gitdog 0.0.0-stage → 0.1.1

package/dist/auth.d.ts

@@ -0,0 +1,13 @@
+import { SessionStore } from "./storage.js";
+import { type Ui } from "./ui.js";
+export declare const CALLBACK_PATH = "/gitdog/callback";
+export declare function openBrowser(url: string, signal?: AbortSignal): Promise<boolean>;
+export declare function createLoginListener(timeoutMs?: number): Promise<{
+    redirectTo: string;
+    signal: AbortSignal;
+    code: Promise<string>;
+    close: () => Promise<void>;
+}>;
+export declare function validateAuthRedirect(value: string, apiUrl: string): void;
+export declare function login(apiUrl: string, siteUrl: string, ui: Ui, noBrowser?: boolean): Promise<void>;
+export declare function logout(ui: Ui, localOnly?: boolean, store?: SessionStore): Promise<void>;

package/dist/auth.js

@@ -0,0 +1,243 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { createServer } from "node:http";
+import { randomBytes } from "node:crypto";
+import { httpClient, invoke } from "./client.js";
+import { SessionStore, validTokens, tokenExpiresSoon } from "./storage.js";
+import { asRecord } from "./ui.js";
+const runFile = promisify(execFile);
+export const CALLBACK_PATH = "/gitdog/callback";
+export async function openBrowser(url, signal) {
+    signal?.throwIfAborted();
+    const parsed = new URL(url);
+    if (!["https:", "http:"].includes(parsed.protocol))
+        throw new Error("Invalid browser URL.");
+    try {
+        switch (process.platform) {
+            case "darwin":
+                await runFile("open", [url], { timeout: 10_000, signal });
+                break;
+            case "win32":
+                await runFile("rundll32.exe", ["url.dll,FileProtocolHandler", url], {
+                    timeout: 10_000,
+                    signal,
+                });
+                break;
+            default:
+                await runFile("xdg-open", [url], { timeout: 10_000, signal });
+        }
+        return true;
+    }
+    catch {
+        signal?.throwIfAborted();
+        return false;
+    }
+}
+export async function createLoginListener(timeoutMs = 300_000) {
+    const cancellation = new AbortController();
+    const state = randomBytes(32).toString("hex");
+    let resolveCode;
+    let rejectCode;
+    const code = new Promise((resolve, reject) => {
+        resolveCode = resolve;
+        rejectCode = reject;
+    });
+    void code.catch(() => { });
+    let expectedHost = "";
+    let settled = false;
+    const finish = (error, value) => {
+        if (settled)
+            return;
+        settled = true;
+        clearTimeout(timer);
+        if (error) {
+            cancellation.abort(error);
+            rejectCode(error);
+        }
+        else
+            resolveCode(value);
+    };
+    const server = createServer({ maxHeaderSize: 8192, requestTimeout: 10_000, headersTimeout: 5000 }, (request, response) => {
+        response.setHeader("Content-Type", "text/plain; charset=utf-8");
+        response.setHeader("Cache-Control", "no-store");
+        response.setHeader("Referrer-Policy", "no-referrer");
+        response.setHeader("Content-Security-Policy", "default-src 'none'; frame-ancestors 'none'");
+        let url;
+        try {
+            url = new URL(request.url ?? "/", `http://${expectedHost}`);
+        }
+        catch {
+            response.writeHead(400).end("Invalid request URL.");
+            return;
+        }
+        if (request.method !== "GET" ||
+            request.headers.host !== expectedHost ||
+            url.origin !== `http://${expectedHost}` ||
+            url.pathname !== CALLBACK_PATH) {
+            response.writeHead(404).end("Not found.");
+            return;
+        }
+        if (url.searchParams.getAll("state").length !== 1 ||
+            url.searchParams.get("state") !== state) {
+            response
+                .writeHead(400)
+                .end("Invalid sign-in state. Return to your terminal and try again.");
+            return;
+        }
+        if (settled) {
+            response.writeHead(410).end("This sign-in has already completed.");
+            return;
+        }
+        if (url.searchParams.has("error")) {
+            response
+                .writeHead(400)
+                .end("Gitdog sign-in was not completed. Return to your terminal.");
+            finish(new Error("GitHub sign-in was declined or failed."));
+            return;
+        }
+        const value = url.searchParams.get("code");
+        if (!url.searchParams.has("code")) {
+            response
+                .writeHead(400)
+                .end("Gitdog sign-in was not completed. Return to your terminal.");
+            finish(new Error("GitHub sign-in was declined or failed."));
+            return;
+        }
+        if (url.searchParams.getAll("code").length !== 1 ||
+            !value ||
+            value.length > 4096) {
+            response.writeHead(400).end("Missing or invalid sign-in code.");
+            return;
+        }
+        response.end("Gitdog received your sign-in. Return to your terminal to finish. You can close this tab.");
+        finish(undefined, value);
+    });
+    const timer = setTimeout(() => finish(new Error("Sign-in timed out. Run gitdog login to try again.")), timeoutMs);
+    try {
+        await new Promise((resolve, reject) => {
+            server.once("error", reject);
+            server.listen(0, "127.0.0.1", () => {
+                server.off("error", reject);
