@xortex/xcode 3.0.0

package/constants/figures.ts

@@ -0,0 +1,45 @@
+import { env } from '../utils/env.js'
+
+// The former is better vertically aligned, but isn't usually supported on Windows/Linux
+export const BLACK_CIRCLE = env.platform === 'darwin' ? '⏺' : '●'
+export const BULLET_OPERATOR = '∙'
+export const TEARDROP_ASTERISK = '✻'
+export const UP_ARROW = '\u2191' // ↑ - used for opus 1m merge notice
+export const DOWN_ARROW = '\u2193' // ↓ - used for scroll hint
+export const LIGHTNING_BOLT = '↯' // \u21af - used for fast mode indicator
+export const EFFORT_LOW = '○' // \u25cb - effort level: low
+export const EFFORT_MEDIUM = '◐' // \u25d0 - effort level: medium
+export const EFFORT_HIGH = '●' // \u25cf - effort level: high
+export const EFFORT_MAX = '◉' // \u25c9 - effort level: max (Opus 4.6 only)
+
+// Media/trigger status indicators
+export const PLAY_ICON = '\u25b6' // ▶
+export const PAUSE_ICON = '\u23f8' // ⏸
+
+// MCP subscription indicators
+export const REFRESH_ARROW = '\u21bb' // ↻ - used for resource update indicator
+export const CHANNEL_ARROW = '\u2190' // ← - inbound channel message indicator
+export const INJECTED_ARROW = '\u2192' // → - cross-session injected message indicator
+export const FORK_GLYPH = '\u2442' // ⑂ - fork directive indicator
+
+// Review status indicators (ultrareview diamond states)
+export const DIAMOND_OPEN = '\u25c7' // ◇ - running
+export const DIAMOND_FILLED = '\u25c6' // ◆ - completed/failed
+export const REFERENCE_MARK = '\u203b' // ※ - komejirushi, away-summary recap marker
+
+// Issue flag indicator
+export const FLAG_ICON = '\u2691' // ⚑ - used for issue flag banner
+
+// Blockquote indicator
+export const BLOCKQUOTE_BAR = '\u258e' // ▎ - left one-quarter block, used as blockquote line prefix
+export const HEAVY_HORIZONTAL = '\u2501' // ━ - heavy box-drawing horizontal
+
+// Bridge status indicators
+export const BRIDGE_SPINNER_FRAMES = [
+  '\u00b7|\u00b7',
+  '\u00b7/\u00b7',
+  '\u00b7\u2014\u00b7',
+  '\u00b7\\\u00b7',
+]
+export const BRIDGE_READY_INDICATOR = '\u00b7\u2714\ufe0e\u00b7'
+export const BRIDGE_FAILED_INDICATOR = '\u00d7'

