elanous 0.2.6 → 0.2.7

package/src/oauth/store.ts

@@ -51,7 +51,9 @@ export interface OAuthTokens {
   tokenType?: string;
 }
 
-export type CodexMirrorResult = 'written' | 'not-created-missing-cli-fields' | 'write-failed';
+export type CodexMirrorResult = 'written' | 'not-created-missing-cli-fields' | 'write-failed'
+  // AUTH1 — ~/.codex is the Codex CLI's file: never mix another account's tokens into it.
+  | 'skipped-different-account' | 'skipped-unknown-account';
 
 export interface ProviderAuthState {
   tokens: OAuthTokens;
@@ -245,6 +247,9 @@ export interface WriteTokensOpts {
   /** Default true for 'openai-codex'. Set false to skip the ~/.codex
    *  mirror (e.g. in tests that shouldn't touch the user's home). */
   mirrorCodex?: boolean;
+  /** AUTH1 — when the Codex CLI file belongs to a different account, replace it wholly with this
+   *  login (id_token · account_id · tokens) instead of leaving it. Only on explicit user consent. */
+  replaceDifferentCodexAccount?: boolean;
   /** Explicit ChatGPT claims override. Normally left undefined — for
    *  'openai-codex' with OAuth tokens, saveTokens auto-decodes the
    *  access-token JWT so every refresh site picks up fresh claims
@@ -296,7 +301,10 @@ export function saveTokens(
       ?? (provider === 'openai-codex' ? defaultCodexHome(process.env) : undefined);
     if (home) {
       // loginWithCodex → saveTokens reaches the Codex CLI mirror on each token save.
-      state.codexMirrorResult = mirrorCodexAuth(tokens, state.lastRefresh, join(home, 'auth.json'));
+      state.codexMirrorResult = mirrorCodexAuth(tokens, state.lastRefresh, join(home, 'auth.json'), {
+        knownAccountId: state.chatGPT?.accountId,
+        replaceDifferentAccount: opts.replaceDifferentCodexAccount === true,
+      });
     }
     // ⛔ 이름 계정인데 홈을 모르면 «미러하지 않는다» — 모르는 곳에 토큰을 쓰지 않는다
   }
@@ -377,7 +385,12 @@ export function assertMirrorTargetIsSafeUnderTest(mirrorPath: string): void {
  *  under `oauth.codex-mirror`. ⛔ The 2026-08-05 incident had to be traced by
  *  guessing from the file's `last_refresh` FORMAT, which is deduction, not
  *  observation. Token values are never logged — path + error kind only. */
-function mirrorCodexAuth(tokens: OAuthTokens, lastRefresh: string, mirrorPath: string = codexAuthPath()): CodexMirrorResult {
+function mirrorCodexAuth(
+  tokens: OAuthTokens,
+  lastRefresh: string,
+  mirrorPath: string = codexAuthPath(),
+  account: { knownAccountId?: string; replaceDifferentAccount?: boolean } = {},
+): CodexMirrorResult {
   assertMirrorTargetIsSafeUnderTest(mirrorPath);
   try {
     const path = mirrorPath;
@@ -400,21 +413,45 @@ function mirrorCodexAuth(tokens: OAuthTokens, lastRefresh: string, mirrorPath: s
       && tokens.idToken.length > 0
       && typeof accountId === 'string'
       && accountId.length > 0;
+    // AUTH1 — the file is the Codex CLI's. Same account: rotate tokens as before. Different account
+    // (or ours unknown): leave it untouched unless the user asked to replace it — the old «hasBase»
+    // path kept the file's id_token/account_id and wrote our tokens next to them (two accounts mixed).
+    // Our account: id_token claim → stored claim → the access token's own claim. Refresh responses
+    // carry no id_token, and named rotation accounts keep their CLI homes in sync through this path —
+    // so an unknown account keeps the old rotation behaviour; only «both known and different» is refused.
+    const ourAccount = (typeof accountId === 'string' && accountId) || account.knownAccountId
+      || extractChatGPTClaims(tokens.accessToken)?.accountId || undefined;
+    const baseTokens = (existing.tokens && typeof existing.tokens === 'object') ? existing.tokens as Record<string, unknown> : {};
+    const baseAccount = typeof baseTokens.account_id === 'string' && baseTokens.account_id ? baseTokens.account_id : undefined;
+    let replaceWholly = false;
+    if (hasBase && baseAccount && !ourAccount) debug.log('oauth.codex-mirror', 'account-unknown', { path });
+    if (hasBase && baseAccount && ourAccount) {
+      if (ourAccount !== baseAccount) {
+        if (!account.replaceDifferentAccount || !canCreateUsableMirror) {
+          debug.log('oauth.codex-mirror', 'skipped-different-account', { path, replaceRequested: account.replaceDifferentAccount === true });
+          return 'skipped-different-account';
+        }
+        replaceWholly = true;
+      }
+    }
+
     if (!hasBase && !canCreateUsableMirror) {
       debug.log('oauth.codex-mirror', 'not-created-missing-cli-fields', { path });
       return 'not-created-missing-cli-fields';
     }
 