+                resolve();
+            });
+        });
+    }
+    catch (error) {
+        clearTimeout(timer);
+        throw error;
+    }
+    server.on("error", () => finish(new Error("The local sign-in listener failed.")));
+    const address = server.address();
+    if (!address || typeof address === "string")
+        throw new Error("Could not start the local sign-in listener.");
+    expectedHost = `127.0.0.1:${address.port}`;
+    const redirectTo = `http://${expectedHost}${CALLBACK_PATH}?state=${state}`;
+    const onInterrupt = () => {
+        const error = new Error("Sign-in cancelled.");
+        cancellation.abort(error);
+        finish(error);
+    };
+    process.once("SIGINT", onInterrupt);
+    return {
+        redirectTo,
+        signal: cancellation.signal,
+        code,
+        close: async () => {
+            finish(new Error("Sign-in cancelled."));
+            process.off("SIGINT", onInterrupt);
+            server.closeAllConnections();
+            await new Promise((resolve) => server.close(() => resolve()));
+        },
+    };
+}
+export function validateAuthRedirect(value, apiUrl) {
+    const url = new URL(value);
+    const api = new URL(apiUrl);
+    const siteOrigin = api.origin.replace(/\.convex\.cloud$/, ".convex.site");
+    if (![api.origin, siteOrigin].includes(url.origin) ||
+        url.pathname !== "/api/auth/signin/github" ||
+        url.username ||
+        url.password ||
+        url.hash) {
+        throw new Error("The server returned an unexpected sign-in URL.");
+    }
+}
+export async function login(apiUrl, siteUrl, ui, noBrowser = false) {
+    if (ui.json)
+        throw new Error("Browser login needs human interaction. Omit --json; use GITDOG_TOKEN for automation.");
+    ui.banner();
+    const listener = await createLoginListener();
+    const client = httpClient(apiUrl, 30_000, listener.signal);
+    try {
+        ui.info("1 / 2  Sign in with your GitHub account");
+        const result = asRecord(await invoke(client, "action", "auth:signIn", {
+            provider: "github",
+            params: { redirectTo: listener.redirectTo },
+        }));
+        listener.signal.throwIfAborted();
+        if (typeof result?.redirect !== "string" ||
+            typeof result.verifier !== "string")
+            throw new Error("The server did not start GitHub sign-in.");
+        validateAuthRedirect(result.redirect, apiUrl);
+        ui.info(`Open this URL in a browser on this computer:\n${result.redirect}\n`);
+        if (!noBrowser && !(await openBrowser(result.redirect, listener.signal)))
+            ui.info("Could not open your browser automatically. Use the URL above.");
+        ui.info("Waiting for GitHub authorization… (Ctrl+C to cancel)");
+        const code = await listener.code;
+        listener.signal.throwIfAborted();
+        ui.info("2 / 2  Securely save your Gitdog session");
+        let exchange;
+        try {
+            exchange = await invoke(client, "action", "auth:signIn", {
+                params: { code },
+                verifier: result.verifier,
+            });
+        }
+        catch {
+            listener.signal.throwIfAborted();
+            throw new Error("Could not finish sign-in. Check that the CLI loopback callback is deployed, then run gitdog login again.");
+        }
+        const tokens = asRecord(exchange)?.tokens;
+        if (!validTokens(tokens))
+            throw new Error("Sign-in did not return a session. Run gitdog login again.");
+        client.setAuth(tokens.token);
+        const user = asRecord(await invoke(client, "query", "users/query:getCurrentUser"));
+        if (!user)
+            throw new Error("Gitdog could not verify the signed-in account.");
+        const store = new SessionStore();
+        await store.locked(() => store.save({ ...tokens, apiUrl, siteUrl }, listener.signal), undefined, listener.signal);
+        listener.signal.throwIfAborted();
+        ui.output(`✓ Signed in as ${String(user.name ?? "GitHub user")}.`);
+        if (user.requiresCurrentLegalAttestation)
+            ui.info(`Complete account consent at ${siteUrl}/legal/consent before running AI workflows.`);
+        ui.info("Next: gitdog init");
+    }
+    finally {
+        await listener.close();
+    }
+}
+export async function logout(ui, localOnly = false, store = new SessionStore()) {
+    if (process.env.GITDOG_TOKEN && !localOnly)
+        throw new Error("GITDOG_TOKEN is set. Unset it to log out a saved session, or use --local.");
+    let revoked = false;
+    await store.locked(async () => {
+        let session = localOnly ? undefined : await store.read();
+        if (session) {
+            const client = httpClient(session.apiUrl, 30_000);
+            if (tokenExpiresSoon(session.token)) {
+                const result = asRecord(await invoke(client, "action", "auth:signIn", {
+                    refreshToken: session.refreshToken,
+                }));
+                if (!validTokens(result?.tokens))
+                    throw new Error("Could not refresh this session to revoke it. Run logout --local to remove only local credentials.");
+                session = { ...session, ...result.tokens };
+                await store.save(session);
+            }
+            client.setAuth(session.token);
+            await invoke(client, "action", "auth:signOut");
+            revoked = true;
+        }
+        await store.clear();
+    });
+    ui.output({ loggedOut: true, revoked });
+}

