pi-git-auth 1.0.0

package/gitlab.ts

@@ -0,0 +1,157 @@
+/**
+ * Minimal GitLab REST client (gitlab.com, no dependencies).
+ * Mirrors github.ts: verify, list, create, meta, commits, tree —
+ * all returning the normalized types from forge.ts.
+ */
+
+import type { CommitInfo, ForgeRepo, RepoMeta, TreeEntry } from "./forge";
+
+const API_BASE = "https://gitlab.com/api/v4";
+
+interface ApiResult {
+  status: number;
+  data: any;
+}
+
+async function glFetch(path: string, token: string, init: RequestInit = {}): Promise<ApiResult> {
+  const res = await fetch(`${API_BASE}${path}`, {
+    ...init,
+    headers: {
+      accept: "application/json",
+      authorization: `Bearer ${token}`,
+      ...(init.body ? { "content-type": "application/json" } : {}),
+    },
+  });
+  let data: any = null;
+  if (res.status !== 204) {
+    try {
+      data = await res.json();
+    } catch {
+      data = null;
+    }
+  }
+  return { status: res.status, data };
+}
+
+function errMsg(status: number, data: any): string {
+  return typeof data?.message === "string"
+    ? data.message
+    : Array.isArray(data?.errors)
+      ? data.errors.join(", ")
+      : data?.error
+        ? String(data.error)
+        : "";
+}
+
+function checkAuth(status: number): void {
+  if (status === 401) throw new Error("Token invalid or revoked (HTTP 401)");
+  if (status === 403) throw new Error("Token lacks permissions (HTTP 403)");
+}
+
+/** Verify a token by resolving the current user. */
+export async function getUser(token: string): Promise<{ login: string; name?: string }> {
+  const { status, data } = await glFetch("/user", token);
+  checkAuth(status);
+  if (status >= 400 || !data?.username) throw new Error(`Unexpected response (HTTP ${status})`);
+  return { login: data.username, name: data.name };
+}
+
+/**
+ * Projects, normalized. With `org`: the group's projects; if the name is
+ * not a group, falls back to a user's projects.
+ */
+export async function listRepos(token: string, opts: { org?: string; perPage?: number }): Promise<ForgeRepo[]> {
+  const perPage = opts.perPage ?? 100;
+  if (opts.org) {
+    // Prefer group; fall back to a user's projects.
+    const g = await glFetch(`/groups/${encodeURIComponent(opts.org)}/projects?include_subgroups=true&per_page=${perPage}`, token);
+    if (g.status < 400 && Array.isArray(g.data)) return g.data.map(mapProject);
+    const u = await glFetch(`/users/${encodeURIComponent(opts.org)}/projects?per_page=${perPage}`, token);
+    checkAuth(u.status);
+    if (u.status >= 400 || !Array.isArray(u.data)) {
+      throw new Error(`List projects failed (HTTP ${u.status}): ${errMsg(u.status, u.data)}`);
+    }
+    return u.data.map(mapProject);
+  }
+  const { status, data } = await glFetch(`/projects?owned=true&per_page=${perPage}`, token);
+  checkAuth(status);
+  if (status >= 400 || !Array.isArray(data)) throw new Error(`List projects failed (HTTP ${status}): ${errMsg(status, data)}`);
+  return data.map(mapProject);
+}
+
+function mapProject(p: any): ForgeRepo {
+  return {
+    fullName: p.path_with_namespace,
+    private: p.visibility === "private",
+    description: p.description ?? undefined,
+    htmlUrl: p.web_url,
+  };
+}
+
+/** Full project metadata for the details view. */
+export async function getRepo(token: string, fullName: string): Promise<RepoMeta> {
+  const { status, data } = await glFetch(`/projects/${encodeURIComponent(fullName)}`, token);
+  checkAuth(status);
+  if (status === 404) throw new Error(`Project ${fullName} not found (HTTP 404)`);
+  if (status >= 400 || !data) throw new Error(`Get project failed (HTTP ${status}): ${errMsg(status, data)}`);
+  return {
+    fullName: data.path_with_namespace,
+    private: data.visibility === "private",
+    description: data.description ?? undefined,
+    defaultBranch: data.default_branch ?? "main",
+    // GitLab's API does not expose project size.
