slaunt 0.1.17 → 0.1.19

package/src/oauth-cohort.js

@@ -0,0 +1,44 @@
+'use strict';
+const { runHiddenLogin } = require('./hidden-oauth');
+// The authority must show the user the selected clients and approve the exact
+// requests. It is injected because the Slaunt endpoint is not yet available.
+async function authorizeCohort({ clients, issuer, approve, login = runHiddenLogin, executablePaths = {}, timeoutMs = 120000 }) {
+  if (!Array.isArray(clients) || clients.length < 1 || clients.length > 2 || new Set(clients).size !== clients.length || clients.some(c => !['codex','claude'].includes(c)) || typeof approve !== 'function') throw new Error('invalid-cohort');
+  const selected = new Set(clients);
+  const pending = new Map();
+  let started = false;
+  let failed = false;
+  const controller = new AbortController();
+  let timer;
+  let rejectOverall;
+  const failedPromise = new Promise((_, reject) => { rejectOverall = reject; });
+  const fail = (stage, client, detail) => {
+    if (failed) return;
+    failed = true;
+    clearTimeout(timer);
+    controller.abort();
+    for (const entry of pending.values()) entry.reject(new Error('cohort-failed'));
+    const error = new Error('cohort-failed');
+    error.setupStage = stage;
+    if (['sign-in','workspace','enrollment','client-grants'].includes(detail)) error.setupDetail = detail;
+    if (client === 'codex' || client === 'claude') error.setupClient = client;
+    if (stage === 'native-login' && ['launch','request','waiting-approval','callback','client-exit'].includes(detail)) error.nativeStage = detail;
+    rejectOverall(error);
+  };
+  timer = setTimeout(() => fail('timeout'), timeoutMs);
+  const authorize = ({client, authorizationUrl}) => new Promise((resolve, reject) => {
+    if (failed || !selected.has(client) || pending.has(client) || typeof authorizationUrl !== 'string') { reject(new Error('cohort-invalid-request')); fail('authorization'); return; }
+    pending.set(client, { authorizationUrl, resolve, reject });
+    if (pending.size !== clients.length || started) return;
+    started = true;
+    const requests = clients.map(name => ({client:name, authorizationUrl:pending.get(name).authorizationUrl}));
+    Promise.resolve().then(() => approve(requests)).then(callbacks => {
+      if (failed) return;
+      if (!callbacks || typeof callbacks !== 'object' || Array.isArray(callbacks) || Object.keys(callbacks).length !== clients.length || clients.some(name => typeof callbacks[name] !== 'string')) throw new Error('cohort-invalid-response');
+      for (const name of clients) pending.get(name).resolve(callbacks[name]);
+    }).catch(error => fail('authorization', undefined, error?.setupDetail));
+  });
+  const runs = clients.map(executable => Promise.resolve().then(() => login({executable,commandPath:executablePaths[executable] || executable,issuer,authorize,timeoutMs,signal:controller.signal})).catch(error => { fail('native-login', executable, error?.nativeStage); throw error; }));
+  try { await Promise.race([Promise.all(runs), failedPromise]); } finally { clearTimeout(timer); }
+}
+module.exports = { authorizeCohort };

package/src/pty-wrapper.py

@@ -0,0 +1,57 @@
+import os
+import pty
+import select
+import signal
+import subprocess
+import sys
+import termios
+
+master, slave = pty.openpty()
+attrs = termios.tcgetattr(slave)
+attrs[3] &= ~termios.ECHO
+termios.tcsetattr(slave, termios.TCSANOW, attrs)
+process = subprocess.Popen(sys.argv[1:], stdin=slave, stdout=slave, stderr=slave, start_new_session=True)
+os.close(slave)
+
+def stop(_signal, _frame):
+    raise KeyboardInterrupt()
+
+signal.signal(signal.SIGTERM, stop)
+signal.signal(signal.SIGINT, stop)
+stdin_open = True
+interrupted = False
+try:
+    while True:
+        sources = [master] + ([sys.stdin.buffer] if stdin_open else [])
+        ready, _, _ = select.select(sources, [], [], 0.2)
+        if master in ready:
+            try:
+                data = os.read(master, 4096)
+            except OSError:
+                data = b''
+            if not data:
+                break
+            os.write(sys.stdout.fileno(), data)
+        if stdin_open and sys.stdin.buffer in ready:
+            data = os.read(sys.stdin.fileno(), 4096)
+            if data:
+                os.write(master, data)
+            else:
+                stdin_open = False
+        if process.poll() is not None and not ready:
+            break
+except KeyboardInterrupt:
+    interrupted = True
+finally:
+    if process.poll() is None:
+        try:
+            process.wait(timeout=2 if not interrupted else 0.1)
+        except subprocess.TimeoutExpired:
+            process.terminate()
+            try:
+                process.wait(timeout=2)
+            except subprocess.TimeoutExpired:
+                process.kill()
+    process.wait()
+    os.close(master)
+sys.exit(1 if interrupted else (process.returncode or 0))

