larkit 0.0.0-stage → 0.1.1

package/src/auth/store.js

@@ -0,0 +1,213 @@
+import fs from "node:fs";
+import {
+  AUTH_CONFIG_FILE,
+  AUTH_CREDENTIALS_FILE,
+  LARKIT_HOME,
+} from "../shared/paths.js";
+import { loadConfig } from "../shared/config.js";
+import { ensureDir, readJson, writeJson } from "../shared/util.js";
+
+function ensureHome() {
+  ensureDir(LARKIT_HOME);
+  try {
+    fs.chmodSync(LARKIT_HOME, 0o700);
+  } catch {
+    // best effort
+  }
+}
+
+function readCredentials() {
+  ensureHome();
+  return readJson(AUTH_CREDENTIALS_FILE, { profiles: {} });
+}
+
+function writeCredentials(credentials) {
+  ensureHome();
+  writeJson(AUTH_CREDENTIALS_FILE, credentials);
+  try {
+    fs.chmodSync(AUTH_CREDENTIALS_FILE, 0o600);
+  } catch {
+    // best effort
+  }
+}
+
+function readAuthConfig() {
+  ensureHome();
+  return readJson(AUTH_CONFIG_FILE, { activeProfile: null });
+}
+
+function writeAuthConfig(config) {
+  ensureHome();
+  // Preserve user-level keys (defaultProfile, apps, console) that share this
+  // file; auth only owns `activeProfile`.
+  const current = readJson(AUTH_CONFIG_FILE, {});
+  writeJson(AUTH_CONFIG_FILE, { ...current, ...config });
+  try {
+    fs.chmodSync(AUTH_CONFIG_FILE, 0o600);
+  } catch {
+    // best effort
+  }
+}
+
+export function listProfiles() {
+  const credentials = readCredentials();
+  const authConfig = readAuthConfig();
+  const project = loadConfig();
+  return {
+    active_profile: authConfig.activeProfile || null,
+    larkit_default_profile:
+      project.defaultProfile || project.console?.profile || null,
+    profiles: Object.entries(credentials.profiles || {}).map(([name, profile]) => ({
+      name,
+      active: name === authConfig.activeProfile,
+      cookies: String(profile.cookies || "").split(";").filter(Boolean).length,
+      created_at: profile.createdAt || null,
+      updated_at: profile.updatedAt || null,
+    })),
+  };
+}
+
+export function resolveProfileName(profile) {
+  const credentials = readCredentials();
+  const authConfig = readAuthConfig();
+  const project = loadConfig();
+  const preferred =
+    profile ||
+    process.env.LARKIT_PROFILE ||
+    project.defaultProfile ||
+    project.console?.profile;
+  if (preferred && credentials.profiles?.[preferred]) return preferred;
+  if (preferred && profile) {
+    throw new Error(
+      `unknown larkit profile "${preferred}"; run "larkit auth list"`,
+    );
+  }
+  return (
+    authConfig.activeProfile ||
+    Object.keys(credentials.profiles || {})[0] ||
+    null
+  );
+}
+
+export function getProfileCookies(profile) {
+  const credentials = readCredentials();
+  const name = resolveProfileName(profile);
+  const entry = name ? credentials.profiles?.[name] : null;
+  if (!entry?.cookies) {
+    throw new Error(
+      `no larkit profile "${name || "<none>"}"; run "larkit auth login <name>" or "larkit auth import --file <cookie.json>"`,
+    );
+  }
+  return { name, cookies: entry.cookies, profile: entry };
+}
+
+export function saveProfile({ name, cookie, active = false } = {}) {
+  if (!name) throw new Error("profile name is required");
+  if (!cookie) throw new Error("cookie is required");
+  const credentials = readCredentials();
+  const now = new Date().toISOString();
+  const existing = credentials.profiles?.[name];
+  credentials.profiles = credentials.profiles || {};
+  credentials.profiles[name] = {
+    name,
+    cookies: String(cookie).trim(),
+    createdAt: existing?.createdAt || now,
+    updatedAt: now,
+  };
+  writeCredentials(credentials);
+  const authConfig = readAuthConfig();
+  if (active || !authConfig.activeProfile) {
+    authConfig.activeProfile = name;
+    writeAuthConfig(authConfig);
+  }
+  return {
+    ok: true,
+    profile: name,
+    active_profile: authConfig.activeProfile,
+    cookies: String(cookie).split(";").filter(Boolean).length,
+  };
+}
+
+export function setActiveProfile(name) {
