omnirush 0.1.1

package/assets/collect-once.ts

@@ -0,0 +1,126 @@
+// omnirush collect — one-shot workspace snapshot upload (the manual
+// trigger; the same snapshots also flow automatically during agent
+// sessions via the omnirush pi extension).
+//
+// Builds the standard collect envelope (schema_version 1, snapshot_type
+// "start") for a project directory and POSTs it zstd-compressed to
+// {origin}/collect with the device access token. Requires the bundled
+// bun (zstd) or Node >= 22.15.
+//
+// Usage: omnirush collect [--dir PATH] [--yes] [--dry-run]
+
+import { randomBytes } from "node:crypto";
+import path from "node:path";
+import readline from "node:readline";
+
+import { omniDir, resolveOrigin, gatewayUrlForOrigin } from "./extensions/omnirush/auth";
+import {
+  buildEnvelopePayload,
+  collectFiles,
+  compressZstd,
+  MAX_COMPRESSED_BYTES,
+  MAX_COLLECTOR_SESSION_BYTES,
+} from "./extensions/omnirush/collector-lib";
+
+function parseArgs(argv: string[]): { dir: string; yes: boolean; dryRun: boolean } {
+  let dir = process.cwd();
+  let yes = false;
+  let dryRun = false;
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "--dir" && argv[i + 1]) {
+      dir = path.resolve(argv[++i]);
+    } else if (arg === "--yes") {
+      yes = true;
+    } else if (arg === "--dry-run") {
+      dryRun = true;
+    } else if (arg === "-h" || arg === "--help") {
+      console.log("usage: omnirush collect [--dir PATH] [--yes] [--dry-run]");
+      process.exit(0);
+    }
+  }
+  return { dir, yes, dryRun };
+}
+
+async function confirm(question: string): Promise<boolean> {
+  if (!process.stdin.isTTY) return false;
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  const answer = await new Promise<string>((resolve) => rl.question(question, resolve));
+  rl.close();
+  return answer.trim().toLowerCase() === "y" || answer.trim().toLowerCase() === "yes";
+}
+
+async function main() {
+  const { dir, yes, dryRun } = parseArgs(process.argv.slice(2));
+  const sessionId = `manual-${randomBytes(6).toString("hex")}`;
+  const workspaceId = path.basename(dir) || "workspace";
+
+  const files = await collectFiles(dir, MAX_COLLECTOR_SESSION_BYTES, workspaceId, {
+    id: sessionId,
+    segment: 1,
+    resumed: false,
+  });
+  const bytes = files.reduce((total, file) => total + Buffer.byteLength(file.content), 0);
+  if (files.length <= 1) {
+    console.error("omnirush collect: nothing to upload (empty or fully filtered workspace)");
+    process.exit(1);
+  }
+  console.log(
+    `collect: ${files.length - 1} files (${bytes} bytes, denylist/caps applied) as session ${sessionId}`,
+  );
+
+  const state = { id: sessionId, segment: 1, resumed: false };
+  const payload = buildEnvelopePayload(state, "start", files);
+  const compressed = await compressZstd(payload);
+  console.log(
+    `envelope: ${payload.length} bytes plain, ${compressed.length} bytes zstd (cap ${MAX_COMPRESSED_BYTES})`,
+  );
+
+  if (dryRun) {
+    console.log("dry run — no upload performed");
+    return;
+  }
+  if (!yes && !(await confirm(`Upload ${files.length - 1} files from ${dir} to Omnirush? [y/N] `))) {
+    console.log("aborted");
+    process.exit(1);
+  }
+
+  const origin = resolveOrigin(process.env);
+  const collectUrl = gatewayUrlForOrigin(origin).replace(/\/v1$/, "/collect");
+  const accessToken = (
+    process.env.OMNIRUSH_ACCESS_TOKEN ||
+    process.env.OMNIRUSH_TOKEN ||
+    ""
+  ).trim();
+  if (!accessToken) {
+    console.error("omnirush collect: no access token (run `omnirush login`)");
+    process.exit(1);
+  }
+  const response = await fetch(collectUrl, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${accessToken}`,
+      "Content-Type": "application/zstd",
+      "X-Omnirush-Session-ID": sessionId,
+    },
+    body: compressed.buffer.slice(
+      compressed.byteOffset,
+      compressed.byteOffset + compressed.byteLength,
+    ) as ArrayBuffer,
+    signal: AbortSignal.timeout(60_000),
+  });
+  if (!response.ok) {
+    await response.body?.cancel().catch(() => undefined);
+    console.error(`upload failed: HTTP ${response.status}`);
+    process.exit(1);
+  }
+  const extra = [...response.headers]
+    .filter(([name]) => name.toLowerCase().startsWith("x-omnirush-"))
+    .map(([name, value]) => `${name}: ${value}`);
+  console.log(`uploaded (HTTP ${response.status})${extra.length ? "\n  " + extra.join("\n  ") : ""}`);
+}
+
+main().catch((error) => {
+  console.error(`omnirush collect failed: ${error?.message ?? error}`);
+  process.exit(1);
+});

package/assets/extensions/omnirush/auth.js

@@ -0,0 +1,419 @@
+// Omnirush device-flow auth core — shared by the CLI (src/bin.js), the
+// extensions (sota guard 401-refresh, collector), and node:test.
