logwork-cli 0.0.0-stage → 1.1.0

package/lib/credential-store.mjs

@@ -0,0 +1,130 @@
+import {
+  createKeychainEmailStorage,
+  createKeychainTokenStorage,
+  KEYCHAIN_ACCOUNT,
+  KEYCHAIN_EMAIL_ACCOUNT,
+  KEYCHAIN_SERVICE,
+  LEGACY_KEYCHAIN_SERVICE
+} from './keychain.mjs';
+import {
+  createWindowsCredentialEmailStorage,
+  createWindowsCredentialTokenStorage
+} from './windows-credential-manager.mjs';
+
+export const SUPPORTED_CREDENTIAL_PLATFORMS = Object.freeze(['darwin', 'win32']);
+
+export function credentialStoreLabel({ platform = process.platform } = {}) {
+  if (platform === 'darwin') {
+    return 'macOS Keychain';
+  }
+  if (platform === 'win32') {
+    return 'Windows Credential Manager';
+  }
+  return 'OS credential store';
+}
+
+export function assertSupportedCredentialPlatform(platform = process.platform) {
+  if (!SUPPORTED_CREDENTIAL_PLATFORMS.includes(platform)) {
+    throw unsupportedCredentialStoreError(platform);
+  }
+}
+
+export function createCredentialTokenStorage({
+  platform = process.platform,
+  service = KEYCHAIN_SERVICE,
+  account = KEYCHAIN_ACCOUNT,
+  run
+} = {}) {
+  const create = (name) => {
+    if (platform === 'darwin') {
+      return createKeychainTokenStorage({ service: name, account, ...(run ? { run } : {}) });
+    }
+    if (platform === 'win32') {
+      return createWindowsCredentialTokenStorage({ service: name, account, ...(run ? { run } : {}) });
+    }
+    return createUnsupportedCredentialStorage(platform);
+  };
+  return withLegacyService({ platform, service, create });
+}
+
+export function createCredentialEmailStorage({
+  platform = process.platform,
+  service = KEYCHAIN_SERVICE,
+  account = KEYCHAIN_EMAIL_ACCOUNT,
+  run
+} = {}) {
+  const create = (name) => {
+    if (platform === 'darwin') {
+      return createKeychainEmailStorage({ service: name, account, ...(run ? { run } : {}) });
+    }
+    if (platform === 'win32') {
+      return createWindowsCredentialEmailStorage({ service: name, account, ...(run ? { run } : {}) });
+    }
+    return createUnsupportedCredentialStorage(platform);
+  };
+  return withLegacyService({ platform, service, create });
+}
+
+// Sessions saved before the logwork-helper -> logwork-cli rename live under the
+// legacy service name. On a miss, read the legacy entry once and copy it to the
+// new service so nobody has to log in again. Delete clears both entries.
+export function withLegacyService({ platform, service, create, legacyService = LEGACY_KEYCHAIN_SERVICE }) {
+  const primary = create(service);
+  if (service !== KEYCHAIN_SERVICE || !SUPPORTED_CREDENTIAL_PLATFORMS.includes(platform)) {
+    return primary;
+  }
+  const legacy = create(legacyService);
+  return {
+    async get() {
+      const value = await primary.get();
+      if (value) {
+        return value;
+      }
+      const legacyValue = await legacy.get().catch(() => null);
+      if (legacyValue) {
+        await primary.set(legacyValue).catch(() => {});
+      }
+      return legacyValue || null;
+    },
+    set(value) {
+      return primary.set(value);
+    },
+    async delete() {
+      const result = await primary.delete();
+      await legacy.delete().catch(() => {});
+      return result;
+    }
+  };
+}
+
+export function createCredentialJiraStorage({
+  platform = process.platform,
+  service = KEYCHAIN_SERVICE,
+  account = 'jira',
+  run
+} = {}) {
+  return createCredentialTokenStorage({
+    platform,
+    service,
+    account,
+    ...(run ? { run } : {})
+  });
+}
+
+function createUnsupportedCredentialStorage(platform) {
+  return {
+    async get() {
+      throw unsupportedCredentialStoreError(platform);
+    },
+    async set() {
+      throw unsupportedCredentialStoreError(platform);
+    },
+    async delete() {
+      throw unsupportedCredentialStoreError(platform);
+    }
+  };
+}
+
+function unsupportedCredentialStoreError(platform) {
+  return new Error(`Unsupported operating system for logwork credential storage: ${platform}. Supported platforms are macOS and Windows.`);
+}

