faberwright 0.3.1 → 0.4.1

package/dist/prompt.js

@@ -2,24 +2,63 @@ import pc from "picocolors";
 let guardFn;
 /** Wired by the CLI: pauses the composed-input pipe while the selector owns stdin. */
 export function setSelectGuard(fn) { guardFn = fn; }
-export async function select(rl, question, options, defaultIndex = 0) {
+async function selectRaw(rl, question, options, defaultIndex = 0) {
     if (!process.stdin.isTTY || !process.stdout.isTTY) {
         const menu = options.map((o, i) => `  ${i + 1}) ${o}`).join("\n");
-        const ans = (await rl.question(`${question}\n${menu}\nChoose [1-${options.length}] (default ${defaultIndex + 1}): `)).trim();
+        let ans;
+        try {
+            ans = (await rl.question(`${question}\n${menu}\nChoose [1-${options.length}] (default ${defaultIndex + 1}): `)).trim();
+        }
+        catch {
+            // stdin closed mid-prompt (piped input ran out, or Ctrl-D):
+            // take the default rather than surfacing a readline stack trace.
+            return defaultIndex;
+        }
         const n = Number.parseInt(ans, 10);
         return Number.isInteger(n) && n >= 1 && n <= options.length ? n - 1 : defaultIndex;
     }
-    console.log(pc.bold(question) + pc.dim("   ↑/↓ then Enter, or 1-9"));
+    // Long lists (a provider can return dozens of models) are unusable with
+    // arrow keys alone, so typing filters the list as you go.
+    const searchable = options.length > 8;
+    console.log(pc.bold(question) +
+        pc.dim(searchable ? "   ↑/↓ then Enter · type to filter" : "   ↑/↓ then Enter, or 1-9"));
     return new Promise((resolve) => {
-        let idx = defaultIndex;
-        let firstRender = true;
+        let filter = "";
+        let view = options.map((_, i) => i); // indices currently shown
+        let cursor = Math.max(0, view.indexOf(defaultIndex));
+        let painted = 0; // rows drawn last time
+        const applyFilter = () => {
+            const q = filter.toLowerCase();
+            const next = options
+                .map((o, i) => [o, i])
+                .filter(([o]) => o.toLowerCase().includes(q))
+                .map(([, i]) => i);
+            view = next.length ? next : [];
+            cursor = 0;
+        };
         const render = () => {
-            if (!firstRender)
-                process.stdout.write(`\x1b[${options.length}A`);
-            firstRender = false;
-            for (let i = 0; i < options.length; i++) {
+            if (painted)
+                process.stdout.write(`\x1b[${painted}A`);
+            const rows = view.length ? view.length : 1;
+            const extra = filter ? 1 : 0;
+            for (let r = 0; r < view.length; r++) {
                 process.stdout.write("\x1b[2K");
-                process.stdout.write((i === idx ? pc.cyan(`❯ ${options[i]}`) : pc.dim(`  ${options[i]}`)) + "\n");
+                const i = view[r];
+                process.stdout.write((r === cursor ? pc.cyan(`❯ ${options[i]}`) : pc.dim(`  ${options[i]}`)) + "\n");
+            }
+            if (!view.length) {
+                process.stdout.write("\x1b[2K" + pc.yellow(`  no match for "${filter}"`) + "\n");
+            }
+            if (filter) {
+                process.stdout.write("\x1b[2K" + pc.dim(`  filter: ${filter}`) + "\n");
+            }
+            // clear any rows the previous, longer render left behind
+            for (let r = rows + extra; r < painted; r++)
+                process.stdout.write("\x1b[2K\n");
+            painted = Math.max(rows + extra, painted);
+            if (painted > rows + extra) {
+                process.stdout.write(`\x1b[${painted - (rows + extra)}A`);
+                painted = rows + extra;
             }
         };
         const stdin = process.stdin;
@@ -50,24 +89,48 @@ export async function select(rl, question, options, defaultIndex = 0) {
                     key = s[i];
                     i += 1;
                 }
-                if (key === "\x1b[A" || key === "k") {
-                    idx = (idx - 1 + options.length) % options.length;
-                    render();
-                }
-                else if (key === "\x1b[B" || key === "j") {
-                    idx = (idx + 1) % options.length;
+                if (key === "\x1b[A") {
+                    if (view.length)
+                        cursor = (cursor - 1 + view.length) % view.length;
                     render();
                 }
-                else if (key >= "1" && key <= "9" && Number(key) <= options.length) {
-                    idx = Number(key) - 1;
+                else if (key === "\x1b[B") {
+                    if (view.length)
+                        cursor = (cursor + 1) % view.length;
                     render();
-                    finish(idx);
-                    done = true;
                 }
                 else if (key === "\r" || key === "\n") {
-                    finish(idx);
+                    if (view.length) {
+                        finish(view[cursor]);
+                        done = true;
+                    }
+                }
+                else if (key === "\x7f" || key === "\b") { // backspace edits the filter
+                    if (filter) {
+                        filter = filter.slice(0, -1);
+                        applyFilter();
+                        render();
+                    }
+                }
+                // Number shortcuts only while unfiltered; once you're typing, digits
+                // are part of the search term (model ids are full of them).
