@yagni-app/code 0.2.1 → 0.3.1

package/dist/token.js

@@ -0,0 +1,45 @@
+/**
+ * `yagni token` — print the active environment's API token to stdout.
+ *
+ * This is the credential feed for `yagni connect claude-code`: Claude Code's
+ * `apiKeyHelper` runs this command (re-running on 401 and on a TTL), so the
+ * contract is strict — stdout carries the TOKEN AND NOTHING ELSE (Claude Code
+ * v2.1.227+ rejects helpers that print banners), and every notice goes to
+ * stderr. Riding the same refresh-at-launch client as the launcher means a
+ * token that enters the 7-day rotation window is rotated and persisted here
+ * too, so a Claude Code session keeps working without the user ever running
+ * `yagni` itself.
+ */
+import { classifyTokenExpiry } from "./launch.js";
+import { maybeRefreshAtLaunch } from "./refresh.js";
+import { credentialsFromProfile, persistProfileTokenRotation, readActiveProfile, } from "./profiles.js";
+export async function tokenCommand(deps = {}) {
+    const readProfile = deps.readProfile ?? readActiveProfile;
+    const refresh = deps.refresh ?? maybeRefreshAtLaunch;
+    const persist = deps.persist ?? persistProfileTokenRotation;
+    const stdout = deps.stdout ?? ((t) => process.stdout.write(t));
+    const stderr = deps.stderr ?? ((t) => process.stderr.write(t));
+    const profile = await readProfile();
+    let creds = credentialsFromProfile(profile);
+    if (!creds?.token) {
+        stderr(`Not logged in to environment "${profile.name}" (${profile.baseUrl}). Run \`yagni login\` first.\n`);
+        return 1;
+    }
+    const outcome = await refresh(creds, {
+        persist: (c) => persist(profile.name, c),
+        ...(deps.now ? { now: deps.now } : {}),
+    });
+    for (const warning of outcome.warnings)
+        stderr(`${warning}\n`);
+    creds = outcome.creds;
+    // An expired token would send the consumer into a silent 401 loop — fail
+    // loudly instead so Claude Code surfaces a helper error the user can act on.
+    const nowMs = deps.now ? deps.now() : Date.now();
+    if (classifyTokenExpiry(creds.expiresAt, nowMs).kind === "expired") {
+        stderr("Your YAGNI Code session has expired. Run `yagni login` to re-authenticate.\n");
+        return 1;
+    }
+    stdout(`${creds.token}\n`);
+    return 0;
+}
+//# sourceMappingURL=token.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code",
-  "version": "0.2.1",
+  "version": "0.3.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -34,9 +34,10 @@
   "main": "./dist/cli.js",
   "types": "./dist/cli.d.ts",
   "dependencies": {
-    "@earendil-works/pi-coding-agent": "0.83.0",
-    "@earendil-works/pi-tui": "0.83.0",
-    "typebox": "^1.1.38"
+    "@earendil-works/pi-coding-agent": "0.84.1",
+    "@earendil-works/pi-tui": "0.84.1",
+    "smol-toml": "^1.8.0",
+    "typebox": "^1.3.11"
   },
-  "yagniSourceSha": "33b62c8a01064f7681085e441aa00b02693b13c7"
+  "yagniSourceSha": "27482c0e8f72e0f171de23bd39e774d9661c0bc6"
 }

package/dist/extension/boostCommand.d.ts

@@ -1,144 +0,0 @@
-/**
- * `/boost` — the sanctioned session-scoped escalation to Peak (spec §7).
- *
- * The session default is the `balanced` tier. `/boost` flips the
- * DRIVER session's live model to `peak` until `/boost off` or the process
- * exits; `peak` stays directly pickable through pi's own model picker too,
- * this just adds a one-word lever plus an attribution flag.
- *
- * Two halves, same split as `advisor.ts` / `permission.ts`:
- *
- *   - `boostOn` / `boostOff` are PURE. They own every transition and the exact
- *     notice copy; no pi, no I/O, no env. That is what needs exhaustive tests.
