shakers-cli 0.0.0-stage → 0.14.0

package/src/detection-noise.js

@@ -0,0 +1,132 @@
+'use strict';
+
+const { execFileSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+
+// Anti-noise CLASSIFICATION for detected candidates (hybrid evaluation, Slice 3 — issue 019).
+
+const GIT_TIMEOUT_MS = 15000;
+const README_MAX_BYTES = 8 * 1024;
+
+// Directory segments that mark a path as vendored / generated (dependency trees, build output, virtualenvs, package caches).
+const VENDORED_SEGMENTS = new Set([
+  // JS / general
+  'node_modules', 'bower_components', '.pnp', 'jspm_packages',
+  // generic vendoring
+  'vendor', 'vendored', 'third_party', 'third-party', 'external', 'deps',
+  // build / generated output
+  'dist', 'build', 'out', 'generated', '__generated__',
+  '.next', '.nuxt', '.output', '.svelte-kit', '.turbo', '.cache',
+  // Python
+  '.venv', 'venv', 'virtualenv', 'site-packages', '__pycache__',
+  // iOS / macOS / other package managers
+  'pods', 'carthage',
+  // JVM / Rust build output
+  'target', '.gradle',
+  // IaC provider plugins
+  '.terraform',
+]);
+
+// True when ANY segment of the (root-relative, POSIX) path is a vendored
+// segment. Case-insensitive so `Pods`/`pods` both match.
+function isVendoredPath(relPath) {
+  if (typeof relPath !== 'string' || !relPath) return false;
+  return relPath
+    .split('/')
+    .some((seg) => VENDORED_SEGMENTS.has(seg.toLowerCase()));
+}
+
+// A candidate's evidence is VENDORED-dominated when it has at least one evidence path AND every one of them is vendored.
+function classifyVendored(evidencePaths) {
+  if (!Array.isArray(evidencePaths) || evidencePaths.length === 0) return false;
+  return evidencePaths.every(isVendoredPath);
+}
+
+function runGit(root, args) {
+  try {
+    return execFileSync('git', ['-C', root, ...args], {
+      encoding: 'utf8',
+      timeout: GIT_TIMEOUT_MS,
+      stdio: ['ignore', 'pipe', 'ignore'],
+      maxBuffer: 4 * 1024 * 1024,
+    });
+  } catch {
+    return null;
+  }
+}
+
+// LOW-CONFIDENCE fork signal: a git remote named `upstream` alongside `origin` is the canonical local convention for a fork's parent.
+function detectFork(root) {
+  const out = runGit(root, ['remote']);
+  if (out === null) return { fork: false, forkSignal: null };
+  const remotes = new Set(
+    out
+      .split('\n')
+      .map((l) => l.trim())
+      .filter(Boolean),
+  );
+  if (remotes.has('upstream')) {
+    return { fork: true, forkSignal: 'upstream-remote' };
+  }
+  return { fork: false, forkSignal: null };
+}
+
+// Scaffolder README signatures.
+const BOILERPLATE_MARKERS = [
+  { id: 'create-react-app', re: /bootstrapped with \[?create react app/i },
+  { id: 'create-next-app', re: /bootstrapped with \[?`?create-next-app/i },
+  { id: 'vite-starter', re: /this template provides a minimal setup to get .*working in vite/i },
+  { id: 'angular-cli', re: /generated with \[?angular ?cli/i },
+  { id: 'nuxt-starter', re: /nuxt[\s\d]*minimal starter/i },
+  { id: 'create-svelte', re: /(create-svelte|everything you need to build a svelte project)/i },
+];
+
+const README_NAMES = ['README.md', 'README', 'readme.md', 'Readme.md'];
+
+function readReadmeHead(root) {
+  for (const name of README_NAMES) {
+    const abs = path.join(root, name);
+    try {
+      const fd = fs.openSync(abs, 'r');
+      try {
+        const buf = Buffer.alloc(README_MAX_BYTES);
+        const bytes = fs.readSync(fd, buf, 0, README_MAX_BYTES, 0);
+        return buf.toString('utf8', 0, bytes);
+      } finally {
+        fs.closeSync(fd);
+      }
+    } catch {
+      // try the next candidate name
+    }
+  }
+  return null;
+}
+
+// Repo-level boilerplate flag from an unmodified scaffolder README.