package/lib/diagnostics.mjs

@@ -0,0 +1,307 @@
+import { spawn } from 'node:child_process';
+import { constants as fsConstants } from 'node:fs';
+import { access, mkdir, readFile, stat, writeFile } from 'node:fs/promises';
+import { EOL, homedir, platform, release, type } from 'node:os';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
+import { CONFIG } from './config.mjs';
+import { getStoredAuthStatus } from './auth.mjs';
+import { redactText } from './auth-redaction.mjs';
+import { authDebugLogPath, sanitizeDiagnosticValue } from './auth-diagnostics.mjs';
+import { configPath, loadLocalConfig } from './logwork-config.mjs';
+import { helperHome, manualDraftsPath, userConfigPath } from './paths.mjs';
+
+const DIAGNOSTICS_DIR_NAME = 'diagnostics';
+const MAX_AUTH_DEBUG_CHARS = 20_000;
+const MCP_SMOKE_TIMEOUT_MS = 5_000;
+const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+
+export function diagnosticsDir() {
+  return resolve(helperHome(), DIAGNOSTICS_DIR_NAME);
+}
+
+export function diagnosticsReportPath(now = new Date()) {
+  const stamp = now.toISOString().replace(/[:.]/g, '-');
+  return resolve(diagnosticsDir(), `logwork-diagnostics-${stamp}.txt`);
+}
+
+export async function generateDiagnosticsReport({
+  outputPath = diagnosticsReportPath(),
+  now = () => new Date(),
+  cwd = process.cwd(),
+  includeMappingDetails = process.env.LOGWORK_DIAGNOSTICS_INCLUDE_MAPPINGS === '1',
+  commandFinder = findCommandOnPath,
+  authStatusFn = getStoredAuthStatus,
+  mcpSmokeFn = runMcpSmoke,
+  readFileFn = readFile,
+  statFn = stat,
+  writeFileFn = writeFile,
+  mkdirFn = mkdir
+} = {}) {
+  const sections = [];
+  const packageInfo = await readPackageInfo({ readFileFn });
+  const commandChecks = await collectCommandChecks(commandFinder);
+  const authStatus = await safeCollect('auth status', async () => sanitizeAuthStatus(await authStatusFn()));
+  const fileChecks = await collectFileChecks({ statFn, cwd });
+  const configSnapshot = await safeCollect('config snapshot', () => collectConfigSnapshot({ cwd, includeMappingDetails }));
+  const mcpSmoke = await safeCollect('mcp smoke', () => mcpSmokeFn({ cwd }));
+  const authDebug = await readSanitizedAuthDebug({ readFileFn });
+
+  sections.push(formatSection('logwork-cli Diagnostics', [
+    `generatedAt: ${now().toISOString()}`,
+    `packageVersion: ${packageInfo.version || 'unknown'}`,
+    `cwd: ${cwd}`,
+    `helperHome: ${helperHome()}`
+  ]));
+
+  sections.push(formatSection('Runtime', [
+    `platform: ${platform()}`,
+    `os: ${type()} ${release()}`,
+    `node: ${process.version}`,
+    `nodePath: ${process.execPath}`,
+    `home: ${homedir()}`
+  ]));
+
+  sections.push(formatSection('Commands', commandChecks.map((entry) => `${entry.command}: ${entry.available ? 'found' : 'missing'}${entry.path ? ` (${entry.path})` : ''}`)));
+  sections.push(formatSection('Files', fileChecks.map((entry) => formatFileCheck(entry))));
+  sections.push(formatSection('Config Snapshot', formatObjectLines(configSnapshot)));
+  sections.push(formatSection('Auth Status', formatObjectLines(authStatus)));
+  sections.push(formatSection('MCP Smoke', formatObjectLines(mcpSmoke)));
+  sections.push(formatSection('Recent Auth Debug', authDebug ? [authDebug] : ['No auth-debug.log found.']));
+
+  const report = sanitizeReport(`${sections.join(`${EOL}${EOL}`)}${EOL}`);
+  await mkdirFn(dirname(outputPath), { recursive: true });
+  await writeFileFn(outputPath, report, 'utf8');
+
+  return {
+    path: outputPath,
+    report,
+    summary: `Diagnostics report written to ${outputPath}`
+  };
+}
+
+async function readPackageInfo({ readFileFn }) {
+  try {
+    const packagePath = resolve(dirname(fileURLToPath(import.meta.url)), '..', 'package.json');
+    return JSON.parse(await readFileFn(packagePath, 'utf8'));
+  } catch {
+    return {};
+  }
+}
+
+async function collectCommandChecks(commandFinder) {
+  const commands = ['node', 'npm', 'logwork'];
+  const output = [];
+  for (const command of commands) {
+    output.push({ command, ...await commandFinder(command) });
+  }
+  return output;
+}
+
+async function collectFileChecks({ statFn, cwd }) {
+  const files = [
+    { label: 'userConfig', path: userConfigPath() },
+    { label: 'projectConfig', path: configPath(cwd, 'project') },
+    { label: 'manualDrafts', path: manualDraftsPath() },
+    { label: 'authDebugLog', path: authDebugLogPath() }
+  ];
+
+  const output = [];
+  for (const file of files) {
+    try {
+      const info = await statFn(file.path);
+      output.push({
+        ...file,
+        exists: true,
+        size: info.size,
+        modifiedAt: info.mtime?.toISOString?.() || null
+      });
+    } catch (error) {
+      output.push({
+        ...file,
+        exists: false,
+        error: error.code === 'ENOENT' ? null : error.message
+      });
+    }
+  }
+  return output;
+}
+
+async function collectConfigSnapshot({ cwd, includeMappingDetails = false }) {
+  const config = await loadLocalConfig(cwd);
+  const mappings = config.projectMappings || [];
+  return {
+    profile: CONFIG.profile,
+    apiHost: hostFromUrl(CONFIG.apiBase),
+    loginHost: hostFromUrl(CONFIG.loginUrl),
+    keycloakHost: hostFromUrl(CONFIG.keycloakAuthUrl),
+    allowedSafariHosts: CONFIG.allowedSafariHosts,
+    httpTimeoutMs: CONFIG.httpTimeoutMs,
+    httpReadRetries: CONFIG.httpReadRetries,
