hub-launch 1.22.0 → 1.24.0

package/dist/commands/launch.js

@@ -19,11 +19,11 @@ import { loadGitHubToken } from './login.js';
 import { resolveProject } from '../utils/project-resolver.js';
 import { HULA_PROJECT_URL } from '../config/constants.js';
 import { updateUsageTierInConfig } from '../utils/config-writer.js';
-import { resolveEphemeralCredentials } from '../utils/ephemeral-credentials.js';
+import { resolveProviderCredentials, validateTokenFormat, } from '../utils/provider-credentials.js';
 import { readClientSessionId } from '../utils/client-session.js';
 import { input, UserCancelledError } from '../utils/prompts.js';
 import { findGitRoot } from '../utils/git-utils.js';
-import { upsertAnthropicApiKey } from '../utils/config-file-edit.js';
+import { upsertProviderApiKey } from '../utils/config-file-edit.js';
 import { validateNoReservedVars, readAndFilterEnvVars, RESERVED_ENV_VARS, } from '../utils/env-vars.js';
 const DEFAULT_CONTAINER_RESOURCES = { cpu: 2, memory: 4, disk: 10 };
 /**
@@ -69,7 +69,8 @@ export function launchCommand(program, config) {
         //   'Run in test mode (server uses a mock Claude — fast E2E run, still creates a real PR)',
         // )
         .option('--handoff <username>', 'Assign the created issue to this GitHub user')
-        .option('--anthropic-key <key>', 'Anthropic API key for Claude Code (ephemeral)')
+        .option('--provider <type>', 'LLM provider: claude | openai | openrouter (default: config or claude)')
+        .option('--provider-key <key>', 'Provider credential (ephemeral; never stored server-side beyond the run)')
         .option('--container-cpu <n>', 'vCPU cores for the sandbox (1–32)', parseInt)
         .option('--container-memory <n>', 'GiB RAM for the sandbox (1–128)', parseInt)
         .option('--container-disk <n>', 'GiB disk for the sandbox (5–200)', parseInt)
@@ -318,16 +319,56 @@ export function resolveSteps(configSteps, skipRegressionFlag, legacyRegressionFl
     }
     return { steps: Object.keys(steps).length > 0 ? steps : undefined };
 }
-async function validateLaunchCredentials(anthropicApiKey, githubToken) {
+/**
+ * Per-provider live-validation endpoint + copy. Claude accepts both subscription
+ * OAuth tokens (Bearer) and API keys (x-api-key); openai/openrouter use Bearer.
+ * See the endpoint table in the multi-provider plan (Requirements §4).
+ */
+function buildProviderValidation(providerType, authToken) {
+    switch (providerType) {
+        case 'claude': {
+            const isApiKey = authToken.startsWith('sk-ant-api');
+            return {
+                url: 'https://api.anthropic.com/v1/models',
+                headers: isApiKey
+                    ? { 'x-api-key': authToken, 'anthropic-version': '2023-06-01' }
+                    : {
+                        Authorization: `Bearer ${authToken}`,
+                        'anthropic-version': '2023-06-01',
+                    },
+                readyLabel: 'Claude Code is ready to go 🤖',
+                providerName: 'Anthropic',
+                invalidHint: 'Generate a new credential — a subscription OAuth token at https://claude.ai/settings (Pro/Max) or an API key at https://platform.claude.com.',
+                quotaHint: 'Your Anthropic account is out of quota — check your plan and usage.',
+            };
+        }
+        case 'openai':
+            return {
+                url: 'https://api.openai.com/v1/models',
+                headers: { Authorization: `Bearer ${authToken}` },
+                readyLabel: 'Codex (OpenAI) is ready to go 🤖',
+                providerName: 'OpenAI',
+                invalidHint: 'Create a new API key at https://platform.openai.com/api-keys.',
+                quotaHint: 'Your OpenAI account is out of quota — check billing at https://platform.openai.com/account/billing.',
+            };
+        case 'openrouter':
+            return {
+                url: 'https://openrouter.ai/api/v1/key',
+                headers: { Authorization: `Bearer ${authToken}` },
+                readyLabel: 'Codex (OpenRouter) is ready to go 🤖',
+                providerName: 'OpenRouter',
+                invalidHint: 'Create a new key at https://openrouter.ai/settings/keys.',
+                quotaHint: 'Your OpenRouter account is out of credits — top up at https://openrouter.ai/settings/credits.',
+            };
+    }
+}
+async function validateProviderCredentials(providerType, authToken, githubToken) {
     console.log('Checking your credentials before launch...\n');
-    // --- Anthropic ---
-    const anthropicAuthHeaders = {
