK,CAAC,CAAC,CAC/B,QAAQ,UAA2B,QAAQ,KAAK,CAAC;EAEpD,OAAO,WAAW,SAAS,IAAI,aAAa;CAC9C;CAEA,IAAI,OAAO,UAAU,UAAU;EAC7B,MAAM,aAAa,MAChB,MAAM,SAAS,CAAC,CAChB,KAAK,UAAU,MAAM,KAAK,CAAC,CAAC,CAC5B,QAAQ,UAAU,MAAM,SAAS,CAAC;EAErC,OAAO,WAAW,SAAS,IAAI,aAAa;CAC9C;CAEA,OAAO;AACT;AAEA,SAAS,WAAW,OAAgB,QAA2C;CAC7E,IAAI,UAAU,aAAa,UAAU,MAAM;EACzC,OAAO;CACT;CACA,IACE,UAAU,wBACV,UAAU,iBACV,UAAU,wBACV,UAAU,gBACV,UAAU,kBACV;EACA,OAAO;CACT;CACA,MAAM,IAAI,MACR,GAAG,OAAO,mIAAmI,KAAK,UAAU,KAAK,EAAE,EACrK;AACF;AAEA,SAAS,eAAe,OAAgB,QAAoC;CAC1E,IAAI,UAAU,aAAa,UAAU,MAAM;EACzC,OAAO;CACT;CACA,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;EACnD,MAAM,IAAI,MAAM,GAAG,OAAO,uDAAuD;CACnF;CACA,OAAO;AACT;AAEA,SAAS,eAAe,OAAgB,QAAoC;CAC1E,IAAI,UAAU,aAAa,UAAU,MAAM;EACzC,OAAO;CACT;CACA,IAAI,OAAO,UAAU,YAAY,OAAO,UAAU,KAAK,KAAK,QAAQ,KAAK,QAAQ,OAAO;EACtF,OAAO;CACT;CACA,MAAM,IAAI,MACR,GAAG,OAAO,2DAA2D,KAAK,UAAU,KAAK,EAAE,EAC7F;AACF;AAEA,SAAS,UAAU,OAAgB,QAAqC;CACtE,IAAI,UAAU,aAAa,UAAU,MAAM;EACzC,OAAO;CACT;CACA,IAAI,OAAO,UAAU,WAAW;EAC9B,MAAM,IAAI,MAAM,GAAG,OAAO,+BAA+B,KAAK,UAAU,KAAK,EAAE,EAAE;CACnF;CACA,OAAO;AACT;AAEA,SAAS,qBAAqB,OAAgD;;;CAG5E,OAAO;AACT;;;;;;;;;AAUA,OAAO,SAAS,qBACd,iBACqB;CACrB,IAAI,CAAC,iBAAiB;EACpB,OAAO,EAAE,MAAM,eAAe;CAChC;CAEA,MAAM,OAAO,SAAS,gBAAgB,IAAI;CAC1C,IAAI,CAAC,MAAM;EACT,OAAO,EAAE,MAAM,eAAe;CAChC;CAEA,MAAM,MAAM,SAAS,KAAK,mBAAmB;CAC7C,IAAI,CAAC,KAAK;EACR,OAAO,EAAE,MAAM,eAAe;CAChC;CAEA,MAAM,YAAY,SAAS,IAAI,SAAS;CACxC,IAAI,CAAC,WAAW;EACd,OAAO,EAAE,MAAM,qBAAqB;CACtC;CAEA,MAAM,SAAS;CACf,MAAM,SAAS,SAAS,IAAI,MAAM;CAClC,MAAM,WAAW,SAAS,IAAI,QAAQ;CACtC,MAAM,SAAS,cAAc,IAAI,MAAM;CAEvC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,QAAQ;EACnC,MAAM,IAAI,MACR,GAAG,OAAO,6DAA6D,UAAU,EACnF;CACF;CAEA,OAAO;EACL,MAAM;EACN,QAAQ;GACN;GACA,MAAM;IACJ,IAAI;IACJ;IACA;IACA,cAAc,eAAe,IAAI,cAAc,MAAM;IACrD;IACA,uBAAuB,SAAS,IAAI,qBAAqB;IACzD,eAAe,SAAS,IAAI,aAAa;IACzC,6BAA6B,SAAS,IAAI,2BAA2B;IACrE,SAAS,SAAS,IAAI,OAAO;IAC7B,cAAc,eAAe,IAAI,cAAc,MAAM;IACrD,UAAU,WAAW,IAAI,UAAU,MAAM;IACzC,MAAM,UAAU,IAAI,MAAM,GAAG,OAAO,MAAM;IAC1C,oBAAoB,qBAAqB,IAAI,kBAAkB;GACjE;EACF;CACF;AACF;AAEA,MAAM,uBAAuB,CAAC,UAAU,iBAAiB;;;;;;;AAazD,OAAO,SAAS,yBAAyB,QAAyC;CAChF,MAAM,MAAM,IAAI,IAAY;CAC5B,MAAM,eAAe,SAAS,OAAO,YAAY;CACjD,MAAM,kBAAkB,SAAS,cAAc,eAAe;CAC9D,MAAM,UAAU,SAAS,eAAe,CAAC,EAAE;CAC3C,IAAI,MAAM,QAAQ,OAAO,GAAG;EAC1B,KAAK,MAAM,aAAa,SAAS;GAC/B,MAAM,QAAQ,SAAS,SAAS;GAChC,MAAM,KAAK,SAAS,OAAO,EAAE;GAC7B,IAAI,IAAI;IACN,IAAI,IAAI,EAAE;GACZ;EACF;CACF;CACA,OAAO;AACT;;;;;;;;AASA,OAAO,SAAS,kBACd,QACA,iBACA,YACS;CACT,IACE,mBACA,qBAAqB,MAAM,QAAQ,SAAS,gBAAgB,IAAI,MAAM,SAAS,GAC/E;EACA,OAAO;CACT;CACA,IAAI,cAAc,yBAAyB,MAAM,CAAC,CAAC,IAAI,UAAU,GAAG;EAClE,OAAO;CACT;CACA,OAAO;AACT","names":[],"sources":["../src/config.ts"],"version":3,"file":"config.js","sourceRoot":""}

