backeer-opencode 0.1.0 → 0.1.1

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to `backeer-opencode` are documented here.
 
+## 0.1.1 - 2026-09-01
+
+- Add `backeer-opencode configure` for hidden interactive token entry.
+- Preserve existing tokens unless replacement is explicitly confirmed.
+- Keep npm plugin configuration separate from side-loaded installation.
+
 ## 0.1.0 - 2026-09-01
 
 - Publish OpenCode permission requests to Backeer.

package/README.md

@@ -53,8 +53,13 @@ Install the package in OpenCode's global configuration:
 
 ```sh
 opencode plugin backeer-opencode -g
+npx backeer-opencode@latest configure
 ```
 
+`configure` asks for the source ingest token without echoing it, stores it with
+mode `0600`, and does not install a second side-loaded plugin. If a token already
+exists, replacement requires confirmation.
+
 Alternatively, add it to `~/.config/opencode/opencode.json` manually:
 
 ```json
@@ -72,7 +77,8 @@ If npm package loading is not available in a particular OpenCode installation,
 install the package as a side-loaded plugin instead:
 
 ```sh
-npx backeer-opencode@latest --token-file /path/from/your/secret-manager/backeer-token
+npx backeer-opencode@latest install \
+  --token-file /path/from/your/secret-manager/backeer-token
 ```
 
 Use either the configured npm plugin or the side-loaded form, not both. Loading

package/bin/backeer-opencode.js

@@ -3,39 +3,61 @@
 import {
   chmodSync,
   copyFileSync,
+  existsSync,
   mkdirSync,
   readFileSync,
   renameSync,
+  statSync,
   writeFileSync,
 } from "node:fs"
 import { homedir } from "node:os"
 import { dirname, join, resolve } from "node:path"
+import { createInterface } from "node:readline/promises"
 import { fileURLToPath } from "node:url"
 
 function usage(exitCode = 0) {
-  console.log(`Usage: backeer-opencode [options]
+  console.log(`Usage: backeer-opencode [command] [options]
+
+Commands:
+  configure           Securely prompt for and store the Backeer ingest token
+  install             Install the side-loaded plugin (default)
 
 Options:
   --config-dir PATH   OpenCode config directory (default: XDG_CONFIG_HOME/opencode)
-  --token-file PATH   Read the Backeer ingest token from PATH
-  --token-stdin       Read the Backeer ingest token from standard input
+  --token-file PATH   Read the token from PATH when using install
+  --token-stdin       Read the token from standard input when using install
+  --force             Replace an existing token without confirmation
   --help              Show this help
 
-If no token option is supplied, an existing token is preserved.`)
+Examples:
+  backeer-opencode configure
+  backeer-opencode install --token-file /run/secrets/backeer-token
+
+If install has no token option, an existing token is preserved.`)
   process.exit(exitCode)
 }
 
 function parseArguments(arguments_) {
-  const result = {}
-  for (let index = 0; index < arguments_.length; index++) {
-    const argument = arguments_[index]
+  const remaining = [...arguments_]
+  let command = "install"
+  if (remaining[0] === "configure" || remaining[0] === "install") {
+    command = remaining.shift()
+  }
+
+  const result = { command }
+  for (let index = 0; index < remaining.length; index++) {
+    const argument = remaining[index]
     if (argument === "--help") usage()
     if (argument === "--token-stdin") {
       result.tokenStdin = true
       continue
     }
+    if (argument === "--force") {
+      result.force = true
+      continue
+    }
     if (argument === "--config-dir" || argument === "--token-file") {
-      const value = arguments_[++index]
+      const value = remaining[++index]
       if (!value) usage(1)
       result[argument === "--config-dir" ? "configDir" : "tokenFile"] = value
       continue
@@ -46,6 +68,12 @@ function parseArguments(arguments_) {
   if (result.tokenStdin && result.tokenFile) {
     throw new Error("Use either --token-stdin or --token-file, not both")
   }
+  if (command === "configure" && (result.tokenStdin || result.tokenFile)) {
+    throw new Error("configure prompts securely; do not use token input options")
+  }
+  if (command === "install" && result.force) {
+    throw new Error("--force is supported only by configure")
+  }
   return result
 }
 
@@ -63,6 +91,83 @@ function writeSecretAtomically(path, token) {
   renameSync(temporaryPath, path)
 }
 
+async function confirmReplacement(secretPath) {
+  if (!existsSync(secretPath) || statSync(secretPath).size === 0) return true