-        Authorization: `Bearer ${anthropicApiKey}`,
-        'anthropic-version': '2023-06-01',
-    };
-    const anthropicPromise = axios
-        .get('https://api.anthropic.com/v1/models', {
-        headers: anthropicAuthHeaders,
+    // --- LLM provider ---
+    const providerCfg = buildProviderValidation(providerType, authToken);
+    const providerPromise = axios
+        .get(providerCfg.url, {
+        headers: providerCfg.headers,
         timeout: 8000,
     })
         .then(() => ({ ok: true }))
@@ -335,20 +376,37 @@ async function validateLaunchCredentials(anthropicApiKey, githubToken) {
         if (axios.isAxiosError(err) &&
             err.response &&
             err.response.status < 500) {
-            // Any 4xx → token is rejected (invalid, expired, or forbidden)
+            const status = err.response.status;
+            if (status === 429) {
+                return {
+                    ok: false,
+                    hard: true,
+                    message: `${providerCfg.providerName} rejected the request — rate limit or quota exceeded.`,
+                    hint: providerCfg.quotaHint,
+                };
+            }
+            if (status === 403) {
+                return {
+                    ok: false,
+                    hard: true,
+                    message: `${providerCfg.providerName} credential is forbidden (account suspended or payment required).`,
+                    hint: providerCfg.invalidHint,
+                };
+            }
+            // 401 and any other 4xx → credential is rejected (invalid or expired)
             return {
                 ok: false,
                 hard: true,
-                message: 'Anthropic OAuth token is invalid or expired.',
-                hint: 'Generate a new OAuth token at https://claude.ai/settings (requires a paid Claude.ai plan — Pro or Max).',
+                message: `${providerCfg.providerName} credential is invalid or expired.`,
+                hint: providerCfg.invalidHint,
             };
         }
         // Network error / timeout / 5xx — non-blocking warning
         return {
             ok: false,
             hard: false,
-            message: 'Could not reach the Anthropic API to verify your OAuth token (network issue).',
-            hint: 'Proceeding anyway — the server will validate the token on startup.',
+            message: `Could not reach the ${providerCfg.providerName} API to verify your credential (network issue).`,
+            hint: 'Proceeding anyway — the server will validate the credential on startup.',
         };
     });
     // --- GitHub ---
@@ -382,22 +440,22 @@ async function validateLaunchCredentials(anthropicApiKey, githubToken) {
             message: 'No GitHub token found.',
             hint: "Run 'hula login' to authenticate with GitHub first.",
         });
-    const [anthropicResult, githubResult] = await Promise.allSettled([
-        anthropicPromise,
+    const [providerResult, githubResult] = await Promise.allSettled([
+        providerPromise,
         githubPromise,
     ]);
     let hasHardFailure = false;
-    // Print Anthropic result
-    const result = anthropicResult.status === 'fulfilled'
-        ? anthropicResult.value
+    // Print LLM provider result
+    const result = providerResult.status === 'fulfilled'
+        ? providerResult.value
         : {
             ok: false,
             hard: false,
-            message: 'Unexpected error during Anthropic validation.',
+            message: `Unexpected error during ${providerCfg.providerName} validation.`,
             hint: 'Proceeding anyway.',
         };
     if (result.ok) {
-        console.log(`  ${chalk.green('✓')} Anthropic OAuth token is valid — Claude Code is ready to go 🤖`);
+        console.log(`  ${chalk.green('✓')} ${providerCfg.providerName} credential is valid — ${providerCfg.readyLabel}`);
     }
     else if (result.hard) {
         console.error(`  ${chalk.red('✗')} ${result.message}`);
@@ -434,43 +492,104 @@ async function validateLaunchCredentials(anthropicApiKey, githubToken) {
         process.exit(1);
     }
 }
-function printFreeTierError() {
-    logger.error('You cannot run launch because you are on the free tier.');
+/**
+ * Billing page of the server the CLI is actually talking to. Never hardcode
+ * hublaunch.site — a preview or self-hosted deployment must point the user at
+ * its own dashboard, otherwise they "fix" billing on the wrong instance.
+ */
+function billingUrl(serverUrl) {
+    return `${serverUrl.replace(/\/$/, '')}/dashboard/billing`;
+}
+/**
+ * Explain why a launch was refused for billing reasons.
