@vymalo/opencode-repo-auth 0.14.1

package/dist/opencode.js

@@ -0,0 +1,331 @@
+import { createJsonConsoleLogger, DEFAULT_LOG_LEVEL, LOG_LEVEL_PRIORITY } from "@vymalo/opencode-auth-core/lib";
+import { hasOAuth2Conflict, parseRepoAuthOptions } from "./config.js";
+import { resolveOriginRemote, resolveRepoRoot } from "./git.js";
+import { RepoAuthPlugin } from "./plugin.js";
+const PLUGIN_SERVICE_NAME = "opencode-repo-auth-plugin";
+/**
+* Map OpenCode's host-level `config.logLevel` (uppercase `"DEBUG" | "INFO" |
+* "WARN" | "ERROR"`) to the plugin's internal `LogLevel`. Unknown / missing
+* values fall through to `undefined` so the caller applies its own default —
+* we never throw on an OpenCode-supplied value because the host owns
+* validation of its own field. Host `DEBUG` unlocks the `trace` tier (there is
+* no separate host `TRACE` level), surfacing the `repo_auth_*` trace events.
+*/
+function fromOpenCodeLogLevel(value) {
+	if (typeof value !== "string") {
+		return undefined;
+	}
+	switch (value.toUpperCase()) {
+		case "DEBUG": return "trace";
+		case "INFO": return "info";
+		case "WARN": return "warn";
+		case "ERROR": return "error";
+		default: return undefined;
+	}
+}
+function asRecord(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) {
+		return undefined;
+	}
+	return value;
+}
+function createOpenCodeLogger(client, getMinLevel) {
+	const fallback = createJsonConsoleLogger("debug");
+	const consoleAll = /^(1|true|yes|on)$/i.test(process.env.VYMALO_PLUGIN_CONSOLE_LOG ?? "");
+	const write = (level, event, fields) => {
+		if (LOG_LEVEL_PRIORITY[level] < LOG_LEVEL_PRIORITY[getMinLevel()]) {
+			return;
+		}
+		if (consoleAll || level === "warn" || level === "error") {
+			fallback[level](event, fields);
+		}
+		const hostLevel = level === "trace" ? "debug" : level;
+		void client.app.log({ body: {
+			service: PLUGIN_SERVICE_NAME,
+			level: hostLevel,
+			message: event,
+			extra: fields
+		} }).catch(() => {
+			// Best-effort forwarding; console logger is the reliable fallback.
+		});
+	};
+	return {
+		trace(event, fields) {
+			write("trace", event, fields);
+		},
+		debug(event, fields) {
+			write("debug", event, fields);
+		},
+		info(event, fields) {
+			write("info", event, fields);
+		},
+		warn(event, fields) {
+			write("warn", event, fields);
+		},
+		error(event, fields) {
+			write("error", event, fields);
+		}
+	};
+}
+function authSignature(auth) {
+	return JSON.stringify({
+		issuer: auth.issuer,
+		clientId: auth.clientId,
+		clientSecret: auth.clientSecret,
+		scopes: auth.scopes,
+		authorizationEndpoint: auth.authorizationEndpoint,
+		tokenEndpoint: auth.tokenEndpoint,
+		deviceAuthorizationEndpoint: auth.deviceAuthorizationEndpoint,
+		jwksUri: auth.jwksUri,
+		redirectPort: auth.redirectPort,
+		authFlow: auth.authFlow,
+		pkce: auth.pkce,
+		subjectTokenSource: auth.subjectTokenSource
+	});
+}
+/**
+* Config-time stamp of the project bearer onto `provider.options.headers
+* .Authorization`, mirroring oauth2's `propagateCachedBearer`. This is the
+* config-object handshake that lets `@vymalo/opencode-models-info` (which runs
+* after repo-auth in `plugin`) fetch an OAuth2-protected `meta.modelsInfoUrl`.
+* A user-set `Authorization` always wins here; and a stale stamped value is
+* harmless because `chat.headers` overwrites it per request with a fresh
+* token. Never opens a browser / device-code prompt: on any failure (no cached
+* human token, exchange error) it logs and skips the stamp.
+*/
+async function propagateCachedBearer(providerConfig, providerId, plugin, logger) {
+	const options = providerConfig.options ??= {};
+	const headers = options.headers ??= {};
+	const hasUserAuth = Object.keys(headers).some((key) => key.toLowerCase() === "authorization");
+	if (hasUserAuth) {
+		logger.debug("repo_auth_bearer_propagation_skipped_user_set", { providerId });
+		return;
+	}
+	let token;
+	try {
+		// Config-time warmup is strictly non-interactive: a first-ever login must
+		// not block boot on a browser/device-code prompt. The project token is
+		// renewed later by the first `chat.headers` request (interactive) or the
+		// user's explicit `auth login`. A missing/expired human token throws here
+		// and is caught below — `repo_auth_bearer_propagation_skipped_no_token`.
+		token = await plugin.resolveProjectToken({ interactive: false });
+	} catch (error) {
+		logger.debug("repo_auth_bearer_propagation_skipped_no_token", {
+			providerId,
+			error: error instanceof Error ? error.message : String(error)
+		});
+		return;
+	}
+	if (!token.accessToken) {
+		logger.debug("repo_auth_bearer_propagation_skipped_empty_token", { providerId });
+		return;
+	}
+	headers.Authorization = `${token.tokenType || "Bearer"} ${token.accessToken}`;
+	logger.debug("repo_auth_bearer_propagated_to_provider_headers", { providerId });
+}
+/**
+* Resolve the repo's git identity once per config hook — worktree-aware, read
+* off disk, normalized (userinfo stripped). Log-only in v1: nothing is derived
+* from the remote; the module exists to make the plugin worktree-correct and
+* to leave a repo-auditable trace in the log stream.