+function detectBoilerplate(root) {
+  const head = readReadmeHead(root);
+  if (!head) return { boilerplate: false, boilerplateMarker: null };
+  for (const { id, re } of BOILERPLATE_MARKERS) {
+    if (re.test(head)) return { boilerplate: true, boilerplateMarker: id };
+  }
+  return { boilerplate: false, boilerplateMarker: null };
+}
+
+// Repo-level provenance context for the whole scan.
+function collectProvenance(root) {
+  const scanRoot = root || process.cwd();
+  return {
+    ...detectFork(scanRoot),
+    ...detectBoilerplate(scanRoot),
+  };
+}
+
+module.exports = {
+  VENDORED_SEGMENTS,
+  isVendoredPath,
+  classifyVendored,
+  detectFork,
+  detectBoilerplate,
+  collectProvenance,
+};

package/src/detectors.js

@@ -0,0 +1,221 @@
+'use strict';
+
+// Catalog of AI tools for developers.
+
+const CATEGORIES = {
+  AGENTIC_CLI: 'CLI agéntica',
+  AI_EDITOR: 'Editor con IA',
+  IDE_ASSISTANT: 'Asistente en IDE',
+  COMPLETION: 'Autocompletado',
+  AI_TERMINAL: 'Terminal con IA',
+};
+
+const detectors = [
+  {
+    id: 'claude-code',
+    name: 'Claude Code',
+    vendor: 'Anthropic',
+    category: CATEGORIES.AGENTIC_CLI,
+    signals: [
+      { type: 'projectPath', path: '.claude' },
+      { type: 'projectPath', path: 'CLAUDE.md' },
+      { type: 'projectPath', path: '.mcp.json' },
+      { type: 'homePath', path: '.claude' },
+      { type: 'bin', name: 'claude' },
+    ],
+  },
+  {
+    id: 'cursor',
+    name: 'Cursor',
+    vendor: 'Anysphere',
+    category: CATEGORIES.AI_EDITOR,
+    signals: [
+      { type: 'projectPath', path: '.cursor' },
+      { type: 'projectPath', path: '.cursorrules' },
+      { type: 'homePath', path: '.cursor' },
+      { type: 'bin', name: 'cursor' },
+    ],
+  },
+  {
+    id: 'github-copilot',
+    name: 'GitHub Copilot',
+    vendor: 'GitHub',
+    category: CATEGORIES.IDE_ASSISTANT,
+    signals: [
+      { type: 'projectPath', path: '.github/copilot-instructions.md' },
+      { type: 'vscodeExt', prefix: 'github.copilot' },
+      { type: 'bin', name: 'copilot' },
+    ],
+  },
+  {
+    id: 'windsurf',
+    name: 'Windsurf',
+    vendor: 'Codeium',
+    category: CATEGORIES.AI_EDITOR,
+    signals: [
+      { type: 'projectPath', path: '.windsurf' },
+      { type: 'projectPath', path: '.windsurfrules' },
+      { type: 'homePath', path: '.codeium/windsurf' },
+      { type: 'bin', name: 'windsurf' },
+    ],
+  },
+  {
+    id: 'aider',
+    name: 'Aider',
+    vendor: 'Aider AI',
+    category: CATEGORIES.AGENTIC_CLI,
+    signals: [
+      { type: 'projectPath', path: '.aider.conf.yml' },
+      { type: 'projectPath', path: '.aider.chat.history.md' },
+      { type: 'homePath', path: '.aider.conf.yml' },
+      { type: 'bin', name: 'aider' },
+    ],
+  },
+  {
+    id: 'continue',
+    name: 'Continue',
+    vendor: 'Continue',
+    category: CATEGORIES.IDE_ASSISTANT,
+    signals: [
+      { type: 'projectPath', path: '.continue' },
+      { type: 'homePath', path: '.continue' },
+      { type: 'vscodeExt', prefix: 'continue.continue' },
+    ],
+  },
+  {
+    id: 'cline',
+    name: 'Cline',
+    vendor: 'Cline',
+    category: CATEGORIES.IDE_ASSISTANT,