package/constants/files.ts

@@ -0,0 +1,156 @@
+/**
+ * Binary file extensions to skip for text-based operations.
+ * These files can't be meaningfully compared as text and are often large.
+ */
+export const BINARY_EXTENSIONS = new Set([
+  // Images
+  '.png',
+  '.jpg',
+  '.jpeg',
+  '.gif',
+  '.bmp',
+  '.ico',
+  '.webp',
+  '.tiff',
+  '.tif',
+  // Videos
+  '.mp4',
+  '.mov',
+  '.avi',
+  '.mkv',
+  '.webm',
+  '.wmv',
+  '.flv',
+  '.m4v',
+  '.mpeg',
+  '.mpg',
+  // Audio
+  '.mp3',
+  '.wav',
+  '.ogg',
+  '.flac',
+  '.aac',
+  '.m4a',
+  '.wma',
+  '.aiff',
+  '.opus',
+  // Archives
+  '.zip',
+  '.tar',
+  '.gz',
+  '.bz2',
+  '.7z',
+  '.rar',
+  '.xz',
+  '.z',
+  '.tgz',
+  '.iso',
+  // Executables/binaries
+  '.exe',
+  '.dll',
+  '.so',
+  '.dylib',
+  '.bin',
+  '.o',
+  '.a',
+  '.obj',
+  '.lib',
+  '.app',
+  '.msi',
+  '.deb',
+  '.rpm',
+  // Documents (PDF is here; FileReadTool excludes it at the call site)
+  '.pdf',
+  '.doc',
+  '.docx',
+  '.xls',
+  '.xlsx',
+  '.ppt',
+  '.pptx',
+  '.odt',
+  '.ods',
+  '.odp',
+  // Fonts
+  '.ttf',
+  '.otf',
+  '.woff',
+  '.woff2',
+  '.eot',
+  // Bytecode / VM artifacts
+  '.pyc',
+  '.pyo',
+  '.class',
+  '.jar',
+  '.war',
+  '.ear',
+  '.node',
+  '.wasm',
+  '.rlib',
+  // Database files
+  '.sqlite',
+  '.sqlite3',
+  '.db',
+  '.mdb',
+  '.idx',
+  // Design / 3D
+  '.psd',
+  '.ai',
+  '.eps',
+  '.sketch',
+  '.fig',
+  '.xd',
+  '.blend',
+  '.3ds',
+  '.max',
+  // Flash
+  '.swf',
+  '.fla',
+  // Lock/profiling data
+  '.lockb',
+  '.dat',
+  '.data',
+])
+
+/**
+ * Check if a file path has a binary extension.
+ */
+export function hasBinaryExtension(filePath: string): boolean {
+  const ext = filePath.slice(filePath.lastIndexOf('.')).toLowerCase()
+  return BINARY_EXTENSIONS.has(ext)
+}
+
+/**
+ * Number of bytes to read for binary content detection.
+ */
+const BINARY_CHECK_SIZE = 8192
+
+/**
+ * Check if a buffer contains binary content by looking for null bytes
+ * or a high proportion of non-printable characters.
+ */
+export function isBinaryContent(buffer: Buffer): boolean {
+  // Check first BINARY_CHECK_SIZE bytes (or full buffer if smaller)
+  const checkSize = Math.min(buffer.length, BINARY_CHECK_SIZE)
+
+  let nonPrintable = 0
+  for (let i = 0; i < checkSize; i++) {
+    const byte = buffer[i]!
+    // Null byte is a strong indicator of binary
+    if (byte === 0) {
+      return true
+    }
+    // Count non-printable, non-whitespace bytes
+    // Printable ASCII is 32-126, plus common whitespace (9, 10, 13)
+    if (
+      byte < 32 &&
+      byte !== 9 && // tab
+      byte !== 10 && // newline
+      byte !== 13 // carriage return
+    ) {
+      nonPrintable++
+    }
+  }
+
+  // If more than 10% non-printable, likely binary
+  return nonPrintable / checkSize > 0.1
+}

