@wrongstack/cli 0.299.0 → 0.301.0

package/dist/chunk-PYTFS4MC.js

@@ -0,0 +1,238 @@
+import {
+  mutateConfigProviders,
+  normalizeKeys,
+  nowIso,
+  writeKeysBack
+} from "./chunk-PJHET45A.js";
+
+// src/auth-menu/openai-codex-oauth.ts
+import { color } from "@wrongstack/core/utils";
+import {
+  buildCodexAuthorizeUrl,
+  CODEX_BASE_URL,
+  CODEX_FALLBACK_REDIRECT_PORT,
+  CODEX_PROVIDER_ID,
+  CODEX_REDIRECT_HOST,
+  CODEX_REDIRECT_PATH,
+  CODEX_REDIRECT_PORT,
+  CODEX_SCOPE,
+  codexRedirectUri,
+  createState,
+  exchangeCodexAuthorizationCode,
+  extractAccountId,
+  generatePkce,
+  parseAuthorizationInput,
+  refreshCodexTokens,
+  resolveCodexModels
+} from "@wrongstack/providers/oauth";
+
+// src/auth-menu/loopback-server.ts
+import { spawn } from "node:child_process";
+import {
+  startLoopbackServer as startSharedLoopbackServer
+} from "@wrongstack/providers/oauth";
+import { callbackHtml } from "@wrongstack/providers/oauth";
+function openBrowser(url) {
+  try {
+    const platform = process.platform;
+    const { command, args } = platform === "win32" ? { command: "cmd", args: ["/c", "start", "", url] } : platform === "darwin" ? { command: "open", args: [url] } : { command: "xdg-open", args: [url] };
+    const child = spawn(command, args, { stdio: "ignore", windowsHide: true });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+}
+function startLoopbackServer(expectedState, ports, signal, callbackPath = "/auth/callback", redirectHost = "127.0.0.1") {
+  const [primary = 1455, ...fallbackPorts] = ports;
+  return startSharedLoopbackServer({
+    port: primary,
+    fallbackPorts: [...fallbackPorts],
+    host: redirectHost,
+    path: callbackPath,
+    expectedState,
+    ...signal ? { signal } : {}
+  });
+}
+
+// src/auth-menu/openai-codex-oauth.ts
+import {
+  CODEX_BASE_URL as CODEX_BASE_URL2,
+  CODEX_CATALOG_FAMILIES,
+  CODEX_PROVIDER_ID as CODEX_PROVIDER_ID2,
+  extractAccountId as extractAccountId2,
+  FALLBACK_CODEX_MODELS,
+  fallbackCodexModelIds,
+  fallbackCodexProviderModels,
+  fetchCodexModels,
+  filterCurrentCodexModelIds,
+  generatePkce as generatePkce2,
+  isCodexCatalogModel,
+  parseAuthorizationInput as parseAuthorizationInput2,
+  resolveCodexModels as resolveCodexModels2
+} from "@wrongstack/providers/oauth";
+var buildAuthorizeUrl = buildCodexAuthorizeUrl;
+var exchangeAuthorizationCode = exchangeCodexAuthorizationCode;
+function startLoopbackServer2(expectedState, signal) {
+  return startLoopbackServer(
+    expectedState,
+    [CODEX_REDIRECT_PORT, CODEX_FALLBACK_REDIRECT_PORT],
+    signal,
+    CODEX_REDIRECT_PATH,
+    CODEX_REDIRECT_HOST
+  );
+}
+var redirectUri = codexRedirectUri;
+async function runCodexOAuthLogin(deps, opts = {}) {
+  const providerId = opts.providerId ?? CODEX_PROVIDER_ID;
+  const pkce = generatePkce();
+  const state = createState();
+  const ac = new AbortController();
+  let sigintCount = 0;
+  const onSig = () => {
+    sigintCount += 1;
+    if (sigintCount === 1) {
+      deps.renderer.write(color.dim("\n  Cancelling sign-in\u2026 (press Ctrl+C again to force-quit)\n"));
+      ac.abort();
+    } else {
+      process.exit(130);
+    }
+  };
+  const external = opts.signal;
+  const onExternalAbort = () => ac.abort();
+  if (external) {
+    if (external.aborted) ac.abort();
+    else external.addEventListener("abort", onExternalAbort, { once: true });
+  } else {
+    process.on("SIGINT", onSig);
+  }
+  const server = await startLoopbackServer2(state, ac.signal);
+  const authorizeUrl = buildAuthorizeUrl(pkce.challenge, state, server.port);
+  const osc8 = (url) => `\x1B]8;;${url}\x1B\\${url}\x1B]8;;\x1B\\`;
+  deps.renderer.write(
+    color.bold(`
+  Sign in with ChatGPT \u2014 ${color.cyan(providerId)}
+`) + color.dim("  Uses your ChatGPT Plus/Pro/Team subscription (not an API key).\n") + color.amber("  \u26A0 Using a subscription outside the official Codex client may violate\n") + color.amber("    OpenAI\u2019s Terms \u2014 your account could be rate-limited or banned.\n") + color.dim("    Sanctioned programmatic use = an API key: ") + color.bold("wstack auth openai") + color.dim("\n\n") + color.bold(`  ${"\u2500".repeat(56)}
+`) + color.bold("  Open this URL in your browser to sign in:\n") + color.cyan(`  ${osc8(authorizeUrl)}
+`) + color.bold(`  ${"\u2500".repeat(56)}
+
+`)
+  );
+  if (server.bound) {
+    openBrowser(authorizeUrl);
+    deps.renderer.write(