+//
+// Plain ESM JavaScript on node builtins only: pi extensions are loaded
+// through jiti with a fixed virtual-module set (pi packages + typebox),
+// so this file must never import an npm package. Loaded as a relative
+// import from sibling .ts extensions and directly by node from the repo.
+//
+// Endpoint contract (live-verified 2026-09-22 against
+// https://omnirush.ai/omnirush):
+//   POST /device/authorize {device_name, platform}
+//        -> 200 {device_code, user_code, verification_uri,
+//                verification_uri_complete, expires_in, interval}
+//   POST /device/token {device_code}
+//        -> 200 {access_token, refresh_token, gateway_url?}   (approved)
+//        -> 428 {"detail":"authorization_pending"}            (keep polling)
+//        -> 400 {"detail":"expired_token"}                    (unknown/expired)
+//   POST /device/refresh {refresh_token}
+//        -> 200 {access_token, refresh_token, gateway_url?}   (rotate both)
+//        -> 401 {"detail":"refresh_token_invalid_or_expired"}
+//   GET  /device/me        -> 200 device identity | 401 device_token_invalid
+//   POST /collect          -> zstd body, X-Omnirush-Session-ID header
+//
+// SECURITY: nothing in this module ever returns or logs a token; error
+// messages carry only server `detail` strings and HTTP statuses.
+
+import { spawn } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+export const DEFAULT_ORIGIN = "https://omnirush.ai/omnirush";
+export const DEFAULT_POLL_INTERVAL_SEC = 5;
+export const MAX_POLL_INTERVAL_SEC = 30;
+
+const AUTH_FILE = "auth.json";
+const PENDING_FILE = "device-flow.json";
+
+/** Strip a trailing "/v1" (and slashes) from a gateway URL to get the manager origin. */
+export function originFromGatewayUrl(gatewayUrl) {
+  return String(gatewayUrl || "")
+    .trim()
+    .replace(/\/+$/, "")
+    .replace(/\/v1$/, "");
+}
+
+/** The pi provider base URL for a manager origin. */
+export function gatewayUrlForOrigin(origin) {
+  return `${String(origin).replace(/\/+$/, "")}/v1`;
+}
+
+/**
+ * Manager origin resolution order: OMNIRUSH_ORIGIN, OMNIRUSH_GATEWAY_URL
+ * (stripped of its /v1 suffix), shipped default.
+ */
+export function resolveOrigin(env = process.env) {
+  const direct = (env.OMNIRUSH_ORIGIN || "").trim().replace(/\/+$/, "");
+  if (direct) return direct;
+  const viaGateway = originFromGatewayUrl(env.OMNIRUSH_GATEWAY_URL);
+  if (viaGateway) return viaGateway;
+  return DEFAULT_ORIGIN;
+}
+
+/** Runtime state dir (~/.omnirush by default); OMNIRUSH_DIR overrides (tests). */
+export function omniDir(env = process.env) {
+  return env.OMNIRUSH_DIR
+    ? path.resolve(env.OMNIRUSH_DIR)
+    : path.join(os.homedir(), ".omnirush");
+}
+
+function ensureDir(dir) {
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+}
+
+function readJsonFile(filePath) {
+  try {
+    return JSON.parse(fs.readFileSync(filePath, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Enforce 0600 where POSIX mode bits exist (repairing files that were
+ * written too openly). On Windows chmod is a permissions no-op — it only
+ * toggles the read-only flag — so the store relies on the user-profile
+ * ACLs there and this is deliberately skipped.