+    userConfigPath: configPath(cwd, 'user'),
+    projectConfigPath: configPath(cwd, 'project'),
+    mappingCount: mappings.length,
+    mappingTicketCount: mappings.reduce((sum, mapping) => sum + (mapping.tickets || []).length, 0),
+    mappingKeywordCount: mappings.reduce((sum, mapping) => sum + (mapping.keywords || []).length, 0),
+    mappingDetails: includeMappingDetails ? mappings.map((mapping) => ({
+      projectMemberId: mapping.projectMemberId ?? null,
+      projectName: mapping.projectName || '',
+      tickets: mapping.tickets || [],
+      keywordCount: (mapping.keywords || []).length
+    })) : '<redacted; set LOGWORK_DIAGNOSTICS_INCLUDE_MAPPINGS=1 to include mapping details>'
+  };
+}
+
+function hostFromUrl(value) {
+  try {
+    return new URL(value).host;
+  } catch {
+    return 'invalid';
+  }
+}
+
+async function readSanitizedAuthDebug({ readFileFn }) {
+  try {
+    const content = await readFileFn(authDebugLogPath(), 'utf8');
+    const tail = content.slice(-MAX_AUTH_DEBUG_CHARS);
+    return sanitizeDiagnosticText(tail);
+  } catch (error) {
+    if (error.code === 'ENOENT') {
+      return '';
+    }
+    return `Unable to read auth debug log: ${sanitizeDiagnosticValue(error.message)}`;
+  }
+}
+
+function sanitizeAuthStatus(status) {
+  if (!status || typeof status !== 'object') {
+    return { available: false };
+  }
+  return {
+    authenticated: Boolean(status.authenticated),
+    expired: Boolean(status.expired),
+    refreshAvailable: Boolean(status.refreshAvailable),
+    userId: status.userId || null,
+    email: status.email || null,
+    expiresAt: status.expiresAt || null,
+    summary: status.summary || ''
+  };
+}
+
+async function safeCollect(label, fn) {
+  try {
+    return await fn();
+  } catch (error) {
+    return {
+      ok: false,
+      label,
+      error: sanitizeDiagnosticValue(error.message || String(error))
+    };
+  }
+}
+
+export async function runMcpSmoke({ cwd = process.cwd(), timeoutMs = MCP_SMOKE_TIMEOUT_MS } = {}) {
+  const client = new Client({
+    name: 'logwork-diagnostics',
+    version: '0.1.0'
+  });
+  const transport = new StdioClientTransport({
+    command: process.execPath,
+    args: [resolve(PACKAGE_ROOT, 'bin', 'logwork.mjs'), 'mcp'],
+    cwd: PACKAGE_ROOT,
+    env: {
+      ...process.env,
+      LOGWORK_HOME: helperHome()
+    },
+    stderr: 'pipe'
+  });
+
+  let timeout;
+  try {
+    await Promise.race([
+      client.connect(transport),
+      new Promise((_, reject) => {
+        timeout = setTimeout(() => reject(new Error('MCP connect timed out.')), timeoutMs);
+      })
+    ]);
+    const result = await Promise.race([
+      client.listTools(),
+      new Promise((_, reject) => {
+        clearTimeout(timeout);
+        timeout = setTimeout(() => reject(new Error('MCP tools/list timed out.')), timeoutMs);
+      })
+    ]);
+    return {
+      ok: true,
+      toolCount: result.tools.length,
+      tools: result.tools.map((tool) => tool.name).sort()
+    };
+  } finally {
+    clearTimeout(timeout);
+    await client.close().catch(() => {});
+  }
+}
+
+async function findCommandOnPath(commandName) {
+  const pathEntries = (process.env.PATH || '').split(process.platform === 'win32' ? ';' : ':').filter(Boolean);
+  const names = process.platform === 'win32' ? [commandName, `${commandName}.cmd`, `${commandName}.exe`] : [commandName];
+  for (const pathEntry of pathEntries) {
+    for (const name of names) {
+      const candidate = resolve(pathEntry, name);
+      try {
+        await stat(candidate);
+        await access(candidate, fsConstants.X_OK);
+        return { available: true, path: candidate };
+      } catch {
+        // Keep searching.
+      }
+    }
+  }
+  return { available: false, path: null };
+}
+
+function formatSection(title, lines = []) {
+  return [`# ${title}`, ...lines.map((line) => String(line))].join(EOL);
+}
+
+function formatObjectLines(value) {
+  if (!value || typeof value !== 'object') {
+    return [String(value ?? '')];
+  }
+  return Object.entries(value).map(([key, entryValue]) => `${key}: ${formatValue(entryValue)}`);
+}
+
+function formatValue(value) {
+  if (Array.isArray(value)) {
+    return value.map((item) => {
+      if (item && typeof item === 'object') {
+        return JSON.stringify(sanitizeDiagnosticValue(item));
+      }
+      return String(sanitizeDiagnosticValue(item));
+    }).join(', ');
+  }
+  if (value && typeof value === 'object') {
+    return JSON.stringify(sanitizeDiagnosticValue(value));
+  }
+  return String(sanitizeDiagnosticValue(value));
+}
+
+function formatFileCheck(entry) {
+  if (!entry.exists) {
+    return `${entry.label}: missing (${entry.path})${entry.error ? ` error=${entry.error}` : ''}`;
+  }
+  return `${entry.label}: exists (${entry.path}) size=${entry.size} modifiedAt=${entry.modifiedAt}`;
+}
+
+function sanitizeReport(report) {
+  return redactText(String(report || ''));
+}
+
+function sanitizeDiagnosticText(value) {
+  let text = redactText(String(value || ''));
+  text = text.replace(/("(?:password|otp|cookie|authorization|token|accessToken|refreshToken|access_token|refresh_token|code|session_code|state|nonce|tab_id|credentialId)"\s*:\s*)"[^"]*"/gi, '$1"<redacted>"');
+  text = text.replace(/<\/?(html|body|form|input|script|style)\b[^>]*>/gi, '<html-redacted>');
+  return text;
+}