+                else if (!filter && !searchable && key >= "1" && key <= "9" && Number(key) <= options.length) {
+                    finish(Number(key) - 1);
                     done = true;
                 }
+                else if (searchable && key >= " " && key !== "\x1b") {
+                    filter += key;
+                    applyFilter();
+                    render();
+                }
+                else if (!searchable && (key === "k" || key === "j")) {
+                    if (view.length)
+                        cursor = (cursor + (key === "k" ? -1 : 1) + view.length) % view.length;
+                    render();
+                }
+                // Ctrl-C or Esc cancels. Returning -1 used to leak out as an array
+                // index, crashing the caller with "cannot read properties of
+                // undefined" — a cancel must be a clean exit, not a bad index.
                 else if (key === "\x03" || key === "\x1b") {
                     finish(-1);
                     done = true;
@@ -78,3 +141,77 @@ export async function select(rl, question, options, defaultIndex = 0) {
         stdin.on("data", onData);
     });
 }
+/**
+ * Read a secret without echoing it. A pasted API key that appears on screen
+ * survives in terminal scrollback, `script` logs, and screen recordings — so
+ * the characters are consumed in raw mode and only a masked length is shown.
+ * Falls back to a normal read when there's no TTY (CI piping a key in).
+ */
+export async function readSecret(rl, promptText, io) {
+    const stdin = io?.stdin ?? process.stdin;
+    const stdout = io?.stdout ?? process.stdout;
+    if (!stdin.isTTY || !stdout.isTTY) {
+        return (await rl.question(promptText)).trim();
+    }
+    guardFn?.(true);
+    rl.pause();
+    const wasRaw = stdin.isRaw ?? false;
+    stdin.setRawMode(true);
+    stdin.resume();
+    stdout.write(promptText);
+    return new Promise((resolve) => {
+        let value = "";
+        const done = () => {
+            stdin.removeListener("data", onData);
+            stdin.setRawMode(wasRaw);
+            guardFn?.(false);
+            rl.resume();
+            stdout.write("\n");
+            resolve(value.trim());
+        };
+        const onData = (buf) => {
+            // Terminals wrap pasted text in bracketed-paste markers, ESC[200~ before
+            // and ESC[201~ after. The ESC byte is below space and gets dropped by the
+            // printable test below, but "[200~" is ordinary text and would be glued
+            // onto the secret — which is how a pasted key ends up rejected as
+            // malformed. Strip the markers, and any other escape sequence, first.
+            const chunk = buf.toString("utf8")
+                .replace(/\x1b\[20[01]~/g, "")
+                .replace(/\x1b\[[0-9;]*[A-Za-z~]/g, "")
+                .replace(/\x1b./g, "");
+            for (const ch of chunk) {
+                if (ch === "\r" || ch === "\n")
+                    return done();
+                if (ch === "\x03") {
+                    value = "";
+                    return done();
+                } // Ctrl-C
+                if (ch === "\x7f" || ch === "\b") { // backspace
+                    if (value.length)
+                        value = value.slice(0, -1);
+                    continue;
+                }
+                // Echo nothing at all, the way sudo and ssh do. Masking characters
+                // would still reveal the key's length, and a hundred dots for a long
+                // key looks like something went wrong.