+    stars: data.star_count ?? 0,
+    forks: data.forks_count ?? 0,
+    lastPush: data.last_activity_at || undefined,
+    htmlUrl: data.web_url,
+  };
+}
+
+/** Latest commits, newest first (default branch). */
+export async function listCommits(token: string, fullName: string, perPage = 5): Promise<CommitInfo[]> {
+  const { status, data } = await glFetch(
+    `/projects/${encodeURIComponent(fullName)}/repository/commits?per_page=${perPage}`,
+    token,
+  );
+  checkAuth(status);
+  if (status === 404) throw new Error(`Project ${fullName} not found (HTTP 404)`);
+  if (status >= 400 || !Array.isArray(data)) throw new Error(`List commits failed (HTTP ${status}): ${errMsg(status, data)}`);
+  return data.map((c: any) => ({
+    sha: String(c.short_id ?? c.id ?? ""),
+    subject: String(c.title ?? "").split("\n")[0],
+    date: c.committed_date ?? c.created_at ?? "",
+  }));
+}
+
+/** Flat recursive tree (default branch, or `ref`). Returns [] on 404. */
+export async function getTree(token: string, fullName: string, ref?: string): Promise<TreeEntry[]> {
+  const q = `recursive=1&per_page=100${ref ? `&ref=${encodeURIComponent(ref)}` : ""}`;
+  const { status, data } = await glFetch(`/projects/${encodeURIComponent(fullName)}/repository/tree?${q}`, token);
+  if (status === 404) return [];
+  if (status >= 400 || !Array.isArray(data)) throw new Error(`Get tree failed (HTTP ${status}): ${errMsg(status, data)}`);
+  return data.map((t: any) => ({
+    path: String(t.path),
+    type: t.type === "tree" ? ("tree" as const) : ("blob" as const),
+  }));
+}
+
+/**
+ * Create a project. Without `org` it is created in the user's namespace.
+ */
+export async function createRepo(
+  token: string,
+  name: string,
+  opts: { org?: string; private?: boolean; description?: string },
+): Promise<ForgeRepo> {
+  const body = JSON.stringify({
+    name,
+    description: opts.description ?? null,
+    visibility: opts.private ? "private" : "public",
+    ...(opts.org ? { namespace_path: opts.org } : {}),
+  });
+  const { status, data } = await glFetch("/projects", token, { method: "POST", body });
+  if (status >= 400 || !data?.web_url) {
+    throw new Error(`Create project failed (HTTP ${status}): ${errMsg(status, data) || (opts.org ? `unknown namespace ${opts.org}` : "")}`);
+  }
+  return mapProject(data);
+}

package/index.ts

@@ -0,0 +1,119 @@
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { isToolCallEventType } from "@earendil-works/pi-coding-agent";
+import { Type } from "typebox";
+import { loadStore, activeAccount } from "./store";
+import { SERVICES } from "./forge";
+import { findAccounts, setActiveAccount, statusDetail } from "./auth";
+import { instrumentGit } from "./git-gate";
+import { handleAuthCommand } from "./commands";
+
+export default function (pi: ExtensionAPI) {
+  // ------------------------------------------------------------------
+  // Deterministic git auth: instrument bash tool calls that run git,
+  // using the token of the ACTIVE account for its host.
