opencode-harness-kit 0.3.7 → 0.3.9

package/CHANGELOG.md

@@ -14,6 +14,48 @@ is not happening.
 
 ## [Unreleased]
 
+## [0.3.9] — 2026-10-20
+
+### Fixed
+
+- **Each npm command gets its own two-factor challenge.** The code a browser
+  flow returns is valid for the challenge that asked for it and for nothing
+  else, so carrying one from one command to the next made the second command
+  send a code that was already spent - and the registry answered that with a
+  different challenge, one that wants an authenticator code rather than a
+  browser. The failure looked like "npm wants something else now" and nothing
+  like the cause.
+- **The URLs come from the response body, not from a guess.** The done URL
+  was rebuilt from the id, which sent a real request to the registry with a
+  made-up id; the registry answered "forbidden", which is not a token, so the
+  wait ran its full length and then reported that nobody had answered.
+- **`OC_TRUST_NO_BROWSER` turns the browser off.** A test that opens a
+  browser on the machine it runs on is a test that breaks whatever the
+  person at the keyboard was doing.
+
+## [0.3.8] — 2026-10-20
+
+### Fixed
+
+- **`oc-harness trust` completes the two-factor challenge the way npm does, so
+  it works with whatever second factor the account has.** npm answers a
+  request that needs one with the URL to authenticate at and the URL to
+  collect the result from - the URL in the error text is masked, but the one
+  in the JSON body is not.
+  
+  The URL is opened in a browser and printed, the result is collected, and the
+  command carries on. That works with an authenticator app, a security key,
+  or a code sent to the user's email - none of which is a code typed into a
+  terminal.
+  
+  npm's own helper does the same thing, but only when stdin AND stdout are
+  both terminals. A tool that pipes npm's output takes the terminal away from
+  it, and npm then gives up and prints a URL nobody can open. That is what
+  was happening, and it is why the command looked like it wanted a code from
+  an authenticator app and nothing else.
+- The wait for a human is configurable with `OC_TRUST_WAIT_SECONDS`, so a CI
+  run does not hang on it.
+
 ## [0.3.7] — 2026-10-20
 
 ### Fixed
@@ -335,7 +377,9 @@ silent in the worst way:
 
 ---
 
-[Unreleased]: https://github.com/pham-canh/space-harness/compare/v0.3.7...HEAD
+[Unreleased]: https://github.com/pham-canh/space-harness/compare/v0.3.9...HEAD
+[0.3.9]: https://github.com/pham-canh/space-harness/compare/v0.3.8...v0.3.9
+[0.3.8]: https://github.com/pham-canh/space-harness/compare/v0.3.7...v0.3.8
 [0.3.7]: https://github.com/pham-canh/space-harness/compare/v0.3.6...v0.3.7
 [0.3.6]: https://github.com/pham-canh/space-harness/compare/v0.3.5...v0.3.6
 [0.3.5]: https://github.com/pham-canh/space-harness/compare/v0.3.4...v0.3.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-harness-kit",
-  "version": "0.3.7",
+  "version": "0.3.9",
   "description": "Harness kit for OpenCode: capability profiles, a fleet of job lanes with one free model each, role-based reasoning effort, context pruning, and measured baselines.",
   "license": "MIT",
   "homepage": "https://github.com/pham-canh/space-harness#readme",

package/src/trust.js

@@ -25,7 +25,7 @@
 // only runs from one directory is a release tool that people run from the
 // wrong one.
 
-import { execFileSync } from "node:child_process"
+import { execFileSync, spawnSync } from "node:child_process"
 import { readFileSync } from "node:fs"
 import { dirname, join } from "node:path"
 import { fileURLToPath } from "node:url"
@@ -84,80 +84,118 @@ function npm(args, opts = {}) {
 }
 
