amicus 1.0.0

package/src/utils/api-key-store.js

@@ -0,0 +1,259 @@
+/**
+ * API Key Store — reading, saving, and validating API keys.
+ * Keys stored in ~/.config/amicus/.env with 0o600 permissions.
+ */
+const fs = require('fs');
+const path = require('path');
+const { validateApiKey, validateOpenRouterKey, VALIDATION_ENDPOINTS } = require('./api-key-validation');
+const { getCompatEnv } = require('./env-compat');
+
+/** Maps provider IDs to environment variable names */
+const PROVIDER_ENV_MAP = {
+  openrouter: 'OPENROUTER_API_KEY',
+  google: 'GOOGLE_GENERATIVE_AI_API_KEY',
+  openai: 'OPENAI_API_KEY',
+  anthropic: 'ANTHROPIC_API_KEY',
+  deepseek: 'DEEPSEEK_API_KEY'
+};
+
+/** Legacy key names that have been renamed (old -> new) */
+const LEGACY_KEY_NAMES = {
+  'GEMINI_API_KEY': 'GOOGLE_GENERATIVE_AI_API_KEY'
+};
+
+/** Get the path to the .env file */
+function getEnvPath() {
+  const envDir = getCompatEnv('ENV_DIR');
+  if (envDir) {
+    const resolved = path.resolve(envDir);
+    if (resolved.includes('\0')) {
+      throw new Error('Invalid ENV_DIR: null bytes not allowed');
+    }
+    return path.join(resolved, '.env');
+  }
+  const homeDir = process.env.HOME || process.env.USERPROFILE;
+  const amicusEnvPath = path.join(homeDir, '.config', 'amicus', '.env');
+  // DEPRECATED(amicus-shim): fall back to the legacy ~/.config/sidecar/.env if it
+  // exists and the new one does not, so pre-rebrand installs keep reading/writing
+  // their existing keys. Remove in a future revision — see docs/SHIMS.md.
+  if (!fs.existsSync(amicusEnvPath)) {
+    const legacyEnvPath = path.join(homeDir, '.config', 'sidecar', '.env');
+    if (fs.existsSync(legacyEnvPath)) {
+      return legacyEnvPath;
+    }
+  }
+  return amicusEnvPath;
+}
+
+/** Parse a .env file into a key-value map (comments/blanks excluded) */
+function parseEnvContent(content) {
+  const entries = new Map();
+  const lines = content.split('\n');
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#')) {
+      continue;
+    }
+    const eqIndex = trimmed.indexOf('=');
+    if (eqIndex === -1) {
+      continue;
+    }
+    const key = trimmed.slice(0, eqIndex);
+    const value = trimmed.slice(eqIndex + 1);
+    entries.set(key, value);
+  }
+  return entries;
+}
+
+/** Migrate a legacy key name in a .env file (best-effort, one-time) */
+function migrateEnvFileKey(envPath, oldName, newName) {
+  try {
+    const content = fs.readFileSync(envPath, 'utf-8');
+    const re = new RegExp(`^${oldName}=`, 'm');
+    const updated = content.replace(re, `${newName}=`);
+    if (updated !== content) {
+      fs.writeFileSync(envPath, updated, { mode: 0o600 });
+    }
+  } catch (_err) {
+    // Best effort
+  }
+}
+
+/** Load .env file entries (auto-migrates legacy key names) */
+function loadEnvEntries() {
+  const envPath = getEnvPath();
+  let fileEntries = new Map();
+  try {
+    if (fs.existsSync(envPath)) {
+      const content = fs.readFileSync(envPath, 'utf-8');
+      fileEntries = parseEnvContent(content);
+      // Auto-migrate legacy key names
+      for (const [oldName, newName] of Object.entries(LEGACY_KEY_NAMES)) {
+        if (fileEntries.has(oldName) && !fileEntries.has(newName)) {
+          fileEntries.set(newName, fileEntries.get(oldName));
+          fileEntries.delete(oldName);
+          migrateEnvFileKey(envPath, oldName, newName);
+        }
+      }
+    }
+  } catch (_err) {
+    // Ignore read errors
+  }
+  return fileEntries;
+}
+
+/** Resolve key value: file entry takes precedence over process.env */
+function resolveKeyValue(fileEntries, envVar) {
+  const fromFile = fileEntries.get(envVar);
+  if (fromFile && fromFile.length > 0) { return fromFile; }
+  const fromEnv = process.env[envVar];
+  if (fromEnv && fromEnv.length > 0) { return fromEnv; }
+  return '';
+}
+
+/**
+ * Read API key availability from .env file and process.env
+ * @returns {{openrouter: boolean, google: boolean, openai: boolean, anthropic: boolean, deepseek: boolean}}
+ */
+function readApiKeys() {
+  const result = { openrouter: false, google: false, openai: false, anthropic: false, deepseek: false };
+  const entries = loadEnvEntries();
+  for (const [provider, envVar] of Object.entries(PROVIDER_ENV_MAP)) {