     mkdirSync(dirname(path), { recursive: true });
+    if (replaceWholly) existing = {};
+    const fresh = !hasBase || replaceWholly;
     const priorTokens = (existing.tokens && typeof existing.tokens === 'object')
       ? existing.tokens as Record<string, unknown> : {};
     existing.tokens = {
       ...priorTokens,
-      ...(hasBase ? {} : { id_token: tokens.idToken, account_id: accountId }),
+      ...(fresh ? { id_token: tokens.idToken, account_id: accountId } : {}),
       access_token: tokens.accessToken,
       refresh_token: tokens.refreshToken,
     };
-    if (!hasBase) {
+    if (fresh) {
       existing.OPENAI_API_KEY = null;
       existing.auth_mode = 'chatgpt';
     }

package/src/onboarding/continue-here.ts

@@ -0,0 +1,29 @@
+export interface ContinueHereOptions {
+  daemonRunning: boolean;
+  /** Resolved PWA URL for the running daemon, if available. */
+  pwaUrl?: string;
+  /** Already-issued short-lived phone connection link; never pass its token separately. */
+  phoneLink?: string;
+  telegramEnabled: boolean;
+  /** Non-interactive output must not include links (or QR payloads). */
+  interactive: boolean;
+}
+
+/** Render post-setup directions without inspecting the daemon, issuing credentials, or performing IO. */
+export function continueHereLines(opts: ContinueHereOptions): string[] {
+  const lines = ['  Continue here:'];
+  if (!opts.daemonRunning) lines.push('  Start the daemon: `elanous nexus run`');
+  if (opts.interactive && opts.daemonRunning && opts.pwaUrl) {
+    lines.push(`  Browser: ${opts.pwaUrl}`);
+  } else {
+    lines.push('  Browser: `elanous nexus show`');
+  }
+  if (opts.interactive && opts.daemonRunning && opts.phoneLink) {
+    lines.push(`  Phone: ${opts.phoneLink}`);
+    lines.push('  ⚠ This link contains a connection token — do not share it or include it in a public screenshot.');
+  } else {
+    lines.push('  Phone: `elanous phone link --temp --ttl 24h`');
+  }
+  if (opts.telegramEnabled) lines.push('  Telegram: `elanous telegram`');
+  return lines;
+}

package/src/onboarding/entry-hints.ts

@@ -0,0 +1,8 @@
+export const UNATTENDED_SETUP_COMMAND = 'elanous onboarding --non-interactive --config <answers.json>';
+export const SKILLS_STEP_COMMAND = 'elanous onboarding skills';
+
+export function unattendedSetupHint(): string {
+  return `unattended: \`${UNATTENDED_SETUP_COMMAND}\``;
+}
+
+export const SKILLS_LIST_DESCRIPTION = 'List elanous skills from configured skill directories (skills.activeSet / skills.dirs and packaged skills): subdirectories and the first non-heading line of each SKILL.md. Read-only.';

package/src/onboarding/full-screen-io.ts

@@ -147,6 +147,28 @@ export function fullScreenIO(opts: FullScreenIOOpts = {}): WizardIO {
     out.write(composeFullPaint(spec));
   };
 
+  // OB4(2026-10-01 · 0.2.6 실물): print() 는 «다음 질문 화면»에 묻어 그린다 — 그런데 기기 코드 로그인처럼
+  //   질문 없이 오래 기다리는 구간에선 다음 화면이 오지 않아 코드·URL 이 끝내 안 보이고, 원시 모드라 Ctrl-C 도
+  //   신호가 안 돼 «멈춤»이 됐다. 질문이 없을 때 print 는 곧바로 메시지 화면을 그리고 Ctrl-C 감시를 붙인다.
+  let questionDepth = 0;
+  let idleWatcher: ((chunk: string | Buffer) => void) | null = null;
+  const detachIdleWatcher = (): void => {
+    if (idleWatcher) { inp.off('data', idleWatcher); idleWatcher = null; }
+  };
+  const attachIdleWatcher = (): void => {
+    if (idleWatcher || !inp.isTTY) return;
+    idleWatcher = (chunk) => {
+      const s = typeof chunk === 'string' ? chunk : chunk.toString('utf8');
+      if (s.includes('\x03')) handleSigInt();
+    };
+    inp.on('data', idleWatcher);
+  };
+  const inQuestion = async <R>(fn: () => Promise<R>): Promise<R> => {
+    detachIdleWatcher();
+    questionDepth++;
+    try { return await fn(); } finally { questionDepth--; }
+  };
+
   // ── Raw key reader ──────────────────────────────────────────────
   const readKey = (): Promise<MiniKey> =>
     new Promise((resolve) => {
@@ -159,7 +181,12 @@ export function fullScreenIO(opts: FullScreenIOOpts = {}): WizardIO {
     });
 