 /**
- * Run npm, and if it asks for a one-time password, ask for one here and run
- * it again.
+ * Run npm with its output captured.
  *
- * npm's own helper for this opens a browser - but only when stdin and stdout
- * are both terminals, and under `npx` they are not. The result is a failure
- * that prints a web URL masked as `auth/cli/***`, which cannot be opened.
+ * @param {string[]} args
+ * @param {string[]} [extra] arguments to add, such as `--otp=<code>`
+ * @returns {{ out: string, code: number }}
+ */
+function npmCaptured(args, extra = []) {
+  const r = spawnSync("npm", [...args, ...extra], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+  })
+  return { out: `${r.stdout ?? ""}${r.stderr ?? ""}`, code: r.status ?? 1 }
+}
+
+/**
+ * Run npm, and complete a two-factor challenge if it asks for one.
  *
- * So the code is asked for here, and the same code is passed straight back to
- * npm as `--otp`.
+ * npm answers a request that needs a second factor with a body carrying the
+ * URL to authenticate at and the URL to collect the result from. The URL in
+ * the ERROR TEXT is masked - `auth/cli/***` - but the one in the JSON body is
+ * not, and that is the one that can be opened.
+ *
+ * So the challenge is completed the way npm completes it: the URL is opened
+ * in a browser, the user answers there however their account is set up - a
+ * code from an authenticator app, a security key, or one mailed to them - and
+ * the result is collected from the second URL.
+ *
+ * npm's own helper does exactly this, but only when stdin AND stdout are
+ * both terminals. A tool that pipes npm's output takes the terminal away from
+ * it, and npm then gives up and prints a URL nobody can open. So the flow is
+ * done here, where the URL can be recovered.
+ *
+ * EACH CALL GETS ITS OWN CHALLENGE. The code a browser flow returns is valid
+ * for the challenge that asked for it and for nothing else, so carrying one
+ * from one npm command to the next makes the second command send a code that
+ * is already spent, and the registry answers that with a different challenge
+ * - one that wants an authenticator code rather than a browser.
  *
  * @param {string[]} args
- * @param {{ otp?: string }} [state]
+ * @param {{ otp?: string }} [state] the user's own code, if they gave one
  * @returns {Promise<{ out: string, code: number }>}
  */
 async function npmWithOtp(args, state = {}) {
-  /** @param {string[]} extra */
-  const run = (extra) => {
+  const userOtp = state.otp ? [`--otp=${state.otp}`] : []
+  let result = npmCaptured(args, userOtp)
+  if (result.code === 0) return result
+
+  // The URLs come FROM the body, not from a guess. Guessing the done URL
+  // sends a real request to the registry with a made-up id, and the registry
+  // answers "forbidden" - which is not a token, so the wait runs its full
+  // length and then reports that nobody answered.
+  const done = /"doneUrl"\s*:\s*"([^"]+)"/.exec(result.out)
+  if (!done) return result
+  const doneUrl = done[1]
+  const auth = /"authUrl"\s*:\s*"([^"]+)"/.exec(result.out)
+  const authId = /authId=([a-f0-9-]+)/.exec(doneUrl)
+  const authUrl = auth ? auth[1] : `https://www.npmjs.com/auth/cli/${authId?.[1] ?? ""}`
+
+  // Open it if this machine can. The URL is printed either way, because a
+  // browser that cannot be opened here can be opened anywhere.
+  //
+  // OC_TRUST_NO_BROWSER turns the opening off, which is what a test needs:
+  // a test that opens a browser on the machine it runs on is a test that
+  // breaks whatever the person at the keyboard was doing.
+  if (!process.env.OC_TRUST_NO_BROWSER) {
     try {
-      return {
-        out: execFileSync("npm", [...args, ...extra], {
-          encoding: "utf8",
-          stdio: ["ignore", "pipe", "pipe"],
-        }),
-        code: 0,
-      }
-    } catch (err) {
-      const e = /** @type {any} */ (err)
-      return { out: `${e.stdout ?? ""}${e.stderr ?? ""}`, code: e.status ?? 1 }
+      execFileSync("xdg-open", [authUrl], { stdio: "ignore", timeout: 10_000 })
+    } catch {
+      // No browser here. The URL below is the way out.
     }
   }
+  console.error("")
+  console.error(bold("  npm needs to confirm it is you."))
+  console.error(`  ${authUrl}`)
+  console.error(dim("  Answer there however your npm account is set up - an authenticator"))
+  console.error(dim("  app, a security key, or a code sent to your email."))
+  console.error(dim("  This page is open in a browser, or copy the URL above."))
+  console.error("")
 
-  const withOtp = state.otp ? [`--otp=${state.otp}`] : []
-  let result = run(withOtp)
-  if (result.code === 0 || !/one-time password|EOTP/i.test(result.out)) return result
-
-  // npm wants a code. Get one.
-  const code = state.otp ?? (await askForOtp())
-  if (!code) {
-    console.error(red("npm needs a one-time password and none was given."))
-    console.error(dim("  run it again with --otp=<the code from your authenticator app>"))
-    return { out: result.out, code: result.code }
+  const token = await waitForToken(doneUrl)
+  if (!token) {
+    console.error(red("  no answer came back, so nothing was changed."))
+    return result
   }
-  state.otp = code
-  result = run([`--otp=${code}`])
+  // The code is used for THIS call only.
+  result = npmCaptured(args, [`--otp=${token}`])
   return result
 }
 
 /**
- * Ask for the one-time password.
+ * Wait for the browser to answer.
  *
+ * @param {string} doneUrl
  * @returns {Promise<string | null>}
  */
-async function askForOtp() {
-  if (!process.stdin.isTTY) {
-    console.error(
-      red("this needs a one-time password, and there is no terminal to ask for it on."),
-    )
-    console.error(dim(`  run it with --otp=<the code from your authenticator app>`))
-    return null
-  }
-  const { createInterface } = await import("node:readline/promises")
-  // The prompt goes to stderr, and it gets a line of its own: a question
-  // buried in the middle of npm's output is a question nobody answers.
-  process.stderr.write("\n")
-  const rl = createInterface({ input: process.stdin, output: process.stderr })
-  try {
-    const answer = (
-      await rl.question("  one-time password from your authenticator app: ")
-    ).trim()
-    process.stderr.write("\n")
-    return answer || null
-  } finally {
-    rl.close()
+async function waitForToken(doneUrl) {
+  // How long to wait for a human. The window is generous, because the person
+  // may be answering an email, and it is configurable so a CI run does not
+  // hang on it.
+  const seconds = Number(process.env.OC_TRUST_WAIT_SECONDS ?? 600)
+  const attempts = Math.max(1, Math.round(seconds / 5))
+  for (let i = 0; i < attempts; i++) {
+    try {
+      const res = await fetch(doneUrl)
+      const body = /** @type {any} */ (await res.json())
+      if (body && typeof body.token === "string" && body.token) return body.token
+    } catch {
+      // Not ready yet, or the network blipped. Try again.
+    }
+    await new Promise((r) => setTimeout(r, 5000))
   }
+  return null
 }
 
 /**