+*/
+async function logGitIdentity(logger, cwd) {
+	const repoRoot = await resolveRepoRoot(cwd);
+	if (!repoRoot) {
+		logger.trace("repo_auth_remote_missing", {});
+		return;
+	}
+	const remote = await resolveOriginRemote(repoRoot);
+	if (!remote) {
+		logger.trace("repo_auth_remote_missing", { repoRoot });
+		return;
+	}
+	logger.debug("repo_auth_remote_resolved", {
+		repoRoot,
+		remote
+	});
+}
+/**
+* Walk the provider map, collect every `options.meta.repoAuth` opt-in, and
+* enforce the plugin's guards. Returns the managed providers map (providerId →
+* parsed config), logging `repo_auth_*` events as it goes.
+*/
+function collectManagedProviders(config, logger) {
+	const managed = new Map();
+	const providers = config.provider ?? {};
+	const optedIn = [];
+	for (const [providerId, providerConfig] of Object.entries(providers)) {
+		const options = asRecord(providerConfig.options);
+		// A malformed opt-in on one provider must not take down the whole plugin:
+		// warn and skip, mirroring the no-op matrix. (oauth2 throws for its own
+		// config keys; here a stray/typo'd `meta.repoAuth` on any provider would
+		// otherwise reject the entire config hook for every provider.)
+		let parsed;
+		try {
+			parsed = parseRepoAuthOptions(options);
+		} catch (error) {
+			logger.warn("repo_auth_skipped_malformed", {
+				providerId,
+				error: error instanceof Error ? error.message : String(error)
+			});
+			continue;
+		}
+		if (parsed.kind === "not_opted_in") {
+			logger.trace("repo_auth_provider_skipped", { providerId });
+			continue;
+		}
+		if (parsed.kind === "missing_project_id") {
+			logger.warn("repo_auth_skipped_no_project_id", { providerId });
+			continue;
+		}
+		if (hasOAuth2Conflict(config, options, providerId)) {
+			logger.warn("repo_auth_skipped_oauth2_provider", { providerId });
+			continue;
+		}
+		const entry = {
+			projectId: parsed.config.projectId,
+			auth: parsed.config.auth,
+			authSignature: authSignature(parsed.config.auth)
+		};
+		optedIn.push({
+			providerId,
+			config: entry
+		});
+	}
+	// v1 is single-IdP: one identity key (the human) per cache namespace. The
+	// human root file is shared across every managed provider, so two opted-in
+	// providers MUST resolve to the same IdP or the second would clobber the
+	// first's human token. Guard: keep the first IdP group, warn + skip the rest.
+	const first = optedIn[0];
+	if (first) {
+		const selected = new Set([first.config.authSignature]);
+		for (const { providerId, config } of optedIn) {
+			if (!selected.has(config.authSignature)) {
+				logger.warn("repo_auth_multiple_idps_unsupported", { providerId });
+				continue;
+			}
+			logger.trace("repo_auth_provider_opted_in", {
+				providerId,
+				projectId: config.projectId
+			});
+			managed.set(providerId, config);
+		}
+	}
+	return managed;
+}
+function runtimeSignature(managed) {
+	const sorted = [...managed.entries()].sort(([a], [b]) => a.localeCompare(b));
+	return JSON.stringify(sorted.map(([providerId, entry]) => ({
+		providerId,
+		projectId: entry.projectId,
+		authSignature: entry.authSignature
+	})));
+}
+export function createOpencodeRepoAuthPlugin(factoryOptions = {}) {
+	return async ({ client }) => {
+		let currentLogLevel = DEFAULT_LOG_LEVEL;
+		const logger = factoryOptions.logger ?? createOpenCodeLogger(client, () => currentLogLevel);
+		const state = {
+			pluginByProvider: new Map(),
+			signature: undefined
+		};
+		return {
+			config: async (config) => {
+				currentLogLevel = fromOpenCodeLogLevel(config.logLevel) ?? DEFAULT_LOG_LEVEL;
+				logger.trace("repo_auth_config_hook_start", {
+					logLevel: currentLogLevel,
+					hostLogLevel: typeof config.logLevel === "string" ? config.logLevel : undefined
+				});
+				await logGitIdentity(logger, factoryOptions.cwd ?? process.cwd());
+				const managed = collectManagedProviders(config, logger);
+				logger.trace("repo_auth_config_hook_collected_providers", {
+					managedCount: managed.size,
+					providerIds: [...managed.keys()]
+				});
+				if (managed.size === 0) {
+					logger.trace("repo_auth_config_hook_no_managed_providers", {});
+					state.pluginByProvider.clear();
+					state.signature = undefined;
+					logger.trace("repo_auth_config_hook_finished", { managedCount: 0 });
+					return;
+				}
+				const signature = runtimeSignature(managed);
+				if (state.signature !== signature || state.pluginByProvider.size === 0) {
+					logger.trace("repo_auth_runtime_rebuild", {
+						reason: state.pluginByProvider.size > 0 ? "signature_changed" : "first_build",
+						providerCount: managed.size
+					});
+					const rebuilt = new Map();
+					for (const [providerId, entry] of managed.entries()) {
+						try {
+							const plugin = new RepoAuthPlugin({
+								projectId: entry.projectId,
+								auth: entry.auth
+							}, {
+								logger,
+								fetchImpl: factoryOptions.fetchImpl,
+								onAuthorizationUrl: factoryOptions.onAuthorizationUrl,
+								cacheDir: factoryOptions.cacheDir
+							});
+							rebuilt.set(providerId, plugin);
+						} catch (error) {
+							// validateAuthConfig inside the constructor can still reject
+							// (e.g. client_credentials without clientSecret). Fail that one
+							// provider, keep the rest — never abort the whole config hook.