package/dist/git.d.ts

@@ -0,0 +1,55 @@
+/**
+* Git identity resolution, read directly off disk (`.git/config`, worktree
+* aware) rather than shelling out to `git` — no subprocess, no `git` on
+* `PATH`. Mirrors the house precedent in otel's VCS collector. The remote is
+* log-only in v1: nothing is ever derived from it, so the accepted trade-off
+* (raw config misses `url.<base>.insteadOf` rewrites that `git remote get-url`
+* would apply) is harmless; revisit if resolve-by-remote ever lands.
+*/
+/**
+* Walk up from `startDir` to the nearest ancestor that contains a `.git` entry.
+* `.git` may be a directory (a normal checkout) or a file (a linked worktree,
+* pointing at the common dir). Returns the repo root, or `undefined` when no
+* enclosing repository exists.
+*/
+export declare function resolveRepoRoot(startDir: string): Promise<string | undefined>;
+/**
+* Resolve the git "common dir" (where `config` lives) for a repo root, handling
+* the linked-worktree `.git`-file case:
+*   - `.git` is a directory  → common dir is `.git` itself.
+*   - `.git` is a file        → read `gitdir: <path>`; the pointed-at worktree
+*     gitdir may carry a `commondir` file (relative to itself) that names the
+*     shared object/config dir. Falls back to the worktree gitdir when no
+*     `commondir` marker exists (a bare gitdir without worktree layout).
+* Returns the directory containing the `config` file, or `undefined`.
+*
+* The `gitdir:` pointer is attacker-influenced (the `.git` file is part of the
+* tree the user opened), so it is validated defensively: the target must be a
+* real directory (no symlinks), must contain a `HEAD` file (git's own marker
+* that a worktree gitdir exists there), and its `config` must be a regular
+* file — a FIFO/socket/device/symlink is rejected so a crafted tree cannot
+* hang the config hook on a blocking read or reach into unrelated files.
+*/
+export declare function resolveGitCommonDir(repoRoot: string): Promise<string | undefined>;
+/**
+* Minimal git-config reader for the `[remote "origin"]`/`url` entry — enough
+* for the one key repo-auth (or any embedder) needs. Handles quoted section
+* names and values; comments at line start; case-sensitive section names are
+* not matched, only `remote "<name>"` sections.
+*/
+export declare function parseGitConfig(text: string): Map<string, Map<string, string>>;
+/** Extract the raw `origin` remote URL from git-config text, if any. */
+export declare function parseOriginRemote(configText: string): string | undefined;
+/**
+* Normalize a git remote URL to a `<host>/<path>` string safe for logging and
+* repo correlation:
+*   - strips userinfo (`user@` / `user:pass@`) in both https and scp forms,
+*   - folds scp-style `git@host:org/repo.git` onto the https shape,
+*   - drops a trailing `.git` and any trailing slashes,
+*   - drops query / fragment.
+* Returns `undefined` for anything that is not a recognizable remote (local
+* paths, garbage) — callers treat that as "no remote".
+*/
+export declare function normalizeRemote(url: string): string | undefined;
+/** Read the normalized `origin` remote for a repo root, if any. */
+export declare function resolveOriginRemote(repoRoot: string): Promise<string | undefined>;

