indusagi-coding-agent 0.2.5 → 0.2.9

package/src/addons/sandbox.ts

@@ -0,0 +1,170 @@
+/**
+ * Addon sandbox — the SINGLE jiti-backed {@link ModuleLoader}.
+ *
+ * This module turns a path on disk into a loaded {@link AddonManifest}.
+ */
+import { createJiti } from "jiti";
+import { homedir } from "node:os";
+import { isAbsolute, resolve } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import * as agentNamespace from "indusagi/agent";
+import * as aiNamespace from "indusagi/ai";
+import * as tuiNamespace from "indusagi/tui";
+import { isPackagedBinary } from "../workspace/runtime-detect.js";
+import type {
+  AddonManifest,
+  BundledNamespace,
+  ModuleLoader,
+} from "./contract.js";
+import { BUNDLED_NAMESPACES } from "./contract.js";
+
+const NAMESPACE_OBJECTS: Readonly<Record<BundledNamespace, unknown>> = {
+  "indusagi/agent": agentNamespace,
+  "indusagi/ai": aiNamespace,
+  "indusagi/tui": tuiNamespace,
+  "@sinclair/typebox": {},
+};
+
+const INVISIBLE_CODE_POINTS: readonly number[] = [
+  160, 8203, 8204, 8205, 8206, 8207, 8288, 65279, 8239, 8287, 12288,
+  8192, 8193, 8194, 8195, 8196, 8197, 8198, 8199, 8200, 8201, 8202,
+];
+
+const INVISIBLE_SET = new Set<number>(INVISIBLE_CODE_POINTS);
+
+export function scrubInvisible(raw: string): string {
+  let out = "";
+  for (const char of raw) {
+    const code = char.codePointAt(0);
+    if (code !== undefined && INVISIBLE_SET.has(code)) {
+      continue;
+    }
+    out += char;
+  }
+  return out.trim();
+}
+
+export function expandPath(raw: string, home: string = homedir()): string {
+  const cleaned = scrubInvisible(raw);
+  if (cleaned === "~") {
+    return home;
+  }
+  if (cleaned.startsWith("~/") || cleaned.startsWith("~\\")) {
+    return home + cleaned.slice(1);
+  }
+  return cleaned;
+}
+
+export function resolvePath(
+  raw: string,
+  base: string = process.cwd(),
+  home: string = homedir(),
+): string {
+  const expanded = expandPath(raw, home);
+  return isAbsolute(expanded) ? resolve(expanded) : resolve(base, expanded);
+}
+
+function buildVirtualModules(): Record<string, unknown> {
+  const map: Record<string, unknown> = {};
+  for (const specifier of BUNDLED_NAMESPACES) {
+    map[specifier] = NAMESPACE_OBJECTS[specifier];
+  }
+  return map;
+}
+
+function resolveSpecifierPath(specifier: string): string | undefined {
+  try {
+    const resolved = import.meta.resolve(specifier);
+    return resolved.startsWith("file:") ? fileURLToPath(resolved) : resolved;
+  } catch {
+    return undefined;
+  }
+}
+
+function buildAliasMap(): Record<string, string> {
+  const map: Record<string, string> = {};
+  for (const specifier of BUNDLED_NAMESPACES) {
+    const path = resolveSpecifierPath(specifier);
+    if (path !== undefined) {
+      map[specifier] = path;
+    }
+  }
+  return map;
+}
+
+interface JitiOptions {
+  moduleCache?: boolean;
+  virtualModules?: Record<string, unknown>;
+  alias?: Record<string, string>;
+  tryNative?: boolean;
+}
+
+function jitiOptionsForRuntime(): JitiOptions {
+  const base = { moduleCache: false };
+  if (isPackagedBinary()) {
+    return { ...base, virtualModules: buildVirtualModules(), tryNative: false };
+  }
+  return { ...base, alias: buildAliasMap() };
+}
+
+function isObject(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null;
+}
+
+function pickManifestObject(imported: unknown): Record<string, unknown> | undefined {
+  if (!isObject(imported)) {
+    return undefined;
+  }
+  const direct = imported;
+  if (typeof direct.register === "function") {
+    return imported;
+  }
+  const fallback = imported.default;
+  return isObject(fallback) ? fallback : imported;
+}
+
+function toManifest(imported: unknown): AddonManifest | undefined {
+  const candidate = pickManifestObject(imported);
+  if (candidate === undefined) {
+    return undefined;
+  }
+  const register = candidate.register;
+  if (typeof register !== "function") {
+    return undefined;
+  }
+  const id = candidate.id;
+  const version = candidate.version;
+  return {
+    register: register.bind(candidate),
+    ...(typeof id === "string" ? { id } : {}),
+    ...(typeof version === "string" ? { version } : {}),
+  };
+}
+
+export interface JitiLoaderOptions {
+  readonly base?: string;
+  readonly home?: string;
+}
+
+/**
+ * Construct the default jiti-backed {@link ModuleLoader}.