+  // ------------------------------------------------------------------
+  pi.on("tool_call", async (event, ctx) => {
+    if (!isToolCallEventType("bash", event)) return;
+    const acc = activeAccount(loadStore());
+    if (!acc?.accessToken) return;
+    const host = SERVICES[acc.platform].host;
+    event.input.command = instrumentGit(event.input.command, host, acc.accessToken);
+  });
+
+  // ------------------------------------------------------------------
+  // /auth command
+  // ------------------------------------------------------------------
+  pi.registerCommand("auth", {
+    description: "Git auth (GitHub/GitLab): status, login, logout, switch account, repos, create repos",
+    handler: (args, ctx) => handleAuthCommand(args, ctx),
+  });
+
+  // ------------------------------------------------------------------
+  // Tool for the LLM
+  // ------------------------------------------------------------------
+  pi.registerTool({
+    name: "auth",
+    label: "git auth",
+    description:
+        "Manage git forges (GitHub & GitLab): multiple accounts (status, switch), list/create repositories. " +
+        "Every action uses the service of the active account — switch accounts to work as a different user. " +
+        "Requires the user to have run `/auth login`. For clone/push just run `git` via bash — the harness " +
+        "authenticates the active account's host automatically (the git gate).",
+    promptSnippet: "Git forges (GitHub/GitLab): accounts (status/switch), list/create repos (git auth managed by harness)",
+    parameters: Type.Object({
+      action: Type.Union([
+        Type.Literal("status"),
+        Type.Literal("switch"),
+        Type.Literal("list"),
+        Type.Literal("create"),
+      ]),
+      repo: Type.Optional(Type.String({ description: 'Repository as "owner/name"; bare name for create' })),
+      org: Type.Optional(Type.String({ description: "Org/owner for list, create (default: logged-in user)" })),
+      private: Type.Optional(Type.Boolean({ description: "Visibility for create (default: private)" })),
+      description: Type.Optional(Type.String({ description: "Description for create" })),
+      account: Type.Optional(Type.String({ description: "Login for switch (\"platform:login\" to disambiguate)" })),
+    }),
+    async execute(_toolCallId, params, signal) {
+      const text = (t: string) => ({ content: [{ type: "text" as const, text: t }], details: {} });
+      const notConnected = "Not connected. Ask the user to run /auth login, then retry.";
+
+      const active = () => {
+        const data = loadStore();
+        const acc = activeAccount(data);
+        const service = acc ? SERVICES[acc.platform] : undefined;
+        return acc?.accessToken && service ? { data, acc, service } : undefined;
+      };
+
+      switch (params.action) {
+        case "status": {
+          const data = loadStore();
+          if (Object.keys(data.accounts).length === 0) return { ...text(notConnected), isError: true };
+          return text(statusDetail(data));
+        }
+
+        case "switch": {
+          if (!params.account) return { ...text("Missing account (login) for switch."), isError: true };
+          const matches = findAccounts(params.account);
+          if (matches.length === 0) return { ...text(`Unknown account "${params.account}".`), isError: true };
+          if (matches.length > 1)
+            return { ...text(`Ambiguous login — use "platform:login" (e.g. github:${params.account}).`), isError: true };
+          if (setActiveAccount(matches[0])) {
+            const data = loadStore();
+            const acc = data.accounts[matches[0]];
+            return text(`Active account: @${acc?.user ?? matches[0]} (${acc?.platform ?? "github"})`);
+          }
+          return { ...text(`Switch failed for "${params.account}".`), isError: true };
+        }
+
+        case "list": {
+          const a = active();
+          if (!a) return { ...text(notConnected), isError: true };
+          const repos = await a.service.listRepos(a.acc.accessToken, params.org);
+          return text(
+            repos.length
+              ? repos.map((r) => `${r.fullName} [${r.private ? "private" : "public"}] ${r.description ?? ""}`).join("\n")
+              : "No repositories found.",
+          );
+        }
+
+        case "create": {
+          const a = active();
+          if (!a) return { ...text(notConnected), isError: true };
+          if (!params.repo) return { ...text("Missing repo name for create."), isError: true };
+          const sep = params.repo.indexOf("/");
+          const org = params.repo.includes("/") ? params.repo.slice(0, sep) : params.org;
+          const name = params.repo.includes("/") ? params.repo.slice(sep + 1) : params.repo;
+          const repo = await a.service.createRepo(a.acc.accessToken, name, {
+            org,
+            private: params.private ?? true,
+            description: params.description,
+          });
+          return text(`Created ${repo.fullName} (${repo.private ? "private" : "public"}) → ${repo.htmlUrl}`);
+        }
+
+        default:
+          return { ...text(`Unknown action.`), isError: true };
+      }
+    },
+  });
+}

package/keyring.ts

@@ -0,0 +1,338 @@
+/**
+ * OS keyring backend (freedesktop Secret Service API — the
+ * org.freedesktop.secrets D-Bus standard, implemented by GNOME Keyring, KDE
+ * KWallet via ksecretd, KeePassXC, …) for token storage.