- *   - `registerBoostCommand` is the wiring: it applies the pure result's
- *     `targetModelId` through pi's real model-switch API, toggles
- *     `process.env.YAGNI_BOOST`, and paints the notice + a status-bar chip.
- *
- * The model-switch API (verified against pi 0.83.0's typings, not guessed):
- * `ctx.modelRegistry.find(provider, modelId)` resolves a tier id to a
- * `Model`, and `pi.setModel(model)` (the top-level `ExtensionAPI` method, NOT
- * `ctx.setModel` — `ExtensionCommandContext` does not expose a setter) applies
- * it to the live session, resolving `false` when no API key is configured.
- * The `yagni` provider's catalog entries key `id` on the tier id itself (see
- * `provider.ts`), so `peak` is the pi model id for the peak tier.
- *
- * State lives in the registration closure — module/session-scoped, mirroring
- * `costHud.ts`'s accumulator — because a session's process exit is the only
- * "end" there is; nothing needs to persist across it. `registerBoostCommand`
- * returns a small `{ isBoosted() }` handle onto that same closure so other
- * registrations (currently just `/cost`, see below) can read the live flag
- * without a second source of truth.
- *
- * Picker-drift guard (spec review item 3): pi's OWN model picker (Ctrl+P,
- * `/model`) can change the live model independently of `/boost` in either
- * direction, so `state.active` can go stale relative to `ctx.model.id`. Both
- * halves read the live model and reconcile rather than trusting `state.active`
- * blindly:
- *
- *   - `boostOn` while already active but the live model has drifted OFF peak
- *     (the user cycled models mid-boost without `/boost off`): re-applies
- *     peak instead of a silent "Already boosted." that would leave the
- *     driver quietly running a cheaper tier under an attribution header that
- *     claims otherwise. The remembered `priorModelId` is left untouched — the
- *     tier to restore is still whatever was active before the ORIGINAL boost,
- *     not the tier the user happened to drift to.
- *   - `boostOff` while active but the live model is no longer peak (same
- *     drift, encountered from the other command): the user already left
- *     boost manually, so forcing a switch back to the remembered prior tier
- *     would clobber a choice they just made on purpose. Instead this clears
- *     `/boost`'s own bookkeeping (state, env, chip) without touching the
- *     model, and names where they actually landed.
- *
- * KNOWN asymmetry, documented rather than worked around: `YAGNI_BOOST=1`
- * while boosted makes every CHILD process spawned during the boost (a /go
- * run, a subagent, an advisor consult) inherit it, and those children's
- * completions carry `x-yagni-boost` because their provider is registered
- * fresh per child. The DRIVER's own completions do not gain that header
- * retroactively — `buildYagniProvider`'s headers are baked into the
- * `registerProvider` call once, at session start, from the env snapshot at
- * that moment (see `provider.ts` / `attributionHeaders`). Re-registering the
- * provider mid-session to pick up a new header is explicitly NOT the fix
- * here: it would race the in-flight request the switch itself triggers and
- * has no test coverage as a live-swap path.
- *
- * This is exactly why `/cost` cannot rely on server rows alone: the server's
- * per-tier "Boosted (tier) spend" subtotal (`formatServerCostLines`, Task 7)
- * only ever sees rows carrying `x-yagni-boost` — i.e. `/go` children, never
- * the driver's own turns. A session that only chats while boosted would
- * otherwise show no boost line at all. `registerCostCommand`'s `isBoosted`
- * dep (threaded from THIS module's return handle, the same way
- * `advisorSubtotal` is threaded from `advisor.ts`) closes that gap: `/cost`
- * appends a fixed "Boost is on. Driver turns bill at the peak tier." line
- * whenever the live toggle is on, on BOTH the server-authoritative and the
- * local-fallback branch, independent of what server rows happen to show.