+    signals: [
+      { type: 'projectPath', path: '.clinerules' },
+      { type: 'vscodeExt', prefix: 'saoudrizwan.claude-dev' },
+    ],
+  },
+  {
+    id: 'gemini-cli',
+    name: 'Gemini CLI',
+    vendor: 'Google',
+    category: CATEGORIES.AGENTIC_CLI,
+    signals: [
+      { type: 'projectPath', path: '.gemini' },
+      { type: 'projectPath', path: 'GEMINI.md' },
+      { type: 'homePath', path: '.gemini' },
+      { type: 'bin', name: 'gemini' },
+    ],
+  },
+  {
+    id: 'codex-cli',
+    name: 'Codex CLI',
+    vendor: 'OpenAI',
+    category: CATEGORIES.AGENTIC_CLI,
+    signals: [
+      { type: 'projectPath', path: 'AGENTS.md' },
+      { type: 'homePath', path: '.codex' },
+      { type: 'bin', name: 'codex' },
+    ],
+  },
+  {
+    id: 'cody',
+    name: 'Cody',
+    vendor: 'Sourcegraph',
+    category: CATEGORIES.IDE_ASSISTANT,
+    signals: [
+      { type: 'projectPath', path: '.sourcegraph' },
+      { type: 'vscodeExt', prefix: 'sourcegraph.cody-ai' },
+      { type: 'bin', name: 'cody' },
+    ],
+  },
+  {
+    id: 'zed',
+    name: 'Zed',
+    vendor: 'Zed Industries',
+    category: CATEGORIES.AI_EDITOR,
+    signals: [
+      { type: 'homePath', path: '.config/zed' },
+      { type: 'bin', name: 'zed' },
+    ],
+  },
+  {
+    id: 'tabnine',
+    name: 'Tabnine',
+    vendor: 'Tabnine',
+    category: CATEGORIES.COMPLETION,
+    signals: [
+      { type: 'homePath', path: '.config/TabNine' },
+      { type: 'vscodeExt', prefix: 'tabnine.tabnine-vscode' },
+    ],
+  },
+
+  // ---- Expansion (talents-ai-score, more signals) — confidence per entry below ----
+  {
+    id: 'amazon-q-developer',
+    name: 'Amazon Q Developer',
+    vendor: 'AWS',
+    category: CATEGORIES.AGENTIC_CLI,
+    signals: [
+      // High confidence: binary and extension id are stable for the official CLI/extension.
+      { type: 'bin', name: 'q' },
+      { type: 'vscodeExt', prefix: 'amazonwebservices.amazon-q-vscode' },
+      // Medium confidence: CLI credentials/cache directory under .aws.
+      { type: 'homePath', path: '.aws/amazonq' },
+    ],
+  },
+  {
+    id: 'codeium',
+    name: 'Codeium',
+    vendor: 'Codeium (Exafunction)',
+    category: CATEGORIES.IDE_ASSISTANT,
+    signals: [
+      // Codeium's base extension (autocomplete in any editor), distinct from Windsurf (its own editor, already cataloged above).
+      { type: 'vscodeExt', prefix: 'codeium.codeium' },
+      { type: 'homePath', path: '.codeium/config.json' },
+    ],
+  },
+  {
+    id: 'supermaven',
+    name: 'Supermaven',
+    vendor: 'Supermaven',
+    category: CATEGORIES.COMPLETION,
+    signals: [
+      // High confidence in the extension id; medium in the local state directory.
+      { type: 'vscodeExt', prefix: 'supermaven.supermaven' },
+      { type: 'homePath', path: '.supermaven' },
+    ],
+  },
+  {
+    id: 'pieces',
+    name: 'Pieces for Developers',
+    vendor: 'Mesh Intelligent Technologies',
+    category: CATEGORIES.IDE_ASSISTANT,
+    signals: [
+      // Medium confidence: extension id recalled from memory, could not be verified against the marketplace in this environment.
