indusagi-coding-agent 0.2.8 → 0.2.9

package/src/boot/server-token.ts

@@ -0,0 +1,148 @@
+/**
+ * Server-token store — the boot-layer persistence for the indus device-login
+ * session token. This is the app side of the login + model-gateway contract: a
+ * successful `indus login` device flow writes the better-auth session token
+ * here, and the key resolver later reads it back to drive "server mode" (Case B
+ * — no local provider key, but a valid server session, so requests are routed
+ * through the indus-server gateway with the session token as the api key).
+ *
+ * The token lives in a single JSON file under the app's profile directory
+ * (`~/.indusagi/agent/server-token.json`) — deliberately NOT the framework's
+ * `~/.better-auth` location, so the CLI session is isolated from any other
+ * tooling. As with the credential vault, the file is tiny and access is
+ * interactive, so we read / write the whole file each time and tolerate a
+ * missing or malformed file as "no token".
+ *
+ * Ported from supercli `server/src/lib/token.ts`; the load-bearing detail is the
+ * `expires_in` (seconds, from the device-flow response) → `expires_at` (absolute
+ * ISO timestamp, on disk) conversion, which lets {@link isServerTokenExpired}
+ * decide freshness without re-deriving the clock offset.
+ */
+import { mkdir, readFile, unlink, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+
+/** Root of the indus-server. Used to build the gateway base URL and the device-login endpoints. Any trailing slash(es) are stripped so callers can append paths with a single separator. */
+export const INDUS_SERVER_URL: string = process.env.INDUS_SERVER_URL?.replace(/\/+$/, "") ?? "https://indus-server.vercel.app";
+/** The app profile directory that holds the server session token. */
+export const CONFIG_DIR: string = path.join(os.homedir(), ".indusagi", "agent");
+/** Absolute path of the JSON file the session token is persisted to. */
+export const TOKEN_FILE: string = path.join(CONFIG_DIR, "server-token.json");
+
+/** On-disk token shape (what {@link storeServerToken} writes / {@link getServerToken} returns). */
+export interface TokenData {
+  /** The better-auth session token, used as the gateway api key in server mode. */
+  access_token: string;
+  /** Optional refresh token, when the device flow returns one. */
+  refresh_token?: string;
+  /** Token scheme; defaults to `"Bearer"`. */
+  token_type: string;
+  /** Optional granted scope string. */
+  scope?: string;
+  /** Absolute expiry as an ISO string, or null when the token has no expiry. */
+  expires_at: string | null;
+  /** When this record was written, as an ISO string. */
+  created_at: string;
+}
+
+/** Device-flow response shape accepted by {@link storeServerToken} (`expires_in` → `expires_at`). */
+export interface ServerTokenInput {
+  /** The better-auth session token. */
+  access_token: string;
+  /** Optional refresh token. */
+  refresh_token?: string;
+  /** Token scheme; defaults to `"Bearer"` when omitted. */
+  token_type?: string;
+  /** Optional granted scope string. */
+  scope?: string;
+  /** Lifetime in seconds, relative to now; converted to an absolute `expires_at`. */
+  expires_in?: number;
+}
+
+/**
+ * Read the stored session token, tolerating a missing or malformed file as
+ * "no token".
+ *
+ * @returns the parsed {@link TokenData}, or `null` when nothing is stored.
+ */
+export async function getServerToken(): Promise<TokenData | null> {
+  try {
+    const data = await readFile(TOKEN_FILE, "utf8");
+    return JSON.parse(data);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Persist a session token from a device-flow response, converting the relative
+ * `expires_in` (seconds) into an absolute `expires_at` ISO timestamp and
+ * defaulting `token_type` to `"Bearer"`. Creates the profile directory if
+ * needed and writes the file with owner-only permissions.
+ *
+ * @param token the device-flow token payload.
+ * @returns `true` on success, `false` if the write failed.
+ */
+export async function storeServerToken(token: ServerTokenInput): Promise<boolean> {
+  try {
+    await mkdir(CONFIG_DIR, { recursive: true });
+    const tokenData = {
+      access_token: token.access_token,
+      refresh_token: token.refresh_token,
+      token_type: token.token_type ?? "Bearer",
+      scope: token.scope,
+      expires_at: token.expires_in !== undefined ? new Date(Date.now() + token.expires_in * 1000).toISOString() : null,
+      created_at: new Date().toISOString(),
+    };
+    await writeFile(TOKEN_FILE, `${JSON.stringify(tokenData, null, 2)}\n`, {
+      encoding: "utf8",
+      mode: 384,
+    });
+    return true;
+  } catch (error) {
+    console.error("Failed to store server token:", (error as Error).message);
+    return false;
+  }
+}
+
+/**
+ * Remove the stored session token (used by `indus logout`). A missing file is
+ * treated as nothing-to-do.
+ *
+ * @returns `true` when a file was deleted, `false` when none existed / removal failed.
+ */
+export async function clearServerToken(): Promise<boolean> {
+  try {
+    await unlink(TOKEN_FILE);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Decide whether a token is expired. A token counts as expired when it is
+ * absent, has no `expires_at`, or has under 5 minutes of life remaining (the
+ * margin keeps a long turn from racing the expiry boundary).
+ *
+ * @param token the token to inspect (or `null`).
+ * @returns `true` when the token is missing or stale.
+ */
+export function isServerTokenExpired(token: TokenData | null): boolean {
+  if (!token || !token.expires_at) {
+    return true;
+  }
+  const expiresAt = new Date(token.expires_at);
+  const now = new Date();
+  return expiresAt.getTime() - now.getTime() < 5 * 60 * 1000;
+}
+
+/**
+ * Convenience predicate: there is a stored token and it is not expired.
+ *
+ * @returns `true` when a usable (fresh) session token is on disk.
+ */
+export async function hasValidServerToken(): Promise<boolean> {
+  const token = await getServerToken();
+  return token !== null && !isServerTokenExpired(token);
+}