package/dist/git.js

@@ -0,0 +1,231 @@
+import { lstat, readFile, stat } from "node:fs/promises";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+/** Git config files are small; anything beyond this is not a genuine repo. */
+const GIT_CONFIG_MAX_BYTES = 256 * 1024;
+/** Bound the read so a FIFO / stalled file cannot hang the config hook. */
+const GIT_CONFIG_READ_TIMEOUT_MS = 2e3;
+async function isRegularFile(path) {
+	try {
+		const entry = await lstat(path);
+		return entry.isFile();
+	} catch {
+		return false;
+	}
+}
+/**
+* Git identity resolution, read directly off disk (`.git/config`, worktree
+* aware) rather than shelling out to `git` — no subprocess, no `git` on
+* `PATH`. Mirrors the house precedent in otel's VCS collector. The remote is
+* log-only in v1: nothing is ever derived from it, so the accepted trade-off
+* (raw config misses `url.<base>.insteadOf` rewrites that `git remote get-url`
+* would apply) is harmless; revisit if resolve-by-remote ever lands.
+*/
+/**
+* Walk up from `startDir` to the nearest ancestor that contains a `.git` entry.
+* `.git` may be a directory (a normal checkout) or a file (a linked worktree,
+* pointing at the common dir). Returns the repo root, or `undefined` when no
+* enclosing repository exists.
+*/
+export async function resolveRepoRoot(startDir) {
+	let current = resolve(startDir);
+	for (;;) {
+		const gitEntry = join(current, ".git");
+		try {
+			const entry = await stat(gitEntry);
+			if (entry.isDirectory() || entry.isFile()) {
+				return current;
+			}
+		} catch {}
+		const parent = dirname(current);
+		if (parent === current) {
+			return undefined;
+		}
+		current = parent;
+	}
+}
+/**
+* Resolve the git "common dir" (where `config` lives) for a repo root, handling
+* the linked-worktree `.git`-file case:
+*   - `.git` is a directory  → common dir is `.git` itself.
+*   - `.git` is a file        → read `gitdir: <path>`; the pointed-at worktree
+*     gitdir may carry a `commondir` file (relative to itself) that names the
+*     shared object/config dir. Falls back to the worktree gitdir when no
+*     `commondir` marker exists (a bare gitdir without worktree layout).
+* Returns the directory containing the `config` file, or `undefined`.
+*
+* The `gitdir:` pointer is attacker-influenced (the `.git` file is part of the
+* tree the user opened), so it is validated defensively: the target must be a
+* real directory (no symlinks), must contain a `HEAD` file (git's own marker
+* that a worktree gitdir exists there), and its `config` must be a regular
+* file — a FIFO/socket/device/symlink is rejected so a crafted tree cannot
+* hang the config hook on a blocking read or reach into unrelated files.
+*/
+export async function resolveGitCommonDir(repoRoot) {
+	const gitEntry = join(repoRoot, ".git");
+	let commonDir;
+	try {
+		const entry = await stat(gitEntry);
+		if (entry.isDirectory()) {
+			commonDir = gitEntry;
+		} else if (entry.isFile()) {
+			const pointer = await readFile(gitEntry, "utf8");
+			const match = /^gitdir:\s*(.+)$/m.exec(pointer);
+			if (!match) {
+				return undefined;
+			}
+			const gitDir = isAbsolute(match[1].trim()) ? match[1].trim() : join(dirname(gitEntry), match[1].trim());
+			try {
+				const dirEntry = await lstat(gitDir);
+				if (!dirEntry.isDirectory()) {
+					return undefined;
+				}
+			} catch {
+				return undefined;
+			}
+			// git writes a HEAD at the top of every (worktree) gitdir; its presence
+			// distinguishes a real git dir from an arbitrary directory the pointer
+			// happened to name.
+			if (!await isRegularFile(join(gitDir, "HEAD"))) {
+				return undefined;
+			}
+			try {
+				const marker = await readFile(join(gitDir, "commondir"), {
+					encoding: "utf8",
+					signal: AbortSignal.timeout(GIT_CONFIG_READ_TIMEOUT_MS)
+				});
+				const common = marker.trim();
+				commonDir = isAbsolute(common) ? common : join(gitDir, common);
+			} catch {
+				commonDir = gitDir;
+			}
+		} else {
+			return undefined;