+      { type: 'vscodeExt', prefix: 'meshintelligenttechnologiesinc.pieces-vscode' },
+    ],
+  },
+  {
+    id: 'warp-ai',
+    name: 'Warp (AI terminal)',
+    vendor: 'Warp',
+    category: CATEGORIES.AI_TERMINAL,
+    signals: [
+      // Medium confidence: config directory of the Warp terminal app.
+      { type: 'homePath', path: '.warp' },
+      // On Linux, Warp's config lives under ~/.config/warp-terminal.
+      { type: 'homePath', path: '.config/warp-terminal' },
+    ],
+  },
+  {
+    id: 'trae',
+    name: 'Trae',
+    vendor: 'ByteDance',
+    category: CATEGORIES.AI_EDITOR,
+    signals: [
+      { type: 'projectPath', path: '.trae' },
+      { type: 'homePath', path: '.trae' },
+      { type: 'bin', name: 'trae' },
+    ],
+  },
+];
+
+module.exports = { detectors, CATEGORIES };

package/src/device-auth-store.js

@@ -0,0 +1,100 @@
+'use strict';
+
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+const { getConfigDir } = require('./config-dir');
+
+// `~/.config/shakers/device-auth.json` — bridges the MCP start/poll tools; the secret device_code lives here (0600), never in a tool result.
+
+const DEVICE_FILE_NAME = 'device-auth.json';
+const DEVICE_FILE_VERSION = 1;
+
+function devicePath(env = process.env) {
+  return path.join(getConfigDir(env), DEVICE_FILE_NAME);
+}
+
+// Atomic 0600 write (temp + fsync + rename), same recipe as auth-session-store.
+function savePendingDevice(pending, env = process.env, { fs: fsImpl = fs } = {}) {
+  const payload = `${JSON.stringify(
+    {
+      deviceCode: typeof pending.deviceCode === 'string' && pending.deviceCode ? pending.deviceCode : null,
+      verificationUrl: typeof pending.verificationUrl === 'string' && pending.verificationUrl ? pending.verificationUrl : null,
+      userCode: typeof pending.userCode === 'string' && pending.userCode ? pending.userCode : null,
+      tokenEndpoint: typeof pending.tokenEndpoint === 'string' && pending.tokenEndpoint ? pending.tokenEndpoint : null,
+      authTokenEndpoint: typeof pending.authTokenEndpoint === 'string' && pending.authTokenEndpoint ? pending.authTokenEndpoint : null,
+      interval: typeof pending.interval === 'number' && pending.interval > 0 ? Math.floor(pending.interval) : 5,
+      expiresAt: typeof pending.expiresAt === 'string' && pending.expiresAt ? pending.expiresAt : null,
+      mode: pending.mode === 'register' ? 'register' : 'login',
+      provider: pending.provider === 'linkedin' ? 'linkedin' : 'google',
+      registerContext: pending.registerContext && typeof pending.registerContext === 'object' ? pending.registerContext : null,
+      email: typeof pending.email === 'string' && pending.email ? pending.email : null,
+      version: DEVICE_FILE_VERSION,
+    },
+    null,
+    2,
+  )}\n`;
+
+  const target = devicePath(env);
+  const dir = path.dirname(target);
+  fsImpl.mkdirSync(dir, { recursive: true, mode: 0o700 });
+
+  const tmp = path.join(dir, `.${DEVICE_FILE_NAME}.${process.pid}.${crypto.randomBytes(6).toString('hex')}.tmp`);
+  let fd = null;
+  try {
+    fd = fsImpl.openSync(tmp, 'wx', 0o600);
+    fsImpl.writeFileSync(fd, payload);
+    try { fsImpl.fsyncSync(fd); } catch { /* e.g. EINVAL on some filesystems */ }
+    fsImpl.closeSync(fd);
+    fd = null;
+    fsImpl.renameSync(tmp, target);
+  } catch (e) {