+ */
+export function createJitiLoader(options: JitiLoaderOptions = {}): ModuleLoader {
+  const jiti = createJiti(import.meta.url, jitiOptionsForRuntime() as Parameters<typeof createJiti>[1]);
+  const base = options.base ?? process.cwd();
+  const home = options.home ?? homedir();
+  return {
+    async load(path: string): Promise<AddonManifest> {
+      const absolute = resolvePath(path, base, home);
+      const specifier = pathToFileURL(absolute).href;
+      const imported = (await jiti.import(specifier)) as unknown;
+      const manifest = toManifest(imported);
+      if (manifest === undefined) {
+        throw new Error(
+          `addon at ${absolute} does not export a register() entry point`,
+        );
+      }
+      return manifest;
+    },
+  };
+}

package/src/addons/surface.ts

@@ -0,0 +1,78 @@
+/**
+ * AddonSurface implementation — the recording registration API.
+ */
+import type {
+  AddonCommand,
+  AddonId,
+  AddonSurface,
+  AddonTool,
+  EventSubscription,
+  FrameworkHandles,
+  HookEvent,
+  HookHandler,
+  RegisteredManifest,
+  ToolInterceptor,
+} from "./contract.js";
+
+class RecordingSurface implements AddonSurface {
+  readonly id: AddonId;
+  readonly handles: FrameworkHandles;
+  readonly version: string | undefined;
+  readonly subscriptions: EventSubscription[] = [];
+  readonly interceptors: ToolInterceptor[] = [];
+  readonly commands: AddonCommand[] = [];
+  readonly tools: AddonTool[] = [];
+
+  constructor(id: AddonId, handles: FrameworkHandles, version?: string) {
+    this.id = id;
+    this.handles = handles;
+    this.version = version;
+  }
+
+  on<TPayload>(event: HookEvent, handler: HookHandler<TPayload>): void {
+    this.subscriptions.push({
+      event,
+      handler: handler as HookHandler,
+      addon: this.id,
+    });
+  }
+
+  interceptTool(
+    name: string | "*",
+    interceptor: Omit<ToolInterceptor, "match" | "addon">,
+  ): void {
+    this.interceptors.push({ ...interceptor, match: name, addon: this.id });
+  }
+
+  addCommand(name: string, handler: Omit<AddonCommand, "name" | "addon">): void {
+    this.commands.push({ ...handler, name, addon: this.id });
+  }
+
+  addTool(card: AddonTool): void {
+    this.tools.push(card);
+  }
+
+  manifest(): RegisteredManifest {
+    const base = {
+      addon: this.id,
+      subscriptions: Object.freeze([...this.subscriptions]),
+      interceptors: Object.freeze([...this.interceptors]),
+      commands: Object.freeze([...this.commands]),
+      tools: Object.freeze([...this.tools]),
+    };
+    return Object.freeze(
+      this.version === undefined ? base : { ...base, version: this.version },
+    );
+  }
+}
+
+/**
+ * Mint a fresh {@link AddonSurface} for one addon.
+ */
+export function createSurface(
+  id: AddonId,
+  handles: FrameworkHandles,
+  version?: string,
+): AddonSurface {
+  return new RecordingSurface(id, handles, version);
+}

package/src/boot/auth-vault.ts

@@ -0,0 +1,195 @@
+/**
+ * Disk-backed credential vault — the boot-layer adapter that satisfies the
+ * launch {@link AuthVault} seam so the credential command can persist
+ * credentials before the concrete Phase-2 multi-account vault lands.
