opencode-ufr 0.2.0

package/src/shared/connect.ts

@@ -0,0 +1,100 @@
+/**
+ * Shared connect logic: parsing key lists and applying credentials to the
+ * keyring + config. Used by the CLI (`ufr connect`) and by the plugin's
+ * /connect integration watcher.
+ */
+
+import { loadConfig, saveConfig } from "./config"
+import type { Paths } from "./paths"
+import type { SecretStore } from "./secrets"
+import { VPN_PASS, VPN_USER } from "./secrets"
+
+/** Splits a key list on commas AND newlines, trims whitespace, drops empties. */
+export function splitKeys(spec: string): string[] {
+  return spec
+    .split(/[,\n\r]+/)
+    .map((k) => k.trim())
+    .filter((k) => k.length > 0)
+}
+
+/** Auto-aliases key1…keyN, skipping numbers already in use. */
+export function nextAliases(existing: string[], count: number): string[] {
+  const used = new Set(existing)
+  const out: string[] = []
+  for (let n = 1; out.length < count; n++) {
+    const alias = `key${n}`
+    if (!used.has(alias)) {
+      used.add(alias)
+      out.push(alias)
+    }
+  }
+  return out
+}
+
+export const EMAIL_RE = /^[^\s@]+@[^\s@]+$/
+
+export type ConnectInput = {
+  keys: string // comma/newline separated, whitespace filtered
+  login?: string // optional uni login (built-in VPN)
+  password?: string
+}
+
+export type ConnectApplied = {
+  aliases: { alias: string; key: string }[]
+  removedAliases: string[]
+  loginStored: boolean
+  errors: string[]
+}
+
+/**
+ * Applies a /connect submission: stores the keys as key1…keyN in the keyring
+ * (replacing previous key* aliases), optionally the uni login, and updates
+ * config.keys. Custom (non-key*) aliases are left untouched.
+ */
+export async function applyConnect(
+  input: ConnectInput,
+  o: { paths: Paths; secrets: SecretStore; log?: (m: string) => void },
+): Promise<ConnectApplied> {
+  const log = o.log ?? (() => {})
+  const errors: string[] = []
+  const keys = splitKeys(input.keys)
+  if (keys.length === 0) {
+    errors.push("no keys given")
+    return { aliases: [], removedAliases: [], loginStored: false, errors }
+  }
+  if (input.login && !EMAIL_RE.test(input.login.trim())) {
+    errors.push(`"${input.login}" does not look like a uni login`)
+    return { aliases: [], removedAliases: [], loginStored: false, errors }
+  }
+
+  const cfg = await loadConfig(o.paths.configFile)
+  const custom = cfg.keys.filter((k) => !/^key\d+$/.test(k))
+
+  // replace the managed key1…keyN aliases
+  const removedAliases: string[] = []
+  const wanted = nextAliases(custom, keys.length)
+  for (const alias of cfg.keys) {
+    if (/^key\d+$/.test(alias) && !wanted.includes(alias)) {
+      await o.secrets.delete(alias)
+      removedAliases.push(alias)
+    }
+  }
+  const aliases: { alias: string; key: string }[] = []
+  for (let i = 0; i < keys.length; i++) {
+    const alias = wanted[i]!
+    await o.secrets.set(alias, keys[i]!)
+    aliases.push({ alias, key: keys[i]! })
+  }
+
+  let loginStored = false
+  if (input.login?.trim()) {
+    await o.secrets.set(VPN_USER, input.login.trim())
+    if (input.password) await o.secrets.set(VPN_PASS, input.password)
+    loginStored = true
+  }
+
+  cfg.keys = [...custom, ...wanted]
+  await saveConfig(o.paths.configFile, cfg)
+  log(`connect applied: ${aliases.length} key(s), login ${loginStored ? "stored" : "unchanged"}`)
+  return { aliases, removedAliases, loginStored, errors }
+}