+      color.dim("  A browser window should open. Waiting for you to finish signing in...\n") + color.dim(`  (Listening on ${redirectUri(server.port)} \u2014 press Ctrl+C to cancel.)
+`)
+    );
+  } else {
+    deps.renderer.write(
+      color.amber("  \u26A0 Could not start the local callback listener (ports 1455 and 1457 in use).\n") + color.dim("  After signing in, copy the full redirect URL from your browser\n") + color.dim("  (it starts with http://localhost:1455/auth/callback or :1457) and paste it below.\n")
+    );
+  }
+  let code;
+  try {
+    if (server.bound) {
+      const callback = await server.waitForCode();
+      if (ac.signal.aborted) {
+        deps.renderer.write(color.dim("  Cancelled.\n"));
+        return 1;
+      }
+      if (callback) code = callback.code;
+    }
+    if (!code) {
+      const input = (await deps.reader.readLine(
+        `
+  ${color.amber("?")} Paste the redirect URL or code ${color.dim("(or q to cancel)")}: `
+      )).trim();
+      if (input.toLowerCase() === "q" || input === "") {
+        deps.renderer.write(color.dim("  Cancelled.\n"));
+        return 1;
+      }
+      const parsed = parseAuthorizationInput(input);
+      if (parsed.state && parsed.state !== state) {
+        deps.renderer.writeError("  State mismatch \u2014 please restart the login flow.");
+        return 1;
+      }
+      code = parsed.code;
+    }
+    if (!code) {
+      deps.renderer.writeError("  No authorization code received.");
+      return 1;
+    }
+    deps.renderer.write(color.dim("\n  Exchanging authorization code for tokens...\n"));
+    const tokens = await exchangeAuthorizationCode(code, pkce.verifier, ac.signal, server.port);
+    const accountId = extractAccountId(tokens.access) ?? (tokens.idToken ? extractAccountId(tokens.idToken) : null);
+    if (!accountId) {
+      deps.renderer.writeError(
+        "  Signed in, but the token has no ChatGPT account id.\n  This account may not have Codex/ChatGPT subscription access."
+      );
+      return 1;
+    }
+    deps.renderer.write(color.dim("  Fetching available models...\n"));
+    const models = await resolveCodexModels(
+      deps.modelsRegistry,
+      tokens.access,
+      CODEX_BASE_URL,
+      ac.signal
+    );
+    const saved = await saveCodexTokens(deps, providerId, tokens, accountId, models);
+    if (!saved) return 1;
+    const modelHint = models[0] ?? "gpt-5.5";
+    deps.renderer.write(color.green("\n  \u2713 Signed in with ChatGPT!\n"));
+    deps.renderer.writeInfo(
+      `  Saved as provider ${color.bold(providerId)}${models.length > 0 ? ` (${models.length} models)` : ""}.
+  Use: ${color.bold(`wstack --provider ${providerId} --model ${modelHint}`)} "<task>"
+` + color.dim("  Tokens refresh automatically before they expire.\n")
+    );
+    return 0;
+  } catch (err) {
+    const msg = err instanceof DOMException && err.name === "AbortError" ? "Login cancelled." : err.message;
+    deps.renderer.writeError(`  Login failed: ${msg}`);
+    return 1;
+  } finally {
+    server.close();
+    if (external) external.removeEventListener("abort", onExternalAbort);
+    else process.off("SIGINT", onSig);
+  }
+}
+async function saveCodexTokens(deps, providerId, tokens, accountId, models) {
+  const entry = {
+    label: "oauth-default",
+    apiKey: tokens.access,
+    createdAt: nowIso(),
+    authMethod: "oauth",
+    expiresAt: new Date(tokens.expires).toISOString(),
+    refreshToken: tokens.refresh,
+    tokenType: "bearer",
+    scope: CODEX_SCOPE,
+    accountId
+  };
+  try {
+    await mutateConfigProviders(deps.profileConfigPath, deps.vault, (all) => {
+      const existing = all[providerId];
+      const p = existing ? { ...existing } : { type: providerId };
+      p.family = "openai-codex";
+      if (!p.baseUrl) p.baseUrl = CODEX_BASE_URL;
+      p.models = [...models];
+      const keys = normalizeKeys(p).filter((k) => k.label !== entry.label);
+      keys.push(entry);
+      writeKeysBack(p, keys);
+      p.activeKey = entry.label;
+      all[providerId] = p;
+    }, deps.profileConfigPath);
+    return true;
+  } catch (err) {
+    deps.renderer.writeError(`  Failed to save tokens: ${err.message}`);
+    return false;
+  }
+}
+
+export {
+  openBrowser,
+  startLoopbackServer,
+  runCodexOAuthLogin,
+  fallbackCodexProviderModels,
+  filterCurrentCodexModelIds,
+  isCodexCatalogModel
+};
+//# sourceMappingURL=chunk-PYTFS4MC.js.map