package/src/boot/stages.ts

@@ -0,0 +1,167 @@
+/**
+ * Boot stage pipeline — the ordered list of {@link Stage} transforms that turn a
+ * bare {@link BootContext} (argv + workspace + brand) into a fully-resolved one
+ * (parsed invocation, materialised directories, applied upgrades, resolved
+ * startup resources, selected runner).
+ *
+ * The pipeline is data, not control flow: {@link STAGES} lists each step in order,
+ * and {@link runStages} folds an *immutable* context through them — every stage
+ * receives a context and returns its successor (built by spreading, never by
+ * mutating). A stage may be async; the fold awaits each in turn so ordering and
+ * side-effect sequencing are deterministic.
+ *
+ * Stage order and intent:
+ *   1. `locate-workspace`  — materialise the resolved {@link Workspace} on disk
+ *      (`createWorkspace` + `ensureDirs`). Pure path computation already happened
+ *      when the initial context was built; this stage only `mkdir`s.
+ *   2. `apply-upgrades`    — fold the idempotent {@link applyUpgrades} registry
+ *      over the workspace (a no-op on an already-current profile).
+ *   3. `build-invocation`  — parse `argv` into the typed {@link Invocation}.
+ *   4. `resolve-resources` — best-effort construct the framework
+ *      settings/auth/model graph; degrade to a minimal object if the framework
+ *      pieces are unavailable.
+ *   5. `select-runner`     — no-op transform that exists for symmetry and tracing
+ *      (the actual dispatch happens in {@link "./boot"} after the pipeline, so the
+ *      selected runner can own the exit code). Kept in the list so the ordered
+ *      pipeline reads as the full launch sequence.
+ */
+import { tokenizeInvocation } from "./invocation.js";
+import { applyUpgrades } from "./upgrade/apply.js";
+import { ensureDirs } from "../workspace/locator.js";
+import type { BootContext, Stage } from "./contract.js";
+
+/**
+ * Materialise the resolved workspace directories on disk.
+ *
+ * The {@link BootContext.workspace} was already computed (pure) when the initial
+ * context was assembled; this stage only ensures the directory subset exists so
+ * later stages and runners can write into it. Returns the same context (the
+ * workspace record is unchanged — only the filesystem side-effects happen here).
+ */
+const locateWorkspace: Stage = {
+  name: "locate-workspace",
+  apply(ctx) {
+    ensureDirs(ctx.workspace);
+    return ctx;
+  },
+};
+
+/**
+ * Run any pending one-time profile upgrades, idempotently.
+ *
+ * Folds the upgrade registry over the workspace. The driver is non-fatal: a step
+ * that fails is reported and retried on a later launch, never aborting boot. The
+ * context is returned unchanged (upgrades touch the filesystem, not the context).
+ */
+const upgrade: Stage = {
+  name: "apply-upgrades",
+  async apply(ctx) {
+    await applyUpgrades(ctx.workspace);
+    return ctx;
+  },
+};
+
+/**
+ * Parse `argv` into the typed {@link Invocation} and thread it onto the context.
+ *
+ * The initial context carries a placeholder invocation (the bootstrapper cannot
+ * know the mode before parsing); this stage replaces it with the real parse.
+ */
+const buildInvocation: Stage = {
+  name: "build-invocation",
+  apply(ctx) {
+    const invocation = tokenizeInvocation(ctx.argv);