package/src/shared/errors.ts

@@ -0,0 +1,6 @@
+/** OpenAI-format error with a whole-second Retry-After when a wait is known. */
+export function errorResponse(status: number, type: string, message: string, retryAfterMs?: number): Response {
+  const headers: Record<string, string> = { "content-type": "application/json" }
+  if (retryAfterMs !== undefined && retryAfterMs > 0) headers["retry-after"] = String(Math.max(1, Math.ceil(retryAfterMs / 1000)))
+  return new Response(JSON.stringify({ error: { message, type, code: status } }), { status, headers })
+}

package/src/shared/fs.ts

@@ -0,0 +1,31 @@
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises"
+import { dirname } from "node:path"
+
+/** Write via a temp file + rename, so readers never see half a file. */
+export async function writeFileAtomic(file: string, data: string, mode?: number): Promise<void> {
+  await mkdir(dirname(file), { recursive: true })
+  const tmp = `${file}.tmp-${process.pid}-${Math.random().toString(36).slice(2, 8)}`
+  await writeFile(tmp, data, mode === undefined ? {} : { mode })
+  await rename(tmp, file)
+}
+
+/** File contents, or null if it does not exist. Other errors propagate. */
+export async function readText(file: string): Promise<string | null> {
+  try {
+    return await readFile(file, "utf8")
+  } catch (e) {
+    if ((e as NodeJS.ErrnoException).code === "ENOENT") return null
+    throw e
+  }
+}
+
+/** Parsed JSON, or null if the file is missing or not JSON. */
+export async function readJson(file: string): Promise<unknown | null> {
+  const text = await readText(file)
+  if (text === null) return null
+  try {
+    return JSON.parse(text)
+  } catch {
+    return null
+  }
+}

package/src/shared/models-file.ts

@@ -0,0 +1,68 @@
+/** USD per 1M tokens. */
+export type Price = { input: number; output: number; cache_read?: number; cache_write?: number }
+
+export type ModelEntry = {
+  context?: number
+  max_output?: number
+  vision?: boolean
+  tools?: boolean
+  price?: Price
+  note?: string
+}
+
+export type ModelsFile = {
+  schema: 1
+  updated: string
+  defaults: { context: number; max_output: number }
+  fallbacks: { free_escape_order: string[]; max_targets: number; context_hub: string | null }
+  exclude: string[]
+  aliases: Record<string, string>
+  models: Record<string, ModelEntry>
+}
+
+export class ModelsFileError extends Error {}
+
+const isObj = (x: unknown): x is Record<string, unknown> => typeof x === "object" && x !== null && !Array.isArray(x)
+const posInt = (x: unknown) => typeof x === "number" && Number.isInteger(x) && x > 0
+const nonNeg = (x: unknown) => typeof x === "number" && Number.isFinite(x) && x >= 0
+const strList = (x: unknown) => Array.isArray(x) && x.every((s) => typeof s === "string")
+
+function fail(path: string, why: string): never {
+  throw new ModelsFileError(`models.json: ${path} ${why}`)
+}
+
+export function validateModelsFile(x: unknown): ModelsFile {
+  if (!isObj(x)) fail("(root)", "must be an object")
+  if (x.schema !== 1) fail("schema", `must be 1 (got ${JSON.stringify(x.schema)})`)
+  if (typeof x.updated !== "string") fail("updated", "must be a date string")
+  const d = x.defaults
+  if (!isObj(d) || !posInt(d.context) || !posInt(d.max_output)) fail("defaults", "needs positive integers context and max_output")
+  const fb = x.fallbacks
+  if (!isObj(fb)) fail("fallbacks", "must be an object")
+  if (!strList(fb.free_escape_order)) fail("fallbacks.free_escape_order", "must be a list of model ids")
+  if (!posInt(fb.max_targets)) fail("fallbacks.max_targets", "must be a positive integer")
+  if (fb.context_hub !== null && typeof fb.context_hub !== "string") fail("fallbacks.context_hub", "must be a model id or null")
+  if (!strList(x.exclude)) fail("exclude", "must be a list of model ids")
+  if (!isObj(x.aliases) || !Object.values(x.aliases).every((s) => typeof s === "string")) fail("aliases", "must map alias -> model id")
+  if (!isObj(x.models)) fail("models", "must be an object")
+  for (const [id, m] of Object.entries(x.models)) {
+    const p = `models["${id}"]`
+    if (!isObj(m)) fail(p, "must be an object")
+    if (m.context !== undefined && !posInt(m.context)) fail(`${p}.context`, "must be a positive integer")
+    if (m.max_output !== undefined && !posInt(m.max_output)) fail(`${p}.max_output`, "must be a positive integer")
+    if (m.vision !== undefined && typeof m.vision !== "boolean") fail(`${p}.vision`, "must be true or false")
+    if (m.tools !== undefined && typeof m.tools !== "boolean") fail(`${p}.tools`, "must be true or false")
+    if (m.note !== undefined && typeof m.note !== "string") fail(`${p}.note`, "must be a string")
+    if (m.price !== undefined) {
+      const pr = m.price
+      if (!isObj(pr) || !nonNeg(pr.input) || !nonNeg(pr.output)) fail(`${p}.price`, "needs non-negative input and output (USD per 1M tokens)")
+      for (const k of ["cache_read", "cache_write"] as const) {
+        if (pr[k] !== undefined && !nonNeg(pr[k])) fail(`${p}.price.${k}`, "must be a non-negative number")
+      }
+    }
+  }
+  for (const [alias, target] of Object.entries(x.aliases as Record<string, string>)) {
+    if (!(target in x.models)) fail(`aliases["${alias}"]`, `points at "${target}", which has no models entry`)
+  }
+  return x as unknown as ModelsFile
+}