+ *
+ * The store is a single JSON file (`auth.json` under the profile directory),
+ * keyed provider → account → record. Each record is a discriminated union: it
+ * holds *either* a stored api key *or* a set of browser-sign-in credentials, plus
+ * a default marker. The adapter is deliberately small and self-contained: it
+ * reads / writes the whole file each time (the file is tiny and the operations
+ * are interactive, so atomic-rewrite simplicity beats incremental I/O).
+ *
+ * Two kinds of read are offered. The default-account lookup is plain bookkeeping;
+ * {@link AuthVault.readUsableKey} resolves a record to a live api-key string — for
+ * an api-key record it returns the stored key verbatim, and for a browser-sign-in
+ * record it asks the framework to refresh an expired token (persisting the
+ * rotated credentials back to disk) before handing back the usable key.
+ *
+ * This is *not* the Phase-2 vault — it is the minimal real persistence the
+ * launch wiring needs. When the concrete multi-account vault arrives it replaces
+ * this adapter at the one call site in {@link "./boot"}.
+ */
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import {
+  ensureFreshOAuthCredentials,
+  getOAuthProvider,
+} from "indusagi/ai";
+import type { AuthVault } from "../launch.js";
+
+interface OAuthRecord {
+  access: string;
+  refresh: string;
+  expires?: number;
+  [key: string]: unknown;
+}
+
+interface ApiKeyRecord {
+  kind: "apiKey";
+  key: string;
+  isDefault: boolean;
+}
+
+interface OAuthStoredRecord extends OAuthRecord {
+  kind: "oauth";
+  isDefault: boolean;
+}
+
+type NormalisedRecord = ApiKeyRecord | OAuthStoredRecord;
+
+function normaliseRecord(value: unknown): NormalisedRecord | undefined {
+  if (value === null || typeof value !== "object") return undefined;
+  const raw = value as Record<string, unknown>;
+  const isDefault = raw.isDefault === true;
+  if (raw.kind === "oauth") {
+    if (typeof raw.access === "string" && typeof raw.refresh === "string") {
+      return { ...raw, kind: "oauth", isDefault } as OAuthStoredRecord;
+    }
+    return undefined;
+  }
+  if (raw.kind === "apiKey" && typeof raw.key === "string") {
+    return { kind: "apiKey", key: raw.key, isDefault };
+  }
+  if (typeof raw.apiKey === "string") {
+    return { kind: "apiKey", key: raw.apiKey, isDefault };
+  }
+  return undefined;
+}
+
+function readAuthFile(filePath: string): Record<string, Record<string, NormalisedRecord>> {
+  try {
+    const text = readFileSync(filePath, "utf8");
+    const parsed = JSON.parse(text);
+    if (parsed === null || typeof parsed !== "object") return {};
+    const file: Record<string, Record<string, NormalisedRecord>> = {};
+    for (const [provider, accounts] of Object.entries(parsed)) {
+      if (accounts === null || typeof accounts !== "object") continue;
+      const normalised: Record<string, NormalisedRecord> = {};
+      for (const [account, record] of Object.entries(accounts)) {
+        const value = normaliseRecord(record);
+        if (value !== undefined) normalised[account] = value;
+      }
+      file[provider] = normalised;
+    }
+    return file;
+  } catch {
+    return {};
+  }
+}
+
+function writeAuthFile(
+  filePath: string,
+  data: Record<string, Record<string, NormalisedRecord>>,
+): void {
+  mkdirSync(dirname(filePath), { recursive: true });
+  writeFileSync(filePath, `${JSON.stringify(data, null, 2)}\n`, { mode: 384 });
+}
+
+function toCredentials(record: OAuthStoredRecord): OAuthRecord {
+  const { kind: _kind, isDefault: _isDefault, ...credentials } = record;
+  return credentials as OAuthRecord;
+}
+
+function clearDefaults(accounts: Record<string, NormalisedRecord>): void {
+  for (const name of Object.keys(accounts)) {
+    accounts[name] = { ...accounts[name], isDefault: false };
+  }
+}
+
+/**
+ * Build a disk-backed {@link AuthVault} persisting to `authPath`.