+    return { ...ctx, invocation };
+  },
+};
+
+/**
+ * Best-effort assembly of the startup resource graph.
+ *
+ * Where the rebuilt framework owns a concept, the field is constructed from it:
+ * {@link StartupResources.settings} from the framework's `DEFAULT_SETTINGS`, and
+ * {@link StartupResources.models} from the framework's `ModelRegistry`. The
+ * credential graph has no framework type yet, so it is an empty placeholder until
+ * Phase 2. If a framework piece cannot be loaded, the stage degrades to a minimal
+ * resources object built from empty literals rather than failing the boot — the
+ * shape is what later phases depend on, and they fill it in.
+ */
+const resolveResources: Stage = {
+  name: "resolve-resources",
+  async apply(ctx) {
+    const resources = await buildStartupResources();
+    return { ...ctx, resources };
+  },
+};
+
+async function buildStartupResources(): Promise<{ settings: unknown; auth: Record<string, unknown>; models: unknown }> {
+  const settings = await loadDefaultSettings();
+  const models = await loadModelRegistry();
+  return { settings, auth: {}, models };
+}
+
+async function loadDefaultSettings(): Promise<unknown> {
+  try {
+    const mod = await import("indusagi/shell-app");
+    return (mod as { DEFAULT_SETTINGS?: unknown }).DEFAULT_SETTINGS ?? {};
+  } catch {
+    return {};
+  }
+}
+
+async function loadModelRegistry(): Promise<unknown> {
+  const mod = (await import("indusagi/ai")) as { ModelRegistry?: unknown; modelRegistry?: unknown };
+  if (typeof mod.ModelRegistry === "function") {
+    return new (mod.ModelRegistry as new () => unknown)();
+  }
+  return mod.modelRegistry;
+}
+
+/**
+ * Marker / tracing stage for runner selection.
+ *
+ * The real dispatch is performed by {@link "./boot"} after the pipeline so the
+ * chosen runner can own the process exit code; this stage exists to keep the
+ * ordered pipeline a faithful description of the launch sequence and to give the
+ * selection step a name for tracing. It returns the context unchanged.
+ */
+const selectRunnerStage: Stage = {
+  name: "select-runner",
+  apply(ctx) {
+    return ctx;
+  },
+};
+
+/**
+ * The launch pipeline, in execution order. Folded by {@link runStages}.
+ */
+export const STAGES: readonly Stage[] = [
+  locateWorkspace,
+  upgrade,
+  buildInvocation,
+  resolveResources,
+  selectRunnerStage,
+];
+
+/**
+ * Fold an ordered list of {@link Stage} transforms over an immutable
+ * {@link BootContext}.
+ *
+ * Each stage receives the current context and returns its successor; the result
+ * of one stage is the input to the next. Awaits every stage so async ordering is
+ * deterministic. The input `initial` is never mutated — stages produce new
+ * contexts by spreading.
+ *
+ * @param initial The seed context (argv + workspace + brand + placeholder fields).
+ * @param stages  The ordered transforms to apply; defaults to {@link STAGES}.
+ * @returns The fully-resolved context after every stage has run.
+ */
+export async function runStages(initial: BootContext, stages: readonly Stage[] = STAGES): Promise<BootContext> {
+  let ctx: BootContext = initial;
+  for (const stage of stages) {
+    ctx = await stage.apply(ctx);
+  }
+  return ctx;
+}
+
+export { locateWorkspace, upgrade, buildInvocation, resolveResources, selectRunnerStage };