package/constants/github-app.ts

@@ -0,0 +1,144 @@
+export const PR_TITLE = 'Add Claude Code GitHub Workflow'
+
+export const GITHUB_ACTION_SETUP_DOCS_URL =
+  'https://github.com/anthropics/claude-code-action/blob/main/docs/setup.md'
+
+export const WORKFLOW_CONTENT = `name: Claude Code
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+  issues:
+    types: [opened, assigned]
+  pull_request_review:
+    types: [submitted]
+
+jobs:
+  claude:
+    if: |
+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
+      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+      issues: read
+      id-token: write
+      actions: read # Required for Claude to read CI results on PRs
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Run Claude Code
+        id: claude
+        uses: anthropics/claude-code-action@v1
+        with:
+          anthropic_api_key: \${{ secrets.ANTHROPIC_API_KEY }}
+
+          # This is an optional setting that allows Claude to read CI results on PRs
+          additional_permissions: |
+            actions: read
+
+          # Optional: Give a custom prompt to Claude. If this is not specified, Claude will perform the instructions specified in the comment that tagged it.
+          # prompt: 'Update the pull request description to include a summary of changes.'
+
+          # Optional: Add claude_args to customize behavior and configuration
+          # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
+          # or https://code.claude.com/docs/en/cli-reference for available options
+          # claude_args: '--allowed-tools Bash(gh pr:*)'
+
+`
+
+export const PR_BODY = `## 🤖 Installing Claude Code GitHub App
+
+This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.
+
+### What is Claude Code?
+
+[Claude Code](https://claude.com/claude-code) is an AI coding agent that can help with:
+- Bug fixes and improvements  
+- Documentation updates
+- Implementing new features
+- Code reviews and suggestions
+- Writing tests
+- And more!
+
+### How it works
+
+Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
+Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.
+
+### Important Notes
+
+- **This workflow won't take effect until this PR is merged**
+- **@claude mentions won't work until after the merge is complete**
+- The workflow runs automatically whenever Claude is mentioned in PR or issue comments
+- Claude gets access to the entire PR or issue context including files, diffs, and previous comments
+
+### Security
+
+- Our Anthropic API key is securely stored as a GitHub Actions secret
+- Only users with write access to the repository can trigger the workflow
+- All Claude runs are stored in the GitHub Actions run history
+- Claude's default tools are limited to reading/writing files and interacting with our repo by creating comments, branches, and commits.
+- We can add more allowed tools by adding them to the workflow file like:
+
+\`\`\`
+allowed_tools: Bash(npm install),Bash(npm run build),Bash(npm run lint),Bash(npm run test)
+\`\`\`
+
+There's more information in the [Claude Code action repo](https://github.com/anthropics/claude-code-action).
+
+After merging this PR, let's try mentioning @claude in a comment on any PR to get started!`
+
+export const CODE_REVIEW_PLUGIN_WORKFLOW_CONTENT = `name: Claude Code Review
+
+on:
+  pull_request:
+    types: [opened, synchronize, ready_for_review, reopened]
+    # Optional: Only run on specific file changes
+    # paths:
+    #   - "src/**/*.ts"
+    #   - "src/**/*.tsx"
+    #   - "src/**/*.js"
+    #   - "src/**/*.jsx"
+
+jobs:
+  claude-review:
+    # Optional: Filter by PR author
+    # if: |
+    #   github.event.pull_request.user.login == 'external-contributor' ||
+    #   github.event.pull_request.user.login == 'new-developer' ||
+    #   github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR'
+
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+      issues: read
+      id-token: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Run Claude Code Review
+        id: claude-review
+        uses: anthropics/claude-code-action@v1
+        with:
+          anthropic_api_key: \${{ secrets.ANTHROPIC_API_KEY }}
+          plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
+          plugins: 'code-review@claude-code-plugins'
+          prompt: '/code-review:code-review \${{ github.repository }}/pull/\${{ github.event.pull_request.number }}'
+          # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
+          # or https://code.claude.com/docs/en/cli-reference for available options
+
+`

package/constants/keys.ts

@@ -0,0 +1,11 @@
+import { isEnvTruthy } from '../utils/envUtils.js'
+
+// Lazy read so ENABLE_GROWTHBOOK_DEV from globalSettings.env (applied after
+// module load) is picked up. USER_TYPE is a build-time define so it's safe.
+export function getGrowthBookClientKey(): string {
+  return process.env.USER_TYPE === 'ant'
+    ? isEnvTruthy(process.env.ENABLE_GROWTHBOOK_DEV)
+      ? 'sdk-yZQvlplybuXjYh6L'
+      : 'sdk-xRVcrliHIlrg4og4'
+    : 'sdk-zAZezfDKGoZuXXKe'
+}

package/constants/messages.ts

@@ -0,0 +1 @@
+export const NO_CONTENT_MESSAGE = '(no content)'