+		}
+	} catch {
+		return undefined;
+	}
+	return commonDir;
+}
+/**
+* Minimal git-config reader for the `[remote "origin"]`/`url` entry — enough
+* for the one key repo-auth (or any embedder) needs. Handles quoted section
+* names and values; comments at line start; case-sensitive section names are
+* not matched, only `remote "<name>"` sections.
+*/
+export function parseGitConfig(text) {
+	const sections = new Map();
+	let currentRemote;
+	for (const rawLine of text.split(/\r?\n/)) {
+		const line = rawLine.trim();
+		if (!line || line.startsWith("#") || line.startsWith(";")) {
+			continue;
+		}
+		const sectionMatch = /^\[(.+)]$/.exec(line);
+		if (sectionMatch) {
+			const header = sectionMatch[1].trim();
+			const subsection = /^remote\s+"([^"]+)"$/.exec(header);
+			currentRemote = subsection?.[1];
+			if (currentRemote) {
+				sections.set(`remote.${currentRemote}`, new Map());
+			}
+			continue;
+		}
+		if (!currentRemote) {
+			continue;
+		}
+		const eq = line.indexOf("=");
+		if (eq < 0) {
+			continue;
+		}
+		const key = line.slice(0, eq).trim();
+		let value = line.slice(eq + 1).trim();
+		if (value.startsWith("\"") && value.endsWith("\"")) {
+			value = value.slice(1, -1);
+		}
+		sections.get(`remote.${currentRemote}`)?.set(key, value);
+	}
+	return sections;
+}
+/** Extract the raw `origin` remote URL from git-config text, if any. */
+export function parseOriginRemote(configText) {
+	return parseGitConfig(configText).get("remote.origin")?.get("url");
+}
+/**
+* Normalize a git remote URL to a `<host>/<path>` string safe for logging and
+* repo correlation:
+*   - strips userinfo (`user@` / `user:pass@`) in both https and scp forms,
+*   - folds scp-style `git@host:org/repo.git` onto the https shape,
+*   - drops a trailing `.git` and any trailing slashes,
+*   - drops query / fragment.
+* Returns `undefined` for anything that is not a recognizable remote (local
+* paths, garbage) — callers treat that as "no remote".
+*/
+export function normalizeRemote(url) {
+	const candidate = url.trim();
+	if (!candidate) {
+		return undefined;
+	}
+	// scp-like: [user@]host:path — the path must not start with `/` so a
+	// `scheme://…` URL (whose colon sits right before `//`) does not match.
+	const scp = /^(?:[^@/]+@)?([^:/]+):([^/].*)$/.exec(candidate);
+	if (scp) {
+		const path = stripDotGit(scp[2].split(/[?#]/, 1)[0]);
+		return path ? `${scp[1]}/${path}` : scp[1];
+	}
+	if (/^[\w+.-]+:\/\//.test(candidate)) {
+		try {
+			const parsed = new URL(candidate);
+			if (parsed.hostname) {
+				const path = stripDotGit(parsed.pathname.replace(/^\/+/, ""));
+				return path ? `${parsed.hostname}/${path}` : parsed.hostname;
+			}
+		} catch {}
+	}
+	return undefined;
+}
+function stripDotGit(path) {
+	let cleaned = path;
+	while (cleaned.endsWith("/")) {
+		cleaned = cleaned.slice(0, -1);
+	}
+	if (cleaned.endsWith(".git")) {
+		cleaned = cleaned.slice(0, -4);
+	}
+	while (cleaned.endsWith("/")) {
+		cleaned = cleaned.slice(0, -1);
+	}
+	return cleaned;
+}
+/** Read the normalized `origin` remote for a repo root, if any. */
+export async function resolveOriginRemote(repoRoot) {
+	const commonDir = await resolveGitCommonDir(repoRoot);
+	if (!commonDir) {
+		return undefined;
+	}
+	const configPath = join(commonDir, "config");
+	// Only regular files: a crafted `.git` pointer must not let the plugin hang
+	// on a FIFO read or follow a symlink to an arbitrary file.
+	if (!await isRegularFile(configPath)) {
+		return undefined;
+	}
+	let configText;
+	try {
+		const configStats = await stat(configPath);
+		if (configStats.size > GIT_CONFIG_MAX_BYTES) {
+			return undefined;
+		}
+		configText = await readFile(configPath, {
+			encoding: "utf8",
+			signal: AbortSignal.timeout(GIT_CONFIG_READ_TIMEOUT_MS)
+		});
+	} catch {
+		return undefined;
+	}
+	if (!configText) {
+		return undefined;
+	}
+	const raw = parseOriginRemote(configText);
+	return raw ? normalizeRemote(raw) : undefined;
+}
+
+//# sourceMappingURL=git.js.map