+ *
+ * The python3 client is EMBEDDED below and (re)written to the state dir on
+ * first use, so there is nothing to install and nothing to ship separately.
+ * It talks JSON over stdin/stdout, which means the secret NEVER appears in
+ * a process argument list — only in the parent process's memory.
+ *
+ * Two API generations are auto-detected at runtime by introspection:
+ *   - modern 0.0.1 (gnome-keyring, kwallet --secretservice):
+ *       Service.Store / SearchItems / item.GetSecret
+ *   - legacy 0.0.0 (KDE ksecretd, default with KWallet 6):
+ *       Collection.CreateItem / Service.SearchItems / Service.GetSecrets
+ *
+ * Fallback: when python3/dbus/keyring are unavailable (headless, no D-Bus),
+ * store.ts silently keeps the on-disk AES-encrypted file format.
+ */
+import { spawnSync } from "node:child_process";
+import { writeFileSync, mkdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+export const STATE_DIR = join(homedir(), ".pi", "agent", "pi-git-auth");
+const PY_PATH = join(STATE_DIR, "wallet-tool.py");
+const TIMEOUT_MS = 8000;
+
+interface WalletRes {
+  ok: boolean;
+  secret?: string;
+  api?: string;
+  error?: string;
+}
+
+const PY = `#!/usr/bin/env python3
+"""pi-git-auth keyring client (freedesktop Secret Service API).
+
+Protocol: one JSON request on stdin, one JSON response line on stdout.
+  {"cmd": "available"}
+  {"cmd": "store",  "attrs": {...}, "secret": "..."}
+  {"cmd": "lookup", "attrs": {...}}
+  {"cmd": "clear",  "attrs": {...}}
+
+Auto-detects the Secret Service API generation (modern 0.0.1 vs legacy
+0.0.0/ksecretd) by introspecting the service.
+"""
+import sys
+import json
+import re
+
+
+def out(obj):
+    sys.stdout.write(json.dumps(obj) + "\\n")
+    sys.stdout.flush()
+
+
+def to_bytes(v):
+    return bytes(bytearray(v))
+
+
+def main():
+    line = sys.stdin.readline()
+    req = json.loads(line) if line.strip() else {}
+    cmd = req.get("cmd")
+    secret = req.get("secret", "")
+
+    try:
+        import dbus
+    except Exception:
+        out({"ok": False, "error": "python3 dbus module not available"})
+        return
+
+    SVC = "org.freedesktop.secrets"
+    try:
+        bus = dbus.SessionBus()
+    except Exception:
+        out({"ok": False, "error": "no D-Bus session bus (headless?)"})
+        return
+    try:
+        owner = bus.get_name_owner(SVC)
+    except Exception:
+        out({"ok": False, "error": "no keyring service on session bus"})
+        return
+
+    svc = bus.get_object(SVC, "/org/freedesktop/secrets")
+    dbusi = dbus.Interface(svc, "org.freedesktop.Secret.Service")
+    try:
+        xml = dbus.Interface(
+            bus.get_object(owner, "/org/freedesktop/secrets"),
+            "org.freedesktop.DBus.Introspectable",
+        ).Introspect()
+    except Exception:
+        xml = ""
+    MODERN = 'name="Store"' in xml
+
+    if cmd == "available":
+        out({"ok": True, "api": "modern" if MODERN else "legacy"})
+        return
+
+    try:
+        attrs = req["attrs"]
+        label = "pi-git-auth %s %s" % (
+            attrs.get("platform", "?"),
+            attrs.get("login", "?"),
+        )
+
+        # open a plaintext session
+        if MODERN:
+            _o, session = dbusi.OpenSession("none", "")
+        else:
+            _o, session = dbusi.OpenSession("plain", "")
+            coll = dbusi.ReadAlias("default")
+            if str(coll) == "/":
+                out({"ok": False, "error": "no default collection in keyring"})
+                return
+            try:
+                dbusi.Unlock([coll])
+            except Exception:
+                pass
+
+        def find_items():
+            if MODERN:
+                res = dbusi.SearchItems(
+                    dbus.UInt32(0),
+                    dbus.Dictionary(
+                        {k: v for k, v in attrs.items()}, "sv"
+                    ),
+                    dbus.ObjectPath("/"),
+                )
+                return [str(k) for k in res]
+            (u, _l) = dbusi.SearchItems(dbus.Dictionary(
+                {k: v for k, v in attrs.items()}, "ss"
+            ))
+            return [str(k) for k in list(u) + list(_l)]
+
+        def get_content(path):
+            """Return the secret bytes for an item path, or None."""
