opencode-harness-kit 0.3.6 → 0.3.8

package/CHANGELOG.md

@@ -14,6 +14,45 @@ is not happening.
 
 ## [Unreleased]
 
+## [0.3.8] — 2026-10-20
+
+### Fixed
+
+- **`oc-harness trust` completes the two-factor challenge the way npm does, so
+  it works with whatever second factor the account has.** npm answers a
+  request that needs one with the URL to authenticate at and the URL to
+  collect the result from - the URL in the error text is masked, but the one
+  in the JSON body is not.
+  
+  The URL is opened in a browser and printed, the result is collected, and the
+  command carries on. That works with an authenticator app, a security key,
+  or a code sent to the user's email - none of which is a code typed into a
+  terminal.
+  
+  npm's own helper does the same thing, but only when stdin AND stdout are
+  both terminals. A tool that pipes npm's output takes the terminal away from
+  it, and npm then gives up and prints a URL nobody can open. That is what
+  was happening, and it is why the command looked like it wanted a code from
+  an authenticator app and nothing else.
+- The wait for a human is configurable with `OC_TRUST_WAIT_SECONDS`, so a CI
+  run does not hang on it.
+
+## [0.3.7] — 2026-10-20
+
+### Fixed
+
+- **`oc-harness trust` no longer reports a failed create as a configured
+  one.** It printed "the trusted publisher is configured" after npm refused,
+  because it checked the error TEXT rather than the exit code. The user walks
+  away believing the publish path is fixed and finds out at the next release.
+  The exit code is what decides now, and npm's own words are printed when it
+  is not zero.
+- **A failed read is reported as a failed read**, with npm's answer attached,
+  rather than as "nothing is configured" - which sent the reader off to
+  create a configuration that already existed.
+- **The one-time password prompt goes to stderr, on a line of its own.** A
+  question buried in npm's output is a question nobody answers.
+
 ## [0.3.6] — 2026-10-20
 
 ### Fixed
@@ -319,7 +358,9 @@ silent in the worst way:
 
 ---
 
-[Unreleased]: https://github.com/pham-canh/space-harness/compare/v0.3.6...HEAD
+[Unreleased]: https://github.com/pham-canh/space-harness/compare/v0.3.8...HEAD
+[0.3.8]: https://github.com/pham-canh/space-harness/compare/v0.3.7...v0.3.8
+[0.3.7]: https://github.com/pham-canh/space-harness/compare/v0.3.6...v0.3.7
 [0.3.6]: https://github.com/pham-canh/space-harness/compare/v0.3.5...v0.3.6
 [0.3.5]: https://github.com/pham-canh/space-harness/compare/v0.3.4...v0.3.5
 [0.3.4]: https://github.com/pham-canh/space-harness/compare/v0.3.1...v0.3.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-harness-kit",
-  "version": "0.3.6",
+  "version": "0.3.8",
   "description": "Harness kit for OpenCode: capability profiles, a fleet of job lanes with one free model each, role-based reasoning effort, context pruning, and measured baselines.",
   "license": "MIT",
   "homepage": "https://github.com/pham-canh/space-harness#readme",

package/src/trust.js

@@ -25,7 +25,7 @@
 // only runs from one directory is a release tool that people run from the
 // wrong one.
 
-import { execFileSync } from "node:child_process"
+import { execFileSync, spawnSync } from "node:child_process"
 import { readFileSync } from "node:fs"
 import { dirname, join } from "node:path"
 import { fileURLToPath } from "node:url"
@@ -84,74 +84,101 @@ function npm(args, opts = {}) {
 }
 