package/dist/git.js.map

@@ -0,0 +1 @@
+{"mappings":"AAAA,SAAS,OAAO,UAAU,YAAY;AACtC,SAAS,SAAS,YAAY,MAAM,eAAe;;AAGnD,MAAM,uBAAuB,MAAM;;AAEnC,MAAM,6BAA6B;AAEnC,eAAe,cAAc,MAAgC;CAC3D,IAAI;EACF,MAAM,QAAQ,MAAM,MAAM,IAAI;EAC9B,OAAO,MAAM,OAAO;CACtB,QAAQ;EACN,OAAO;CACT;AACF;;;;;;;;;;;;;;;AAiBA,OAAO,eAAe,gBAAgB,UAA+C;CACnF,IAAI,UAAU,QAAQ,QAAQ;CAC9B,SAAS;EACP,MAAM,WAAW,KAAK,SAAS,MAAM;EACrC,IAAI;GACF,MAAM,QAAQ,MAAM,KAAK,QAAQ;GACjC,IAAI,MAAM,YAAY,KAAK,MAAM,OAAO,GAAG;IACzC,OAAO;GACT;EACF,QAAQ,CAER;EACA,MAAM,SAAS,QAAQ,OAAO;EAC9B,IAAI,WAAW,SAAS;GACtB,OAAO;EACT;EACA,UAAU;CACZ;AACF;;;;;;;;;;;;;;;;;;AAmBA,OAAO,eAAe,oBAAoB,UAA+C;CACvF,MAAM,WAAW,KAAK,UAAU,MAAM;CACtC,IAAI;CACJ,IAAI;EACF,MAAM,QAAQ,MAAM,KAAK,QAAQ;EACjC,IAAI,MAAM,YAAY,GAAG;GACvB,YAAY;EACd,OAAO,IAAI,MAAM,OAAO,GAAG;GACzB,MAAM,UAAU,MAAM,SAAS,UAAU,MAAM;GAC/C,MAAM,QAAQ,oBAAoB,KAAK,OAAO;GAC9C,IAAI,CAAC,OAAO;IACV,OAAO;GACT;GACA,MAAM,SAAS,WAAW,MAAM,EAAE,CAAC,KAAK,CAAC,IACrC,MAAM,EAAE,CAAC,KAAK,IACd,KAAK,QAAQ,QAAQ,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC;GAC3C,IAAI;IACF,MAAM,WAAW,MAAM,MAAM,MAAM;IACnC,IAAI,CAAC,SAAS,YAAY,GAAG;KAC3B,OAAO;IACT;GACF,QAAQ;IACN,OAAO;GACT;;;;GAIA,IAAI,CAAE,MAAM,cAAc,KAAK,QAAQ,MAAM,CAAC,GAAI;IAChD,OAAO;GACT;GACA,IAAI;IACF,MAAM,SAAS,MAAM,SAAS,KAAK,QAAQ,WAAW,GAAG;KACvD,UAAU;KACV,QAAQ,YAAY,QAAQ,0BAA0B;IACxD,CAAC;IACD,MAAM,SAAS,OAAO,KAAK;IAC3B,YAAY,WAAW,MAAM,IAAI,SAAS,KAAK,QAAQ,MAAM;GAC/D,QAAQ;IACN,YAAY;GACd;EACF,OAAO;GACL,OAAO;EACT;CACF,QAAQ;EACN,OAAO;CACT;CACA,OAAO;AACT;;;;;;;AAQA,OAAO,SAAS,eAAe,MAAgD;CAC7E,MAAM,WAAW,IAAI,IAAiC;CACtD,IAAI;CACJ,KAAK,MAAM,WAAW,KAAK,MAAM,OAAO,GAAG;EACzC,MAAM,OAAO,QAAQ,KAAK;EAC1B,IAAI,CAAC,QAAQ,KAAK,WAAW,GAAG,KAAK,KAAK,WAAW,GAAG,GAAG;GACzD;EACF;EACA,MAAM,eAAe,YAAY,KAAK,IAAI;EAC1C,IAAI,cAAc;GAChB,MAAM,SAAS,aAAa,EAAE,CAAC,KAAK;GACpC,MAAM,aAAa,uBAAuB,KAAK,MAAM;GACrD,gBAAgB,aAAa;GAC7B,IAAI,eAAe;IACjB,SAAS,IAAI,UAAU,iBAAiB,IAAI,