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    throw new Error(
+      `A token already exists at ${secretPath}; rerun in a terminal or use --force`,
+    )
+  }
+
+  const prompt = createInterface({ input: process.stdin, output: process.stdout })
+  try {
+    const answer = await prompt.question(
+      `A Backeer token already exists at ${secretPath}. Replace it? [y/N] `,
+    )
+    return ["y", "yes"].includes(answer.trim().toLowerCase())
+  } finally {
+    prompt.close()
+  }
+}
+
+function readHiddenToken() {
+  const input = process.stdin
+  const output = process.stdout
+  if (!input.isTTY || !output.isTTY || typeof input.setRawMode !== "function") {
+    throw new Error("Interactive token entry requires a terminal")
+  }
+
+  return new Promise((resolvePromise, rejectPromise) => {
+    let token = ""
+    const wasRaw = input.isRaw === true
+    output.write("Backeer source ingest token: ")
+    input.setEncoding("utf8")
+    input.setRawMode(true)
+    input.resume()
+
+    function cleanup() {
+      input.removeListener("data", onData)
+      input.setRawMode(wasRaw)
+      if (!wasRaw) input.pause()
+      output.write("\n")
+    }
+
+    function onData(chunk) {
+      for (const character of chunk) {
+        if (character === "\u0003") {
+          cleanup()
+          rejectPromise(new Error("Token configuration cancelled"))
+          return
+        }
+        if (character === "\r" || character === "\n") {
+          cleanup()
+          resolvePromise(token.trim())
+          return
+        }
+        if (character === "\u007f" || character === "\b") {
+          token = token.slice(0, -1)
+          continue
+        }
+        if (character >= " ") token += character
+      }
+    }
+
+    input.on("data", onData)
+  })
+}
+
+async function configureToken(secretPath, force) {
+  if (!force && !(await confirmReplacement(secretPath))) {
+    console.log("Backeer token unchanged.")
+    return
+  }
+
+  const token = await readHiddenToken()
+  writeSecretAtomically(secretPath, token)
+  console.log(`Configured protected Backeer token: ${secretPath}`)
+  console.log("Restart OpenCode to use the new token.")
+}
+
 const arguments_ = parseArguments(process.argv.slice(2))
 const configDirectory = resolve(arguments_.configDir ?? defaultConfigDirectory())
 const pluginDirectory = join(configDirectory, "plugins")
@@ -73,20 +178,32 @@ const sourcePath = join(packageDirectory, "src", "index.js")
 // replaces it instead of loading two copies of the same plugin.
 const installedPath = join(pluginDirectory, "backeer-permission.js")
 
-mkdirSync(pluginDirectory, { recursive: true })
-copyFileSync(sourcePath, installedPath)
-chmodSync(installedPath, 0o644)
+try {
+  if (arguments_.command === "configure") {
+    await configureToken(secretPath, arguments_.force)
+  } else {
+    mkdirSync(pluginDirectory, { recursive: true })
+    copyFileSync(sourcePath, installedPath)
+    chmodSync(installedPath, 0o644)
 
-if (arguments_.tokenFile) {
-  writeSecretAtomically(secretPath, readFileSync(resolve(arguments_.tokenFile), "utf8").trim())
-} else if (arguments_.tokenStdin) {
-  writeSecretAtomically(secretPath, readFileSync(0, "utf8").trim())
-}
+    if (arguments_.tokenFile) {
+      writeSecretAtomically(
+        secretPath,
+        readFileSync(resolve(arguments_.tokenFile), "utf8").trim(),
+      )
+    } else if (arguments_.tokenStdin) {
+      writeSecretAtomically(secretPath, readFileSync(0, "utf8").trim())
+    }
 
-console.log(`Installed Backeer OpenCode plugin: ${installedPath}`)
-console.log(
-  arguments_.tokenFile || arguments_.tokenStdin
-    ? `Installed protected ingest token: ${secretPath}`
-    : `Token unchanged; expected at ${secretPath} or in BACKEER_INGEST_TOKEN`,
-)
-console.log("Restart OpenCode to load the plugin.")
+    console.log(`Installed Backeer OpenCode plugin: ${installedPath}`)
+    console.log(
+      arguments_.tokenFile || arguments_.tokenStdin
+        ? `Installed protected ingest token: ${secretPath}`
+        : `Token unchanged; expected at ${secretPath} or in BACKEER_INGEST_TOKEN`,
+    )
+    console.log("Restart OpenCode to load the plugin.")
+  }
+} catch (error) {
+  console.error(`Backeer configuration failed: ${error.message}`)
+  process.exitCode = 1
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "backeer-opencode",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Backeer notifications and remote permission decisions for OpenCode",
   "type": "module",
   "main": "./src/index.js",