package/dist/{chunk-DPJZQCVP.js → chunk-YMXXOOFN.js}

@@ -10,4 +10,4 @@ function activeProfileConfigPath(paths, config) {
 export {
   activeProfileConfigPath
 };
-//# sourceMappingURL=chunk-DPJZQCVP.js.map
+//# sourceMappingURL=chunk-YMXXOOFN.js.map

package/dist/{chunk-4U3DMA2Y.js → chunk-ZECLGUTF.js}

@@ -1,13 +1,13 @@
 import {
   PLUGIN_AUDIT_ENTRIES
-} from "./chunk-PEKUKUCH.js";
+} from "./chunk-GUHQQG63.js";
 import {
   patchConfig
 } from "./chunk-TYO2OVAD.js";
 
 // src/wiring/plugins.ts
 import { join } from "node:path";
-import { loadPlugins, resolvePluginConfig } from "@wrongstack/core/plugin";
+import { loadPlugins, resolvePluginConfig, resolvePluginEnablement } from "@wrongstack/core/plugin";
 import { OFFICIAL_PLUGIN_FACTORIES } from "@wrongstack/plugins/factories";
 
 // src/plugin-api-factory.ts
@@ -67,6 +67,10 @@ var BUILTIN_PLUGIN_FACTORIES = [
     const { createSyncPlugin } = await import("@wrongstack/core/plugin");
     return createSyncPlugin();
   },
+  async () => {
+    const { createCloudConfigSyncPlugin } = await import("@wrongstack/core/plugin");
+    return createCloudConfigSyncPlugin();
+  },
   async () => {
     const { createChimeraPlugin } = await import("@wrongstack/core/plugin");
     return createChimeraPlugin();
@@ -112,30 +116,25 @@ async function setupPlugins(params) {
     hookRegistry
   } = params;
   const builtinPlugins = [];
-  const disabledBuiltins = new Set(
-    (config.plugins ?? []).filter(
-      (p) => typeof p === "object" && p.enabled === false
-    ).flatMap((p) => {
-      const builtinName = builtinPluginNameFromSpec(p.name);
-      return builtinName && builtinName !== p.name ? [p.name, builtinName] : [p.name];
-    })
-  );
   if (paths && config.features?.plugins !== false) {
     for (const factory of BUILTIN_PLUGIN_FACTORIES) {
       try {
         const plugin = await factory();
         if (!plugin) continue;
         const auditEntry = PLUGIN_AUDIT_ENTRIES.find((entry) => entry.name === plugin.name);
-        const explicitlyEnabled = (config.plugins ?? []).some((entry) => {
-          const spec = typeof entry === "string" ? entry : entry.name;
-          if (typeof entry === "object" && entry.enabled === false) return false;
-          return (builtinPluginNameFromSpec(spec) ?? spec) === plugin.name;
+        const { enabled, source } = resolvePluginEnablement({
+          name: plugin.name,
+          aliases: plugin.configAliases,
+          // Built-ins outside the audit catalog (prompts, sync, skills, …)
+          // are infrastructure — they run unless explicitly turned off.
+          defaultState: auditEntry?.defaultState ?? "active",
+          config,
+          matches: (spec) => (builtinPluginNameFromSpec(spec) ?? spec) === plugin.name
         });
-        if (auditEntry?.defaultState === "inactive" && !explicitlyEnabled) {
-          continue;
-        }
-        if (disabledBuiltins.has(plugin.name)) {
-          log.info(`[setupPlugins] built-in plugin "${plugin.name}" disabled by config`);
+        if (!enabled) {
+          if (source !== "default") {
+            log.info(`[setupPlugins] built-in plugin "${plugin.name}" disabled by ${source}`);
+          }
           continue;
         }
         if (warnIfDeprecatedPluginName(plugin.name, log)) continue;
@@ -148,8 +147,16 @@ async function setupPlugins(params) {
   const userPlugins = [];
   if (config.features?.plugins !== false) {
     for (const p of config.plugins ?? []) {
-      if (typeof p === "object" && p.enabled === false) continue;
       const spec = typeof p === "string" ? p : p.name;
+      const { enabled } = resolvePluginEnablement({
+        name: pluginNameFromSpec(spec) ?? spec,
+        aliases: [spec],
+        defaultState: "active",
+        config,
+        // The resolver already extracts an entry's name before calling this.
+        matches: (configuredName) => configuredName === spec
+      });
+      if (!enabled) continue;
       const bareName = pluginNameFromSpec(spec);
       if (bareName && warnIfDeprecatedPluginName(bareName, log)) {
         continue;
@@ -255,4 +262,4 @@ export {
   BUILTIN_PLUGIN_FACTORIES,
   setupPlugins
 };
-//# sourceMappingURL=chunk-4U3DMA2Y.js.map
+//# sourceMappingURL=chunk-ZECLGUTF.js.map