IAAI,CAAC;GACnD;GACA;EACF;EACA,IAAI,CAAC,eAAe;GAClB;EACF;EACA,MAAM,KAAK,KAAK,QAAQ,GAAG;EAC3B,IAAI,KAAK,GAAG;GACV;EACF;EACA,MAAM,MAAM,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC,KAAK;EACnC,IAAI,QAAQ,KAAK,MAAM,KAAK,CAAC,CAAC,CAAC,KAAK;EACpC,IAAI,MAAM,WAAW,IAAG,KAAK,MAAM,SAAS,IAAG,GAAG;GAChD,QAAQ,MAAM,MAAM,GAAG,CAAC,CAAC;EAC3B;EACA,SAAS,IAAI,UAAU,eAAe,CAAC,EAAE,IAAI,KAAK,KAAK;CACzD;CACA,OAAO;AACT;;AAGA,OAAO,SAAS,kBAAkB,YAAwC;CACxE,OAAO,eAAe,UAAU,CAAC,CAAC,IAAI,eAAe,CAAC,EAAE,IAAI,KAAK;AACnE;;;;;;;;;;;AAYA,OAAO,SAAS,gBAAgB,KAAiC;CAC/D,MAAM,YAAY,IAAI,KAAK;CAC3B,IAAI,CAAC,WAAW;EACd,OAAO;CACT;;;CAIA,MAAM,MAAM,kCAAkC,KAAK,SAAS;CAC5D,IAAI,KAAK;EACP,MAAM,OAAO,YAAY,IAAI,EAAE,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,EAAE;EACnD,OAAO,OAAO,GAAG,IAAI,GAAG,GAAG,SAAS,IAAI;CAC1C;CAEA,IAAI,iBAAiB,KAAK,SAAS,GAAG;EACpC,IAAI;GACF,MAAM,SAAS,IAAI,IAAI,SAAS;GAChC,IAAI,OAAO,UAAU;IACnB,MAAM,OAAO,YAAY,OAAO,SAAS,QAAQ,QAAQ,EAAE,CAAC;IAC5D,OAAO,OAAO,GAAG,OAAO,SAAS,GAAG,SAAS,OAAO;GACtD;EACF,QAAQ,CAER;CACF;CAEA,OAAO;AACT;AAEA,SAAS,YAAY,MAAsB;CACzC,IAAI,UAAU;CACd,OAAO,QAAQ,SAAS,GAAG,GAAG;EAC5B,UAAU,QAAQ,MAAM,GAAG,CAAC,CAAC;CAC/B;CACA,IAAI,QAAQ,SAAS,MAAM,GAAG;EAC5B,UAAU,QAAQ,MAAM,GAAG,CAAC,CAAC;CAC/B;CACA,OAAO,QAAQ,SAAS,GAAG,GAAG;EAC5B,UAAU,QAAQ,MAAM,GAAG,CAAC,CAAC;CAC/B;CACA,OAAO;AACT;;AAGA,OAAO,eAAe,oBAAoB,UAA+C;CACvF,MAAM,YAAY,MAAM,oBAAoB,QAAQ;CACpD,IAAI,CAAC,WAAW;EACd,OAAO;CACT;CACA,MAAM,aAAa,KAAK,WAAW,QAAQ;;;CAG3C,IAAI,CAAE,MAAM,cAAc,UAAU,GAAI;EACtC,OAAO;CACT;CACA,IAAI;CACJ,IAAI;EACF,MAAM,cAAc,MAAM,KAAK,UAAU;EACzC,IAAI,YAAY,OAAO,sBAAsB;GAC3C,OAAO;EACT;EACA,aAAa,MAAM,SAAS,YAAY;GACtC,UAAU;GACV,QAAQ,YAAY,QAAQ,0BAA0B;EACxD,CAAC;CACH,QAAQ;EACN,OAAO;CACT;CACA,IAAI,CAAC,YAAY;EACf,OAAO;CACT;CACA,MAAM,MAAM,kBAAkB,UAAU;CACxC,OAAO,MAAM,gBAAgB,GAAG,IAAI;AACtC","names":[],"sources":["../src/git.ts"],"version":3,"file":"git.js","sourceRoot":""}