+							logger.warn("repo_auth_skipped_invalid_auth", {
+								providerId,
+								error: error instanceof Error ? error.message : String(error)
+							});
+						}
+					}
+					state.pluginByProvider = rebuilt;
+					state.signature = signature;
+				} else {
+					logger.trace("repo_auth_runtime_reused", { providerCount: managed.size });
+				}
+				const providers = config.provider ??= {};
+				await Promise.all([...state.pluginByProvider.entries()].map(([providerId, plugin]) => {
+					const providerConfig = providers[providerId];
+					if (!providerConfig) {
+						return undefined;
+					}
+					return propagateCachedBearer(providerConfig, providerId, plugin, logger);
+				}));
+				logger.trace("repo_auth_config_hook_finished", { managedCount: state.pluginByProvider.size });
+			},
+			"chat.headers": async (input, output) => {
+				const providerId = input.model?.providerID ?? input.provider?.info?.id;
+				const plugin = providerId ? state.pluginByProvider.get(providerId) : undefined;
+				if (!providerId || !plugin) {
+					logger.trace("repo_auth_chat_headers_skipped", {
+						providerId,
+						managed: providerId ? state.pluginByProvider.has(providerId) : false
+					});
+					return;
+				}
+				// Fail closed: on any exchange failure we inject NO header — the
+				// request goes out without a bearer and the gateway 401s, matching the
+				// SPI's fail-closed semantics. The failure itself is logged at error
+				// level by `resolveProjectToken` (`repo_auth_exchange_failed`); here we
+				// must not let it escape the hook or the whole chat request would error
+				// instead of degrading to the gateway's 401.
+				try {
+					const token = await plugin.resolveProjectToken({ interactive: true });
+					output.headers.Authorization = `${token.tokenType || "Bearer"} ${token.accessToken}`;
+					logger.trace("repo_auth_chat_headers_bearer_injected", {
+						providerId,
+						present: Boolean(token.accessToken),
+						tokenType: token.tokenType || "Bearer"
+					});
+				} catch {
+					logger.trace("repo_auth_chat_headers_no_bearer", { providerId });
+					return;
+				}
+			}
+		};
+	};
+}
+export const OpencodeRepoAuthPlugin = createOpencodeRepoAuthPlugin();
+export default OpencodeRepoAuthPlugin;
+
+//# sourceMappingURL=opencode.js.map

package/dist/opencode.js.map

@@ -0,0 +1 @@
+{"mappings":"AAEA,SACE,yBACA,mBAGA,0BAIK;AAEP,SAAS,mBAAmB,4BAA4B;AACxD,SAAS,qBAAqB,uBAAuB;AACrD,SAAS,sBAAsB;AAM/B,MAAM,sBAAsB;;;;;;;;;AAU5B,SAAS,qBAAqB,OAAsC;CAClE,IAAI,OAAO,UAAU,UAAU;EAC7B,OAAO;CACT;CACA,QAAQ,MAAM,YAAY,GAA1B;EACE,KAAK,SACH,OAAO;EACT,KAAK,QACH,OAAO;EACT,KAAK,QACH,OAAO;EACT,KAAK,SACH,OAAO;EACT,SACE,OAAO;CACX;AACF;AAEA,SAAS,SAAS,OAAqD;CACrE,IAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;EAC/D,OAAO;CACT;CAEA,OAAO;AACT;AAuBA,SAAS,qBAAqB,QAA+B,aAAqC;CAChG,MAAM,WAAW,wBAAwB,OAAO;CAChD,MAAM,aAAa,qBAAqB,KAAK,QAAQ,IAAI,6BAA6B,EAAE;CAExF,MAAM,SACJ,OACA,OACA,WACG;EACH,IAAI,mBAAmB,SAAS,mBAAmB,YAAY,IAAI;GACjE;EACF;EAEA,IAAI,cAAc,UAAU,UAAU,UAAU,SAAS;GACvD,SAAS,MAAM,CAAC,OAAO,MAAM;EAC/B;EAEA,MAAM,YAAY,UAAU,UAAU,UAAU;EAChD,KAAK,OAAO,IACT,IAAI,EACH,MAAM;GACJ,SAAS;GACT,OAAO;GACP,SAAS;GACT,OAAO;EACT,EACF,CAAC,CAAC,CACD,YAAY;;EAEb,CAAC;CACL;CAEA,OAAO;EACL,MAAM,OAAO,QAAQ;GACnB,MAAM,SAAS,OAAO,MAAM;EAC9B;EACA,MAAM,OAAO,QAAQ;GACnB,MAAM,SAAS,OAAO,MAAM;EAC9B;EACA,KAAK,OAAO,QAAQ;GAClB,MAAM,QAAQ,OAAO,MAAM;EAC7B;EACA,KAAK,OAAO,QAAQ;GAClB,MAAM,QAAQ,OAAO,MAAM;EAC7B;EACA,MAAM,OAAO,QAAQ;GACnB,MAAM,SAAS,OAAO,MAAM;EAC9B;CACF;AACF;AAEA,SAAS,cAAc,MAAqC;CAC1D,OAAO,KAAK,UAAU;EACpB,QAAQ,KAAK;EACb,UAAU,KAAK;EACf,cAAc,KAAK;EACnB,QAAQ,KAAK;EACb,uBAAuB,KAAK;EAC5B,eAAe,KAAK;EACpB,6BAA6B,KAAK;EAClC,SAAS,KAAK;EACd,cAAc,KAAK;EACnB,UAAU,KAAK;EACf,MAAM,KAAK;EACX,oBAAoB,KAAK;CAC3B,CAAC;AACH;;;;;;;;;;;AAYA,eAAe,sBACb,gBACA,YACA,QACA,QACe;CACf,MAAM,UAAW,eAAe,YAAY,CAAC;CAC7C,MAAM,UAAW,AAAC,QAAiD,YAAY,CAAC;CAChF,MAAM,cAAc,OAAO,KAAK,OAAO,CAAC,CAAC,MAAM,QAAQ,IAAI,YAAY,MAAM,eAAe;CAC5F,IAAI,aAAa;EACf,OAAO,MAAM,iDAAiD,EAAE,WAAW,CAAC;EAC5E;CACF;CAEA,IAAI;CACJ,IAAI;;;;;;EAMF,QAAQ,MAAM,OAAO,oBAAoB,EAAE,aAAa,MAAM,CAAC;CACjE,SAAS,OAAO;EACd,OAAO,MAAM,iDAAiD;GAC5D;GACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EAC9D,CAAC;EACD;CACF;CAEA,IAAI,CAAC,MAAM,aAAa;EACtB,OAAO,MAAM,oDAAoD,EAAE,WAAW,CAAC;EAC/E;CACF;CAEA,QAAQ,gBAAgB,GAAG,MAAM,aAAa,SAAS,GAAG,MAAM;CAChE,OAAO,MAAM,mDAAmD,EAAE,WAAW,CAAC;AAChF;;;;;;;AAQA,eAAe,eAAe,QAAgB,KAA4B;CACxE,MAAM,WAAW,MAAM,gBAAgB,GAAG;CAC1C,IAAI,CAAC,UAAU;EACb,OAAO,MAAM,4BAA4B,CAAC,CAAC;EAC3C;CACF;CACA,MAAM,SAAS,MAAM,oBAAoB,QAAQ;CACjD,IAAI,CAAC,QAAQ;EACX,OAAO,MAAM,4BAA4B,EAAE,SAAS,CAAC;EACrD;CACF;CACA,OAAO,MAAM,6BAA6B;EAAE;EAAU;CAAO,CAAC;AAChE;;;;;;AAOA,SAAS,wBACP,QACA,QAC8B;CAC9B,MAAM,UAAU,IAAI,IAA6B;CACjD,MAAM,YAAY,OAAO,YAAY,CAAC;CAEtC,MAAM,UAAkE,CAAC;CACzE,KAAK,MAAM,CAAC,YAAY,mBAAmB,OAAO,QAAQ,SAAS,GAAG;EACpE,MAAM,UAAU,SAAS,eAAe,OAAO;;;;;EAK/C,IAAI;EACJ,IAAI;GACF,SAAS,qBAAqB,OAAO;EACvC,SAAS,OAAO;GACd,OAAO,KAAK,+BAA+B;IACzC;IACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GAC9D,CAAC;GACD;EACF;EACA,IAAI,OAAO,SAAS,gBAAgB;GAClC,OAAO,MAAM,8BAA8B,EAAE,WAAW,CAAC;GACzD;EACF;EACA,IAAI,OAAO,SAAS,sBAAsB;GACxC,OAAO,KAAK,mCAAmC,EAAE,WAAW,CAAC;GAC7D;EACF;EACA,IAAI,kBAAkB,QAAQ,SAAS,UAAU,GAAG;GAClD,OAAO,KAAK,qCAAqC,EAAE,WAAW,CAAC;GAC/D;EACF;EAEA,MAAM,QAAyB;GAC7B,WAAW,OAAO,OAAO;GACzB,MAAM,OAAO,OAAO;GACpB,eAAe,cAAc,OAAO,OAAO,IAAI;EACjD;EACA,QAAQ,KAAK;GAAE;GAAY,QAAQ;EAAM,CAAC;CAC5C;;;;;CAMA,MAAM,QAAQ,QAAQ;CACtB,IAAI,OAAO;EACT,MAAM,WAAW,IAAI,IAAY,CAAC,MAAM,OAAO,aAAa,CAAC;EAC7D,KAAK,MAAM,EAAE,YAAY,YAAY,SAAS;GAC5C,IAAI,CAAC,SAAS,IAAI,OAAO,aAAa,GAAG;IACvC,OAAO,KAAK,uCAAuC,EAAE,WAAW,CAAC;IACjE;GACF;GACA,OAAO,MAAM,+BAA+B;IAAE;IAAY,WAAW,OAAO;GAAU,CAAC;GACvF,QAAQ,IAAI,YAAY,MAAM;EAChC;CACF;CAEA,OAAO;AACT;AAEA,SAAS,iBAAiB,SAA+C;CACvE,MAAM,SAAS,CAAC,GAAG,QAAQ,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;CAC3E,OAAO,KAAK,UACV,OAAO,KAAK,CAAC,YAAY,YAAY;EACnC;EACA,WAAW,MAAM;EACjB,eAAe,MAAM;CACvB,EAAE,CACJ;AACF;AAEA,OAAO,SAAS,6BACd,iBAA+C,CAAC,GACxC;CACR,OAAO,OAAO,EAAE,aAAa;EAC3B,IAAI,kBAA4B;EAChC,MAAM,SAAS,eAAe,UAAU,qBAAqB,cAAc,eAAe;EAE1F,MAAM,QAAsB;GAC1B,kBAAkB,IAAI,IAA4B;GAClD,WAAW;EACb;EAEA,OAAO;GACL,QAAQ,OAAO,WAAW;IACxB,kBAAkB,qBAAqB,OAAO,QAAQ,KAAK;IAC3D,OAAO,MAAM,+BAA+B;KAC1C,UAAU;KACV,cAAc,OAAO,OAAO,aAAa,WAAW,OAAO,WAAW;IACxE,CAAC;IAED,MAAM,eAAe,QAAQ,eAAe,OAAO,QAAQ,IAAI,CAAC;IAEhE,MAAM,UAAU,wBAAwB,QAAQ,MAAM;IACtD,OAAO,MAAM,6CAA6C;KACxD,cAAc,QAAQ;KACtB,aAAa,CAAC,GAAG,QAAQ,KAAK,CAAC;IACjC,CAAC;IACD,IAAI,QAAQ,SAAS,GAAG;KACtB,OAAO,MAAM,8CAA8C,CAAC,CAAC;KAC7D,MAAM,iBAAiB,MAAM;KAC7B,MAAM,YAAY;KAClB,OAAO,MAAM,kCAAkC,EAAE,cAAc,EAAE,CAAC;KAClE;IACF;IAEA,MAAM,YAAY,iBAAiB,OAAO;IAC1C,IAAI,MAAM,cAAc,aAAa,MAAM,iBAAiB,SAAS,GAAG;KACtE,OAAO,MAAM,6BAA6B;MACxC,QAAQ,MAAM,iBAAiB,OAAO,IAAI,sBAAsB;MAChE,eAAe,QAAQ;KACzB,CAAC;KACD,MAAM,UAAU,IAAI,IAA4B;KAChD,KAAK,MAAM,CAAC,YAAY,UAAU,QAAQ,QAAQ,GAAG;MACnD,IAAI;OACF,MAAM,SAAS,IAAI,eACjB;QAAE,WAAW,MAAM;QAAW,MAAM,MAAM;OAAK,GAC/C;QACE;QACA,WAAW,eAAe;QAC1B,oBAAoB,eAAe;QACnC,UAAU,eAAe;OAC3B,CACF;OACA,QAAQ,IAAI,YAAY,MAAM;MAChC,SAAS,OAAO;;;;OAId,OAAO,KAAK,kCAAkC;QAC5C;QACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;OAC9D,CAAC;MACH;KACF;KACA,MAAM,mBAAmB;KACzB,MAAM,YAAY;IACpB,OAAO;KACL,OAAO,MAAM,4BAA4B,EAAE,eAAe,QAAQ,KAAK,CAAC;IAC1E;IAEA,MAAM,YAAa,OAAO,aAAa,CAAC;IACxC,MAAM,QAAQ,IACZ,CAAC,GAAG,MAAM,iBAAiB,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,YAAY;KAClE,MAAM,iBAAiB,UAAU;KACjC,IAAI,CAAC,gBAAgB;MACnB,OAAO;KACT;KACA,OAAO,sBAAsB,gBAAgB,YAAY,QAAQ,MAAM;IACzE,CAAC,CACH;IACA,OAAO,MAAM,kCAAkC,EAC7C,cAAc,MAAM,iBAAiB,KACvC,CAAC;GACH;GACA,gBAAgB,OAAO,OAAO,WAAW;IACvC,MAAM,aAAa,MAAM,OAAO,cAAc,MAAM,UAAU,MAAM;IACpE,MAAM,SAAS,aAAa,MAAM,iBAAiB,IAAI,UAAU,IAAI;IACrE,IAAI,CAAC,cAAc,CAAC,QAAQ;KAC1B,OAAO,MAAM,kCAAkC;MAC7C;MACA,SAAS,aAAa,MAAM,iBAAiB,IAAI,UAAU,IAAI;KACjE,CAAC;KACD;IACF;;;;;;;IAQA,IAAI;KACF,MAAM,QAAQ,MAAM,OAAO,oBAAoB,EAAE,aAAa,KAAK,CAAC;KACpE,OAAO,QAAQ,gBAAgB,GAAG,MAAM,aAAa,SAAS,GAAG,MAAM;KACvE,OAAO,MAAM,0CAA0C;MACrD;MACA,SAAS,QAAQ,MAAM,WAAW;MAClC,WAAW,MAAM,aAAa;KAChC,CAAC;IACH,QAAQ;KACN,OAAO,MAAM,oCAAoC,EAAE,WAAW,CAAC;KAC/D;IACF;GACF;EACF;CACF;AACF;AAEA,OAAO,MAAM,yBAAiC,6BAA6B;AAE3E,eAAe","names":[],"sources":["../src/opencode.ts"],"version":3,"file":"opencode.js","sourceRoot":""}

package/dist/plugin.d.ts

@@ -0,0 +1,100 @@
+import { type Logger, type TokenSet } from "@vymalo/opencode-auth-core/lib";
+import type { RepoAuthConfig } from "./config.js";
+/**
+* The plugin is identity-keyed by the *human* — the single person whose one
+* interactive login (device-code / authorization-code) grounds every project
+* exchange. v1 is single-IdP, so the identity is a constant; if multi-IdP ever
+* lands, derive `issuer|clientId` instead.
+*/
+export declare const HUMAN_IDENTITY = "human";
+export declare const DEFAULT_CACHE_NAMESPACE = "opencode-repo-auth";
+export interface RepoAuthPluginOptions {
+	logger?: Logger;
+	fetchImpl?: typeof fetch;
+	onAuthorizationUrl?: (url: string) => Promise<void> | void;
+	/** Override the cache root (defaults to the OS cache dir convention). */
+	cacheDir?: string;
+	tokenExpirySkewMs?: number;
+}
+/**
+* Whether a cached project token is usable. Deliberately *not* routed through
+* auth-core's `OAuthClient.isTokenValid`: that check treats a missing
+* `expiresAt` as non-expiring for interactive flows, but the project token has
+* **no refresh token** — an undefined or passed lifetime must trigger a
+* re-exchange (the machine-flow policy), otherwise a 401 after the server
+* revoked it becomes a permanent failure rather than a one round trip.
+*/
+export declare function isProjectTokenUsable(token: TokenSet | undefined, skewMs: number): token is TokenSet;
+/**
+* Repo-auth runtime over `@vymalo/opencode-auth-core`'s `TokenRuntime`.