- */
-import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-/** Session-scoped boost state, held in the registration closure. */
-export interface BoostState {
-    active: boolean;
-    /** The tier to restore on `/boost off`. Set only while `active`. */
-    priorModelId?: string;
-}
-/** The pure outcome of a `/boost` transition. */
-export interface BoostResult {
-    state: BoostState;
-    /** Exact notice text to surface to the user. */
-    notice: string;
-    /** The tier id to switch the session to, or undefined for a pure no-op. */
-    targetModelId?: string;
-}
-/**
- * Turn boost on. PURE.
- *
- * - Already active AND the live model is still `peak`: genuine no-op,
- *   "Already boosted." (no switch — nothing about the prior tier changes).
- * - Already active but the live model has drifted off `peak` (picker-drift
- *   guard 3b, see module docblock): re-applies `peak`, keeping the ORIGINAL
- *   `priorModelId` rather than adopting the drifted-to tier.
- * - Not active, current model IS already `peak`: activates anyway (so
- *   attribution and `/boost off` behave correctly) with a distinct notice,
- *   remembering `peak` itself as the tier to restore.
- * - Not active, otherwise: remembers the current tier, targets `peak`.
- */
-export declare function boostOn(state: BoostState, currentModelId: string | undefined): BoostResult;
-/**
- * Turn boost off. PURE.
- *
- * - Not active: no-op, "Boost is not on."
- * - Active but the live model is no longer `peak` (picker-drift guard 3a,
- *   see module docblock): the user already left boost manually. Clears
- *   `/boost`'s own bookkeeping WITHOUT a switch — forcing one back to the
- *   remembered prior tier would clobber a choice just made on purpose — and
- *   names the model they actually landed on.
- * - Active and still on `peak`: restores the remembered prior tier (falling
- *   back to the session default when none was recorded, which should not
- *   normally happen). When the prior tier is itself `peak` (the
- *   already-on-Peak activation path), the resulting switch is a no-op in
- *   effect — still applied, harmlessly.
- */
-export declare function boostOff(state: BoostState, currentModelId: string | undefined): BoostResult;
-/** Injectable seams for `registerBoostCommand`. */
-export interface RegisterBoostCommandDeps {
-    /** Environment `YAGNI_BOOST` is toggled on. Defaults to `process.env`. */
-    env?: NodeJS.ProcessEnv;
-}
-/** What `registerBoostCommand` hands back so other registrations (`/cost`) can read the live flag. */
-export interface BoostCommandHandle {
-    /** Whether the session is currently boosted, read fresh off the same closure `/boost` mutates. */
-    isBoosted(): boolean;
-}
-/**
- * Register the `/boost` command.
- *
- * `/boost` (no args) turns boost on; `/boost off` turns it off; any other
- * argument shows a usage notice and changes nothing. Every transition that
- * requires a model switch runs it through pi's real API and is guarded end to
- * end: state and `YAGNI_BOOST` are only ever committed together, AFTER the
- * switch succeeds (or is deliberately skipped — the picker-drift guards), so
- * a half-applied boost (env set but model unchanged, or vice versa) can never
- * happen. A failed ON reports "Boost failed."; a failed OFF reports a
- * DISTINCT message, because the failure mode is materially worse — the
- * driver is left still running (and billing) on Peak, not merely unchanged.
- */
-export declare function registerBoostCommand(pi: ExtensionAPI, deps?: RegisterBoostCommandDeps): BoostCommandHandle;
-//# sourceMappingURL=boostCommand.d.ts.map

package/dist/extension/boostCommand.js

@@ -1,263 +0,0 @@
-/**
- * `/boost` — the sanctioned session-scoped escalation to Peak (spec §7).
- *
- * The session default is the `balanced` tier. `/boost` flips the
- * DRIVER session's live model to `peak` until `/boost off` or the process
- * exits; `peak` stays directly pickable through pi's own model picker too,
- * this just adds a one-word lever plus an attribution flag.
- *
- * Two halves, same split as `advisor.ts` / `permission.ts`:
- *
- *   - `boostOn` / `boostOff` are PURE. They own every transition and the exact
- *     notice copy; no pi, no I/O, no env. That is what needs exhaustive tests.
- *   - `registerBoostCommand` is the wiring: it applies the pure result's
- *     `targetModelId` through pi's real model-switch API, toggles
- *     `process.env.YAGNI_BOOST`, and paints the notice + a status-bar chip.