+            try:
+                if MODERN:
+                    _s, content = dbus.Interface(
+                        bus.get_object(owner, path),
+                        "org.freedesktop.Secret.Item",
+                    ).GetSecret(session)
+                    return to_bytes(content)
+                secs = dbusi.GetSecrets(
+                    [dbus.ObjectPath(path)], session
+                )
+                for st in secs.values():
+                    c = to_bytes(st[2])
+                    if c:
+                        return c
+            except Exception:
+                pass
+            # fallback: per-item GetSecret (both generations)
+            try:
+                _s, content = dbus.Interface(
+                    bus.get_object(owner, path),
+                    "org.freedesktop.Secret.Item",
+                ).GetSecret(session)
+                return to_bytes(content)
+            except Exception:
+                return None
+
+        def item_delete(path):
+            try:
+                dbus.Interface(
+                    bus.get_object(owner, path),
+                    "org.freedesktop.Secret.Item",
+                ).Delete()
+            except Exception:
+                pass
+
+        if cmd == "store":
+            if MODERN:
+                item = "/org/freedesktop/secrets/0/item/" + re.sub(
+                    r"[^A-Za-z0-9_]", "_", "%s_%s" % (
+                        attrs.get("platform", "x"),
+                        attrs.get("login", "x"),
+                    )
+                )
+                item_props = dbus.Struct((
+                    dbus.ObjectPath(item),
+                    dbus.Dictionary({
+                        "org.freedesktop.Secret.Item.Label": dbus.ByteArray(
+                            label.encode("utf-8")
+                        ),
+                        "org.freedesktop.Secret.Item.Attributes":
+                            dbus.Dictionary(
+                                {k: v for k, v in attrs.items()}, "sv"
+                            ),
+                    }, "sv"),
+                ))
+                secret_props = dbus.Struct((
+                    dbus.ObjectPath(item),
+                    dbus.Dictionary({
+                        "org.freedesktop.Secret.Secret.Value": dbus.ByteArray(
+                            secret.encode("utf-8")
+                        ),
+                        "org.freedesktop.Secret.Secret.Content-Type":
+                            "application/octet-stream",
+                        "org.freedesktop.Secret.Secret.Parameters":
+                            dbus.Dictionary({}, "sv"),
+                    }, "sv"),
+                ))
+                dbusi.Store(
+                    dbus.Dictionary({item: ""}, "sv"),
+                    dbus.UInt32(0),
+                    dbus.Dictionary(
+                        {item: dbus.Struct((item_props, secret_props))},
+                        "sv",
+                    ),
+                )
+            else:
+                coll_obj = dbus.Interface(
+                    bus.get_object(owner, str(dbusi.ReadAlias("default"))),
+                    "org.freedesktop.Secret.Collection",
+                )
+                secret_arg = dbus.Struct((
+                    session,
+                    dbus.ByteArray(b""),
+                    dbus.ByteArray(secret.encode("utf-8")),
+                    "application/octet-stream",
+                ))
+                props = dbus.Dictionary({
+                    "org.freedesktop.Secret.Item.Label": dbus.ByteArray(
+                        label.encode("utf-8")
+                    ),
+                    "org.freedesktop.Secret.Item.Attributes":
+                        dbus.Dictionary(
+                            {k: v for k, v in attrs.items()}, "ss"
+                        ),
+                }, "sv")
+                coll_obj.CreateItem(props, secret_arg, True)
+            out({"ok": True})
+            return
+
+        if cmd == "lookup":