package/dist/index.d.ts

@@ -0,0 +1 @@
+export { default } from "./opencode.js";

package/dist/index.js

@@ -0,0 +1,3 @@
+export { default } from "./opencode.js";
+
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"mappings":"AAAA,SAAS,eAAe","names":[],"sources":["../src/index.ts"],"version":3,"file":"index.js","sourceRoot":""}

package/dist/lib.d.ts

@@ -0,0 +1,4 @@
+export { OpencodeRepoAuthPlugin, createOpencodeRepoAuthPlugin, type OpenCodePluginFactoryOptions } from "./opencode.js";
+export { RepoAuthPlugin, isProjectTokenUsable, HUMAN_IDENTITY, DEFAULT_CACHE_NAMESPACE, repoAuthCacheDir, type RepoAuthPluginOptions } from "./plugin.js";
+export { REPO_AUTH_META_KEY, parseRepoAuthOptions, hasOAuth2Conflict, type RepoAuthConfig, type RepoAuthParseResult } from "./config.js";
+export { normalizeRemote, parseGitConfig, parseOriginRemote, resolveOriginRemote, resolveRepoRoot } from "./git.js";

package/dist/lib.js

@@ -0,0 +1,6 @@
+export { OpencodeRepoAuthPlugin, createOpencodeRepoAuthPlugin } from "./opencode.js";
+export { RepoAuthPlugin, isProjectTokenUsable, HUMAN_IDENTITY, DEFAULT_CACHE_NAMESPACE, repoAuthCacheDir } from "./plugin.js";
+export { REPO_AUTH_META_KEY, parseRepoAuthOptions, hasOAuth2Conflict } from "./config.js";
+export { normalizeRemote, parseGitConfig, parseOriginRemote, resolveOriginRemote, resolveRepoRoot } from "./git.js";
+
+//# sourceMappingURL=lib.js.map

package/dist/lib.js.map

@@ -0,0 +1 @@
+{"mappings":"AAAA,SACE,wBACA,oCAEK;AACP,SACE,gBACA,sBACA,gBACA,yBACA,wBAEK;AACP,SACE,oBACA,sBACA,yBAGK;AACP,SACE,iBACA,gBACA,mBACA,qBACA,uBACK","names":[],"sources":["../src/lib.ts"],"version":3,"file":"lib.js","sourceRoot":""}

package/dist/opencode.d.ts

@@ -0,0 +1,13 @@
+import type { Plugin } from "@opencode-ai/plugin";
+import { type Logger } from "@vymalo/opencode-auth-core/lib";
+export interface OpenCodePluginFactoryOptions {
+	logger?: Logger;
+	fetchImpl?: typeof fetch;
+	onAuthorizationUrl?: (url: string) => Promise<void> | void;
+	cacheDir?: string;
+	/** Repo root to resolve git identity from (defaults to `process.cwd()`). */
+	cwd?: string;
+}
+export declare function createOpencodeRepoAuthPlugin(factoryOptions?: OpenCodePluginFactoryOptions): Plugin;
+export declare const OpencodeRepoAuthPlugin: Plugin;
+export default OpencodeRepoAuthPlugin;