- *
- * The model-switch API (verified against pi 0.83.0's typings, not guessed):
- * `ctx.modelRegistry.find(provider, modelId)` resolves a tier id to a
- * `Model`, and `pi.setModel(model)` (the top-level `ExtensionAPI` method, NOT
- * `ctx.setModel` — `ExtensionCommandContext` does not expose a setter) applies
- * it to the live session, resolving `false` when no API key is configured.
- * The `yagni` provider's catalog entries key `id` on the tier id itself (see
- * `provider.ts`), so `peak` is the pi model id for the peak tier.
- *
- * State lives in the registration closure — module/session-scoped, mirroring
- * `costHud.ts`'s accumulator — because a session's process exit is the only
- * "end" there is; nothing needs to persist across it. `registerBoostCommand`
- * returns a small `{ isBoosted() }` handle onto that same closure so other
- * registrations (currently just `/cost`, see below) can read the live flag
- * without a second source of truth.
- *
- * Picker-drift guard (spec review item 3): pi's OWN model picker (Ctrl+P,
- * `/model`) can change the live model independently of `/boost` in either
- * direction, so `state.active` can go stale relative to `ctx.model.id`. Both
- * halves read the live model and reconcile rather than trusting `state.active`
- * blindly:
- *
- *   - `boostOn` while already active but the live model has drifted OFF peak
- *     (the user cycled models mid-boost without `/boost off`): re-applies
- *     peak instead of a silent "Already boosted." that would leave the
- *     driver quietly running a cheaper tier under an attribution header that
- *     claims otherwise. The remembered `priorModelId` is left untouched — the
- *     tier to restore is still whatever was active before the ORIGINAL boost,
- *     not the tier the user happened to drift to.
- *   - `boostOff` while active but the live model is no longer peak (same
- *     drift, encountered from the other command): the user already left
- *     boost manually, so forcing a switch back to the remembered prior tier
- *     would clobber a choice they just made on purpose. Instead this clears
- *     `/boost`'s own bookkeeping (state, env, chip) without touching the
- *     model, and names where they actually landed.
- *
- * KNOWN asymmetry, documented rather than worked around: `YAGNI_BOOST=1`
- * while boosted makes every CHILD process spawned during the boost (a /go
- * run, a subagent, an advisor consult) inherit it, and those children's
- * completions carry `x-yagni-boost` because their provider is registered
- * fresh per child. The DRIVER's own completions do not gain that header
- * retroactively — `buildYagniProvider`'s headers are baked into the
- * `registerProvider` call once, at session start, from the env snapshot at
- * that moment (see `provider.ts` / `attributionHeaders`). Re-registering the
- * provider mid-session to pick up a new header is explicitly NOT the fix
- * here: it would race the in-flight request the switch itself triggers and
- * has no test coverage as a live-swap path.
- *
- * This is exactly why `/cost` cannot rely on server rows alone: the server's
- * per-tier "Boosted (tier) spend" subtotal (`formatServerCostLines`, Task 7)
- * only ever sees rows carrying `x-yagni-boost` — i.e. `/go` children, never
- * the driver's own turns. A session that only chats while boosted would
- * otherwise show no boost line at all. `registerCostCommand`'s `isBoosted`
- * dep (threaded from THIS module's return handle, the same way
- * `advisorSubtotal` is threaded from `advisor.ts`) closes that gap: `/cost`
- * appends a fixed "Boost is on. Driver turns bill at the peak tier." line
- * whenever the live toggle is on, on BOTH the server-authoritative and the
- * local-fallback branch, independent of what server rows happen to show.
- */
-/** The pi provider name the YAGNI catalog registers under (see `provider.ts`). */
-const YAGNI_PROVIDER = "yagni";
-/** The tier `/boost` escalates to. */
-const BOOST_TIER = "peak";
-/** The session default tier, restored when no prior tier is known. */
-const DEFAULT_TIER = "balanced";
-/** Tier ids are lowercase; every known tier's display name is just Title Case of the id. */
-function displayTierName(id) {
-    return id.length === 0 ? id : id.charAt(0).toUpperCase() + id.slice(1);
-}
-/**
- * Turn boost on. PURE.