+ */
+function repairPosixMode(filePath) {
+  if (process.platform === "win32") return;
+  try {
+    fs.chmodSync(filePath, 0o600);
+  } catch {
+    /* best effort */
+  }
+}
+
+function writeJsonFile0600(dir, name, value) {
+  ensureDir(dir);
+  const filePath = path.join(dir, name);
+  fs.writeFileSync(filePath, JSON.stringify(value, null, 2) + "\n", { mode: 0o600 });
+  repairPosixMode(filePath);
+}
+
+export function authFilePath(dir) {
+  return path.join(dir, AUTH_FILE);
+}
+
+/** Valid stored credentials or null. Repairs overly-open file modes. */
+export function loadAuth(dir) {
+  const value = readJsonFile(authFilePath(dir));
+  if (!value || typeof value !== "object") return null;
+  const accessToken = typeof value.accessToken === "string" ? value.accessToken : "";
+  const refreshToken = typeof value.refreshToken === "string" ? value.refreshToken : "";
+  if (!accessToken || !refreshToken) return null;
+  const gatewayUrl =
+    typeof value.gatewayUrl === "string" && value.gatewayUrl ? value.gatewayUrl : undefined;
+  repairPosixMode(authFilePath(dir));
+  return { accessToken, refreshToken, ...(gatewayUrl ? { gatewayUrl } : {}) };
+}
+
+export function saveAuth(dir, auth) {
+  if (!auth?.accessToken || !auth?.refreshToken) {
+    throw new Error("refusing to store incomplete omnirush credentials");
+  }
+  writeJsonFile0600(dir, AUTH_FILE, {
+    accessToken: auth.accessToken,
+    refreshToken: auth.refreshToken,
+    ...(auth.gatewayUrl ? { gatewayUrl: auth.gatewayUrl } : {}),
+    savedAt: new Date().toISOString(),
+  });
+}
+
+export function clearAuth(dir) {
+  for (const name of [AUTH_FILE, PENDING_FILE]) {
+    try {
+      fs.rmSync(path.join(dir, name), { force: true });
+    } catch {
+      /* best effort */
+    }
+  }
+}
+
+/** Login state kept while a device code awaits browser approval (doctor reads this). */
+export function savePendingFlow(dir, flow) {
+  writeJsonFile0600(dir, PENDING_FILE, flow);
+}
+
+export function loadPendingFlow(dir) {
+  const value = readJsonFile(path.join(dir, PENDING_FILE));
+  if (!value || typeof value !== "object") return null;
+  if (typeof value.device_code !== "string" || !value.device_code) return null;
+  return value;
+}
+
+export function clearPendingFlow(dir) {
+  try {
+    fs.rmSync(path.join(dir, PENDING_FILE), { force: true });
+  } catch {
+    /* best effort */
+  }
+}
+
+function detailOf(payload, fallback) {
+  if (payload && typeof payload === "object") {
+    const detail = payload.detail;
+    if (typeof detail === "string") return detail;
+    if (detail != null) return "invalid request";
+  }
+  return fallback;
+}
+
+async function postJson(url, body, fetchImpl, timeoutMs = 20_000) {
+  const response = await fetchImpl(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+    signal: AbortSignal.timeout(timeoutMs),
+  });
+  let payload = null;
+  try {
+    payload = await response.json();
+  } catch {
+    /* non-JSON body — fall through with payload null */
+  }
+  return { response, payload };
+}
+
+/** Step 1 of the device flow: create a pending authorization. */
+export async function deviceAuthorize(origin, { deviceName, platform, fetchImpl } = {}) {
+  const doFetch = fetchImpl ?? globalThis.fetch;
+  const { response, payload } = await postJson(`${origin}/device/authorize`, {
+    device_name: deviceName,
+    platform,
+  }, doFetch);
+  if (!response.ok) {
+    throw new Error(`device authorize failed: HTTP ${response.status} ${detailOf(payload, "")}`.trim());
+  }
+  const deviceCode = typeof payload?.device_code === "string" ? payload.device_code : "";
+  const userCode = typeof payload?.user_code === "string" ? payload.user_code : "";
+  const verificationUriComplete =
+    typeof payload?.verification_uri_complete === "string"
+      ? payload.verification_uri_complete
+      : undefined;
+  if (!deviceCode || !userCode || !verificationUriComplete) {
+    throw new Error("device authorize response missing device_code/user_code/verification_uri_complete");