package/dist/catalog.d.ts

@@ -0,0 +1,11 @@
+import type { Kind } from "./client.js";
+export declare const API_CATALOG: ReadonlyArray<{
+    path: string;
+    kind: Kind;
+    args: string;
+}>;
+export declare function publicOperation(path: string): {
+    path: string;
+    kind: Kind;
+    args: string;
+};

package/dist/catalog.js

@@ -0,0 +1,8 @@
+import catalog from "./api-catalog.json" with { type: "json" };
+export const API_CATALOG = catalog;
+export function publicOperation(path) {
+    const operation = API_CATALOG.find((entry) => entry.path === path);
+    if (!operation)
+        throw new Error("Unknown public operation. Run gitdog api list. Internal functions cannot be called.");
+    return operation;
+}

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,31 @@
+#!/usr/bin/env node
+import { CommanderError } from "commander";
+import { createProgram, normalizeArgv } from "./commands.js";
+import { clean } from "./ui.js";
+const argv = normalizeArgv(process.argv.slice(2));
+const json = argv.includes("--json");
+const program = createProgram();
+program.exitOverride();
+program.configureOutput({
+    writeErr: (value) => {
+        process.stderr.write(clean(value));
+    },
+});
+if (json)
+    program.configureOutput({ writeErr: () => { }, outputError: () => { } });
+try {
+    await program.parseAsync(argv, { from: "user" });
+}
+catch (error) {
+    if (error instanceof CommanderError && error.exitCode === 0)
+        process.exitCode = 0;
+    else {
+        const raw = error instanceof Error ? error.message : "Unexpected error.";
+        const message = clean(raw);
+        if (json)
+            process.stderr.write(`${JSON.stringify({ error: { message } })}\n`);
+        else if (!(error instanceof CommanderError))
+            process.stderr.write(`\nError: ${message}\n`);
+        process.exitCode = error instanceof CommanderError ? error.exitCode : 1;
+    }
+}

package/dist/client.d.ts

@@ -0,0 +1,25 @@
+import { ConvexHttpClient } from "convex/browser";
+import type { Value } from "convex/values";
+import { SessionStore } from "./storage.js";
+export type Kind = "query" | "mutation" | "action";
+export type Args = Record<string, Value>;
+export type CallOptions = {
+    timeoutMs?: number;
+};
+export interface Api {
+    call<T = unknown>(kind: Kind, path: string, args?: Args, options?: CallOptions): Promise<T>;
+}
+export declare function httpClient(url: string, timeout?: number, signal?: AbortSignal): ConvexHttpClient;
+export declare function invoke<T = unknown>(client: ConvexHttpClient, kind: Kind, path: string, args?: Args): Promise<T>;
+export declare class GitdogApi implements Api {
+    readonly apiUrl: string;
+    readonly siteUrl: string;
+    private store;
+    private readonly keyFile?;
+    private client;
+    private session?;
+    private ready;
+    constructor(apiUrl: string, siteUrl: string, store?: SessionStore, keyFile?: string | undefined);
+    private authenticate;
+    call<T = unknown>(kind: Kind, path: string, args?: Args, options?: CallOptions): Promise<T>;
+}