+  const credentials = readCredentials();
+  if (!credentials.profiles?.[name]) throw new Error(`unknown profile: ${name}`);
+  const authConfig = readAuthConfig();
+  authConfig.activeProfile = name;
+  writeAuthConfig(authConfig);
+  return { ok: true, active_profile: name };
+}
+
+export function removeProfile(name) {
+  const credentials = readCredentials();
+  if (!credentials.profiles?.[name]) return { ok: false, error: "profile not found" };
+  delete credentials.profiles[name];
+  writeCredentials(credentials);
+  const authConfig = readAuthConfig();
+  if (authConfig.activeProfile === name) {
+    authConfig.activeProfile = Object.keys(credentials.profiles)[0] || null;
+    writeAuthConfig(authConfig);
+  }
+  return { ok: true, profile: name, active_profile: authConfig.activeProfile };
+}
+
+export function importProfiles(input, { active = false } = {}) {
+  const credentials = readCredentials();
+  const now = new Date().toISOString();
+  let imported = 0;
+  if (input && typeof input === "object" && input.profiles) {
+    for (const [name, value] of Object.entries(input.profiles)) {
+      const cookie = value?.cookies || value?.cookie;
+      if (!cookie) continue;
+      credentials.profiles[name] = {
+        name,
+        cookies: String(cookie).trim(),
+        createdAt: value.createdAt || now,
+        updatedAt: now,
+      };
+      imported++;
+    }
+  } else if (input && typeof input === "object" && input.cookie) {
+    const name = input.name || "default";
+    credentials.profiles[name] = {
+      name,
+      cookies: String(input.cookie).trim(),
+      createdAt: now,
+      updatedAt: now,
+    };
+    imported++;
+  } else if (typeof input === "string" && input.includes("=")) {
+    const name = "default";
+    credentials.profiles[name] = {
+      name,
+      cookies: input.trim(),
+      createdAt: now,
+      updatedAt: now,
+    };
+    imported++;
+  }
+  if (!imported) throw new Error("no profiles/cookies found to import");
+  writeCredentials(credentials);
+  const authConfig = readAuthConfig();
+  if (active || !authConfig.activeProfile) {
+    authConfig.activeProfile = Object.keys(credentials.profiles)[0];
+    writeAuthConfig(authConfig);
+  }
+  return {
+    ok: true,
+    imported,
+    active_profile: authConfig.activeProfile,
+    profiles: listProfiles().profiles,
+  };
+}
+
+export function readRawCredentials() {
+  return readCredentials();
+}
+
+export function authPaths() {
+  return {
+    home: LARKIT_HOME,
+    credentials: AUTH_CREDENTIALS_FILE,
+    config: AUTH_CONFIG_FILE,
+  };
+}

package/src/bootstrap/channel.js

@@ -0,0 +1,201 @@
+import fs from "node:fs";
+import { FORMATTED_DIR, TRUTH_DB } from "../shared/paths.js";
+import {
+  DEFAULT_TRUTH_CHANNEL,
+  TIER_NAME,
+  installTruthPack,
+  isChannelSource,
+  loadPackManifest,
+  packageVersion,
+} from "./pack.js";
+import { initialState, readState, writeState } from "./state.js";
+
+export { DEFAULT_TRUTH_CHANNEL };
+
+/** How often a normal command is allowed to look for a newer truth pack. */
+export const AUTO_UPDATE_TTL_MS = 6 * 60 * 60 * 1000;
+
+/** sha256 of the single unified archive that carries truth + code corpus. */
+export function packShaOf(manifest) {
+  return manifest?.tiers?.[TIER_NAME]?.sha256 || null;
+}
+
+export function truthTagOf(manifest) {
+  return manifest?.packVersion || manifest?.larkitVersion || null;
+}
+
+/**
+ * Resolve where the truth source comes from.
+ *
+ *   --pack=<dir|url>            explicit source (remembered when it is a URL)
+ *   LARKIT_PACK_MANIFEST        same, via env
+ *   --channel[=<url>]           opt in to the official/custom truth channel
+ *   remembered channel          state.steps.truth.channel (set by a previous run)
+ *   otherwise                   the official channel
+ *
+ * There is no bundled pack and no core/code split: every install downloads the
+ * same unified archive.
