popeye-cli 1.0.0

package/src/auth/claude.ts

@@ -0,0 +1,166 @@
+/**
+ * Claude CLI authentication module
+ * Handles OAuth flow and token management for Claude CLI
+ */
+
+import open from 'open';
+import { getClaudeCredential, setClaudeCredential, deleteClaudeCredential } from './keychain.js';
+import { startAuthCallbackServer, findAvailablePort, getCallbackUrl } from './server.js';
+
+/**
+ * Claude authentication status
+ */
+export interface ClaudeAuthStatus {
+  authenticated: boolean;
+  user?: string;
+  expires?: string;
+  error?: string;
+}
+
+/**
+ * Check if Claude CLI is already authenticated
+ * This checks for existing credentials in the keychain or environment
+ */
+export async function checkClaudeCLIAuth(): Promise<ClaudeAuthStatus> {
+  try {
+    const token = await getClaudeCredential();
+
+    if (!token) {
+      return { authenticated: false };
+    }
+
+    // For now, we assume if there's a token, it's valid
+    // In production, you would validate the token with the Claude API
+    return {
+      authenticated: true,
+      user: 'claude-user', // Would be extracted from token in production
+    };
+  } catch (error) {
+    return {
+      authenticated: false,
+      error: error instanceof Error ? error.message : 'Unknown error',
+    };
+  }
+}
+
+/**
+ * Authenticate with Claude CLI using browser-based OAuth flow
+ *
+ * @returns Promise that resolves to true if authentication was successful
+ */
+export async function authenticateClaude(): Promise<boolean> {
+  // Check if already authenticated
+  const existingAuth = await checkClaudeCLIAuth();
+  if (existingAuth.authenticated) {
+    console.log('Already authenticated with Claude CLI');
+    return true;
+  }
+
+  console.log('Claude CLI authentication required.');
+  console.log('Opening browser for login...\n');
+
+  try {
+    // Find an available port for the callback server
+    const port = await findAvailablePort(3000, 3100);
+    const callbackUrl = getCallbackUrl(port, 'claude');
+
+    // Start the callback server
+    const authPromise = startAuthCallbackServer({
+      port,
+      type: 'claude',
+      timeout: 300000, // 5 minutes
+    });
+
+    // Build the login URL
+    // Note: This is a placeholder URL. The actual Claude OAuth URL would be provided by Anthropic
+    const loginUrl = buildClaudeLoginUrl(callbackUrl);
+
+    console.log(`Waiting for authentication...`);
+    console.log(`(Browser opened to: ${loginUrl})\n`);
+
+    // Open the browser to the login URL
+    await open(loginUrl);
+
+    // Wait for the callback
+    const result = await authPromise;
+
+    if (result.success && result.token) {
+      // Store the token securely
+      await setClaudeCredential(result.token);
+      console.log('Claude CLI authenticated successfully!\n');
+      return true;
+    } else {
+      console.error(`Authentication failed: ${result.error || 'Unknown error'}`);
+      return false;
+    }
+  } catch (error) {
+    console.error(`Authentication error: ${error instanceof Error ? error.message : error}`);
+    return false;
+  }
+}
+
+/**
+ * Build the Claude login URL with the callback redirect
+ *
+ * @param callbackUrl - The local callback URL
+ * @returns The full login URL
+ */
+function buildClaudeLoginUrl(callbackUrl: string): string {
+  // This is a placeholder implementation
+  // The actual URL would be provided by Anthropic's OAuth configuration
+  const baseUrl = 'https://claude.ai/login';
+  const params = new URLSearchParams({
+    redirect_uri: callbackUrl,
+    client_id: 'popeye-cli',
+    response_type: 'code',
+    scope: 'cli',
+  });
+
+  return `${baseUrl}?${params.toString()}`;
+}
+
+/**
+ * Logout from Claude CLI
+ * Removes stored credentials
+ */
+export async function logoutClaude(): Promise<void> {
+  const deleted = await deleteClaudeCredential();
+  if (deleted) {
+    console.log('Claude CLI credentials removed.');
+  } else {
+    console.log('No Claude CLI credentials found.');
+  }
+}
+
+/**
+ * Refresh Claude CLI authentication
+ * Re-authenticates if the current token is expired or invalid
+ */
+export async function refreshClaudeAuth(): Promise<boolean> {
+  // Remove existing credentials
+  await deleteClaudeCredential();
+
+  // Re-authenticate
+  return authenticateClaude();
+}
+
+/**
+ * Get the Claude CLI token for API calls
+ */
+export async function getClaudeToken(): Promise<string | null> {
+  return getClaudeCredential();
+}
+
+/**
+ * Ensure Claude CLI is authenticated
+ * Prompts for authentication if not already authenticated
+ */
+export async function ensureClaudeAuth(): Promise<boolean> {
+  const status = await checkClaudeCLIAuth();
+
+  if (status.authenticated) {
+    return true;
+  }
+
+  return authenticateClaude();
+}