 /**
- * Run npm, and if it asks for a one-time password, ask for one here and run
- * it again.
+ * Run npm with its output captured.
  *
- * npm's own helper for this opens a browser - but only when stdin and stdout
- * are both terminals, and under `npx` they are not. The result is a failure
- * that prints a web URL masked as `auth/cli/***`, which cannot be opened.
+ * @param {string[]} args
+ * @param {{ otp?: string }} [state]
+ * @returns {{ out: string, code: number }}
+ */
+function npmCaptured(args, state = {}) {
+  const extra = state.otp ? [`--otp=${state.otp}`] : []
+  const r = spawnSync("npm", [...args, ...extra], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+  })
+  return { out: `${r.stdout ?? ""}${r.stderr ?? ""}`, code: r.status ?? 1 }
+}
+
+/**
+ * Run npm, and complete a two-factor challenge if it asks for one.
+ *
+ * npm answers a request that needs a second factor with a body carrying the
+ * URL to authenticate at and the URL to collect the result from. The URL in
+ * the ERROR TEXT is masked - `auth/cli/***` - but the one in the JSON body is
+ * not, and that is the one that can be opened.
+ *
+ * So the challenge is completed the way npm completes it: the URL is opened
+ * in a browser, the user answers there however their account is set up - a
+ * code from an authenticator app, a security key, or one mailed to them - and
+ * the result is collected from the second URL.
  *
- * So the code is asked for here, and the same code is passed straight back to
- * npm as `--otp`.
+ * npm's own helper does exactly this, but only when stdin AND stdout are
+ * both terminals. A tool that pipes npm's output takes the terminal away from
+ * it, and npm then gives up and prints a URL nobody can open. So the flow is
+ * done here, where the URL can be recovered.
  *
  * @param {string[]} args
  * @param {{ otp?: string }} [state]
- * @returns {Promise<string>}
+ * @returns {Promise<{ out: string, code: number }>}
  */
 async function npmWithOtp(args, state = {}) {
-  /** @param {string[]} extra */
-  const run = (extra) => {
-    try {
-      return {
-        out: execFileSync("npm", [...args, ...extra], {
-          encoding: "utf8",
-          stdio: ["ignore", "pipe", "pipe"],
-        }),
-        failed: false,
-      }
-    } catch (err) {
-      const e = /** @type {any} */ (err)
-      return { out: `${e.stdout ?? ""}${e.stderr ?? ""}`, failed: true }
-    }
-  }
+  let result = npmCaptured(args, state)
+  if (result.code === 0) return result
 
-  const withOtp = state.otp ? [`--otp=${state.otp}`] : []
-  let result = run(withOtp)
-  if (!result.failed || !/one-time password|EOTP/i.test(result.out)) return result.out
+  const m = /"doneUrl"\s*:\s*"[^"]*authId=([a-f0-9-]+)"/.exec(result.out)
+  if (!m) return result
+  const authId = m[1]
+  const authUrl = `https://www.npmjs.com/auth/cli/${authId}`
+  const doneUrl = `https://registry.npmjs.org/-/v1/done?authId=${authId}`
 
-  // npm wants a code. Get one.
-  const code = state.otp ?? (await askForOtp())
-  if (!code) {
-    console.error(red("npm needs a one-time password and none was given."))
-    console.error(dim(`  run it again with --otp=<the code from your authenticator app>`))
-    process.exit(1)
+  // Open it if this machine can. The URL is printed either way, because a
+  // browser that cannot be opened here can be opened anywhere.
+  try {
+    execFileSync("xdg-open", [authUrl], { stdio: "ignore", timeout: 10_000 })
+  } catch {
+    // No browser here. The URL below is the way out.
   }
-  state.otp = code
-  result = run([`--otp=${code}`])
-  return result.out
+  console.error("")
+  console.error(bold("  npm needs to confirm it is you."))
+  console.error(`  ${authUrl}`)
+  console.error(dim("  Answer there however your npm account is set up - an authenticator"))
+  console.error(dim("  app, a security key, or a code sent to your email."))
+  console.error(dim("  This page is open in a browser, or copy the URL above."))
+  console.error("")
+
+  const token = await waitForToken(doneUrl)
+  if (!token) {
+    console.error(red("  no answer came back, so nothing was changed."))
+    return result
+  }
+  state.otp = token
+  result = npmCaptured(args, state)
+  return result
 }
 
 /**
- * Ask for the one-time password.
+ * Wait for the browser to answer.
  *
+ * @param {string} doneUrl
  * @returns {Promise<string | null>}
  */
-async function askForOtp() {
-  if (!process.stdin.isTTY) {
-    console.error(
-      red("this needs a one-time password, and there is no terminal to ask for it on."),
-    )
-    console.error(dim(`  run it with --otp=<the code from your authenticator app>`))
-    return null
-  }
-  const { createInterface } = await import("node:readline/promises")
-  const rl = createInterface({ input: process.stdin, output: process.stdout })
-  try {
-    const answer = (await rl.question("  one-time password from your authenticator app: ")).trim()
-    return answer || null
-  } finally {
-    rl.close()
+async function waitForToken(doneUrl) {
+  // How long to wait for a human. The window is generous, because the person
+  // may be answering an email, and it is configurable so a CI run does not
+  // hang on it.
+  const seconds = Number(process.env.OC_TRUST_WAIT_SECONDS ?? 600)
+  const attempts = Math.max(1, Math.round(seconds / 5))
+  for (let i = 0; i < attempts; i++) {
+    try {
+      const res = await fetch(doneUrl)
+      const body = /** @type {any} */ (await res.json())
+      if (body && typeof body.token === "string" && body.token) return body.token
+    } catch {
+      // Not ready yet, or the network blipped. Try again.
+    }
+    await new Promise((r) => setTimeout(r, 5000))
   }
+  return null
 }
 