+ *
+ * `subscriptionStatus` is what the server reported for this account (`null`
+ * when it has never had a subscription, so a free trial is still available);
+ * `serverError` is the server's own 402 message when the refusal came from the
+ * launch endpoint rather than the pre-flight check — it is more specific than
+ * anything the CLI can infer ("Out of PR credits — buy more to launch"), so it
+ * wins. `actionUrl` is the `upgradeUrl`/`buyCreditsUrl` from that same payload.
+ *
+ * With none of them supplied, the wording stays generic rather than asserting a
+ * tier the CLI has not confirmed.
+ */
+function printNoProAccessError(opts) {
+    const { serverUrl, subscriptionStatus, serverError, actionUrl } = opts;
+    const url = actionUrl || billingUrl(serverUrl);
+    const neverSubscribed = subscriptionStatus === null || subscriptionStatus === undefined;
+    const paymentFailed = subscriptionStatus === 'past_due' || subscriptionStatus === 'unpaid';
+    if (serverError) {
+        logger.error(serverError);
+    }
+    else if (neverSubscribed) {
+        logger.error('Launching requires Pro — this account has no subscription yet.');
+    }
+    else if (subscriptionStatus === 'canceled') {
+        logger.error('Launching requires Pro — your subscription was cancelled.');
+    }
+    else if (paymentFailed) {
+        logger.error('Launching requires Pro — your last payment failed.');
+    }
+    else {
+        logger.error(`Launching requires Pro — your subscription is ${subscriptionStatus}.`);
+    }
     logger.blank();
     logger.info('Your options:');
+    if (neverSubscribed) {
+        logger.info(`  • Start a free trial at ${url} — no charge today, cancel anytime.`);
+    }
+    else if (paymentFailed) {
+        logger.info(`  • Update your payment method at ${url}.`);
+    }
+    else {
+        logger.info(`  • Subscribe or top up credits at ${url}.`);
+    }
     logger.info('  • Run /hula-create, which will assign the issue to Copilot on GitHub.');
-    logger.info('  • Go to https://www.hublaunch.site and upgrade your subscription to Pro.');
     logger.blank();
-    logger.info('The Pro tier allows launching as many plans as you like, subject to the constraints of your own Anthropic subscription.');
+    logger.info('The Pro tier allows launching as many plans as you like, subject to the constraints of your own LLM provider (Claude, OpenAI, or OpenRouter) subscription.');
 }
 /**
- * Checks whether the user is on the Pro tier.
- * If the config already records 'pro', skips the network call.
- * If the config records 'free', calls the API and updates the config on success.
- * Returns false (and prints the error) when the user is not on Pro.
+ * Check whether the account may launch — Pro, including an active free trial
+ * (the server reports `plan: 'pro'` with `subscriptionStatus: 'trialing'`).
+ *
+ * The server is asked on EVERY launch. `usageTier` in the config is a CACHE of
+ * the last answer, never a shortcut: skipping the call once it read 'pro' meant
+ * a cancelled subscription or an expired trial kept passing this local gate and
+ * then failed against the server with a misleading "free tier" message. The
+ * cache is refreshed in both directions here and only relied on when the server
+ * cannot be reached.
  */
 async function verifyProTier(config, serverUrl, apiKey, 
 // Repo root whose config file records the verified tier. Group mode passes
 // the member repo's path — process.cwd() there is the parent folder, which
 // has no .hublaunch and would silently drop the persistence every run.
 repoRoot = process.cwd()) {
-    if (config.usageTier === 'pro') {
-        return true;
-    }
     try {
         const response = await axios.get(`${serverUrl.replace(/\/$/, '')}/api/v1/user/subscription`, {
             headers: { Authorization: `Bearer ${apiKey}` },
             timeout: 10000,
         });
-        const plan = response.data?.plan;
-        if (plan === 'pro') {
-            const saved = updateUsageTierInConfig(repoRoot, 'pro');
-            if (saved) {
-                logger.success('Subscription verified as Pro — config updated for future launches.');
+        const data = response.data;
+        if (data.plan === 'pro') {
+            // Only announce (and rewrite the config) on an actual free -> pro flip,
+            // so a steady-state Pro user sees no extra line every launch.
+            if (config.usageTier !== 'pro') {
+                const saved = updateUsageTierInConfig(repoRoot, 'pro');
+                if (saved) {
+                    logger.success('Subscription verified as Pro — config updated for future launches.');
+                }
             }
             return true;
         }
-        printFreeTierError();
+        // Clear a stale 'pro' cache so the config stops claiming Pro after a
+        // cancellation or an expired trial.