+    if (resolveKeyValue(entries, envVar)) { result[provider] = true; }
+  }
+  return result;
+}
+
+/**
+ * Read API key hints (masked prefixes) for UI display
+ * @returns {{openrouter: string|false, google: string|false, openai: string|false, anthropic: string|false, deepseek: string|false}}
+ */
+function readApiKeyHints() {
+  const result = { openrouter: false, google: false, openai: false, anthropic: false, deepseek: false };
+  const entries = loadEnvEntries();
+  for (const [provider, envVar] of Object.entries(PROVIDER_ENV_MAP)) {
+    const key = resolveKeyValue(entries, envVar);
+    if (key) {
+      const visible = key.slice(0, 8);
+      result[provider] = visible + '\u2022'.repeat(Math.max(0, Math.min(key.length - 8, 12)));
+    }
+  }
+  return result;
+}
+
+/**
+ * Read actual API key strings for configured providers.
+ * Used by model-fetcher to authenticate against provider APIs.
+ * @returns {Object<string, string>} Map of provider → key string (only set providers)
+ */
+function readApiKeyValues() {
+  const result = {};
+  const entries = loadEnvEntries();
+  for (const [provider, envVar] of Object.entries(PROVIDER_ENV_MAP)) {
+    const value = resolveKeyValue(entries, envVar);
+    if (value) { result[provider] = value; }
+  }
+  return result;
+}
+
+/** Save an API key for a provider to the .env file */
+function saveApiKey(provider, key) {
+  const envVar = PROVIDER_ENV_MAP[provider];
+  if (!envVar) {
+    return { success: false, error: `Unknown provider: ${provider}` };
+  }
+
+  const envPath = getEnvPath();
+  const envDir = path.dirname(envPath);
+  fs.mkdirSync(envDir, { recursive: true });
+
+  // Read existing .env content, preserving comments and other lines
+  let lines = [];
+  try {
+    if (fs.existsSync(envPath)) {
+      const content = fs.readFileSync(envPath, 'utf-8');
+      lines = content.split('\n');
+    }
+  } catch (_err) {
+    // Start fresh
+  }
+
+  // Find and replace the line for this env var, or append
+  let found = false;
+  for (let i = 0; i < lines.length; i++) {
+    const trimmed = lines[i].trim();
+    if (trimmed.startsWith(envVar + '=')) {
+      lines[i] = `${envVar}=${key}`;
+      found = true;
+      break;
+    }
+  }
+  if (!found) {
+    // Remove trailing empty lines before appending
+    while (lines.length > 0 && lines[lines.length - 1].trim() === '') {
+      lines.pop();
+    }
+    lines.push(`${envVar}=${key}`);
+  }
+
+  // Write with trailing newline
+  const output = lines.join('\n') + '\n';
+  fs.writeFileSync(envPath, output, { mode: 0o600 });
+
+  // Also set process.env so the key is immediately available
+  process.env[envVar] = key;
+
+  return { success: true };
+}
+
+/** Remove an API key for a provider from the .env file */
+function removeApiKey(provider) {
+  const envVar = PROVIDER_ENV_MAP[provider];
+  if (!envVar) {
+    return { success: false, error: `Unknown provider: ${provider}` };
+  }
+
+  const envPath = getEnvPath();
+  try {
+    if (!fs.existsSync(envPath)) {
+      const { checkAuthJson } = require('./auth-json');
+      delete process.env[envVar];
+      return { success: true, alsoInAuthJson: checkAuthJson(provider) };
+    }
+    const content = fs.readFileSync(envPath, 'utf-8');
+    const lines = content.split('\n').filter(line => {
+      return !line.trim().startsWith(envVar + '=');
+    });
+
+    // Remove trailing empty lines
+    while (lines.length > 0 && lines[lines.length - 1].trim() === '') {
+      lines.pop();
+    }
+
+    const output = lines.length > 0 ? lines.join('\n') + '\n' : '';
+    fs.writeFileSync(envPath, output, { mode: 0o600 });
+  } catch (_err) {
+    // Ignore
+  }
+
+  delete process.env[envVar];
+
+  // Check if key also exists in auth.json (caller decides whether to clean)
+  const { checkAuthJson } = require('./auth-json');
+  return { success: true, alsoInAuthJson: checkAuthJson(provider) };
+}
+
+module.exports = {
+  getEnvPath,
+  loadEnvEntries,
+  readApiKeys,
+  readApiKeyHints,
+  readApiKeyValues,
+  saveApiKey,
+  removeApiKey,
+  validateApiKey,
+  validateOpenRouterKey,
+  PROVIDER_ENV_MAP,
+  LEGACY_KEY_NAMES,
+  VALIDATION_ENDPOINTS
+};

package/src/utils/api-key-validation.js

@@ -0,0 +1,97 @@
+/**
+ * API Key Validation — test API keys against provider endpoints.