package/lib/entrypoint.mjs

@@ -0,0 +1,14 @@
+import { realpathSync } from 'node:fs';
+import { pathToFileURL } from 'node:url';
+
+export function isMainModule(importMetaUrl, argv = process.argv) {
+  if (!argv[1]) {
+    return false;
+  }
+
+  try {
+    return importMetaUrl === pathToFileURL(realpathSync(argv[1])).href;
+  } catch {
+    return importMetaUrl === pathToFileURL(argv[1]).href;
+  }
+}

package/lib/file-lock.mjs

@@ -0,0 +1,44 @@
+import { promises as fs } from 'node:fs';
+import { dirname } from 'node:path';
+import { setTimeout as delay } from 'node:timers/promises';
+
+const DEFAULT_LOCK_TIMEOUT_MS = 10_000;
+const DEFAULT_RETRY_DELAY_MS = 25;
+
+export async function withFileLock(filePath, operation, {
+  timeoutMs = DEFAULT_LOCK_TIMEOUT_MS,
+  retryDelayMs = DEFAULT_RETRY_DELAY_MS,
+  mkdirFn = fs.mkdir,
+  rmFn = fs.rm,
+  now = Date.now,
+  delayFn = delay
+} = {}) {
+  if (typeof operation !== 'function') {
+    throw new Error('withFileLock requires an operation function.');
+  }
+
+  await mkdirFn(dirname(filePath), { recursive: true });
+  const lockPath = `${filePath}.lock`;
+  const startedAt = now();
+
+  while (true) {
+    try {
+      await mkdirFn(lockPath);
+      break;
+    } catch (error) {
+      if (error.code !== 'EEXIST') {
+        throw error;
+      }
+      if (now() - startedAt >= timeoutMs) {
+        throw new Error(`Timed out waiting for file lock: ${filePath}`);
+      }
+      await delayFn(retryDelayMs);
+    }
+  }
+
+  try {
+    return await operation();
+  } finally {
+    await rmFn(lockPath, { recursive: true, force: true }).catch(() => {});
+  }
+}