   // ── choose ─────────────────────────────────────────────────────
-  const choose = async <T>(
+  const choose = <T>(
+    prompt: string,
+    options: ChoiceOption<T>[],
+    opts: ChooseOpts = {},
+  ): Promise<T> => inQuestion(() => chooseInner(prompt, options, opts));
+  const chooseInner = async <T>(
     prompt: string,
     options: ChoiceOption<T>[],
     opts: ChooseOpts = {},
@@ -343,11 +370,11 @@ export function fullScreenIO(opts: FullScreenIOOpts = {}): WizardIO {
 
   // ── ask ────────────────────────────────────────────────────────
   const ask = async (prompt: string): Promise<string> => {
-    return askInternal(prompt, false);
+    return inQuestion(() => askInternal(prompt, false));
   };
 
   const askSecret = async (prompt: string): Promise<string> => {
-    return askInternal(prompt, true);
+    return inQuestion(() => askInternal(prompt, true));
   };
 
   const askInternal = async (prompt: string, mask: boolean): Promise<string> => {
@@ -407,6 +434,10 @@ export function fullScreenIO(opts: FullScreenIOOpts = {}): WizardIO {
     // box — the wizard frame already contains the same info.
     if (isBannerLine(text)) return;
     messages.push({ text, kind: 'plain' });
+    if (questionDepth === 0) {
+      paint(buildScreenSpec({ kind: 'message', lines: [] }, 'Ctrl-C cancel'));
+      attachIdleWatcher();
+    }
   };
 
   return {
@@ -414,6 +445,7 @@ export function fullScreenIO(opts: FullScreenIOOpts = {}): WizardIO {
     askSecret,
     print,
     close: () => {
+      detachIdleWatcher();
       exitRaw();
       // Final clear so any leftover screen does not interfere with
       // the post-wizard CLI banner / dashboard.

package/src/onboarding/help/skills.md

@@ -16,4 +16,4 @@ per line, blank line to finish. Paths that don't exist yet are
 kept anyway so you can create them later.
 
 You can change the active preset any time via:
-    elanous setup skills
+    elanous onboarding skills

package/src/onboarding/non-interactive.ts

@@ -128,6 +128,7 @@ export function nonInteractiveIO(opts: NonInteractiveOptions = {}): WizardIO {
       section = STEP_SECTIONS[spec.index];
     },
     print,
+    nonInteractive: true,
     complete: reportUnusedAnswers,
     close: () => { /* no resources to release */ },
   };

package/src/onboarding/subscription-hint.ts

@@ -0,0 +1,27 @@
+// Onboarding step 1 — turn detected subscription logins into «Found» lines and a default provider (OB1 · 10-01).
+// A fresh user with a ChatGPT/Codex or Grok login was shown «Auto-detect (env vars)» preselected and nothing found.
+import type { DetectedProvider } from '../llm/provider-detect.js';
+
+export interface SubscriptionHint {
+  found: Array<{ provider: 'openai-codex' | 'grok'; line: string }>;
+  /** Provider to preselect when the user has not chosen one yet. */
+  preferred: 'openai-codex' | 'grok';
+}
+
+const SOURCE_LABEL: Record<string, string> = {
+  'codex-auth': '~/.codex/auth.json',
+  'elanous-auth': 'elanous login',
+  'grok-auth': '~/.grok/auth.json',
+};
+
+/** Subscriptions first: codex, then grok. With none found, codex is still the default (most users have ChatGPT). */
+export function subscriptionHint(detected: readonly DetectedProvider[]): SubscriptionHint {
+  const found: SubscriptionHint['found'] = [];
+  for (const provider of ['openai-codex', 'grok'] as const) {
+    const hit = detected.find(d => d.provider === provider && d.auth === 'oauth');
+    if (!hit) continue;
+    const name = provider === 'openai-codex' ? 'ChatGPT / Codex subscription' : 'Grok subscription';
+    found.push({ provider, line: `  Found ${name} (${SOURCE_LABEL[hit.source] ?? hit.source})` });
+  }
+  return { found, preferred: found[0]?.provider ?? 'openai-codex' };
+}