+* Owns two token kinds, both persisted by auth-core's `FileCacheStore` under
+* the plugin's cache namespace (OS cache dir, `0o600`, atomic rename):
+*
+*   - the **human root** (`<cacheDir>/human.json`) — what `ensure` /
+*     `refresh` produces; carries the `offline_access` refresh token that makes
+*     re-exchange automatic ("model b"); never sent to the gateway.
+*   - the **project token** (`<cacheDir>/human-<hash(projectId)>.json`) — the
+*     SPI-sealed RFC 8693 exchange result consumed by the gateway; short-lived,
+*     no refresh token, so renewal is always a fresh exchange from the human
+*     root, never a "refreshed" project token (which would lose the project
+*     claims).
+*
+* The plugin keeps only in-memory state; no `cache.ts` of its own.
+*/
+export declare class RepoAuthPlugin {
+	readonly config: RepoAuthConfig;
+	private readonly runtime;
+	private readonly logger;
+	private readonly tokenExpirySkewMs;
+	private inFlightExchange?;
+	constructor(config: RepoAuthConfig, options?: RepoAuthPluginOptions);
+	get projectId(): string;
+	/**
+	* Ensure the human root token. Config-time callers pass `{interactive:false}`
+	* so a first-ever login never blocks boot on a browser/device-code prompt;
+	* per-request callers allow it (the first chat is the natural moment to log
+	* in). A stale-but-refreshable token is refreshed silently via its
+	* `offline_access` refresh token.
+	*/
+	ensureHumanToken(options?: {
+		interactive?: boolean;
+	}): Promise<TokenSet>;
+	/** Non-network read of the cached project token, if any. */
+	getCachedProjectToken(): Promise<TokenSet | undefined>;
+	/**
+	* Resolve a *usable* project token — "model b":
+	*
+	*   cached usable? ──yes──▶ return it (repo_auth_exchange_cache_hit)
+	*         │ no
+	*         ▼
+	*   ensure human root (refresh-only; interactive never used here)
+	*         ▼
+	*   exchangeTo(projectId, humanToken, { project_id })   ← ONE POST, no audience
+	*         ▼
+	*   cache under human-<hash(projectId)> + return
+	*
+	* The project token is **never refreshed**; re-exchange is the canonical
+	* renewal. Fails closed: an exchange failure (non-member, resolver error,
+	* network) throws `repo_auth_exchange_failed` — the caller injects no header
+	* and the gateway 401s, which is correct (matches the SPI's fail-closed
+	* semantics). The plugin never invents a token.
+	*
+	* `interactive` controls only the human-root derivation for a *re-exchange*:
+	* config-time callers keep it `false` (a first-ever login must not block
+	* boot), while `chat.headers` callers default to `true` so the first chat
+	* request can open the device-code / browser flow.
+	*
+	* Concurrent callers (parallel chat headers, config warmup racing a request)
+	* share the in-flight exchange: the first cache-missing caller kicks it off
+	* and the rest await the same promise, so there is at most one exchange POST
+	* and at most one interactive prompt per cache-miss window.
+	*/
+	resolveProjectToken(options?: {
+		interactive?: boolean;
+	}): Promise<TokenSet>;
+	private performExchange;
+	/** Drop the on-disk human + project tokens for this identity. */
+	reset(): Promise<void>;
+}
+/** Absolute path to the repo-auth cache directory (for diagnostics / tests). */
+export declare function repoAuthCacheDir(cacheRoot: string): string;

package/dist/plugin.js

@@ -0,0 +1,161 @@
+import { join } from "node:path";
+import { createJsonConsoleLogger, DEFAULT_TOKEN_EXPIRY_SKEW_MS, resolveCacheRoot, TokenRuntime, validateAuthConfig } from "@vymalo/opencode-auth-core/lib";
+/**
+* The plugin is identity-keyed by the *human* — the single person whose one
+* interactive login (device-code / authorization-code) grounds every project
+* exchange. v1 is single-IdP, so the identity is a constant; if multi-IdP ever
+* lands, derive `issuer|clientId` instead.
+*/
+export const HUMAN_IDENTITY = "human";
+export const DEFAULT_CACHE_NAMESPACE = "opencode-repo-auth";
+/**
+* Whether a cached project token is usable. Deliberately *not* routed through
+* auth-core's `OAuthClient.isTokenValid`: that check treats a missing
+* `expiresAt` as non-expiring for interactive flows, but the project token has
+* **no refresh token** — an undefined or passed lifetime must trigger a
+* re-exchange (the machine-flow policy), otherwise a 401 after the server
+* revoked it becomes a permanent failure rather than a one round trip.
+*/
+export function isProjectTokenUsable(token, skewMs) {
+	if (!token?.accessToken) {
+		return false;
+	}
+	if (token.expiresAt === undefined) {
+		return false;
+	}
+	return Date.now() + skewMs < token.expiresAt;
+}
+/**
+* Repo-auth runtime over `@vymalo/opencode-auth-core`'s `TokenRuntime`.
+* Owns two token kinds, both persisted by auth-core's `FileCacheStore` under
+* the plugin's cache namespace (OS cache dir, `0o600`, atomic rename):
+*
+*   - the **human root** (`<cacheDir>/human.json`) — what `ensure` /
+*     `refresh` produces; carries the `offline_access` refresh token that makes
+*     re-exchange automatic ("model b"); never sent to the gateway.
+*   - the **project token** (`<cacheDir>/human-<hash(projectId)>.json`) — the
+*     SPI-sealed RFC 8693 exchange result consumed by the gateway; short-lived,
+*     no refresh token, so renewal is always a fresh exchange from the human
+*     root, never a "refreshed" project token (which would lose the project
+*     claims).
+*
+* The plugin keeps only in-memory state; no `cache.ts` of its own.