+ */
+export function resolveTruthChannel(state, options = {}) {
+  const explicit = options.pack || process.env.LARKIT_PACK_MANIFEST || null;
+  const remembered = state?.steps?.truth?.channel || null;
+  const flag = options.channel;
+  const requested = flag
+    ? flag === true || flag === "default" || flag === "latest"
+      ? DEFAULT_TRUTH_CHANNEL
+      : String(flag)
+    : null;
+  const channel = isChannelSource(explicit) ? explicit : requested || remembered;
+  return { explicit, remembered, channel, requested };
+}
+
+/** The channel a plain command should consult. */
+export function activeChannel(state) {
+  return state?.steps?.truth?.channel || DEFAULT_TRUTH_CHANNEL;
+}
+
+async function fetchManifest(source, { timeoutMs } = {}) {
+  if (!timeoutMs) return (await loadPackManifest(source)).manifest;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const response = await fetch(source, {
+      headers: { "user-agent": `larkit/${packageVersion()}` },
+      redirect: "follow",
+      signal: controller.signal,
+    });
+    if (!response.ok) throw new Error(`HTTP ${response.status} for ${source}`);
+    return await response.json();
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+/**
+ * Compare the installed truth pack with the channel without changing anything.
+ * Backs `larkit status --check`.
+ */
+export async function checkTruthChannel({ channel } = {}) {
+  const state = readState() || initialState();
+  const target = channel
+    ? channel === "default"
+      ? DEFAULT_TRUTH_CHANNEL
+      : String(channel)
+    : activeChannel(state);
+  const manifest = await fetchManifest(target);
+  const latestSha = packShaOf(manifest);
+  const currentSha = state.steps?.truth?.packSha || null;
+  const tier = manifest.tiers?.[TIER_NAME] || null;
+  return {
+    channel: target,
+    checked: true,
+    current: state.steps?.truth?.packVersion || null,
+    currentSha,
+    latest: truthTagOf(manifest),
+    latestSha,
+    clientVersion: manifest.clientVersion || null,
+    archive: tier ? { bytes: tier.bytes, sha256: tier.sha256 } : null,
+    upToDate: Boolean(latestSha && currentSha && latestSha === currentSha),
+  };
+}
+
+export function autoUpdateDisabled(env = process.env) {
+  if (env.CI) return true;
+  const flag = env.LARKIT_NO_AUTO_UPDATE;
+  return Boolean(flag && flag !== "0" && flag !== "false");
+}
+
+/** Persist a check result without clobbering the rest of the install state. */
+export function recordTruth(state, patch) {
+  const next = { ...(readState() || state) };
+  next.steps = {
+    ...(next.steps || {}),
+    truth: { ...(next.steps?.truth || {}), ...patch },
+  };
+  writeState(next);
+  return next;
+}
+
+/**
+ * Startup hook: read the channel, and if the published pack is newer than the
+ * installed one, install it before the command runs.
+ *
+ * Guardrails: no-op in CI, with LARKIT_NO_AUTO_UPDATE=1, or within the TTL
+ * window; the lookup itself is time-boxed, and any failure only produces one
+ * warning — the command always runs with whatever truth exists.