+  }
+  const intervalSec =
+    typeof payload.interval === "number" && payload.interval > 0
+      ? payload.interval
+      : DEFAULT_POLL_INTERVAL_SEC;
+  const expiresInSec =
+    typeof payload.expires_in === "number" && payload.expires_in > 0 ? payload.expires_in : 600;
+  return {
+    deviceCode,
+    userCode,
+    verificationUri: typeof payload.verification_uri === "string" ? payload.verification_uri : undefined,
+    verificationUriComplete,
+    intervalSec,
+    expiresAt: Date.now() + expiresInSec * 1000,
+  };
+}
+
+export async function deviceToken(origin, { deviceCode, fetchImpl } = {}) {
+  const doFetch = fetchImpl ?? globalThis.fetch;
+  const { response, payload } = await postJson(`${origin}/device/token`, { device_code: deviceCode }, doFetch);
+  const detail = detailOf(payload, "");
+  if (response.ok) {
+    const accessToken = typeof payload?.access_token === "string" ? payload.access_token : "";
+    const refreshToken = typeof payload?.refresh_token === "string" ? payload.refresh_token : "";
+    if (!accessToken || !refreshToken) {
+      return { status: "error", detail: "token response missing access_token/refresh_token" };
+    }
+    const gatewayUrl = typeof payload?.gateway_url === "string" && payload.gateway_url
+      ? originFromGatewayUrl(payload.gateway_url)
+      : undefined;
+    return {
+      status: "ok",
+      tokens: { accessToken, refreshToken, ...(gatewayUrl ? { gatewayUrl } : {}) },
+    };
+  }
+  if (response.status === 428 || detail === "authorization_pending") return { status: "pending" };
+  if (response.status === 429 || detail === "slow_down") return { status: "slow_down" };
+  if (detail === "expired_token") return { status: "expired" };
+  return { status: "error", detail: `HTTP ${response.status} ${detail}`.trim() };
+}
+
+/**
+ * Poll /device/token until approval. `sleep` defaults to a real timer and
+ * is injectable for tests; `onWait` observes each waiting round (for the
+ * CLI spinner dots). Resolves with tokens or throws (expired/timeout).
+ */
+export async function pollForToken(origin, {
+  deviceCode,
+  intervalSec = DEFAULT_POLL_INTERVAL_SEC,
+  expiresAt = Date.now() + 600_000,
+  fetchImpl,
+  sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+  onWait,
+} = {}) {
+  let interval = Math.min(Math.max(intervalSec, 1), MAX_POLL_INTERVAL_SEC);
+  const doFetch = fetchImpl ?? globalThis.fetch;
+  for (;;) {
+    if (Date.now() >= expiresAt) {
+      throw new Error("device authorization expired — run `omnirush login` again");
+    }
+    const result = await deviceToken(origin, { deviceCode, fetchImpl: doFetch });
+    if (result.status === "ok") return result.tokens;
+    if (result.status === "expired") {
+      throw new Error("device authorization expired — run `omnirush login` again");
+    }
+    if (result.status === "slow_down") {
+      interval = Math.min(interval + 5, MAX_POLL_INTERVAL_SEC);
+    }
+    if (result.status === "error") throw new Error(`device token poll failed: ${result.detail}`);
+    onWait?.(interval);
+    await sleep(interval * 1000);
+  }
+}
+
+export class RefreshRejectedError extends Error {
+  constructor(detail) {
+    super(`refresh rejected: ${detail}`);
+    this.name = "RefreshRejectedError";
+  }
+}
+
+/** Rotate both tokens. Throws RefreshRejectedError when the refresh token is dead. */
+export async function refreshTokens(origin, { refreshToken, fetchImpl } = {}) {
+  const doFetch = fetchImpl ?? globalThis.fetch;
+  const { response, payload } = await postJson(`${origin}/device/refresh`, { refresh_token: refreshToken }, doFetch);
+  if (!response.ok) {
+    throw new RefreshRejectedError(detailOf(payload, `HTTP ${response.status}`));
+  }
+  const accessToken = typeof payload?.access_token === "string" ? payload.access_token : "";
+  const nextRefreshToken = typeof payload?.refresh_token === "string" ? payload.refresh_token : "";
+  if (!accessToken || !nextRefreshToken) {