+*/
+export class RepoAuthPlugin {
+	config;
+	runtime;
+	logger;
+	tokenExpirySkewMs;
+	inFlightExchange;
+	constructor(config, options = {}) {
+		this.config = config;
+		this.logger = options.logger ?? createJsonConsoleLogger("info");
+		this.tokenExpirySkewMs = typeof options.tokenExpirySkewMs === "number" && Number.isFinite(options.tokenExpirySkewMs) && options.tokenExpirySkewMs > 0 ? options.tokenExpirySkewMs : DEFAULT_TOKEN_EXPIRY_SKEW_MS;
+		this.runtime = new TokenRuntime(
+			HUMAN_IDENTITY,
+			// Validate once at construction so a malformed auth block fails early
+			// with auth-core's field-level errors (defaults applied: authFlow →
+			// authorization_code, pkce → true).
+			validateAuthConfig(config.auth),
+			{
+				logger: this.logger,
+				fetchImpl: options.fetchImpl,
+				onAuthorizationUrl: options.onAuthorizationUrl,
+				cacheDir: options.cacheDir ?? join(resolveCacheRoot(), DEFAULT_CACHE_NAMESPACE),
+				tokenExpirySkewMs: this.tokenExpirySkewMs
+			}
+		);
+	}
+	get projectId() {
+		return this.config.projectId;
+	}
+	/**
+	* Ensure the human root token. Config-time callers pass `{interactive:false}`
+	* so a first-ever login never blocks boot on a browser/device-code prompt;
+	* per-request callers allow it (the first chat is the natural moment to log
+	* in). A stale-but-refreshable token is refreshed silently via its
+	* `offline_access` refresh token.
+	*/
+	async ensureHumanToken(options = {}) {
+		const token = await this.runtime.ensure({ interactive: options.interactive });
+		this.logger.debug("repo_auth_human_token_ensured", { present: Boolean(token.accessToken) });
+		return token;
+	}
+	/** Non-network read of the cached project token, if any. */
+	async getCachedProjectToken() {
+		return this.runtime.getExchangedByKey(this.projectId);
+	}
+	/**
+	* Resolve a *usable* project token — "model b":
+	*
+	*   cached usable? ──yes──▶ return it (repo_auth_exchange_cache_hit)
+	*         │ no
+	*         ▼
+	*   ensure human root (refresh-only; interactive never used here)
+	*         ▼
+	*   exchangeTo(projectId, humanToken, { project_id })   ← ONE POST, no audience
+	*         ▼
+	*   cache under human-<hash(projectId)> + return
+	*
+	* The project token is **never refreshed**; re-exchange is the canonical
+	* renewal. Fails closed: an exchange failure (non-member, resolver error,
+	* network) throws `repo_auth_exchange_failed` — the caller injects no header
+	* and the gateway 401s, which is correct (matches the SPI's fail-closed
+	* semantics). The plugin never invents a token.
+	*
+	* `interactive` controls only the human-root derivation for a *re-exchange*:
+	* config-time callers keep it `false` (a first-ever login must not block
+	* boot), while `chat.headers` callers default to `true` so the first chat
+	* request can open the device-code / browser flow.
+	*
+	* Concurrent callers (parallel chat headers, config warmup racing a request)
+	* share the in-flight exchange: the first cache-missing caller kicks it off
+	* and the rest await the same promise, so there is at most one exchange POST
+	* and at most one interactive prompt per cache-miss window.
+	*/
+	async resolveProjectToken(options = {}) {
+		const cached = await this.getCachedProjectToken();
+		if (isProjectTokenUsable(cached, this.tokenExpirySkewMs)) {
+			this.logger.trace("repo_auth_exchange_cache_hit", { projectId: this.projectId });
+			return cached;
+		}
+		this.logger.trace("repo_auth_exchange_cache_miss", { projectId: this.projectId });
+		if (this.inFlightExchange) {
+			return this.inFlightExchange;
+		}
+		const exchange = this.performExchange(options);
+		this.inFlightExchange = exchange;
+		try {
+			return await exchange;
+		} finally {
+			if (this.inFlightExchange === exchange) {
+				this.inFlightExchange = undefined;
+			}
+		}
+	}
+	async performExchange(options) {
+		const human = await this.ensureHumanToken({ interactive: options.interactive });
+		this.logger.info("repo_auth_exchange_started", { projectId: this.projectId });
+		try {
+			const exchanged = await this.runtime.exchangeTo(this.projectId, human.accessToken, { project_id: this.projectId });
+			this.logger.info("repo_auth_exchange_success", { projectId: this.projectId });
+			return exchanged;
+		} catch (error) {