+ *
+ * @param authPath absolute path of the JSON credential store (e.g. `auth.json`)
+ */
+export function createAuthVault(authPath: string): AuthVault {
+  return {
+    async listAccounts(provider) {
+      const file = readAuthFile(authPath);
+      return Object.keys(file[provider] ?? {});
+    },
+    async defaultAccount(provider) {
+      const file = readAuthFile(authPath);
+      const accounts = file[provider] ?? {};
+      for (const [account, record] of Object.entries(accounts)) {
+        if (record.isDefault) return account;
+      }
+      return undefined;
+    },
+    async putApiKey(provider, account, apiKey, makeDefault = false) {
+      const file = readAuthFile(authPath);
+      const accounts: Record<string, NormalisedRecord> = { ...(file[provider] ?? {}) };
+      if (makeDefault) clearDefaults(accounts);
+      accounts[account] = { kind: "apiKey", key: apiKey, isDefault: makeDefault };
+      file[provider] = accounts;
+      writeAuthFile(authPath, file);
+    },
+    async putOAuth(provider, account, credentials, makeDefault = false) {
+      const file = readAuthFile(authPath);
+      const accounts: Record<string, NormalisedRecord> = { ...(file[provider] ?? {}) };
+      if (makeDefault) clearDefaults(accounts);
+      accounts[account] = { ...credentials, kind: "oauth", isDefault: makeDefault };
+      file[provider] = accounts;
+      writeAuthFile(authPath, file);
+    },
+    async authKind(provider, account) {
+      const file = readAuthFile(authPath);
+      return file[provider]?.[account]?.kind;
+    },
+    async readUsableKey(provider, account) {
+      const file = readAuthFile(authPath);
+      const record = file[provider]?.[account];
+      if (record === undefined) return undefined;
+      if (record.kind === "apiKey") return record.key;
+      const handler = getOAuthProvider(provider);
+      if (handler === undefined) return undefined;
+      const current = toCredentials(record);
+      const result = await ensureFreshOAuthCredentials(provider, current);
+      if (result.refreshed) {
+        const accounts: Record<string, NormalisedRecord> = { ...(file[provider] ?? {}) };
+        accounts[account] = {
+          ...result.credentials,
+          kind: "oauth",
+          isDefault: record.isDefault,
+        };
+        file[provider] = accounts;
+        writeAuthFile(authPath, file);
+      }
+      return handler.getApiKey(result.credentials);
+    },
+    async remove(provider, account) {
+      const file = readAuthFile(authPath);
+      const accounts = file[provider];
+      if (accounts === undefined) return false;
+      if (account === undefined) {
+        delete file[provider];
+        writeAuthFile(authPath, file);
+        return true;
+      }
+      if (accounts[account] === undefined) return false;
+      const wasDefault = accounts[account].isDefault;
+      delete accounts[account];
+      const survivors = Object.keys(accounts);
+      if (wasDefault && survivors.length > 0) {
+        accounts[survivors[0]] = { ...accounts[survivors[0]], isDefault: true };
+      }
+      if (survivors.length === 0) {
+        delete file[provider];
+      } else {
+        file[provider] = accounts;
+      }
+      writeAuthFile(authPath, file);
+      return true;
+    },
+  };
+}

package/src/boot/boot.ts

@@ -0,0 +1,138 @@
+/**
+ * Boot orchestrator — the single function the OS entry point calls.
+ *
+ * {@link boot} owns the whole launch arc: it assembles the seed
+ * {@link BootContext} (resolved workspace + brand + a placeholder invocation),
+ * runs the ordered {@link runStages | stage pipeline} to resolve the rest
+ * (parse the command line, materialise directories, apply upgrades, build the
+ * startup-resource graph), handles the meta requests (`--help` / `--version`)
+ * that short-circuit before any runner, then dispatches to the
+ * {@link selectRunner | selected runner} and returns its exit code.
+ *
+ * Cleanup is guaranteed: every teardown callback accumulated in
+ * {@link BootContext.closables} is drained in a `finally`, latest-registered
+ * first, regardless of how the runner resolved. {@link boot} itself never throws
+ * to its caller for an expected failure — it maps problems to a non-zero exit
+ * code so the entry point can simply set `process.exitCode`.