package/src/auth/index.ts

@@ -0,0 +1,171 @@
+/**
+ * Authentication orchestration module
+ * Coordinates authentication for both Claude CLI and OpenAI API
+ */
+
+import { checkClaudeCLIAuth, authenticateClaude, logoutClaude, type ClaudeAuthStatus } from './claude.js';
+import { checkOpenAIAuth, authenticateOpenAI, logoutOpenAI, type OpenAIAuthStatus } from './openai.js';
+import { clearAllCredentials } from './keychain.js';
+import type { AuthStatus } from '../types/index.js';
+
+// Re-export individual auth modules
+export * from './claude.js';
+export * from './openai.js';
+export * from './keychain.js';
+export * from './server.js';
+
+/**
+ * Combined authentication status
+ */
+export interface CombinedAuthStatus {
+  claude: ClaudeAuthStatus;
+  openai: OpenAIAuthStatus;
+  fullyAuthenticated: boolean;
+}
+
+/**
+ * Get the authentication status for both services
+ */
+export async function getAuthStatus(): Promise<CombinedAuthStatus> {
+  const [claudeStatus, openaiStatus] = await Promise.all([
+    checkClaudeCLIAuth(),
+    checkOpenAIAuth(),
+  ]);
+
+  return {
+    claude: claudeStatus,
+    openai: openaiStatus,
+    fullyAuthenticated: claudeStatus.authenticated && openaiStatus.authenticated,
+  };
+}
+
+/**
+ * Get auth status formatted for CLI display
+ */
+export async function getAuthStatusForDisplay(): Promise<AuthStatus> {
+  const status = await getAuthStatus();
+
+  return {
+    claude: {
+      authenticated: status.claude.authenticated,
+      user: status.claude.user,
+      expires: status.claude.expires,
+    },
+    openai: {
+      authenticated: status.openai.authenticated,
+      keyLastFour: status.openai.keyLastFour,
+      modelAccess: status.openai.modelAccess,
+    },
+  };
+}
+
+/**
+ * Ensure both services are authenticated
+ * Prompts for authentication if either is missing
+ *
+ * @returns True if both services are authenticated
+ */
+export async function ensureAuthenticated(): Promise<boolean> {
+  const status = await getAuthStatus();
+
+  if (status.fullyAuthenticated) {
+    return true;
+  }
+
+  let success = true;
+
+  // Authenticate Claude if needed
+  if (!status.claude.authenticated) {
+    console.log('\n--- Claude CLI Authentication ---\n');
+    const claudeSuccess = await authenticateClaude();
+    if (!claudeSuccess) {
+      success = false;
+    }
+  }
+
+  // Authenticate OpenAI if needed
+  if (!status.openai.authenticated) {
+    console.log('\n--- OpenAI API Authentication ---\n');
+    const openaiSuccess = await authenticateOpenAI();
+    if (!openaiSuccess) {
+      success = false;
+    }
+  }
+
+  return success;
+}
+
+/**
+ * Authenticate a specific service
+ *
+ * @param service - The service to authenticate ('claude', 'openai', or 'all')
+ * @returns True if authentication was successful
+ */
+export async function authenticateService(
+  service: 'claude' | 'openai' | 'all'
+): Promise<boolean> {
+  switch (service) {
+    case 'claude':
+      return authenticateClaude();
+    case 'openai':
+      return authenticateOpenAI();
+    case 'all':
+      return ensureAuthenticated();
+  }
+}
+
+/**
+ * Logout from a specific service or all services
+ *
+ * @param service - The service to logout from ('claude', 'openai', or 'all')
+ */
+export async function logout(service: 'claude' | 'openai' | 'all'): Promise<void> {
+  switch (service) {
+    case 'claude':
+      await logoutClaude();
+      break;
+    case 'openai':
+      await logoutOpenAI();
+      break;
+    case 'all':
+      await clearAllCredentials();
+      console.log('All credentials removed.');
+      break;
+  }
+}
+
+/**
+ * Check if a specific service is authenticated
+ *
+ * @param service - The service to check
+ * @returns True if the service is authenticated
+ */
+export async function isAuthenticated(service: 'claude' | 'openai' | 'both'): Promise<boolean> {
+  const status = await getAuthStatus();
+
+  switch (service) {
+    case 'claude':
+      return status.claude.authenticated;
+    case 'openai':
+      return status.openai.authenticated;
+    case 'both':
+      return status.fullyAuthenticated;
+  }
+}
+
+/**
+ * Require authentication, throwing an error if not authenticated
+ *
+ * @throws Error if not authenticated
+ */
+export async function requireAuth(): Promise<void> {
+  const status = await getAuthStatus();
+
+  if (!status.claude.authenticated) {
+    throw new Error('Claude CLI authentication required. Run: popeye-cli auth claude');
+  }
+
+  if (!status.openai.authenticated) {
+    throw new Error('OpenAI API authentication required. Run: popeye-cli auth openai');
+  }
+}