+                if (ch >= " ")
+                    value += ch;
+            }
+        };
+        stdin.on("data", onData);
+    });
+}
+/**
+ * Arrow-key menu. Cancelling (Ctrl-C or Esc) exits the process cleanly rather
+ * than returning a sentinel index that every caller would have to check —
+ * one forgotten check produced a raw TypeError mid-setup.
+ */
+export async function select(rl, question, options, defaultIndex = 0) {
+    const picked = await selectRaw(rl, question, options, defaultIndex);
+    if (picked < 0 || picked >= options.length) {
+        process.stdout.write("\n");
+        rl.close();
+        process.exit(130); // 128 + SIGINT, the conventional cancel code
+    }
+    return picked;
+}

package/dist/routes.js

@@ -0,0 +1,143 @@
+/**
+ * Vendors, routes, and model aliases.
+ *
+ * Three levels, chosen in order:
+ *   vendor  — who makes the model (Anthropic, OpenAI-compatible)
+ *   route   — how you reach it and who owns authentication
+ *             (direct API key, a cloud provider, a local server, a gateway)
+ *   model   — an alias (sonnet/opus/haiku) or a raw model id
+ *
+ * Aliases exist because the same model has different ids on different routes:
+ * the direct API calls it "claude-sonnet-5" while Bedrock wants a long
+ * region-prefixed inference-profile id. Aliases stay stable; the mapping moves.
+ * For cloud routes the mapping is USER-SUPPLIED — we never guess ids we can't
+ * verify, since a wrong one fails at request time with a confusing error.
+ */
+export const ROUTES = [
+    {
+        id: "anthropic-api",
+        vendor: "Anthropic",
+        label: "Anthropic API",
+        hint: "direct, pay per token with your own key",
+        wire: "anthropic",
+        baseUrl: "https://api.anthropic.com",
+        keyEnv: "ANTHROPIC_API_KEY",
+        implemented: true,
+    },
+    {
+        // AWS's bedrock-mantle endpoint speaks the first-party Messages dialect and
+        // authenticates with a Bedrock API key, so no SigV4 signing is needed —
+        // only the base URL and the credential differ from the direct route.
+        id: "bedrock",
+        vendor: "Anthropic",
+        label: "Amazon Bedrock",
+        hint: "your AWS account owns auth and billing",
+        wire: "anthropic",
+        needsRegion: true,
+        baseUrlTemplate: "https://bedrock-mantle.{region}.api.aws/anthropic",
+        keyEnv: "BEDROCK_API_KEY",
+        aliasesArePinned: true, // Bedrock model ids differ per region/deployment
+        implemented: true,
+    },
+    {
+        id: "vertex",
+        vendor: "Anthropic",
+        label: "Google Vertex AI",
+        hint: "your GCP project owns auth and billing",
+        wire: "anthropic",
+        aliasesArePinned: true,
+        implemented: false, // needs Google OAuth
+    },
+    {
+        id: "openai-api",
+        vendor: "OpenAI",
+        label: "OpenAI API",
+        hint: "direct, with your own key",
+        wire: "openai",
+        baseUrl: "https://api.openai.com/v1",
+        keyEnv: "OPENAI_API_KEY",
+        implemented: true,
+    },
+    {
+        id: "ollama",
+        vendor: "Local",
+        label: "Ollama (local)",
+        hint: "runs on your machine, no key, no cost",
+        wire: "openai",
+        baseUrl: "http://localhost:11434/v1",
+        aliasesArePinned: true,
+        implemented: true,
+    },
+    {
+        id: "custom",
+        vendor: "Other",
+        label: "OpenAI-compatible endpoint",
+        hint: "OpenRouter, Groq, Together, vLLM, a gateway…",
+        wire: "openai",
+        needsBaseUrl: true,
+        keyEnv: "OPENAI_API_KEY",
+        aliasesArePinned: true,
+        implemented: true,
+    },
+];
+export function getRoute(id) {
+    return ROUTES.find((r) => r.id === id);
+}
+export const DEFAULT_REGION = "us-east-1";
+/** Endpoint for a route, substituting the region into region-scoped URLs. */
+export function baseUrlFor(route, region) {
+    if (route.baseUrlTemplate) {
+        return route.baseUrlTemplate.replace("{region}", region || DEFAULT_REGION);
+    }
+    return route.baseUrl;
+}
+/** Vendors in menu order, each with its routes. */
+export function vendors() {
+    const out = [];
+    for (const r of ROUTES) {
+        const found = out.find((v) => v.vendor === r.vendor);
+        if (found)
+            found.routes.push(r);
+        else
+            out.push({ vendor: r.vendor, routes: [r] });
+    }
+    return out;
+}
+/**
+ * Built-in aliases for the direct Anthropic API. Ids on cloud routes differ
+ * per deployment and region, so those are pinned by the user instead.