+    if (fd !== null) { try { fsImpl.closeSync(fd); } catch { /* already closed */ } }
+    try { fsImpl.unlinkSync(tmp); } catch { /* never existed */ }
+    throw e;
+  }
+  return target;
+}
+
+function loadPendingDevice(env = process.env, { fs: fsImpl = fs } = {}) {
+  let parsed;
+  try {
+    parsed = JSON.parse(fsImpl.readFileSync(devicePath(env), 'utf8'));
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return null;
+  if (parsed.version !== DEVICE_FILE_VERSION) return null;
+  if (typeof parsed.deviceCode !== 'string' || !parsed.deviceCode) return null;
+  return {
+    deviceCode: parsed.deviceCode,
+    verificationUrl: typeof parsed.verificationUrl === 'string' && parsed.verificationUrl ? parsed.verificationUrl : null,
+    userCode: typeof parsed.userCode === 'string' && parsed.userCode ? parsed.userCode : null,
+    tokenEndpoint: typeof parsed.tokenEndpoint === 'string' && parsed.tokenEndpoint ? parsed.tokenEndpoint : null,
+    authTokenEndpoint: typeof parsed.authTokenEndpoint === 'string' && parsed.authTokenEndpoint ? parsed.authTokenEndpoint : null,
+    interval: typeof parsed.interval === 'number' && parsed.interval > 0 ? Math.floor(parsed.interval) : 5,
+    expiresAt: typeof parsed.expiresAt === 'string' && parsed.expiresAt ? parsed.expiresAt : null,
+    mode: parsed.mode === 'register' ? 'register' : 'login',
+    provider: parsed.provider === 'linkedin' ? 'linkedin' : 'google',
+    registerContext: parsed.registerContext && typeof parsed.registerContext === 'object' ? parsed.registerContext : null,
+    email: typeof parsed.email === 'string' && parsed.email ? parsed.email : null,
+  };
+}
+
+function clearPendingDevice(env = process.env, { fs: fsImpl = fs } = {}) {
+  try {
+    fsImpl.unlinkSync(devicePath(env));
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+module.exports = {
+  DEVICE_FILE_NAME,
+  DEVICE_FILE_VERSION,
+  devicePath,
+  savePendingDevice,
+  loadPendingDevice,
+  clearPendingDevice,
+};

package/src/device-login.js

@@ -0,0 +1,120 @@
+'use strict';
+
+const { requestDeviceAuthorization, requestDeviceToken, requestApiToken } = require('./auth-device-client');
+
+const SLOW_DOWN_STEP_SECONDS = 5;
+const DEFAULT_MAX_WAIT_MS = 15 * 60 * 1000;
+
+function defaultSleep(ms) {
+  // NOT unref'd: the loop's await sleep(...) is the only handle keeping the process alive while it waits.
+  return new Promise((resolve) => { setTimeout(resolve, ms); });
+}
+
+// The /cli-login page reads `provider` from the query to pick the social button.
+function appendProviderParam(url, provider) {
+  if (!url || !provider) return url;
+  try {
+    const u = new URL(url);
+    u.searchParams.set('provider', provider);
+    return u.href;
+  } catch {
+    return `${url}${url.includes('?') ? '&' : '?'}provider=${encodeURIComponent(provider)}`;
+  }
+}
+
+async function startDeviceLogin({ authorizeEndpoint, clientId, scope, timeoutMs } = {}) {
+  return requestDeviceAuthorization({ endpoint: authorizeEndpoint, clientId, scope, timeoutMs });
+}
+
+async function pollDeviceToken({ deviceCode, tokenEndpoint, clientId, timeoutMs } = {}) {
+  return requestDeviceToken({ deviceCode, clientId }, { endpoint: tokenEndpoint, timeoutMs });
+}
+
+// ORDER: a NEW user needs complete-registration BEFORE GET /auth/token (else the Hub 500s: no domain user).