package/src/read-json.js

@@ -0,0 +1,8 @@
+'use strict';
+async function readJson(response,maxBytes=131072){
+ const declared=Number(response.headers.get('content-length')||0);if(declared>maxBytes)throw new Error('response-too-large');
+ const reader=response.body?.getReader();if(!reader)throw new Error('response-unavailable');let size=0;const chunks=[];
+ for(;;){const {value,done}=await reader.read();if(done)break;size+=value.byteLength;if(size>maxBytes){await reader.cancel();throw new Error('response-too-large');}chunks.push(Buffer.from(value));}
+ return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+}
+module.exports={readJson};

package/src/setup/client-installer.js

@@ -0,0 +1,93 @@
+'use strict';
+
+const { brokerArgsForClient } = require('../desktop/client-identity');
+const { SLAUNT_SERVER_NAME } = require('../mcp-identity');
+const { catalog } = require('../discovery/catalog');
+const { installMcpConfigForClient } = require('./mcp-config-installer');
+const { installHooksForDetectedClients } = require('./hook-installer');
+
+const SUPPORTED_CLIENTS = new Set(['claude-code', 'codex-cli']);
+const SUCCESSFUL_MCP_STATES = new Set(['installed', 'unchanged']);
+
+function installSelectedClients({
+  clients = [],
+  selectedClientIds = [],
+  homeDir,
+  broker,
+  fileSystem
+} = {}) {
+  if (!Array.isArray(selectedClientIds) || selectedClientIds.length > SUPPORTED_CLIENTS.size) {
+    return { results: [], summary: { failed: 1, installed: 0, unchanged: 0 } };
+  }
+
+  const uniqueIds = [...new Set(selectedClientIds)];
+  if (uniqueIds.some((id) => typeof id !== 'string' || !SUPPORTED_CLIENTS.has(id))) {
+    return { results: [], summary: { failed: 1, installed: 0, unchanged: 0 } };
+  }
+
+  const clientById = new Map();
+  for (const client of clients) {
+    if (SUPPORTED_CLIENTS.has(client?.id) && !clientById.has(client.id)) clientById.set(client.id, client);
+  }
+  const resultById = new Map();
+  const hookClients = [];
+
+  for (const id of uniqueIds) {
+    const client = clientById.get(id);
+    if (!client) {
+      resultById.set(id, {
+        id,
+        name: catalog.find((entry) => entry.id === id)?.name || id,
+        status: 'not-detected',
+        mcp: { status: 'not-installed', reason: 'client-not-detected' },
+        hooks: { status: 'not-installed', reason: 'client-not-detected' }
+      });
+      continue;
+    }
+
+    const clientBroker = { ...broker, args: brokerArgsForClient(broker, id) };
+    const mcp = installMcpConfigForClient({ clientId: id, homeDir, broker: clientBroker });
+    const result = {
+      id,
+      name: client.name,
+      status: SUCCESSFUL_MCP_STATES.has(mcp.status) ? 'installed' : mcp.status,
+      mcp,
+      hooks: { status: 'not-installed', reason: 'mcp-configuration-required' }
+    };
+    resultById.set(id, result);
+    if (SUCCESSFUL_MCP_STATES.has(mcp.status)) hookClients.push(client);
+  }
+
+  if (hookClients.length > 0) {
+    const hooks = installHooksForDetectedClients({
+      clients: hookClients,
+      selectedClientIds: hookClients.map((client) => client.id),
+      homeDir,
+      broker,
+      ...(fileSystem ? { fileSystem } : {})
+    });
+    for (const result of hooks.results) {
+      const combined = resultById.get(result.id);
+      if (!combined) continue;
+      combined.hooks = { status: result.status, reason: result.reason };
+      if (result.status === 'error') combined.status = 'partial';
+      if (result.status === 'partial' && combined.status === 'installed') combined.status = 'partial';
+    }
+  }
+
+  const results = uniqueIds.map((id) => resultById.get(id));
+  return {
+    serverName: SLAUNT_SERVER_NAME,
+    results,
+    summary: {
+      selected: results.length,
+      installed: results.filter((result) => result.status === 'installed').length,
+      partial: results.filter((result) => result.status === 'partial').length,
+      conflicts: results.filter((result) => result.status === 'conflict').length,
+      notDetected: results.filter((result) => result.status === 'not-detected').length,
+      failed: results.filter((result) => result.status === 'error').length
+    }
+  };
+}
+
+module.exports = { SUPPORTED_CLIENTS, installSelectedClients };