+ */
+export const ANTHROPIC_MODELS = [
+    { alias: "sonnet", id: "claude-sonnet-5", blurb: "balanced — good default for daily work" },
+    { alias: "opus", id: "claude-opus-5", blurb: "most capable — complex, multi-step work" },
+    { alias: "haiku", id: "claude-haiku-4-5-20251001", blurb: "fastest and cheapest — simple tasks" },
+];
+export const OPENAI_MODELS = [
+    { alias: "gpt", id: "gpt-4o", blurb: "general purpose" },
+    { alias: "mini", id: "gpt-4o-mini", blurb: "cheaper and faster" },
+];
+/** Models offered for a route; empty when ids must be pinned by the user. */
+export function modelsForRoute(route) {
+    if (route.aliasesArePinned)
+        return [];
+    return route.wire === "anthropic" ? ANTHROPIC_MODELS : OPENAI_MODELS;
+}
+/**
+ * Turn whatever the user typed into a concrete model id.
+ * Order: explicit per-route pin > built-in alias > treat it as a raw id.
+ */
+export function resolveModel(input, route, pins = {}) {
+    const key = input.trim();
+    if (pins[key])
+        return pins[key];
+    const hit = modelsForRoute(route).find((m) => m.alias === key);
+    return hit ? hit.id : key;
+}
+/** Reverse lookup: show "sonnet (claude-sonnet-5)" instead of a bare id. */
+export function describeModel(id, route, pins = {}) {
+    const pinned = Object.entries(pins).find(([, v]) => v === id);
+    if (pinned)
+        return `${pinned[0]} (${id})`;
+    const hit = modelsForRoute(route).find((m) => m.id === id);
+    return hit ? `${hit.alias} (${id})` : id;
+}

package/dist/settings.js

@@ -0,0 +1,55 @@
+/**
+ * Global settings: ~/.faber/settings.json
+ *
+ * Holds named profiles — a route, a model, and any endpoint or credential
+ * REFERENCE that route needs. Credentials themselves are never stored here:
+ * a profile names the environment variable to read (`apiKeyEnv`), so this file
+ * stays safe to sync between machines or check into a dotfiles repo.
+ *
+ * Resolution order, highest first:
+ *   env vars  >  <project>/.faber/config.json  >  active profile  >  defaults
+ * Project settings beat the global profile so a repo can pin its own model,
+ * and env vars beat everything so CI and one-off overrides always work.