+            for path in find_items():
+                content = get_content(path)
+                if content:
+                    out({
+                        "ok": True,
+                        "secret": content.decode("utf-8", "replace"),
+                    })
+                    return
+            out({"ok": False, "error": "item not found"})
+            return
+
+        if cmd == "clear":
+            for path in find_items():
+                item_delete(path)
+            out({"ok": True})
+            return
+
+        out({"ok": False, "error": "unknown command"})
+    except Exception as e:
+        msg = str(e)
+        if secret:
+            msg = msg.replace(secret, "***")
+        out({"ok": False, "error": msg or e.__class__.__name__})
+
+
+main()
+`;
+
+/** Attribute set that identifies one account in the keyring. */
+export function walletAttrs(platform: string, login: string): Record<string, string> {
+  return { app: "pi-git-auth", platform, login: login.trim().toLowerCase() };
+}
+
+function writeScript(): boolean {
+  try {
+    mkdirSync(STATE_DIR, { recursive: true, mode: 0o700 });
+    writeFileSync(PY_PATH, PY, { mode: 0o600 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/** Run one keyring round-trip. Returns null when python3 itself is missing. */
+function call(req: Record<string, unknown>, timeoutMs = TIMEOUT_MS): WalletRes | null {
+  try {
+    if (!writeScript()) return null;
+    const r = spawnSync("python3", [PY_PATH], {
+      input: JSON.stringify(req),
+      encoding: "utf8",
+      timeout: timeoutMs,
+    });
+    if (r.error) return { ok: false, error: r.error.message };
+    const lines = (r.stdout ?? "").trim().split("\n").filter(Boolean);
+    const last = lines[lines.length - 1];
+    if (last) {
+      try {
+        return JSON.parse(last) as WalletRes;
+      } catch {
+        /* fall through to stderr-based error */
+      }
+    }
+    return {
+      ok: false,
+      error:
+        (r.stderr ?? "").trim().split("\n").slice(-1)[0] ||
+        `keyring client exited with status ${r.status}`,
+    };
+  } catch (e) {
+    return { ok: false, error: e instanceof Error ? e.message : String(e) };
+  }
+}
+
+let availCache: boolean | null = null;
+
+/** True when a keyring (Secret Service) is reachable. Result is cached. */
+export function walletAvailable(): boolean {
+  if (availCache !== null) return availCache;
+  const r = call({ cmd: "available" }, 5000);
+  availCache = !!(r && r.ok);
+  return availCache;
+}
+
+/** Store (upsert) a secret. */
+export function walletStore(attrs: Record<string, string>, secret: string): boolean {
+  const r = call({ cmd: "store", attrs, secret });
+  return !!(r && r.ok);
+}
+
+/** Read a secret; null when not found or the keyring is unreachable. */
+export function walletLookup(attrs: Record<string, string>): string | null {
+  const r = call({ cmd: "lookup", attrs });
+  return r && r.ok ? (r.secret ?? null) : null;
+}
+
+/** Remove every item matching attrs. No-op when none exist. */
+export function walletClear(attrs: Record<string, string>): boolean {
+  const r = call({ cmd: "clear", attrs });
+  return !!(r && r.ok);
+}

package/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "pi-git-auth",
+  "version": "1.0.0",
+  "description": "pi coding-agent extension: git auth for GitHub and GitLab: keyring-stored login tokens, account switching, transparent git auth, repo list/create with details overlay",
+  "license": "MIT",
+  "author": "Carlo Onofrio",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/comicrocharly/pi-git-auth.git"
+  },
+  "keywords": [
+    "pi-package",
+    "pi",
+    "pi-coding-agent",
+    "extension",
+    "git",
+    "git-auth",
+    "github",
+    "gitlab",
+    "keyring"
+  ],
+  "files": [
+    "*.ts",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "peerDependencies": {
+    "@earendil-works/pi-coding-agent": "*",
+    "@earendil-works/pi-tui": "*",
+    "typebox": "*"
+  },
+  "pi": {
+    "extensions": [
+      "./index.ts"
+    ]
+  }
+}