+ */
+export async function maybeAutoUpdate({ reporter, force = false, timeoutMs = 2500 } = {}) {
+  if (autoUpdateDisabled()) return { status: "disabled" };
+  const state = readState() || initialState();
+  const truth = state.steps?.truth || {};
+  const channel = activeChannel(state);
+
+  const ttl = Number(process.env.LARKIT_TRUTH_TTL_MS || AUTO_UPDATE_TTL_MS);
+  const last = Number(truth.lastCheckAt || 0);
+  if (!force && Date.now() - last < ttl) {
+    return { status: "fresh", channel, checkedAt: last ? new Date(last).toISOString() : null };
+  }
+
+  let manifest;
+  try {
+    manifest = await fetchManifest(channel, { timeoutMs });
+  } catch (error) {
+    if (fs.existsSync(TRUTH_DB)) {
+      recordTruth(state, { lastCheckAt: Date.now() - ttl + 15 * 60 * 1000 });
+      reporter?.warn?.(`truth channel unreachable (${error.message}); keeping the local truth`);
+      return { status: "unreachable", channel, error: error.message };
+    }
+    throw new Error(
+      `cannot reach the truth channel ${channel} (${error.message}).\n` +
+        "retry when the network is back, or install from a pack file:\n" +
+        "  larkit init --pack=<manifest.json|pack-dir|.tar.gz>",
+    );
+  }
+
+  const latestSha = packShaOf(manifest);
+  const latest = truthTagOf(manifest);
+  if (!latestSha || latestSha === truth.packSha) {
+    recordTruth(state, { lastCheckAt: Date.now(), latestSeen: latest, channel });
+    return { status: "up-to-date", channel, latest };
+  }
+
+  const tier = manifest.tiers?.[TIER_NAME];
+  reporter?.info?.(
+    `truth update ${truth.packVersion || "?"} → ${latest} (${tier ? `${(tier.bytes / 1024 / 1024).toFixed(1)} MiB` : "pack"})`,
+  );
+  try {
+    const result = await installTruthPack({
+      source: channel,
+      quiet: true,
+      reporter,
+      state: { truth },
+    });
+    recordTruth(state, {
+      status: "ready",
+      source: result.source,
+      channel,
+      packVersion: result.packVersion,
+      packSha: result.packSha,
+      stats: result.stats,
+      seeds: result.seeds || truth.seeds || {},
+      skipped: false,
+      lastCheckAt: Date.now(),
+      latestSeen: latest,
+      codeFiles: result.files || truth.codeFiles || null,
+    });
+    reporter?.ok?.(`truth ${result.packVersion} installed (${fmt(result.stats)})`);
+    return { status: "updated", channel, latest, result };
+  } catch (error) {
+    recordTruth(state, { lastCheckAt: Date.now() - ttl + 15 * 60 * 1000 });
+    reporter?.warn?.(`truth update failed (${error.message}); keeping the local truth`);
+    return { status: "failed", channel, error: error.message };
+  }
+}
+
+function fmt(stats = {}) {
+  const parts = [];
+  if (stats.protocolCatalog) parts.push(`${stats.protocolCatalog} commands`);
+  if (stats.codeAnchors) parts.push(`${stats.codeAnchors} anchors`);
+  if (fs.existsSync(FORMATTED_DIR)) parts.push("code corpus");
+  return parts.join(" · ") || "up to date";
+}

package/src/bootstrap/cli-install.js

@@ -0,0 +1,184 @@
+import fs from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { spawnSync } from "node:child_process";
+import {
+  BIN_DIR,
+  CLI_INSTALL_DIR,
+  IS_REPO_CHECKOUT,
+  PKG_ROOT,
+  displayPath,
+} from "../shared/paths.js";
+import { ensureDir, readJson, writeJson } from "../shared/util.js";
+
+function runNpm(args) {
+  const command = process.platform === "win32" ? "npm.cmd" : "npm";
+  const result = spawnSync(command, args, {
+    encoding: "utf8",
+    shell: process.platform === "win32",
+    env: {
+      ...process.env,
+      npm_config_update_notifier: "false",
+      npm_config_fund: "false",
+    },
+  });
+  if (result.error) throw result.error;
+  if (result.status !== 0) {
+    const detail = (result.stderr || result.stdout || "").trim().split("\n").slice(-8).join("\n");
+    throw new Error(`npm ${args[0]} failed (exit ${result.status})${detail ? `:\n${detail}` : ""}`);
+  }
+  return result.stdout;
+}
+
+function shimBody(target) {
+  return `#!/usr/bin/env sh\nexec node "${target}" "$@"\n`;
+}
+
+function cmdShimBody(target) {
+  return `@echo off\r\nnode "${target}" %*\r\n`;
+}
+
+function writeShims(entry, binDir) {
+  const binDirOfPackage = path.dirname(entry);
+  const targets = {
+    larkit: path.join(binDirOfPackage, "larkit.js"),
+    "larkit-mcp": path.join(binDirOfPackage, "larkit-mcp.js"),
+  };
+  ensureDir(binDir);
+  const written = [];
+  for (const [name, target] of Object.entries(targets)) {
+    if (!fs.existsSync(target)) continue;
+    const file = path.join(binDir, name);
+    fs.writeFileSync(file, shimBody(target));
+    fs.chmodSync(file, 0o755);
+    written.push(file);
+    if (process.platform === "win32") {
+      const cmd = `${file}.cmd`;
+      fs.writeFileSync(cmd, cmdShimBody(target));
+      written.push(cmd);
+    }
+  }
+  return written;
+}
+
+export function binDirOnPath(binDir = BIN_DIR) {
+  const parts = String(process.env.PATH || "")
+    .split(path.delimiter)
+    .filter(Boolean)
+    .map((part) => path.resolve(part));
+  return parts.includes(path.resolve(binDir));
+}
+
+export function detectCliInstall({ binDir = BIN_DIR } = {}) {
+  const shim = path.join(binDir, "larkit");
+  const installedPackage = path.join(CLI_INSTALL_DIR, "node_modules", "larkit", "package.json");
+  const repoVersion = IS_REPO_CHECKOUT
+    ? readJson(path.join(PKG_ROOT, "package.json"), {}).version || null
+    : null;
+  return {
+    shim,
+    shim_installed: fs.existsSync(shim),
+    bin_dir: binDir,
+    on_path: binDirOnPath(binDir),
+    mode: fs.existsSync(installedPackage)
+      ? "local-prefix"
+      : IS_REPO_CHECKOUT
+        ? "repo"
+        : null,
+    version: readJson(installedPackage, {}).version || repoVersion,
+  };
+}
+
+/**
+ * Install a durable `larkit` command.