+ * Extracted from api-key-store.js to keep modules under 300 lines.
+ */
+const https = require('https');
+
+/** Validation endpoints per provider */
+const VALIDATION_ENDPOINTS = {
+  openrouter: {
+    url: 'https://openrouter.ai/api/v1/models',
+    authHeader: (key) => ({ 'Authorization': `Bearer ${key}` })
+  },
+  openai: {
+    url: 'https://api.openai.com/v1/models',
+    authHeader: (key) => ({ 'Authorization': `Bearer ${key}` })
+  },
+  anthropic: {
+    url: 'https://api.anthropic.com/v1/messages',
+    authHeader: (key) => ({
+      'x-api-key': key,
+      'anthropic-version': '2023-06-01'
+    })
+  },
+  google: {
+    url: 'https://generativelanguage.googleapis.com/v1beta/models',
+    authHeader: () => ({})
+  },
+  deepseek: {
+    url: 'https://api.deepseek.com/models',
+    authHeader: (key) => ({ 'Authorization': `Bearer ${key}` })
+  }
+};
+
+/** Validate an API key by making a test request to the provider's API */
+function validateApiKey(provider, key) {
+  if (!key || key.trim().length === 0) {
+    return Promise.resolve({ valid: false, error: 'API key is required' });
+  }
+
+  const endpoint = VALIDATION_ENDPOINTS[provider];
+  if (!endpoint) {
+    return Promise.resolve({ valid: false, error: `Unknown provider: ${provider}` });
+  }
+
+  const trimmedKey = key.trim();
+
+  // Google uses query param auth, not header
+  let url = endpoint.url;
+  if (provider === 'google') {
+    url = `${endpoint.url}?key=${trimmedKey}`;
+  }
+
+  const headers = endpoint.authHeader(trimmedKey);
+
+  return new Promise((resolve) => {
+    const req = https.get(url, { headers }, (res) => {
+      res.on('data', () => {});
+      res.on('end', () => {
+        // Anthropic returns 401 for invalid key, 400/405 for valid key with no body
+        if (provider === 'anthropic') {
+          if (res.statusCode === 401) {
+            resolve({ valid: false, error: 'Invalid API key (401)' });
+          } else if (res.statusCode >= 500 || res.statusCode === 429) {
+            resolve({ valid: false, error: `Server error (${res.statusCode})` });
+          } else {
+            resolve({ valid: true });
+          }
+          return;
+        }
+
+        if (res.statusCode === 200) {
+          resolve({ valid: true });
+        } else if (res.statusCode === 401 || res.statusCode === 403) {
+          resolve({ valid: false, error: `Invalid API key (${res.statusCode})` });
+        } else {
+          resolve({ valid: false, error: `Unexpected response (${res.statusCode})` });
+        }
+      });
+    });
+    req.setTimeout(10000, () => {
+      req.destroy();
+      resolve({ valid: false, error: 'Request timed out' });
+    });
+    req.on('error', (err) => {
+      resolve({ valid: false, error: err.message });
+    });
+  });
+}
+
+// Backwards compat alias
+const validateOpenRouterKey = validateApiKey;
+
+module.exports = {
+  validateApiKey,
+  validateOpenRouterKey,
+  VALIDATION_ENDPOINTS
+};

package/src/utils/auth-json.js

@@ -0,0 +1,109 @@
+/**
+ * Auth JSON Reader
+ *
+ * Read-only interface to OpenCode's auth.json (~/.local/share/opencode/auth.json).