package/src/shared/paths.ts

@@ -0,0 +1,62 @@
+import { homedir } from "node:os"
+import { join } from "node:path"
+
+export type Paths = {
+  configDir: string
+  stateDir: string
+  cacheDir: string
+  dataDir: string
+  configFile: string
+  daemonFile: string
+  tokenFile: string
+  lockFile: string
+  logFile: string
+  statsDb: string
+  modelsCache: string
+  modelsEtag: string
+  ufrModelsCache: string
+}
+
+const APP = "opencode-ufr"
+
+export function resolvePaths(
+  env: Record<string, string | undefined> = process.env,
+  platform: string = process.platform,
+  home: string = homedir(),
+): Paths {
+  let configDir: string, stateDir: string, cacheDir: string, dataDir: string
+  if (env.OPENCODE_UFR_HOME) {
+    const base = env.OPENCODE_UFR_HOME
+    configDir = join(base, "config")
+    stateDir = join(base, "state")
+    cacheDir = join(base, "cache")
+    dataDir = join(base, "data")
+  } else if (platform === "win32") {
+    const roaming = env.APPDATA ?? join(home, "AppData", "Roaming")
+    const local = env.LOCALAPPDATA ?? join(home, "AppData", "Local")
+    configDir = join(roaming, APP)
+    stateDir = join(local, APP, "state")
+    cacheDir = join(local, APP, "cache")
+    dataDir = join(local, APP, "data")
+  } else {
+    configDir = join(env.XDG_CONFIG_HOME ?? join(home, ".config"), APP)
+    stateDir = join(env.XDG_STATE_HOME ?? join(home, ".local", "state"), APP)
+    cacheDir = join(env.XDG_CACHE_HOME ?? join(home, ".cache"), APP)
+    dataDir = join(env.XDG_DATA_HOME ?? join(home, ".local", "share"), APP)
+  }
+  return {
+    configDir,
+    stateDir,
+    cacheDir,
+    dataDir,
+    configFile: join(configDir, "config.json"),
+    daemonFile: join(stateDir, "daemon.json"),
+    tokenFile: join(stateDir, "token"),
+    lockFile: join(stateDir, "daemon.lock"),
+    logFile: join(stateDir, "daemon.log"),
+    statsDb: join(dataDir, "stats.db"),
+    modelsCache: join(cacheDir, "models.json"),
+    modelsEtag: join(cacheDir, "models.etag"),
+    ufrModelsCache: join(cacheDir, "ufr-models.json"),
+  }
+}