+ */
+import { BRAND, VERSION } from "../workspace/brand.js";
+import { formatCredentialFault, runCredentialCommand } from "../launch/credentials.js";
+import { runPackageCommand } from "../launch/packages.js";
+import { wantsHelp, wantsVersion } from "./invocation.js";
+import { printModelCatalog } from "../launch/catalog.js";
+import { renderUsage } from "../launch/invocation/usage.js";
+import type { BootContext } from "./contract.js";
+import { runStages } from "./stages.js";
+import { selectRunner } from "./runners/registry.js";
+import { createAuthVault } from "./auth-vault.js";
+import { runLogin } from "../launch/login.js";
+import { createWorkspace } from "../workspace/locator.js";
+import { PreferenceStore } from "../settings/manager.js";
+import { tokenizeInvocation } from "./invocation.js";
+
+const EXIT_OK = 0;
+const EXIT_FAILURE = 1;
+const EXIT_CREDENTIAL_FAULT = 1;
+
+function seedContext(argv: string[]): BootContext {
+  const workspace = createWorkspace();
+  const invocation = tokenizeInvocation(argv);
+  return {
+    argv,
+    workspace,
+    brand: BRAND,
+    invocation,
+    closables: [],
+  };
+}
+
+function renderHelp(): void {
+  process.stdout.write(`${renderUsage()}\n`);
+}
+
+function renderVersion(): void {
+  process.stdout.write(`${BRAND.name} ${VERSION}\n`);
+}
+
+async function drainClosables(ctx: BootContext): Promise<void> {
+  for (const close of [...ctx.closables].reverse()) {
+    try {
+      await close();
+    } catch {
+      // ignore teardown errors
+    }
+  }
+}
+
+async function runCredential(ctx: BootContext): Promise<number | undefined> {
+  const result = await runCredentialCommand(ctx.argv, {
+    vault: createAuthVault(ctx.workspace.authPath),
+    profileDir: ctx.workspace.profileDir,
+  });
+  if (!result.handled) {
+    return undefined;
+  }
+  if (result.fault !== undefined) {
+    process.stderr.write(`${formatCredentialFault(result.fault)}\n`);
+    return EXIT_CREDENTIAL_FAULT;
+  }
+  return EXIT_OK;
+}
+
+async function runPackage(ctx: BootContext): Promise<number | undefined> {
+  const result = await runPackageCommand(ctx.argv, {
+    store: PreferenceStore.fromWorkspace(ctx.workspace, ctx.invocation.cwd),
+  });
+  if (!result.handled) {
+    return undefined;
+  }
+  return result.code ?? EXIT_OK;
+}
+
+/**
+ * Boot the agent: resolve everything, dispatch to the chosen runner, and return
+ * the process exit code.
+ *
+ * @param argv The arguments the launch was invoked with, already sliced (no
+ *   node/exec path).
+ * @returns The exit code the process should adopt.
+ */
+export async function boot(argv: string[]): Promise<number> {
+  const seeded = seedContext(argv);
+  const credential = await runCredential(seeded);
+  if (credential !== undefined) {
+    return credential;
+  }
+  const login = await runLogin(seeded);
+  if (login !== undefined) {
+    return login;
+  }
+  const pkg = await runPackage(seeded);
+  if (pkg !== undefined) {
+    return pkg;
+  }
+  if (wantsHelp(seeded.invocation)) {
+    renderHelp();
+    return EXIT_OK;
+  }
+  if (wantsVersion(seeded.invocation)) {
+    renderVersion();
+    return EXIT_OK;
+  }
+  if (seeded.invocation.listModels) {
+    const filter = seeded.invocation.listModelsFilter;
+    printModelCatalog(undefined, filter !== undefined ? { search: filter } : {});
+    return EXIT_OK;
+  }
+  const ctx = await runStages(seeded);
+  try {
+    const runner = selectRunner(ctx.invocation);
+    return await runner.run(ctx);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    process.stderr.write(`${BRAND.name}: ${message}\n`);
+    return EXIT_FAILURE;
+  } finally {
+    await drainClosables(ctx);
+  }
+}