package/constants/oauth.ts

@@ -0,0 +1,234 @@
+import { isEnvTruthy } from 'src/utils/envUtils.js'
+
+// Default to prod config, override with test/staging if enabled
+type OauthConfigType = 'prod' | 'staging' | 'local'
+
+function getOauthConfigType(): OauthConfigType {
+  if (process.env.USER_TYPE === 'ant') {
+    if (isEnvTruthy(process.env.USE_LOCAL_OAUTH)) {
+      return 'local'
+    }
+    if (isEnvTruthy(process.env.USE_STAGING_OAUTH)) {
+      return 'staging'
+    }
+  }
+  return 'prod'
+}
+
+export function fileSuffixForOauthConfig(): string {
+  if (process.env.CLAUDE_CODE_CUSTOM_OAUTH_URL) {
+    return '-custom-oauth'
+  }
+  switch (getOauthConfigType()) {
+    case 'local':
+      return '-local-oauth'
+    case 'staging':
+      return '-staging-oauth'
+    case 'prod':
+      // No suffix for production config
+      return ''
+  }
+}
+
+export const CLAUDE_AI_INFERENCE_SCOPE = 'user:inference' as const
+export const CLAUDE_AI_PROFILE_SCOPE = 'user:profile' as const
+const CONSOLE_SCOPE = 'org:create_api_key' as const
+export const OAUTH_BETA_HEADER = 'oauth-2025-04-20' as const
+
+// Console OAuth scopes - for API key creation via Console
+export const CONSOLE_OAUTH_SCOPES = [
+  CONSOLE_SCOPE,
+  CLAUDE_AI_PROFILE_SCOPE,
+] as const
+
+// Claude.ai OAuth scopes - for Claude.ai subscribers (Pro/Max/Team/Enterprise)
+export const CLAUDE_AI_OAUTH_SCOPES = [
+  CLAUDE_AI_PROFILE_SCOPE,
+  CLAUDE_AI_INFERENCE_SCOPE,
+  'user:sessions:claude_code',
+  'user:mcp_servers',
+  'user:file_upload',
+] as const
+
+// All OAuth scopes - union of all scopes used in Claude CLI
+// When logging in, request all scopes in order to handle both Console -> Claude.ai redirect
+// Ensure that `OAuthConsentPage` in apps repo is kept in sync with this list.
+export const ALL_OAUTH_SCOPES = Array.from(
+  new Set([...CONSOLE_OAUTH_SCOPES, ...CLAUDE_AI_OAUTH_SCOPES]),
+)
+
+type OauthConfig = {
+  BASE_API_URL: string
+  CONSOLE_AUTHORIZE_URL: string
+  CLAUDE_AI_AUTHORIZE_URL: string
+  /**
+   * The claude.ai web origin. Separate from CLAUDE_AI_AUTHORIZE_URL because
+   * that now routes through claude.com/cai/* for attribution — deriving
+   * .origin from it would give claude.com, breaking links to /code,
+   * /settings/connectors, and other claude.ai web pages.
+   */
+  CLAUDE_AI_ORIGIN: string
+  TOKEN_URL: string
+  API_KEY_URL: string
+  ROLES_URL: string
+  CONSOLE_SUCCESS_URL: string
+  CLAUDEAI_SUCCESS_URL: string
+  MANUAL_REDIRECT_URL: string
+  CLIENT_ID: string
+  OAUTH_FILE_SUFFIX: string
+  MCP_PROXY_URL: string
+  MCP_PROXY_PATH: string
+}
+
+// Production OAuth configuration - Used in normal operation
+const PROD_OAUTH_CONFIG = {
+  BASE_API_URL: 'https://api.anthropic.com',
+  CONSOLE_AUTHORIZE_URL: 'https://platform.claude.com/oauth/authorize',
+  // Bounces through claude.com/cai/* so CLI sign-ins connect to claude.com
+  // visits for attribution. 307s to claude.ai/oauth/authorize in two hops.
+  CLAUDE_AI_AUTHORIZE_URL: 'https://claude.com/cai/oauth/authorize',
+  CLAUDE_AI_ORIGIN: 'https://claude.ai',
