slaunt 0.1.18 → 0.1.20

package/.github/workflows/publish.yml

@@ -0,0 +1,59 @@
+name: Publish npm package
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    runs-on: macos-14
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+          package-manager-cache: false
+      - name: Install dependencies
+        run: npm ci --ignore-scripts
+      - name: Run tests
+        run: npm test
+      - name: Verify bundled helper
+        run: |
+          node -e "const f=require('fs'),c=require('crypto'),m=require('./release/manifest.json'); if(m.format!==1 || m.arch!=='arm64' || m.signing!=='adhoc' || !/^[a-f0-9]{40}$/.test(m.cdhash) || c.createHash('sha256').update(f.readFileSync('release/SlauntKillBar.zip')).digest('hex')!==m.sha256) process.exit(1)"
+          mkdir "$RUNNER_TEMP/slaunt-helper"
+          ditto -x -k release/SlauntKillBar.zip "$RUNNER_TEMP/slaunt-helper"
+          codesign --verify --deep --strict "$RUNNER_TEMP/slaunt-helper/SlauntKillBar.app"
+          EXPECTED_CDHASH="$(node -p "require('./release/manifest.json').cdhash")"
+          codesign -dv --verbose=4 "$RUNNER_TEMP/slaunt-helper/SlauntKillBar.app" 2> "$RUNNER_TEMP/codesign-info"
+          grep -Fx "CDHash=$EXPECTED_CDHASH" "$RUNNER_TEMP/codesign-info"
+          grep -Fx "Identifier=ai.slaunt.killbar" "$RUNNER_TEMP/codesign-info"
+          grep -Fx "Signature=adhoc" "$RUNNER_TEMP/codesign-info"
+      - name: Prepare public package metadata
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          node <<'NODE'
+          const fs = require('fs');
+          const tag = process.env.RELEASE_TAG;
+          if (!/^v(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/.test(tag)) throw Error('Expected a stable version tag, e.g. v0.1.20');
+          const p = JSON.parse(fs.readFileSync('package.json', 'utf8'));
+          p.name = 'slaunt';
+          p.version = tag.slice(1);
+          delete p.private;
+          p.bin = { slaunt: 'bin/slaunt-hooks.js', 'slaunt-hooks': 'bin/slaunt-hooks.js' };
+          p.repository = { type: 'git', url: 'git+https://github.com/kerodem/slaunt-hook-cli.git' };
+          fs.writeFileSync('package.json', JSON.stringify(p, null, 2) + '\n');
+          NODE
+      - name: Verify package contents
+        run: |
+          npm pack --dry-run --json > "$RUNNER_TEMP/slaunt-pack.json"
+          node -e "const p=require(process.env.RUNNER_TEMP+'/slaunt-pack.json')[0]; for(const n of ['bin/slaunt-hooks.js','release/manifest.json','release/SlauntKillBar.zip']) if(!p.files.some(f=>f.path===n)) throw Error('Missing package file: '+n)"
+      - name: Publish to npm
+        env:
+          NPM_CONFIG_PROVENANCE: 'false'
+        run: npm publish --access public