+    throw new Error("refresh response missing access_token/refresh_token");
+  }
+  const gatewayUrl = typeof payload?.gateway_url === "string" && payload.gateway_url
+    ? originFromGatewayUrl(payload.gateway_url)
+    : undefined;
+  return { accessToken, refreshToken: nextRefreshToken, ...(gatewayUrl ? { gatewayUrl } : {}) };
+}
+
+export async function deviceMe(origin, { accessToken, fetchImpl } = {}) {
+  const doFetch = fetchImpl ?? globalThis.fetch;
+  const response = await doFetch(`${origin}/device/me`, {
+    headers: { Authorization: `Bearer ${accessToken}` },
+    signal: AbortSignal.timeout(15_000),
+  });
+  if (response.status === 401) return null;
+  if (!response.ok) throw new Error(`device me failed: HTTP ${response.status}`);
+  return response.json();
+}
+
+/** Copy of an identity object safe to print: token-ish keys are dropped. */
+export function redactForDisplay(value) {
+  if (Array.isArray(value)) return value.map((entry) => redactForDisplay(entry));
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const [key, entry] of Object.entries(value)) {
+      if (/token|secret|password|api_?key/i.test(key)) continue;
+      out[key] = redactForDisplay(entry);
+    }
+    return out;
+  }
+  return value;
+}
+
+/**
+ * Single-flight token refresher (the GUI broker pattern): concurrent
+ * callers share one HTTP refresh; a caller whose expected token was
+ * already rotated resolves true without touching the network. Rotated
+ * credentials persist back to the state dir (0600) before resolution.
+ */
+export function createRefresher({ dir, origin, fetchImpl, now = () => Date.now() } = {}) {
+  const doFetch = fetchImpl ?? globalThis.fetch;
+  let auth = dir ? loadAuth(dir) : null;
+  let inflight = null;
+  let lastPersistError = null;
+
+  const setAuth = (next) => {
+    auth = next;
+  };
+
+  const persist = async (next, attempt = 0) => {
+    try {
+      saveAuth(dir, next);
+      lastPersistError = null;
+    } catch (error) {
+      lastPersistError = error?.message ?? "persist failed";
+      if (attempt < 3 && auth?.refreshToken === next.refreshToken) {
+        await new Promise((resolve) => setTimeout(resolve, 250 * 2 ** attempt));
+        await persist(next, attempt + 1);
+      }
+    }
+  };
+
+  const performRefresh = async (expectedAccessToken) => {
+    if (!auth || auth.accessToken !== expectedAccessToken) return true;
+    let next;
+    try {
+      next = await refreshTokens(origin, { refreshToken: auth.refreshToken, fetchImpl: doFetch });
+    } catch (error) {
+      if (error instanceof RefreshRejectedError) {
+        // Dead refresh token: caller surfaces a re-login hint. Keep the
+        // stored pair so doctor can still show an explicit invalid state.
+        return false;
+      }
+      throw error;
+    }
+    setAuth(next);
+    await persist(next);
+    return true;
+  };
+
+  return {
+    get auth() {
+      return auth;
+    },
+    get lastPersistError() {
+      return lastPersistError;
+    },
+    setAuth(next) {
+      setAuth(next);
+    },
+    reload() {
+      auth = dir ? loadAuth(dir) : null;
+    },
+    now,
+    async refresh(expectedAccessToken) {
+      if (!auth) return false;
+      if (auth.accessToken !== expectedAccessToken) return true;
+      inflight ??= performRefresh(expectedAccessToken).finally(() => {
+        inflight = null;
+      });
+      return inflight;
+    },
+  };
+}
+
+/** Best-effort browser open: xdg-open / open / cmd start. Never throws. */
+export function openBrowser(url) {
+  try {
+    if (process.platform === "darwin") {
+      spawn("open", [url], { detached: true, stdio: "ignore" }).unref();
+      return true;
+    }
+    if (process.platform === "win32") {
+      spawn("cmd", ["/c", "start", "", url], { detached: true, stdio: "ignore" }).unref();
+      return true;
+    }
+    spawn("xdg-open", [url], { detached: true, stdio: "ignore" }).unref();
+    return true;
+  } catch {
+    return false;
+  }
+}