+async function finalizeDeviceSession(
+  { sessionToken, isNewUser, authTokenEndpoint, completeRegistrationEndpoint = null, registrationContext = null, claimCode = null, timeoutMs } = {},
+  {
+    requestCompleteRegistration = require('./signup-client').requestCompleteRegistration,
+    requestApiToken: apiToken = requestApiToken,
+  } = {},
+) {
+  if (!authTokenEndpoint) return { ok: false, reason: 'no-endpoint' };
+
+  let claimed = false;
+  if (isNewUser && completeRegistrationEndpoint) {
+    const done = await requestCompleteRegistration(registrationContext || {}, { endpoint: completeRegistrationEndpoint, bearerToken: sessionToken, claimCode, timeoutMs });
+    if (!done.ok) return { ok: false, reason: done.reason || 'complete-registration-failed' };
+    claimed = done.claimed === true;
+  }
+
+  const jwt = await apiToken({ accessToken: sessionToken }, { endpoint: authTokenEndpoint, timeoutMs });
+  if (!jwt.ok) return { ok: false, reason: 'token-exchange-failed' };
+  return claimCode ? { ok: true, token: jwt.token, claimed } : { ok: true, token: jwt.token };
+}
+
+async function runDeviceLogin(
+  { authorizeEndpoint, tokenEndpoint, authTokenEndpoint, completeRegistrationEndpoint = null, registrationContext = null, clientId, scope, timeoutMs } = {},
+  {
+    onPrompt = null,
+    onWaiting = null,
+    sleep = defaultSleep,
+    now = () => Date.now(),
+    maxWaitMs = DEFAULT_MAX_WAIT_MS,
+  } = {},
+) {
+  if (!authorizeEndpoint || !tokenEndpoint || !authTokenEndpoint) return { ok: false, reason: 'no-endpoint' };
+
+  const authz = await startDeviceLogin({ authorizeEndpoint, clientId, scope, timeoutMs });
+  if (!authz.ok) return { ok: false, reason: authz.reason || 'authorize-failed' };
+
+  if (typeof onPrompt === 'function') {
+    onPrompt({
+      verificationUriComplete: authz.verificationUriComplete,
+      verificationUri: authz.verificationUri,
+      userCode: authz.userCode,
+      expiresIn: authz.expiresIn,
+    });
+  }
+
+  let intervalSeconds = authz.interval;
+  const deadline = now() + Math.min(authz.expiresIn * 1000, maxWaitMs);
+
+  for (;;) {
+    if (now() >= deadline) return { ok: false, reason: 'expired' };
+    if (typeof onWaiting === 'function') onWaiting();
+    await sleep(intervalSeconds * 1000);
+
+    const res = await pollDeviceToken({ deviceCode: authz.deviceCode, tokenEndpoint, clientId, timeoutMs });
+    if (res.status === 'authorized') {
+      const fin = await finalizeDeviceSession({
+        sessionToken: res.accessToken,
+        isNewUser: res.isNewUser,
+        authTokenEndpoint,
+        completeRegistrationEndpoint,
+        registrationContext,
+        timeoutMs,
+      });
+      if (!fin.ok) return { ok: false, reason: fin.reason };
+      return { ok: true, token: fin.token, sessionToken: res.accessToken, isNewUser: res.isNewUser, email: res.email || null };
+    }
+    if (res.status === 'pending') continue;
+    if (res.status === 'slow_down') {
+      intervalSeconds += SLOW_DOWN_STEP_SECONDS;
+      continue;
+    }
+    if (res.status === 'denied') return { ok: false, reason: 'denied' };
+    if (res.status === 'expired') return { ok: false, reason: 'expired' };
+    return { ok: false, reason: res.reason || 'poll-failed' };
+  }
+}
+
+module.exports = {
+  startDeviceLogin,
+  pollDeviceToken,
+  finalizeDeviceSession,
+  runDeviceLogin,
+  appendProviderParam,
+  defaultSleep,
+  SLOW_DOWN_STEP_SECONDS,
+  DEFAULT_MAX_WAIT_MS,
+};