package/src/shared/secrets.ts

@@ -0,0 +1,62 @@
+export interface SecretStore {
+  get(alias: string): Promise<string | null>
+  set(alias: string, value: string): Promise<void>
+  delete(alias: string): Promise<boolean>
+}
+
+export const SERVICE = "opencode-ufr"
+
+/** Keyring aliases for the built-in VPN's uni login (never listed as API keys). */
+export const VPN_USER = "vpn-login"
+export const VPN_PASS = "vpn-pass"
+
+export class SecretStoreError extends Error {}
+
+type Backend = {
+  get(o: { service: string; name: string }): Promise<string | null>
+  set(o: { service: string; name: string; value: string }): Promise<void>
+  delete(o: { service: string; name: string }): Promise<boolean>
+}
+
+/** UFR keys in the OS keyring: macOS Keychain, Windows Credential Manager, libsecret on Linux. */
+export class KeyringStore implements SecretStore {
+  constructor(private readonly backend: Backend = Bun.secrets as unknown as Backend) {}
+
+  private async run<T>(what: string, fn: () => Promise<T>): Promise<T> {
+    try {
+      return await fn()
+    } catch (e) {
+      throw new SecretStoreError(
+        `OS keyring unavailable while trying to ${what} (${(e as Error).message}). ` +
+          "On Linux this needs a Secret Service (gnome-keyring or KWallet) running in your session.",
+      )
+    }
+  }
+
+  get(alias: string): Promise<string | null> {
+    return this.run(`read key "${alias}"`, () => this.backend.get({ service: SERVICE, name: alias }))
+  }
+
+  async set(alias: string, value: string): Promise<void> {
+    if (!value) throw new SecretStoreError("refusing to store an empty key")
+    await this.run(`store key "${alias}"`, () => this.backend.set({ service: SERVICE, name: alias, value }))
+  }
+
+  delete(alias: string): Promise<boolean> {
+    return this.run(`delete key "${alias}"`, () => this.backend.delete({ service: SERVICE, name: alias }))
+  }
+}
+
+/** In-memory store for tests. */
+export class MemoryStore implements SecretStore {
+  private readonly m = new Map<string, string>()
+  async get(alias: string): Promise<string | null> {
+    return this.m.get(alias) ?? null
+  }
+  async set(alias: string, value: string): Promise<void> {
+    this.m.set(alias, value)
+  }
+  async delete(alias: string): Promise<boolean> {
+    return this.m.delete(alias)
+  }
+}

package/src/shared/sleep.ts

@@ -0,0 +1,15 @@
+/** setTimeout as a promise that rejects as soon as the signal aborts. */
+export function sleep(ms: number, signal?: AbortSignal): Promise<void> {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) return reject(signal.reason)
+    const onAbort = () => {
+      clearTimeout(timer)
+      reject(signal!.reason)
+    }
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort)
+      resolve()
+    }, ms)
+    signal?.addEventListener("abort", onAbort, { once: true })
+  })
+}

package/src/shared/time.ts

@@ -0,0 +1,6 @@
+/** Local midnight of the day containing `ms`. UFR's own reset time is unknown. */
+export function startOfLocalDay(ms: number): number {
+  const d = new Date(ms)
+  d.setHours(0, 0, 0, 0)
+  return d.getTime()
+}

package/src/shared/version.ts

@@ -0,0 +1,3 @@
+import pkg from "../../package.json" with { type: "json" }
+
+export const VERSION: string = pkg.version

package/src/shared/vpn.ts

@@ -0,0 +1,8 @@
+export const VPN_GUIDE = "https://wiki.uni-freiburg.de/rz/doku.php?id=vpn"
+
+export const VPN_MESSAGE = `UFR answered with its "VPN erforderlich" page — connect to the uni VPN (${VPN_GUIDE})`
+
+/** Off the VPN, UFR answers every path with HTTP 200 and this page (measured 2026-09-28). */
+export function isVpnPage(html: string): boolean {
+  return /VPN erforderlich|Zugriff eingeschr/i.test(html)
+}