package/src/auth/keychain.ts

@@ -0,0 +1,138 @@
+/**
+ * Keychain wrapper for secure credential storage
+ * Uses keytar for cross-platform keychain access (macOS Keychain, Windows Credential Vault, Linux Secret Service)
+ */
+
+import * as keytar from 'keytar';
+import { SERVICE_NAME, KEYCHAIN_ACCOUNTS, ENV_VARS } from '../config/defaults.js';
+
+/**
+ * Get a credential from the system keychain
+ * Falls back to environment variable if keychain is unavailable
+ *
+ * @param account - The account name (e.g., 'claude-cli', 'openai-api')
+ * @returns The stored credential or null if not found
+ */
+export async function getCredential(account: string): Promise<string | null> {
+  try {
+    const password = await keytar.getPassword(SERVICE_NAME, account);
+    if (password) {
+      return password;
+    }
+  } catch {
+    // Keychain unavailable, fall back to environment variables
+    console.warn(`Keychain unavailable for ${account}, checking environment variables`);
+  }
+
+  // Fallback to environment variables
+  if (account === KEYCHAIN_ACCOUNTS.OPENAI) {
+    return process.env[ENV_VARS.OPENAI_KEY] || null;
+  }
+  if (account === KEYCHAIN_ACCOUNTS.CLAUDE) {
+    return process.env[ENV_VARS.ANTHROPIC_KEY] || null;
+  }
+
+  return null;
+}
+
+/**
+ * Store a credential in the system keychain
+ *
+ * @param account - The account name
+ * @param password - The credential to store
+ */
+export async function setCredential(account: string, password: string): Promise<void> {
+  try {
+    await keytar.setPassword(SERVICE_NAME, account, password);
+  } catch (error) {
+    throw new Error(
+      `Failed to store credential in keychain: ${error instanceof Error ? error.message : 'Unknown error'}`
+    );
+  }
+}
+
+/**
+ * Delete a credential from the system keychain
+ *
+ * @param account - The account name
+ * @returns True if the credential was deleted, false if it didn't exist
+ */
+export async function deleteCredential(account: string): Promise<boolean> {
+  try {
+    return await keytar.deletePassword(SERVICE_NAME, account);
+  } catch (error) {
+    console.warn(`Failed to delete credential from keychain: ${error}`);
+    return false;
+  }
+}
+
+/**
+ * Check if a credential exists in the keychain
+ *
+ * @param account - The account name
+ * @returns True if the credential exists
+ */
+export async function hasCredential(account: string): Promise<boolean> {
+  const credential = await getCredential(account);
+  return credential !== null;
+}
+
+/**
+ * Get the Claude CLI credential
+ */
+export async function getClaudeCredential(): Promise<string | null> {
+  return getCredential(KEYCHAIN_ACCOUNTS.CLAUDE);
+}
+
+/**
+ * Set the Claude CLI credential
+ */
+export async function setClaudeCredential(token: string): Promise<void> {
+  return setCredential(KEYCHAIN_ACCOUNTS.CLAUDE, token);
+}
+
+/**
+ * Delete the Claude CLI credential
+ */
+export async function deleteClaudeCredential(): Promise<boolean> {
+  return deleteCredential(KEYCHAIN_ACCOUNTS.CLAUDE);
+}
+
+/**
+ * Get the OpenAI API credential
+ */
+export async function getOpenAICredential(): Promise<string | null> {
+  return getCredential(KEYCHAIN_ACCOUNTS.OPENAI);
+}
+
+/**
+ * Set the OpenAI API credential
+ */
+export async function setOpenAICredential(apiKey: string): Promise<void> {
+  return setCredential(KEYCHAIN_ACCOUNTS.OPENAI, apiKey);
+}
+
+/**
+ * Delete the OpenAI API credential
+ */
+export async function deleteOpenAICredential(): Promise<boolean> {
+  return deleteCredential(KEYCHAIN_ACCOUNTS.OPENAI);
+}
+
+/**
+ * Clear all stored credentials
+ */
+export async function clearAllCredentials(): Promise<void> {
+  await deleteClaudeCredential();
+  await deleteOpenAICredential();
+}
+
+/**
+ * Get the last 4 characters of a credential for display purposes
+ */
+export function maskCredential(credential: string): string {
+  if (credential.length <= 4) {
+    return '****';
+  }
+  return `****${credential.slice(-4)}`;
+}