- *
- * - Already active AND the live model is still `peak`: genuine no-op,
- *   "Already boosted." (no switch — nothing about the prior tier changes).
- * - Already active but the live model has drifted off `peak` (picker-drift
- *   guard 3b, see module docblock): re-applies `peak`, keeping the ORIGINAL
- *   `priorModelId` rather than adopting the drifted-to tier.
- * - Not active, current model IS already `peak`: activates anyway (so
- *   attribution and `/boost off` behave correctly) with a distinct notice,
- *   remembering `peak` itself as the tier to restore.
- * - Not active, otherwise: remembers the current tier, targets `peak`.
- */
-export function boostOn(state, currentModelId) {
-    if (state.active) {
-        if (currentModelId === BOOST_TIER) {
-            return { state, notice: "Already boosted." };
-        }
-        return {
-            state,
-            notice: `Re-boosted to Peak. /boost off to return to ${displayTierName(state.priorModelId ?? DEFAULT_TIER)}.`,
-            targetModelId: BOOST_TIER,
-        };
-    }
-    if (currentModelId === BOOST_TIER) {
-        return {
-            state: { active: true, priorModelId: BOOST_TIER },
-            notice: "Already on Peak. /boost off returns to Peak.",
-            targetModelId: BOOST_TIER,
-        };
-    }
-    return {
-        state: { active: true, priorModelId: currentModelId },
-        notice: `Boosted to Peak. /boost off to return to ${displayTierName(currentModelId ?? DEFAULT_TIER)}.`,
-        targetModelId: BOOST_TIER,
-    };
-}
-/**
- * Turn boost off. PURE.
- *
- * - Not active: no-op, "Boost is not on."
- * - Active but the live model is no longer `peak` (picker-drift guard 3a,
- *   see module docblock): the user already left boost manually. Clears
- *   `/boost`'s own bookkeeping WITHOUT a switch — forcing one back to the
- *   remembered prior tier would clobber a choice just made on purpose — and
- *   names the model they actually landed on.
- * - Active and still on `peak`: restores the remembered prior tier (falling
- *   back to the session default when none was recorded, which should not
- *   normally happen). When the prior tier is itself `peak` (the
- *   already-on-Peak activation path), the resulting switch is a no-op in
- *   effect — still applied, harmlessly.
- */
-export function boostOff(state, currentModelId) {
-    if (!state.active) {
-        return { state, notice: "Boost is not on." };
-    }
-    if (currentModelId !== BOOST_TIER) {
-        return {
-            state: { active: false, priorModelId: undefined },
-            notice: `Boost off. Leaving the model on ${displayTierName(currentModelId ?? DEFAULT_TIER)}.`,
-        };
-    }
-    const priorId = state.priorModelId ?? DEFAULT_TIER;
-    return {
-        state: { active: false, priorModelId: undefined },
-        notice: `Back to ${displayTierName(priorId)}.`,
-        targetModelId: priorId,
-    };
-}
-/**
- * Resolve `tierId` to a live `Model` and apply it via `pi.setModel`.
- *
- * On a registry lookup miss, `allowFallback` (true only on the OFF path —
- * MINOR 5) retries once against the session default tier rather than
- * stranding the user on Peak over one missing catalog entry. Returns the
- * tier id that was ACTUALLY applied, so the caller can tell whether the
- * fallback fired and adjust the notice to name it honestly.
- *
- * @throws when neither the requested tier nor (if allowed) the fallback
- * resolves, or when `pi.setModel` itself throws or resolves `false`.