package/dist/client.js

@@ -0,0 +1,109 @@
+import { ConvexHttpClient } from "convex/browser";
+import { makeFunctionReference } from "convex/server";
+import { SessionStore, tokenExpiresSoon, validTokens, } from "./storage.js";
+import { asRecord } from "./ui.js";
+import { callWithProjectKey } from "./api-keys.js";
+function remainingTimeout(deadline) {
+    if (deadline === undefined)
+        return 120_000;
+    const remaining = Math.ceil(deadline - Date.now());
+    if (remaining <= 0)
+        throw new Error("The request timed out.");
+    return remaining;
+}
+export function httpClient(url, timeout = 120_000, signal) {
+    return new ConvexHttpClient(url, {
+        logger: false,
+        skipConvexDeploymentUrlCheck: true,
+        fetch: (input, init) => fetch(input, {
+            ...init,
+            redirect: "error",
+            signal: signal
+                ? AbortSignal.any([signal, AbortSignal.timeout(timeout)])
+                : AbortSignal.timeout(timeout),
+        }),
+    });
+}
+export async function invoke(client, kind, path, args = {}) {
+    switch (kind) {
+        case "query":
+            return (await client.query(makeFunctionReference(path), args));
+        case "mutation":
+            return (await client.mutation(makeFunctionReference(path), args));
+        case "action":
+            return (await client.action(makeFunctionReference(path), args));
+    }
+}
+export class GitdogApi {
+    apiUrl;
+    siteUrl;
+    store;
+    keyFile;
+    client;
+    session;
+    ready = false;
+    constructor(apiUrl, siteUrl, store = new SessionStore(), keyFile) {
+        this.apiUrl = apiUrl;
+        this.siteUrl = siteUrl;
+        this.store = store;
+        this.keyFile = keyFile;
+        this.client = httpClient(apiUrl);
+    }
+    async authenticate(deadline) {
+        if (this.ready && (!this.session || !tokenExpiresSoon(this.session.token)))
+            return;
+        const token = process.env.GITDOG_TOKEN;
+        if (token) {
+            this.client.setAuth(token);
+            this.ready = true;
+            return;
+        }
+        const initial = await this.store.read();
+        if (!initial)
+            throw new Error("You are not logged in. Run gitdog login.");
+        if (initial.apiUrl !== this.apiUrl)
+            throw new Error("This session belongs to another API URL. Run gitdog login --api-url <url> first.");
+        this.session = initial;
+        if (tokenExpiresSoon(initial.token)) {
+            this.session = await this.store.locked(async () => {
+                const current = await this.store.read();
+                if (!current || current.apiUrl !== this.apiUrl)
+                    throw new Error("Session changed. Run gitdog login again.");
+                if (!tokenExpiresSoon(current.token))
+                    return current;
+                let result;
+                try {
+                    result = await invoke(httpClient(this.apiUrl, remainingTimeout(deadline)), "action", "auth:signIn", {
+                        refreshToken: current.refreshToken,
+                    });
+                }
+                catch {
+                    throw new Error("Could not refresh your session. Check your connection or run gitdog login again.");
+                }
+                const tokens = asRecord(result)?.tokens;
+                if (!validTokens(tokens))
+                    throw new Error("Your session expired. Run gitdog login again.");
+                const updated = { ...current, ...tokens };
+                await this.store.save(updated);
+                return updated;
+            }, deadline);
+        }
+        this.client.setAuth(this.session.token);
+        this.ready = true;
+    }
+    async call(kind, path, args = {}, options) {
+        const deadline = options?.timeoutMs === undefined
+            ? undefined
+            : Date.now() + options.timeoutMs;
+        const keyFile = this.keyFile ?? process.env.GITDOG_API_KEY_FILE;
+        if (keyFile || process.env.GITDOG_API_KEY)
+            return callWithProjectKey(this.apiUrl, keyFile, process.env.GITDOG_API_KEY, kind, path, args, remainingTimeout(deadline));
+        await this.authenticate(deadline);
+        if (options?.timeoutMs !== undefined) {
+            const client = httpClient(this.apiUrl, remainingTimeout(deadline));
+            client.setAuth(process.env.GITDOG_TOKEN ?? this.session.token);
+            return invoke(client, kind, path, args);
+        }
+        return invoke(this.client, kind, path, args);
+    }
+}

package/dist/commands.d.ts

@@ -0,0 +1,9 @@
+import { Command } from "commander";
+import { type Api, type Args } from "./client.js";
+import { Ui } from "./ui.js";
+export declare function jsonArguments(value: string): Promise<Args>;
+export declare function createProgram(dependencies?: {
+    api?: Api;
+    ui?: Ui;
+}): Command;
+export declare function normalizeArgv(argv: string[]): string[];