package/src/boot/upgrade/apply.ts

@@ -0,0 +1,94 @@
+/**
+ * Upgrade driver — folds the ordered {@link UPGRADES} registry over a
+ * {@link Workspace}, exactly once per step.
+ *
+ * The driver is the only place that knows about the *marker file*: a small JSON
+ * record under the profile directory listing the ids of upgrades that have
+ * already run. Each registry step is skipped if its id is present in the marker;
+ * otherwise it is applied and, on success, its id is appended and the marker is
+ * persisted. A step that throws is *not* recorded (so it is retried next launch)
+ * and is reported as a warning rather than aborting the remaining steps — one
+ * bad migration must never wedge startup.
+ *
+ * The result is purely informational: {@link UpgradeReport.applied} lists ids run
+ * *this* invocation (empty on an already-current profile), and
+ * {@link UpgradeReport.warnings} carries human-readable notes for any step that
+ * failed. Callers typically log both and continue.
+ */
+import { promises as fs } from "node:fs";
+import { join } from "node:path";
+import type { Workspace } from "../contract.js";
+import { UPGRADES } from "./upgrades.js";
+
+const MARKER_FILENAME = ".upgrade-state.json";
+
+function markerPath(ws: Workspace): string {
+  return join(ws.profileDir, MARKER_FILENAME);
+}
+
+async function readAppliedIds(ws: Workspace): Promise<Set<string>> {
+  try {
+    const raw = await fs.readFile(markerPath(ws), "utf8");
+    const parsed = JSON.parse(raw) as { appliedIds?: unknown };
+    const ids = Array.isArray(parsed.appliedIds) ? parsed.appliedIds : [];
+    return new Set(ids.filter((id): id is string => typeof id === "string"));
+  } catch {
+    return new Set();
+  }
+}
+
+async function writeAppliedIds(ws: Workspace, appliedIds: Set<string>): Promise<void> {
+  const state = { appliedIds: [...appliedIds] };
+  await fs.mkdir(ws.profileDir, { recursive: true });
+  await fs.writeFile(markerPath(ws), `${JSON.stringify(state, null, 2)}\n`);
+}
+
+function describeError(error: unknown): string {
+  if (error instanceof Error) return error.message;
+  return String(error);
+}
+
+/**
+ * The outcome of an {@link applyUpgrades} pass.
+ *
+ *   - `applied`  — ids of upgrades that ran successfully *this* invocation, in
+ *     apply order. Empty when the profile was already current.
+ *   - `warnings` — one entry per step that threw, naming the step and its error.
+ *     Non-fatal: applying continues past a failed step.
+ */
+export interface UpgradeReport {
+  /** Ids successfully applied during this call, in order. */
+  readonly applied: string[];
+  /** Human-readable notes for steps that failed (non-fatal). */
+  readonly warnings: string[];
+}
+
+/**
+ * Apply every not-yet-applied upgrade in {@link UPGRADES}, in registry order,
+ * recording each success in the marker file so it never runs again.
+ *
+ * Steps already named in the marker are skipped. A step that throws is recorded
+ * as a warning, left unmarked (so it is retried on a later launch), and does not
+ * block the remaining steps. The marker is rewritten after each success, so a
+ * crash mid-pass still preserves the progress made so far.
+ *
+ * @param ws The resolved, absolute on-disk layout to upgrade.
+ * @returns The ids applied this pass and any non-fatal warnings.
+ */
+export async function applyUpgrades(ws: Workspace): Promise<UpgradeReport> {
+  const alreadyApplied = await readAppliedIds(ws);
+  const applied: string[] = [];
+  const warnings: string[] = [];
+  for (const upgrade of UPGRADES) {
+    if (alreadyApplied.has(upgrade.id)) continue;
+    try {
+      await upgrade.apply(ws);
+      alreadyApplied.add(upgrade.id);
+      applied.push(upgrade.id);
+      await writeAppliedIds(ws, alreadyApplied);
+    } catch (error) {
+      warnings.push(`upgrade "${upgrade.id}" failed: ${describeError(error)}`);
+    }
+  }
+  return { applied, warnings };
+}

package/src/boot/upgrade/index.ts

@@ -0,0 +1,13 @@
+/**
+ * Upgrade subsystem — public barrel.
+ *
+ * Surfaces the ordered, idempotent profile-upgrade registry and its driver.
+ * Boot consumers import {@link applyUpgrades} to run pending one-time migrations
+ * and the {@link UPGRADES} registry / {@link Upgrade} type for inspection and
+ * testing. The marker-file bookkeeping is an internal detail of the driver and
+ * is not re-exported.
+ */
+export type { Upgrade } from "./upgrades.js";
+export { UPGRADES, foldCredentials, reshelveTranscripts, relocateBinaries, renamePromptDir, projectTranscriptDirName } from "./upgrades.js";
+export type { UpgradeReport } from "./apply.js";
+export { applyUpgrades } from "./apply.js";