+ */
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+export const DEFAULT_SETTINGS = {
+    activeProfile: "default",
+    profiles: {
+        default: { route: "anthropic-api", model: "sonnet", apiKeyEnv: "ANTHROPIC_API_KEY" },
+    },
+};
+export function settingsPath() {
+    return path.join(os.homedir(), ".faber", "settings.json");
+}
+export function loadSettings(file = settingsPath()) {
+    try {
+        const raw = JSON.parse(fs.readFileSync(file, "utf8"));
+        const profiles = raw.profiles && typeof raw.profiles === "object"
+            ? raw.profiles
+            : DEFAULT_SETTINGS.profiles;
+        const active = typeof raw.activeProfile === "string" && profiles[raw.activeProfile]
+            ? raw.activeProfile
+            : Object.keys(profiles)[0] ?? "default";
+        return { activeProfile: active, profiles };
+    }
+    catch {
+        return structuredClone(DEFAULT_SETTINGS); // absent or malformed -> defaults
+    }
+}
+export function saveSettings(s, file = settingsPath()) {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, JSON.stringify(s, null, 2) + "\n");
+}
+export function activeProfile(s) {
+    return s.profiles[s.activeProfile] ?? DEFAULT_SETTINGS.profiles.default;
+}
+/** Update the active profile in place and persist. */
+export function updateActive(patch, file = settingsPath()) {
+    const s = loadSettings(file);
+    const name = s.activeProfile;
+    s.profiles[name] = { ...activeProfile(s), ...patch };
+    saveSettings(s, file);
+    return s;
+}

package/dist/sigv4.js

@@ -0,0 +1,177 @@
+/**
+ * AWS SigV4 request signing.
+ *
+ * Why this exists: in SageMaker Studio, EC2, ECS, Lambda and anywhere else AWS
+ * injects an execution role, there IS no API key — credentials arrive as an
+ * access key / secret / session token trio, and requests are authenticated by
+ * signing them. That's the natural auth path in those environments, and a
+ * Bedrock API key would be a second, unnecessary credential.
+ *
+ * Implemented directly rather than pulling in the AWS SDK: the signing
+ * algorithm is ~80 lines of HMAC chaining, and the SDK would add dozens of
+ * transitive dependencies to a tool whose whole install story is "zero native
+ * deps, nothing to compile".
+ *
+ * Verified against the signing test vectors AWS publishes for the algorithm.
+ */
+import { createHash, createHmac } from "node:crypto";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+const sha256 = (data) => createHash("sha256").update(data).digest("hex");
+const hmac = (key, data) => createHmac("sha256", key).update(data, "utf8").digest();
+/** ISO8601 basic format: 20260808T210000Z */
+export function amzDate(d = new Date()) {
+    return d.toISOString().replace(/[:-]|\.\d{3}/g, "");
+}
+/**
+ * Canonical request -> string to sign -> signing key -> Authorization header.
+ * Header names are lowercased and sorted; the payload is hashed. Any deviation
+ * produces a signature mismatch, so the ordering here is load-bearing.
+ */
+export function signRequest(opts) {
+    const { method, body, region, service, credentials } = opts;
+    const url = new URL(opts.url);
+    const now = opts.now ?? new Date();
+    const stamp = amzDate(now);
+    const date = stamp.slice(0, 8);
+    const headers = {
+        host: url.host,
+        "x-amz-date": stamp,
+        ...Object.fromEntries(Object.entries(opts.headers ?? {}).map(([k, v]) => [k.toLowerCase(), v])),
+    };
+    if (credentials.sessionToken)
+        headers["x-amz-security-token"] = credentials.sessionToken;
+    const signedHeaderNames = Object.keys(headers).sort();
+    const canonicalHeaders = signedHeaderNames
+        .map((h) => `${h}:${headers[h].trim().replace(/\s+/g, " ")}\n`)
+        .join("");
+    const signedHeaders = signedHeaderNames.join(";");
+    // query params must be sorted and percent-encoded
+    const canonicalQuery = [...url.searchParams.entries()]
+        .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
+        .map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`)
+        .join("&");
+    const payloadHash = sha256(body);
+    const canonicalRequest = [
+        method.toUpperCase(),
+        url.pathname || "/",
+        canonicalQuery,
+        canonicalHeaders,
+        signedHeaders,
+        payloadHash,
+    ].join("\n");
+    const scope = `${date}/${region}/${service}/aws4_request`;
+    const stringToSign = [
+        "AWS4-HMAC-SHA256",
+        stamp,
+        scope,
+        sha256(canonicalRequest),
+    ].join("\n");
+    const kDate = hmac(`AWS4${credentials.secretAccessKey}`, date);
+    const kRegion = hmac(kDate, region);
+    const kService = hmac(kRegion, service);
+    const kSigning = hmac(kService, "aws4_request");
+    const signature = createHmac("sha256", kSigning).update(stringToSign, "utf8").digest("hex");
+    return {
+        ...headers,
+        authorization: `AWS4-HMAC-SHA256 Credential=${credentials.accessKeyId}/${scope}, ` +
+            `SignedHeaders=${signedHeaders}, Signature=${signature}`,
+        "x-amz-content-sha256": payloadHash,
+    };
+}
+// ────────────────────────────────────────────── credential discovery
+/**
+ * Find AWS credentials the way the SDKs do, in the same order. In SageMaker
+ * Studio, ECS and Lambda the environment or the container endpoint is
+ * populated automatically, so this returns credentials with no setup at all.