+  TOKEN_URL: 'https://platform.claude.com/v1/oauth/token',
+  API_KEY_URL: 'https://api.anthropic.com/api/oauth/claude_cli/create_api_key',
+  ROLES_URL: 'https://api.anthropic.com/api/oauth/claude_cli/roles',
+  CONSOLE_SUCCESS_URL:
+    'https://platform.claude.com/buy_credits?returnUrl=/oauth/code/success%3Fapp%3Dclaude-code',
+  CLAUDEAI_SUCCESS_URL:
+    'https://platform.claude.com/oauth/code/success?app=claude-code',
+  MANUAL_REDIRECT_URL: 'https://platform.claude.com/oauth/code/callback',
+  CLIENT_ID: '9d1c250a-e61b-44d9-88ed-5944d1962f5e',
+  // No suffix for production config
+  OAUTH_FILE_SUFFIX: '',
+  MCP_PROXY_URL: 'https://mcp-proxy.anthropic.com',
+  MCP_PROXY_PATH: '/v1/mcp/{server_id}',
+} as const
+
+/**
+ * Client ID Metadata Document URL for MCP OAuth (CIMD / SEP-991).
+ * When an MCP auth server advertises client_id_metadata_document_supported: true,
+ * Claude Code uses this URL as its client_id instead of Dynamic Client Registration.
+ * The URL must point to a JSON document hosted by Anthropic.
+ * See: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-client-id-metadata-document-00
+ */
+export const MCP_CLIENT_METADATA_URL =
+  'https://claude.ai/oauth/claude-code-client-metadata'
+
+// Staging OAuth configuration - only included in ant builds with staging flag
+// Uses literal check for dead code elimination
+const STAGING_OAUTH_CONFIG =
+  process.env.USER_TYPE === 'ant'
+    ? ({
+        BASE_API_URL: 'https://api-staging.anthropic.com',
+        CONSOLE_AUTHORIZE_URL:
+          'https://platform.staging.ant.dev/oauth/authorize',
+        CLAUDE_AI_AUTHORIZE_URL:
+          'https://claude-ai.staging.ant.dev/oauth/authorize',
+        CLAUDE_AI_ORIGIN: 'https://claude-ai.staging.ant.dev',
+        TOKEN_URL: 'https://platform.staging.ant.dev/v1/oauth/token',
+        API_KEY_URL:
+          'https://api-staging.anthropic.com/api/oauth/claude_cli/create_api_key',
+        ROLES_URL:
+          'https://api-staging.anthropic.com/api/oauth/claude_cli/roles',
+        CONSOLE_SUCCESS_URL:
+          'https://platform.staging.ant.dev/buy_credits?returnUrl=/oauth/code/success%3Fapp%3Dclaude-code',
+        CLAUDEAI_SUCCESS_URL:
+          'https://platform.staging.ant.dev/oauth/code/success?app=claude-code',
+        MANUAL_REDIRECT_URL:
+          'https://platform.staging.ant.dev/oauth/code/callback',
+        CLIENT_ID: '22422756-60c9-4084-8eb7-27705fd5cf9a',
+        OAUTH_FILE_SUFFIX: '-staging-oauth',
+        MCP_PROXY_URL: 'https://mcp-proxy-staging.anthropic.com',
+        MCP_PROXY_PATH: '/v1/mcp/{server_id}',
+      } as const)
+    : undefined
+
+// Three local dev servers: :8000 api-proxy (`api dev start -g ccr`),
+// :4000 claude-ai frontend, :3000 Console frontend. Env vars let
+// scripts/claude-localhost override if your layout differs.
+function getLocalOauthConfig(): OauthConfig {
+  const api =
+    process.env.CLAUDE_LOCAL_OAUTH_API_BASE?.replace(/\/$/, '') ??
+    'http://localhost:8000'
+  const apps =
+    process.env.CLAUDE_LOCAL_OAUTH_APPS_BASE?.replace(/\/$/, '') ??