package/lib/http.mjs

@@ -0,0 +1,125 @@
+import { redactText } from './auth-redaction.mjs';
+
+const RETRYABLE_STATUSES = new Set([408, 429, 500, 502, 503, 504]);
+
+export async function fetchWithPolicy(url, {
+  fetchImpl = fetch,
+  timeoutMs = 30_000,
+  retries = 0,
+  retryDelayMs = 250,
+  idempotent = false,
+  ...options
+} = {}) {
+  const attempts = idempotent ? Math.max(0, Number(retries) || 0) + 1 : 1;
+  let lastError = null;
+
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), Math.max(1, Number(timeoutMs) || 30_000));
+    const signal = mergeAbortSignals(options.signal, controller.signal);
+
+    try {
+      const response = await fetchImpl(url, {
+        ...options,
+        signal
+      });
+      clearTimeout(timeout);
+
+      if (
+        attempt < attempts &&
+        RETRYABLE_STATUSES.has(response.status)
+      ) {
+        await discardResponseBody(response);
+        await delay(retryDelayMs);
+        continue;
+      }
+
+      return response;
+    } catch (error) {
+      clearTimeout(timeout);
+      lastError = error;
+
+      if (isAbortError(error)) {
+        throw httpPolicyError(`HTTP request timed out for ${safeUrlLabel(url)} after ${Math.max(1, Number(timeoutMs) || 30_000)}ms.`, {
+          code: 'HTTP_TIMEOUT',
+          cause: error
+        });
+      }
+
+      if (attempt < attempts) {
+        await delay(retryDelayMs);
+        continue;
+      }
+
+      throw httpPolicyError(`HTTP request failed for ${safeUrlLabel(url)}: ${error.message || String(error)}`, {
+        code: 'HTTP_NETWORK_ERROR',
+        cause: error
+      });
+    }
+  }
+
+  throw httpPolicyError(`HTTP request failed for ${safeUrlLabel(url)}: ${lastError?.message || 'unknown network error'}`, {
+    code: 'HTTP_NETWORK_ERROR',
+    cause: lastError
+  });
+}
+
+export function redactedExcerpt(value, maxLength = 500) {
+  let text = redactText(String(value || ''));
+  text = text.replace(/("(?:password|otp|cookie|authorization|token|accessToken|refreshToken|access_token|refresh_token|code|session_code|state|nonce|tab_id|credentialId)"\s*:\s*)"[^"]*"/gi, '$1"<redacted>"');
+  return text.length > maxLength ? `${text.slice(0, maxLength)}...` : text;
+}
+
+function mergeAbortSignals(signal, timeoutSignal) {
+  if (!signal) {
+    return timeoutSignal;
+  }
+
+  if (typeof AbortSignal.any === 'function') {
+    return AbortSignal.any([signal, timeoutSignal]);
+  }
+
+  return timeoutSignal;
+}
+
+function isAbortError(error) {
+  return error?.name === 'AbortError' || error?.code === 'ABORT_ERR';
+}
+
+function httpPolicyError(message, { code, cause } = {}) {
+  const error = new Error(redactText(message));
+  error.code = code;
+  if (cause) {
+    error.cause = cause;
+  }
+  return error;
+}
+
+async function discardResponseBody(response) {
+  try {
+    if (response?.body && typeof response.body.cancel === 'function') {
+      await response.body.cancel();
+      return;
+    }
+
+    if (typeof response?.arrayBuffer === 'function') {
+      await response.arrayBuffer();
+    }
+  } catch {
+    // Best-effort cleanup before retry; the retry itself is more important.
+  }
+}
+
+function safeUrlLabel(rawUrl) {
+  try {
+    const url = new URL(rawUrl);
+    return `${url.origin}${url.pathname}`;
+  } catch {
+    return 'unknown-url';
+  }
+}
+
+function delay(ms) {
+  const waitMs = Math.max(0, Number(ms) || 0);
+  return waitMs ? new Promise((resolve) => setTimeout(resolve, waitMs)) : Promise.resolve();
+}