+ * Used for one-time key import into sidecar's .env and optional cleanup on delete.
+ * Sidecar never writes keys TO auth.json -- only reads and optionally removes.
+ */
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { logger } = require('./logger');
+
+const AUTH_JSON_PATH = path.join(os.homedir(), '.local', 'share', 'opencode', 'auth.json');
+
+/** Known provider IDs that map to sidecar's PROVIDER_ENV_MAP */
+const KNOWN_PROVIDERS = ['openrouter', 'google', 'openai', 'anthropic', 'deepseek'];
+
+/**
+ * Extract key value from an auth.json provider entry.
+ * Checks both .key and .apiKey fields (OpenCode uses both formats).
+ * @param {object} entry - Provider entry from auth.json
+ * @returns {string|undefined} Key string, or undefined if not found
+ */
+function extractKey(entry) {
+  if (!entry || typeof entry !== 'object') { return undefined; }
+  const fromKey = entry.key;
+  if (typeof fromKey === 'string' && fromKey.length > 0) { return fromKey; }
+  const fromApiKey = entry.apiKey;
+  if (typeof fromApiKey === 'string' && fromApiKey.length > 0) { return fromApiKey; }
+  return undefined;
+}
+
+/**
+ * Read and parse auth.json into a normalized provider-key map.
+ * Only returns keys for known providers (openrouter, google, openai, anthropic, deepseek).
+ * @returns {Object<string, string>} Map of provider -> key string (only providers with keys)
+ */
+function readAuthJsonKeys() {
+  if (!fs.existsSync(AUTH_JSON_PATH)) { return {}; }
+  let parsed;
+  try {
+    parsed = JSON.parse(fs.readFileSync(AUTH_JSON_PATH, 'utf-8'));
+  } catch (_err) {
+    logger.debug('auth.json is malformed, skipping import');
+    return {};
+  }
+  if (!parsed || typeof parsed !== 'object') { return {}; }
+
+  const result = {};
+  for (const provider of KNOWN_PROVIDERS) {
+    const key = extractKey(parsed[provider]);
+    if (key) { result[provider] = key; }
+  }
+  return result;
+}
+
+/**
+ * Find keys in auth.json that are not already in sidecar's .env.
+ * @param {Object<string, boolean>} existingKeys - Which providers already have keys in sidecar
+ * @returns {{ imported: Array<{provider: string, key: string}> }}
+ */
+function importFromAuthJson(existingKeys) {
+  const authKeys = readAuthJsonKeys();
+  const imported = [];
+  for (const [provider, key] of Object.entries(authKeys)) {
+    if (!existingKeys[provider]) {
+      imported.push({ provider, key });
+    }
+  }
+  return { imported };
+}
+
+/**
+ * Check if a provider has a key in auth.json.
+ * @param {string} provider - Provider ID
+ * @returns {boolean}
+ */
+function checkAuthJson(provider) {
+  if (!KNOWN_PROVIDERS.includes(provider)) { return false; }
+  const keys = readAuthJsonKeys();
+  return !!keys[provider];
+}
+
+/**
+ * Remove a provider entry from auth.json.
+ * Best-effort: does not throw on errors.
+ * @param {string} provider - Provider ID to remove
+ */
+function removeFromAuthJson(provider) {
+  try {
+    if (!fs.existsSync(AUTH_JSON_PATH)) { return; }
+    const parsed = JSON.parse(fs.readFileSync(AUTH_JSON_PATH, 'utf-8'));
+    if (!parsed[provider]) { return; }
+    delete parsed[provider];
+    fs.writeFileSync(AUTH_JSON_PATH, JSON.stringify(parsed, null, 2), 'utf-8');
+  } catch (_err) {
+    logger.debug('Failed to remove provider from auth.json', { provider });
+  }
+}
+
+module.exports = {
+  readAuthJsonKeys,
+  importFromAuthJson,
+  checkAuthJson,
+  removeFromAuthJson,
+  AUTH_JSON_PATH,
+  KNOWN_PROVIDERS
+};