 /**
@@ -163,19 +190,22 @@ async function askForOtp() {
  *
  * @param {string} name
  * @param {{ otp?: string }} [state]
- * @returns {Promise<{ configs: any[], failed: boolean }>}
+ * @returns {Promise<{ configs: any[], failed: boolean, detail?: string }>}
  */
 async function listConfigs(name, state = {}) {
-  const out = await npmWithOtp(["trust", "list", name, "--json"], state)
-  if (/one-time password|EOTP/i.test(out) && !state.otp) {
-    return { configs: [], failed: true }
+  const { out, code } = await npmWithOtp(["trust", "list", name, "--json"], state)
+  if (code !== 0) {
+    // A package with no configuration answers 404, and a failed call answers
+    // with something else. They are different facts.
+    if (/E404|not found/i.test(out)) return { configs: [], failed: false }
+    return { configs: [], failed: true, detail: out }
   }
   if (!out.trim()) return { configs: [], failed: false }
   let parsed
   try {
     parsed = JSON.parse(out)
   } catch {
-    return { configs: [], failed: true }
+    return { configs: [], failed: true, detail: out }
   }
   const items = Array.isArray(parsed) ? parsed : parsed.configs ?? [parsed]
   return { configs: items.filter(Boolean), failed: false }
@@ -226,10 +256,13 @@ export async function main(argv = []) {
     return 1
   }
 
-  const { configs, failed } = await listConfigs(name, state)
+  const { configs, failed, detail } = await listConfigs(name, state)
   if (failed && !configs.length) {
     console.error(red("could not read the trusted publisher configuration."))
-    console.error(dim("  npm answered with something that is not a configuration list."))
+    if (detail) {
+      console.error(dim("  npm said:"))
+      for (const line of detail.trim().split("\n").slice(-12)) console.error(dim("    " + line))
+    }
     console.error(dim(`  run \`npm trust list ${name}\` to see the raw answer.`))
     return 1
   }
@@ -244,7 +277,7 @@ export async function main(argv = []) {
       return 1
     }
     console.log(`  creating it: ${file}, no environment, publish and stage\n`)
-    const out = await npmWithOtp(
+    const { out, code } = await npmWithOtp(
       [
         "trust",
         "github",
@@ -259,9 +292,19 @@ export async function main(argv = []) {
       ],
       state,
     )
-    if (/one-time password|EOTP/i.test(out)) {
-      console.error(red("npm still wants a one-time password."))
-      console.error(dim("  run it again with --otp=<the code from your authenticator app>"))
+    if (code !== 0) {
+      // Printing "configured" after a failed create is the worst thing this
+      // command could do: the user walks away believing the publish path is
+      // fixed, and finds out at the next release.
+      console.error(red("npm did not create the trusted publisher."))
+      if (/one-time password|EOTP/i.test(out)) {
+        console.error(dim("  run it again with --otp=<the code from your authenticator app>"))
+      }
+      const detail = out.trim()
+      if (detail) {
+        console.error(dim("  npm said:"))
+        for (const line of detail.split("\n").slice(-12)) console.error(dim("    " + line))
+      }
       return 1
     }
     console.log(`\n  ${green("✓")} the trusted publisher is configured\n`)
@@ -314,8 +357,12 @@ export async function main(argv = []) {
       console.error("  revoke it on npmjs.com and run this again.")
       return 1
     }
-    await npmWithOtp(["trust", "revoke", name, "--id", id, "-y"], state)
-    await npmWithOtp(
+    const revoked = await npmWithOtp(["trust", "revoke", name, "--id", id, "-y"], state)
+    if (revoked.code !== 0) {
+      console.error(red("npm did not revoke the old configuration, so nothing was replaced."))
+      return 1
+    }
+    const created = await npmWithOtp(
       [
         "trust",
         "github",
@@ -330,6 +377,15 @@ export async function main(argv = []) {
       ],
       state,
     )
+    if (created.code !== 0) {
+      console.error(red("npm did not create the replacement configuration."))
+      const detail = created.out.trim()
+      if (detail) {
+        console.error(dim("  npm said:"))
+        for (const line of detail.split("\n").slice(-12)) console.error(dim("    " + line))
+      }
+      return 1
+    }
     console.log(`\n  ${green("✓")} the trusted publisher is configured\n`)
   }
   return 0