- */
-async function applyTier(pi, ctx, tierId, allowFallback) {
-    let model = ctx.modelRegistry?.find(YAGNI_PROVIDER, tierId);
-    let applied = tierId;
-    if (!model && allowFallback && tierId !== DEFAULT_TIER) {
-        model = ctx.modelRegistry?.find(YAGNI_PROVIDER, DEFAULT_TIER);
-        applied = DEFAULT_TIER;
-    }
-    if (!model) {
-        throw new Error(`Unknown YAGNI tier "${tierId}".`);
-    }
-    const ok = await pi.setModel(model);
-    if (!ok) {
-        throw new Error("setModel reported no API key configured.");
-    }
-    return applied;
-}
-/**
- * Register the `/boost` command.
- *
- * `/boost` (no args) turns boost on; `/boost off` turns it off; any other
- * argument shows a usage notice and changes nothing. Every transition that
- * requires a model switch runs it through pi's real API and is guarded end to
- * end: state and `YAGNI_BOOST` are only ever committed together, AFTER the
- * switch succeeds (or is deliberately skipped — the picker-drift guards), so
- * a half-applied boost (env set but model unchanged, or vice versa) can never
- * happen. A failed ON reports "Boost failed."; a failed OFF reports a
- * DISTINCT message, because the failure mode is materially worse — the
- * driver is left still running (and billing) on Peak, not merely unchanged.
- */
-export function registerBoostCommand(pi, deps = {}) {
-    const env = deps.env ?? process.env;
-    let state = { active: false };
-    const paintStatus = (ctx, active) => {
-        try {
-            if (ctx.hasUI)
-                ctx.ui.setStatus?.("yagni-boost", active ? "⚡ Peak" : undefined);
-        }
-        catch {
-            // The chip is chrome; never let it break /boost.
-        }
-    };
-    pi.registerCommand("boost", {
-        description: "Escalate this session's model to Peak until /boost off or the session ends. /boost off returns to the prior tier.",
-        handler: async (args, ctx) => {
-            const notify = (message, type) => {
-                if (ctx.hasUI)
-                    ctx.ui.notify(message, type);
-            };
-            // MINOR 4: case-insensitive "off" match, mirroring /mode's arg handling.
-            const arg = args.trim().toLowerCase();
-            if (arg !== "" && arg !== "off") {
-                notify("Usage: /boost (turn on) or /boost off.", "warning");
-                return;
-            }
-            const isOff = arg === "off";
-            const wasActive = state.active;
-            const result = isOff ? boostOff(state, ctx.model?.id) : boostOn(state, ctx.model?.id);
-            try {
-                let notice = result.notice;
-                if (result.targetModelId) {
-                    const applied = await applyTier(pi, ctx, result.targetModelId, isOff);
-                    if (applied !== result.targetModelId) {
-                        // MINOR 5: the remembered/target tier no longer resolves in the
-                        // catalog; we landed on the session default instead of
-                        // stranding the user on Peak. Name the fallback so the notice
-                        // stays honest about what actually happened.
-                        notice = `Back to ${displayTierName(applied)} (could not restore ${displayTierName(result.targetModelId)}).`;
-                    }
-                }
-                state = result.state;
-                // MINOR 6: only touch the env on a real active/inactive flip. Both
-                // pure no-op paths ("Already boosted.", "Boost is not on.") return
-                // `state` unchanged, so this never fires for them — an inherited
-                // YAGNI_BOOST from outside this session is left exactly as found.
-                if (state.active !== wasActive) {
-                    if (state.active) {
-                        env.YAGNI_BOOST = "1";
-                    }
-                    else {
-                        delete env.YAGNI_BOOST;
-                    }
-                }
-                notify(notice, "info");
-                paintStatus(ctx, state.active);
-            }
-            catch {
-                // IMPORTANT 1: a failed OFF is materially worse than a failed ON —
-                // the driver is STILL on Peak, still billing at Peak rates, which a
-                // generic "Boost failed." does not convey. Neither `state` nor
-                // `YAGNI_BOOST` was touched above (the throw lands before both), so
-                // the chip is also left exactly as it was: still lit.
-                notify(isOff ? "Could not leave boost. Still on Peak; try /boost off again." : "Boost failed.", "error");
-            }
-        },
-    });
-    return { isBoosted: () => state.active };
-}
-//# sourceMappingURL=boostCommand.js.map