+ */
+export async function discoverAwsCredentials(profileName = process.env.AWS_PROFILE ?? "default") {
+    // 1. environment (SageMaker Studio, CI, explicit exports)
+    if (process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SECRET_ACCESS_KEY) {
+        return {
+            accessKeyId: process.env.AWS_ACCESS_KEY_ID,
+            secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY,
+            sessionToken: process.env.AWS_SESSION_TOKEN,
+            source: "environment",
+        };
+    }
+    // 2. container credential endpoint (ECS, SageMaker, CodeBuild)
+    const relUri = process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI;
+    const fullUri = process.env.AWS_CONTAINER_CREDENTIALS_FULL_URI;
+    if (relUri || fullUri) {
+        const url = fullUri ?? `http://169.254.170.2${relUri}`;
+        const creds = await fetchContainerCredentials(url);
+        if (creds)
+            return creds;
+    }
+    // 3. shared credentials file (a laptop with `aws configure` run)
+    const fromFile = readSharedCredentials(profileName);
+    if (fromFile)
+        return fromFile;
+    return undefined;
+}
+async function fetchContainerCredentials(url) {
+    try {
+        const ctl = new AbortController();
+        const timer = setTimeout(() => ctl.abort(), 3000);
+        const headers = {};
+        const token = process.env.AWS_CONTAINER_AUTHORIZATION_TOKEN;
+        if (token)
+            headers.authorization = token;
+        const res = await fetch(url, { headers, signal: ctl.signal });
+        clearTimeout(timer);
+        if (!res.ok)
+            return undefined;
+        const b = await res.json();
+        if (!b.AccessKeyId || !b.SecretAccessKey)
+            return undefined;
+        return {
+            accessKeyId: b.AccessKeyId,
+            secretAccessKey: b.SecretAccessKey,
+            sessionToken: b.Token,
+            source: "container credentials endpoint",
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Minimal INI reader for ~/.aws/credentials — no dependency needed. */
+export function readSharedCredentials(profileName = "default", file = path.join(os.homedir(), ".aws", "credentials")) {
+    let text;
+    try {
+        text = fs.readFileSync(file, "utf8");
+    }
+    catch {
+        return undefined;
+    }
+    const wanted = profileName.replace(/^profile\s+/, "");
+    let current = "";
+    const section = {};
+    for (const raw of text.split("\n")) {
+        const line = raw.split(/[#;]/)[0].trim();
+        if (!line)
+            continue;
+        const header = /^\[(.+)\]$/.exec(line);
+        if (header) {
+            current = header[1].replace(/^profile\s+/, "").trim();
+            continue;
+        }
+        if (current !== wanted)
+            continue;
+        const eq = line.indexOf("=");
+        if (eq === -1)
+            continue;
+        section[line.slice(0, eq).trim().toLowerCase()] = line.slice(eq + 1).trim();
+    }
+    const id = section["aws_access_key_id"], secret = section["aws_secret_access_key"];
+    if (!id || !secret)
+        return undefined;
+    return {
+        accessKeyId: id,
+        secretAccessKey: secret,
+        sessionToken: section["aws_session_token"],
+        source: `~/.aws/credentials [${wanted}]`,
+    };
+}