+    'http://localhost:4000'
+  const consoleBase =
+    process.env.CLAUDE_LOCAL_OAUTH_CONSOLE_BASE?.replace(/\/$/, '') ??
+    'http://localhost:3000'
+  return {
+    BASE_API_URL: api,
+    CONSOLE_AUTHORIZE_URL: `${consoleBase}/oauth/authorize`,
+    CLAUDE_AI_AUTHORIZE_URL: `${apps}/oauth/authorize`,
+    CLAUDE_AI_ORIGIN: apps,
+    TOKEN_URL: `${api}/v1/oauth/token`,
+    API_KEY_URL: `${api}/api/oauth/claude_cli/create_api_key`,
+    ROLES_URL: `${api}/api/oauth/claude_cli/roles`,
+    CONSOLE_SUCCESS_URL: `${consoleBase}/buy_credits?returnUrl=/oauth/code/success%3Fapp%3Dclaude-code`,
+    CLAUDEAI_SUCCESS_URL: `${consoleBase}/oauth/code/success?app=claude-code`,
+    MANUAL_REDIRECT_URL: `${consoleBase}/oauth/code/callback`,
+    CLIENT_ID: '22422756-60c9-4084-8eb7-27705fd5cf9a',
+    OAUTH_FILE_SUFFIX: '-local-oauth',
+    MCP_PROXY_URL: 'http://localhost:8205',
+    MCP_PROXY_PATH: '/v1/toolbox/shttp/mcp/{server_id}',
+  }
+}
+
+// Allowed base URLs for CLAUDE_CODE_CUSTOM_OAUTH_URL override.
+// Only FedStart/PubSec deployments are permitted to prevent OAuth tokens
+// from being sent to arbitrary endpoints.
+const ALLOWED_OAUTH_BASE_URLS = [
+  'https://beacon.claude-ai.staging.ant.dev',
+  'https://claude.fedstart.com',
+  'https://claude-staging.fedstart.com',
+]
+
+// Default to prod config, override with test/staging if enabled
+export function getOauthConfig(): OauthConfig {
+  let config: OauthConfig = (() => {
+    switch (getOauthConfigType()) {
+      case 'local':
+        return getLocalOauthConfig()
+      case 'staging':
+        return STAGING_OAUTH_CONFIG ?? PROD_OAUTH_CONFIG
+      case 'prod':
+        return PROD_OAUTH_CONFIG
+    }
+  })()
+
+  // Allow overriding all OAuth URLs to point to an approved FedStart deployment.
+  // Only allowlisted base URLs are accepted to prevent credential leakage.
+  const oauthBaseUrl = process.env.CLAUDE_CODE_CUSTOM_OAUTH_URL
+  if (oauthBaseUrl) {
+    const base = oauthBaseUrl.replace(/\/$/, '')
+    if (!ALLOWED_OAUTH_BASE_URLS.includes(base)) {
+      throw new Error(
+        'CLAUDE_CODE_CUSTOM_OAUTH_URL is not an approved endpoint.',
+      )
+    }
+    config = {
+      ...config,
+      BASE_API_URL: base,
+      CONSOLE_AUTHORIZE_URL: `${base}/oauth/authorize`,
+      CLAUDE_AI_AUTHORIZE_URL: `${base}/oauth/authorize`,
+      CLAUDE_AI_ORIGIN: base,
+      TOKEN_URL: `${base}/v1/oauth/token`,
+      API_KEY_URL: `${base}/api/oauth/claude_cli/create_api_key`,
+      ROLES_URL: `${base}/api/oauth/claude_cli/roles`,
+      CONSOLE_SUCCESS_URL: `${base}/oauth/code/success?app=claude-code`,
+      CLAUDEAI_SUCCESS_URL: `${base}/oauth/code/success?app=claude-code`,
+      MANUAL_REDIRECT_URL: `${base}/oauth/code/callback`,
+      OAUTH_FILE_SUFFIX: '-custom-oauth',
+    }
+  }
+
+  // Allow CLIENT_ID override via environment variable (e.g., for Xcode integration)
+  const clientIdOverride = process.env.CLAUDE_CODE_OAUTH_CLIENT_ID
+  if (clientIdOverride) {
+    config = {
+      ...config,
+      CLIENT_ID: clientIdOverride,
+    }
+  }
+
+  return config
+}