+ *
+ * Default strategy: install the package into ~/.larkit/cli and drop a tiny
+ * shell shim into ~/.local/bin, so no sudo/global prefix is required and the
+ * command survives npx cache cleanup.  In a git checkout the shim points at
+ * the checkout itself.  `--global` delegates to `npm install -g`.
+ */
+export function installCli({
+  version,
+  force = false,
+  global = false,
+  binDir = BIN_DIR,
+  source = null,
+} = {}) {
+  if (global) {
+    const target = source || `larkit@${version}`;
+    runNpm(["install", "-g", target, "--no-audit", "--no-fund", "--loglevel=error"]);
+    return {
+      mode: "global",
+      entry: null,
+      shim: null,
+      bin_dir: binDir,
+      on_path: binDirOnPath(binDir),
+      status: "installed",
+    };
+  }
+
+  const devCheckout =
+    IS_REPO_CHECKOUT && fs.existsSync(path.join(PKG_ROOT, "bin", "larkit.js"));
+
+  if (devCheckout && !source) {
+    const entry = path.join(PKG_ROOT, "bin", "larkit.js");
+    const written = writeShims(entry, binDir);
+    return {
+      mode: "repo",
+      entry,
+      shim: path.join(binDir, "larkit"),
+      shims: written,
+      bin_dir: binDir,
+      on_path: binDirOnPath(binDir),
+      status: "linked",
+      version,
+    };
+  }
+
+  const packageRoot = path.join(CLI_INSTALL_DIR, "node_modules", "larkit");
+  const entry = path.join(packageRoot, "bin", "larkit.js");
+  const installed = readJson(path.join(packageRoot, "package.json"), {});
+  let status = "present";
+  if (force || !fs.existsSync(entry) || (version && installed.version !== version)) {
+    ensureDir(CLI_INSTALL_DIR);
+    const manifest = path.join(CLI_INSTALL_DIR, "package.json");
+    if (!fs.existsSync(manifest)) {
+      writeJson(manifest, { name: "larkit-cli-install", private: true });
+    }
+    const target = source || `larkit@${version}`;
+    runNpm([
+      "install",
+      "--prefix",
+      CLI_INSTALL_DIR,
+      "--no-save",
+      "--no-package-lock",
+      "--no-audit",
+      "--no-fund",
+      "--loglevel=error",
+      target,
+    ]);
+    if (!fs.existsSync(entry)) {
+      throw new Error(
+        `npm installed ${target} but ${displayPath(entry)} is missing; check that the package bin entry is correct`,
+      );
+    }
+    status = "installed";
+  }
+  const written = writeShims(entry, binDir);
+  return {
+    mode: "local-prefix",
+    entry,
+    shim: path.join(binDir, "larkit"),
+    shims: written,
+    bin_dir: binDir,
+    on_path: binDirOnPath(binDir),
+    status,
+    version: readJson(path.join(packageRoot, "package.json"), {}).version || version,
+  };
+}
+
+export function mcpServerCommand() {
+  const shim = path.join(BIN_DIR, "larkit-mcp");
+  if (fs.existsSync(shim)) return shim;
+  return "larkit-mcp";
+}