+        if (config.usageTier === 'pro') {
+            updateUsageTierInConfig(repoRoot, 'free');
+        }
+        printNoProAccessError({
+            serverUrl,
+            subscriptionStatus: data.subscriptionStatus ?? null,
+        });
         return false;
     }
     catch (err) {
@@ -482,7 +601,7 @@ repoRoot = process.cwd()) {
                 process.exit(1);
             }
             if (status >= 400 && status < 500) {
-                printFreeTierError();
+                printNoProAccessError({ serverUrl });
                 return false;
             }
         }
@@ -558,7 +677,10 @@ export function buildRalphRunRequestBody(input) {
     if (input.clientSessionId) {
         body.clientSessionId = input.clientSessionId;
     }
-    body.anthropicApiKey = input.anthropicApiKey;
+    body.provider = {
+        type: input.provider.type,
+        authToken: input.provider.authToken,
+    };
     if (input.containerResources) {
         body.containerResources = input.containerResources;
     }
@@ -739,23 +861,24 @@ async function launchSingleRepo(repoConfig, repoRoot, issueName, planPath, optio
     const stepsResult = resolveSteps(repoConfig.steps, options.skipRegression, options.regression);
     // Maps to RalphRunRequest.clientSessionId (hula-server PR #419).
     const clientSessionId = readClientSessionId(issueName);
-    // Resolve ephemeral credentials through the shared resolver — the single
-    // source of truth for precedence/validation, also used by `execute`.
+    // Resolve provider credentials through the shared resolver — the single
+    // source of truth for precedence/validation, also used by `schedule`.
     // Collect ALL errors before exiting (preserves prior launch behavior).
-    const resolved = resolveEphemeralCredentials(options, repoConfig);
-    let anthropicApiKey = resolved.anthropicApiKey;
+    const resolved = resolveProviderCredentials(options, repoConfig);
+    const providerType = resolved.providerType;
+    let authToken = resolved.authToken;
     const credentialErrors = resolved.errors;
     if (credentialErrors.length > 0) {
         // Interactive terminal + the ONLY problem is a totally-absent token:
         // collect it inline rather than failing, then persist it for next time.
-        // Any other case (wrong-prefix, non-TTY, multiple errors) keeps today's
+        // Any other case (wrong-format, non-TTY, multiple errors) keeps today's
         // fail-fast behavior — identical to what `hula schedule` does.
-        if (resolved.missingAnthropicKey &&
+        if (resolved.missingToken &&
             credentialErrors.length === 1 &&
             process.stdout.isTTY) {
             let pasted;
             try {
-                pasted = (await input('Paste your Anthropic OAuth token (sk-ant-oat01-…), or press Enter to cancel:')).trim();
+                pasted = (await input(`Paste your ${providerType} credential, or press Enter to cancel:`)).trim();
             }
             catch (error) {
                 // Treat an explicit cancel (Ctrl-C / escape) exactly like empty input.
@@ -773,29 +896,29 @@ async function launchSingleRepo(repoConfig, repoRoot, issueName, planPath, optio
                     return { ok: false, message: credentialErrors.join('; ') };
                 process.exit(1);
             }
-            if (!pasted.startsWith('sk-ant-oat')) {
-                // Wrong prefix → the existing wrong-prefix error text. One attempt only.
-                const wrongPrefixMsg = 'Anthropic credential must be an OAuth token (starts with sk-ant-oat01-…). Standard API keys (sk-ant-api03-…) are not supported — the container requires CLAUDE_CODE_OAUTH_TOKEN.';
-                console.error(chalk.red(wrongPrefixMsg));
+            const formatError = validateTokenFormat(providerType, pasted);
+            if (formatError) {
+                // Wrong format for this provider → the per-provider error. One attempt.
+                console.error(chalk.red(formatError));
                 if (isGroup)
-                    return { ok: false, message: wrongPrefixMsg };
+                    return { ok: false, message: formatError };
                 process.exit(1);
             }
             // Valid: use it for this launch and persist it to the config file. A
             // persistence failure must NOT abort a valid launch — warn and continue
             // with the in-memory key. In group mode the token is written to the
             // member repo's own config file (repoRoot); in single mode to the git root.