+			this.logger.error("repo_auth_exchange_failed", {
+				projectId: this.projectId,
+				error: error instanceof Error ? error.message : String(error)
+			});
+			throw error;
+		}
+	}
+	/** Drop the on-disk human + project tokens for this identity. */
+	async reset() {
+		await this.runtime.reset();
+	}
+}
+/** Absolute path to the repo-auth cache directory (for diagnostics / tests). */
+export function repoAuthCacheDir(cacheRoot) {
+	return join(cacheRoot, DEFAULT_CACHE_NAMESPACE);
+}
+
+//# sourceMappingURL=plugin.js.map

package/dist/plugin.js.map

@@ -0,0 +1 @@
+{"mappings":"AAAA,SAAS,YAAY;AAErB,SACE,yBACA,8BACA,kBACA,cACA,0BAGK;;;;;;;AAUP,OAAO,MAAM,iBAAiB;AAE9B,OAAO,MAAM,0BAA0B;;;;;;;;;AAmBvC,OAAO,SAAS,qBACd,OACA,QACmB;CACnB,IAAI,CAAC,OAAO,aAAa;EACvB,OAAO;CACT;CACA,IAAI,MAAM,cAAc,WAAW;EACjC,OAAO;CACT;CACA,OAAO,KAAK,IAAI,IAAI,SAAS,MAAM;AACrC;;;;;;;;;;;;;;;;;AAkBA,OAAO,MAAM,eAAe;CAOf;CANX,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAQ;CAER,YACE,AAAS,QACT,UAAiC,CAAC,GAClC;EAFS;EAGT,KAAK,SAAS,QAAQ,UAAU,wBAAwB,MAAM;EAC9D,KAAK,oBACH,OAAO,QAAQ,sBAAsB,YACrC,OAAO,SAAS,QAAQ,iBAAiB,KACzC,QAAQ,oBAAoB,IACxB,QAAQ,oBACR;EAEN,KAAK,UAAU,IAAI;GACjB;;;;GAIA,mBAAmB,OAAO,IAAI;GAC9B;IACE,QAAQ,KAAK;IACb,WAAW,QAAQ;IACnB,oBAAoB,QAAQ;IAC5B,UAAU,QAAQ,YAAY,KAAK,iBAAiB,GAAG,uBAAuB;IAC9E,mBAAmB,KAAK;GAC1B;EACF;CACF;CAEA,IAAI,YAAoB;EACtB,OAAO,KAAK,OAAO;CACrB;;;;;;;;CASA,MAAM,iBAAiB,UAAqC,CAAC,GAAsB;EACjF,MAAM,QAAQ,MAAM,KAAK,QAAQ,OAAO,EAAE,aAAa,QAAQ,YAAY,CAAC;EAC5E,KAAK,OAAO,MAAM,iCAAiC,EACjD,SAAS,QAAQ,MAAM,WAAW,EACpC,CAAC;EACD,OAAO;CACT;;CAGA,MAAM,wBAAuD;EAC3D,OAAO,KAAK,QAAQ,kBAAkB,KAAK,SAAS;CACtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8BA,MAAM,oBAAoB,UAAqC,CAAC,GAAsB;EACpF,MAAM,SAAS,MAAM,KAAK,sBAAsB;EAChD,IAAI,qBAAqB,QAAQ,KAAK,iBAAiB,GAAG;GACxD,KAAK,OAAO,MAAM,gCAAgC,EAAE,WAAW,KAAK,UAAU,CAAC;GAC/E,OAAO;EACT;EACA,KAAK,OAAO,MAAM,iCAAiC,EAAE,WAAW,KAAK,UAAU,CAAC;EAEhF,IAAI,KAAK,kBAAkB;GACzB,OAAO,KAAK;EACd;EAEA,MAAM,WAAW,KAAK,gBAAgB,OAAO;EAC7C,KAAK,mBAAmB;EACxB,IAAI;GACF,OAAO,MAAM;EACf,UAAU;GACR,IAAI,KAAK,qBAAqB,UAAU;IACtC,KAAK,mBAAmB;GAC1B;EACF;CACF;CAEA,MAAc,gBAAgB,SAAuD;EACnF,MAAM,QAAQ,MAAM,KAAK,iBAAiB,EAAE,aAAa,QAAQ,YAAY,CAAC;EAC9E,KAAK,OAAO,KAAK,8BAA8B,EAAE,WAAW,KAAK,UAAU,CAAC;EAC5E,IAAI;GACF,MAAM,YAAY,MAAM,KAAK,QAAQ,WAAW,KAAK,WAAW,MAAM,aAAa,EACjF,YAAY,KAAK,UACnB,CAAC;GACD,KAAK,OAAO,KAAK,8BAA8B,EAAE,WAAW,KAAK,UAAU,CAAC;GAC5E,OAAO;EACT,SAAS,OAAO;GACd,KAAK,OAAO,MAAM,6BAA6B;IAC7C,WAAW,KAAK;IAChB,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GAC9D,CAAC;GACD,MAAM;EACR;CACF;;CAGA,MAAM,QAAuB;EAC3B,MAAM,KAAK,QAAQ,MAAM;CAC3B;AACF;;AAGA,OAAO,SAAS,iBAAiB,WAA2B;CAC1D,OAAO,KAAK,WAAW,uBAAuB;AAChD","names":[],"sources":["../src/plugin.ts"],"version":3,"file":"plugin.js","sourceRoot":""}

package/package.json

@@ -0,0 +1,67 @@
+{
+  "name": "@vymalo/opencode-repo-auth",
+  "version": "0.14.1",
+  "description": "OpenCode plugin that gives local-dev requests repo-as-project attribution: a developer logs in once as themselves and every gateway request from an enrolled repo carries a project-scoped bearer.",
+  "license": "MIT",
+  "author": "vymalo contributors",
+  "homepage": "https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit.git",
+    "directory": "packages/opencode-repo-auth"
+  },
+  "bugs": {
+    "url": "https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/issues"
+  },
+  "keywords": [
+    "opencode",
+    "opencode-plugin",
+    "oauth2",
+    "token-exchange",
+    "project",
+    "gateway",
+    "ai-sdk"
+  ],
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./lib": {
+      "types": "./dist/lib.d.ts",
+      "import": "./dist/lib.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "sideEffects": false,
+  "files": [
+    "dist"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@opencode-ai/plugin": "1.15.10",
+    "@vymalo/opencode-auth-core": "0.14.1"
+  },
+  "devDependencies": {
+    "vite": "^8.2.1",
+    "vitest": "^4.1.7"
+  },
+  "scripts": {
+    "build": "node ../../scripts/build-package.mjs",
+    "lint": "biome lint .",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run",
+    "test:integration": "vitest run --config vitest.integration.config.ts",
+    "coverage": "vitest run --coverage",
+    "format": "biome format --write .",
+    "format:check": "biome format ."
+  }
+}