package/src/onboarding/web-first.ts

@@ -0,0 +1,83 @@
+import { spawnSync } from 'node:child_process';
+import { isHeadlessEnv } from '../acp/codex-auth.js';
+import { runNexusShow, type NexusShowResult } from '../cli/nexus-show.js';
+import { debug } from '../debug/log.js';
+import type { UserConfig } from '../user-config.js';
+
+export interface WebFirstSetupDeps {
+  config: Pick<UserConfig, 'onboarding'>;
+  isTty?: boolean;
+  terminal?: boolean;
+  showNexus?: () => Promise<NexusShowResult>;
+  issueSetupLinkToken?: () => Promise<string | { token: string }>;
+  renderQr?: (link: string) => string | undefined;
+  openBrowser?: (link: string) => boolean;
+  isHeadless?: () => boolean;
+  print?: (line: string) => void;
+}
+
+function setupUrl(pwa: string, token: string): string {
+  return `${pwa.replace(/\/app\/?$/, '').replace(/\/$/, '')}/setup#t=${encodeURIComponent(token)}`;
+}
+
+export async function runWebFirstSetup(deps: WebFirstSetupDeps): Promise<'link-shown' | 'fallback'> {
+  const observe = (event: 'link-shown' | 'fallback', reason?: string, qr = false, browserOpened = false, remote: 'loopback' | 'tailnet' = 'loopback') => {
+    try { debug.log('onboarding.web-first', event, { ...(reason ? { reason } : {}), qr, browserOpened, remote }); }
+    catch { /* Observability must not block onboarding. */ }
+  };
+  if (deps.config.onboarding.webFirst !== true) { observe('fallback', 'disabled'); return 'fallback'; }
+  if ((deps.isTty ?? (process.stdin.isTTY === true)) !== true) { observe('fallback', 'non-tty'); return 'fallback'; }
+  if (deps.terminal) { observe('fallback', 'terminal'); return 'fallback'; }
+
+  let shown: NexusShowResult;
+  try {
+    shown = await (deps.showNexus ?? (() => runNexusShow({ format: 'json', out: { log: () => {}, error: () => {} } })))();
+  } catch { observe('fallback', 'daemon-unavailable'); return 'fallback'; }
+  const running = shown.status === 'unregistered' || (shown.status === 'registered' && shown.instance?.alive === true);
+  if (!running || !shown.urls?.pwa.loopback) { observe('fallback', 'daemon-unavailable'); return 'fallback'; }
+
+  let token: string;
+  try {
+    const issue = deps.issueSetupLinkToken ?? (async () => {
+      const modulePath = '../auth/setup-link-token.js';
+      const mod = await import(modulePath) as { issueSetupLinkToken?: (options: Record<string, never>) => Promise<string | { token: string }> };
+      if (typeof mod.issueSetupLinkToken !== 'function') throw new Error('issuer-missing');
+      return mod.issueSetupLinkToken({});
+    });
+    const issued = await issue();
+    token = typeof issued === 'string' ? issued : issued?.token;
+    if (!token) throw new Error('issuer-missing');
+  } catch { observe('fallback', 'issuer-missing'); return 'fallback'; }
+
+  const print = deps.print ?? console.log;
+  const link = setupUrl(shown.urls.pwa.loopback, token);
+  const phoneLink = shown.urls.pwa.tailnet ? setupUrl(shown.urls.pwa.tailnet, token) : undefined;
+  print('브라우저에서 셋업을 이어가세요');
+  print(link);
+  let qr = false;
+  if (phoneLink) {
+    try {
+      const rendered = (deps.renderQr ?? ((url: string) => {
+        const result = spawnSync('qrencode', ['-t', 'ANSIUTF8', url], { encoding: 'utf8' });
+        return result.status === 0 ? result.stdout : undefined;
+      }))(phoneLink);
+      if (rendered) {
+        print(rendered);
+        print('같은 와이파이·tailnet 의 폰 카메라로 스캔하세요');
+        qr = true;
+      }
+    } catch { /* QR is optional. */ }
+  }
+  print('터미널에서 하려면: `elanous setup --terminal`');
+  let browserOpened = false;
+  if (!(deps.isHeadless ?? (() => isHeadlessEnv(process.env)))()) {
+    try {
+      browserOpened = (deps.openBrowser ?? ((url: string) => {
+        const command = process.platform === 'darwin' ? 'open' : process.platform === 'linux' || process.platform === 'freebsd' || process.platform === 'openbsd' ? 'xdg-open' : undefined;
+        return command ? spawnSync(command, [url], { stdio: 'ignore' }).status === 0 : false;
+      }))(link);
+    } catch { /* The displayed link remains usable. */ }
+  }
+  observe('link-shown', undefined, qr, browserOpened, phoneLink ? 'tailnet' : 'loopback');
+  return 'link-shown';
+}