-            anthropicApiKey = pasted;
+            authToken = pasted;
             try {
                 const configDir = isGroup ? repoRoot : await findGitRoot();
                 const configFilePath = path.join(configDir, '.hublaunch', 'hublaunch.config.js');
                 const original = readFileSync(configFilePath, 'utf-8');
-                const updated = upsertAnthropicApiKey(original, pasted);
+                const updated = upsertProviderApiKey(original, providerType, pasted);
                 writeFileSync(configFilePath, updated, { mode: 0o600 });
-                logger.success('anthropicApiKey saved to .hublaunch/hublaunch.config.js');
+                logger.success('provider credential saved to .hublaunch/hublaunch.config.js');
             }
             catch {
-                logger.warning("⚠️ Couldn't save the token to .hublaunch/hublaunch.config.js — continuing this launch with it in memory. Add it manually to avoid re-entering.");
+                logger.warning("⚠️ Couldn't save the credential to .hublaunch/hublaunch.config.js — continuing this launch with it in memory. Add it manually to avoid re-entering.");
             }
         }
         else {
@@ -885,10 +1008,10 @@ async function launchSingleRepo(repoConfig, repoRoot, issueName, planPath, optio
         }
     }
     // Pre-flight credential validation (skipped in group mode where each distinct
-    // Anthropic key was validated once before the fan-out loop).
-    // anthropicApiKey is guaranteed non-null here — missing key exits above
+    // provider credential was validated once before the fan-out loop).
+    // authToken is guaranteed non-empty here — missing key exits above.
     if (!ctx.credentialsValidated) {
-        await validateLaunchCredentials(anthropicApiKey, githubToken);
+        await validateProviderCredentials(providerType, authToken, githubToken);
     }
     // Assemble the request body from the resolved values.
     const requestBody = buildRalphRunRequestBody({
@@ -908,7 +1031,7 @@ async function launchSingleRepo(repoConfig, repoRoot, issueName, planPath, optio
         verbose: options.verbose,
         handoff: options.handoff,
         clientSessionId: clientSessionId ?? undefined,
-        anthropicApiKey: anthropicApiKey,
+        provider: { type: providerType, authToken },
         containerResources,
         updateNotificationUrl,
         updateNotificationNameTag,
@@ -1146,13 +1269,15 @@ async function executeGroupLaunch(_config, issueName, options) {
     // GitHub token once (user-level).
     const tokenData = await loadGitHubToken();
     const githubToken = tokenData?.access_token || process.env.GITHUB_TOKEN;
-    // Validate each DISTINCT resolvable Anthropic key once.
+    // Validate each DISTINCT resolvable provider credential once (keyed by
+    // provider type + token, since members may select different providers).
     const validatedKeys = new Set();
     for (const e of entries) {
-        const key = resolveEphemeralCredentials(options, e.repoConfig).anthropicApiKey;
-        if (key && !validatedKeys.has(key)) {
-            validatedKeys.add(key);
-            await validateLaunchCredentials(key, githubToken);
+        const { providerType, authToken } = resolveProviderCredentials(options, e.repoConfig);
+        const dedupKey = `${providerType}:${authToken}`;
+        if (authToken && !validatedKeys.has(dedupKey)) {
+            validatedKeys.add(dedupKey);
+            await validateProviderCredentials(providerType, authToken, githubToken);
         }
     }
     // ── Sequential fan-out (continue on failure) ──────────────────────────
@@ -1412,7 +1537,15 @@ function describeLaunchAxiosError(error, serverUrl, issueName, planPath) {
                 case 401:
                     return { status, message: 'Authentication failed. Your API key may be invalid.' };
                 case 402:
-                    return { status, message: 'You cannot run launch because you are on the free tier.' };
+                    // The server's 402 message is specific ('Pro plan required to launch
+                    // sandboxes', 'Out of PR credits — buy more to launch'); the old
+                    // hardcoded 'free tier' text was wrong for a Pro user who simply ran
+                    // out of credits, and for a lapsed trial.
+                    return {
+                        status,
+                        message: data.error ||
+                            'Launching requires Pro — this account is not entitled to launch.',
+                    };
                 case 403:
                     return {
                         status,
@@ -1464,7 +1597,13 @@ function handleLaunchAxiosError(error, serverUrl, issueName, planPath) {
                     logger.info("Run 'hula login' to re-authenticate.");
                     break;
                 case 402:
-                    printFreeTierError();
+                    // Prefer the server's own message + billing link over anything the
+                    // CLI can infer (credit exhaustion vs. no subscription).
+                    printNoProAccessError({
+                        serverUrl,
+                        serverError: data.error,
+                        actionUrl: data.buyCreditsUrl || data.upgradeUrl,
+                    });
                     break;
                 case 403:
                     // Surface the server's specific ownership message (kill /