package/src/setup/codex-guard-supervisor.js

@@ -0,0 +1,34 @@
+#!/usr/bin/env node
+'use strict';
+// Converts guard process failures into a Codex PreToolUse denial. This program
+// cannot control Codex behavior if the supervisor itself fails to start.
+const {spawn}=require('node:child_process');
+const path=require('node:path');
+const MAX_INPUT=1024*1024, MAX_OUTPUT=64*1024, DEADLINE_MS=8000;
+const denial=JSON.stringify({hookSpecificOutput:{hookEventName:'PreToolUse',permissionDecision:'deny',permissionDecisionReason:'Slaunt tool authorization is unavailable.'}})+'\n';
+let finished=false, child, input=[], inputBytes=0, output=[], outputBytes=0;
+function finish(value=denial){if(finished)return;finished=true;clearTimeout(timer);if(child&&!child.killed)child.kill('SIGKILL');process.stdin.pause();process.stdout.write(value,()=>{process.exitCode=0;});}
+const timer=setTimeout(()=>finish(),DEADLINE_MS);
+const executable=process.argv[2];
+if(process.argv.length!==3 || !executable || !path.isAbsolute(executable) || /[\x00-\x1f\x7f]/.test(executable)) finish();
+else {
+ process.stdin.on('error',()=>finish());
+ process.stdin.on('data',chunk=>{inputBytes+=chunk.length;if(inputBytes>MAX_INPUT)return finish();input.push(chunk);});
+ process.stdin.on('end',()=>{
+  if(finished)return;
+  try {child=spawn(executable,[],{stdio:['pipe','pipe','ignore'],env:{...process.env,NODE_OPTIONS:'',NODE_PATH:''}});}catch{return finish();}
+  child.on('error',()=>finish());child.stdin.on('error',()=>finish());
+  child.stdout.on('data',chunk=>{outputBytes+=chunk.length;if(outputBytes>MAX_OUTPUT)return finish();output.push(chunk);});
+  child.stdout.on('error',()=>finish());
+  child.on('close',code=>{
+   if(finished)return;if(code!==0)return finish();
+   try {
+    const value=JSON.parse(Buffer.concat(output).toString('utf8'));
+    const hook=value?.hookSpecificOutput;
+    if(!hook||hook.hookEventName!=='PreToolUse'||!['deny',undefined].includes(hook.permissionDecision)||Object.keys(value).some(k=>k!=='hookSpecificOutput')||Object.keys(hook).some(k=>!['hookEventName','permissionDecision','permissionDecisionReason'].includes(k))|| (hook.permissionDecision==='deny'&&typeof hook.permissionDecisionReason!=='string')) return finish();
+    finish(JSON.stringify(value)+'\n');
+   }catch{finish();}
+  });
+  child.stdin.end(Buffer.concat(input));
+ });
+}