package/bin/slaunt-hooks.js

@@ -75,10 +75,14 @@ async function main(args=process.argv.slice(2),dependencies={}) {
       if(clientLabel && error?.message==='client-configuration-conflict') messages[error.message]=`${clientLabel} already has a conflicting Slaunt configuration.`;
       if(clientLabel && error?.message==='client-configuration-failed') messages[error.message]=`${clientLabel} configuration could not be updated.`;
       if(error?.message==='cohort-failed') {
-        if(error.setupStage==='native-login' && clientLabel) messages[error.message]=`${clientLabel} could not start its Slaunt authorization.`;
+        if(error.setupStage==='native-login' && clientLabel) {
+          const nativeMessages={launch:'could not be started',request:'did not provide a valid authorization request', 'waiting-approval':'exited while waiting for authorization', callback:'could not complete the authorization handoff', 'client-exit':'did not complete authorization after the callback'};
+          messages[error.message]=`${clientLabel} ${nativeMessages[error.nativeStage] || 'could not complete its Slaunt authorization'}.`;
+        }
         else if(error.setupStage==='authorization') {
           const details={'sign-in':'Slaunt sign-in could not be completed.','workspace':'Slaunt workspace identity could not be verified.','enrollment':'KillBar enrollment could not be completed.','client-grants':'Slaunt could not issue client authorization grants.'};
-          messages[error.message]=details[error.setupDetail] || 'Slaunt authorization or enrollment could not be completed.';
+          const enrollmentMessages={'killbar-helper-unavailable':'KillBar helper is unavailable.','killbar-helper-untrusted':'KillBar helper could not be verified.','killbar-authentication-failed':'KillBar could not use the sign-in grant.','killbar-identity-invalid':'KillBar workspace identity is invalid.','killbar-lock-unavailable':'KillBar enrollment lock could not be created.','killbar-enrollment-busy':'Another KillBar enrollment is in progress.','killbar-status-unavailable':'KillBar status could not be read.','killbar-status-invalid':'KillBar returned an invalid status.','killbar-restart-required':'KillBar requires a restart before enrollment.','killbar-already-enrolled':'KillBar is already enrolled.','killbar-enrollment-failed':'KillBar enrollment request failed.','killbar-enrollment-unverified':'KillBar enrollment could not be verified for this workspace.'};
+          messages[error.message]=(error.setupDetail==='enrollment' && enrollmentMessages[error.enrollmentReason]) || details[error.setupDetail] || 'Slaunt authorization or enrollment could not be completed.';
         }
         else if(error.setupStage==='timeout') messages[error.message]='Slaunt authorization timed out.';
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "slaunt",
-  "version": "0.1.18",
+  "version": "0.1.20",
   "bin": {
     "slaunt": "bin/slaunt-hooks.js",
     "slaunt-hooks": "bin/slaunt-hooks.js"

package/src/full-screen.js

@@ -21,7 +21,7 @@ function createFullScreen({output,logo,color,motion}) {
     const contents=[];
     const add=(text='',tone='normal')=>contents.push({text,tone});
     add('');
-    add(view==='select'?'   CONNECT YOUR CLIENTS':'   SETTING UP SLAUNT','heading');
+    add(view==='select'?'   CONNECT YOUR CLIENTS':'   Installing Slaunt','heading');
     add('');
     if(view==='select'){
       add(cols<52?'   Choose clients':'   Which clients would you like to connect?','title');
@@ -42,8 +42,6 @@ function createFullScreen({output,logo,color,motion}) {
       if(spacious)add('');
       add('   ↑↓ move  ↵ select  esc','muted');
     } else {
-      add(`   ${selection||'Preparing your setup'}`,'title');
-      add('');
       for(const item of completed.slice(-4))add(`   ✓  ${item}`,'success');
       if(current)add(`   ${motion?'⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏'[tick%10]:'…'}  ${current}`,'selected');
       if(failure){add(`   !  ${failure.message}`,'warning');if(failure.detail)add(`      ${failure.detail}`,'muted');}

package/src/hidden-oauth.js

@@ -34,7 +34,7 @@ async function runHiddenLogin({ executable, commandPath = executable, issuer, au
   let settled = false, text = '', found = false, submitted = false, timer;
   const result = new Promise((resolve, reject) => {
     const onAbort = () => finish(new Error('login-cancelled'));
-    const finish = (err) => { if (settled) return; settled = true; clearTimeout(timer); signal?.removeEventListener('abort', onAbort); if (err) { child.kill(); reject(err); } else resolve(); };
+    const finish = (err) => { if (err) { err.nativeStage = err.message === 'client-start-failed' ? 'launch' : err.message === 'authorization-handoff-failed' || err.message === 'login-input-failed' ? 'callback' : submitted ? 'client-exit' : found ? 'waiting-approval' : 'request'; } if (settled) return; settled = true; clearTimeout(timer); signal?.removeEventListener('abort', onAbort); if (err) { child.kill(); reject(err); } else resolve(); };
     if (signal?.aborted) { finish(new Error('login-cancelled')); return; }
     signal?.addEventListener('abort', onAbort, { once: true });
     child.stdin.on('error', () => finish(new Error('login-input-failed')));

package/src/oauth-cohort.js

@@ -12,7 +12,7 @@ async function authorizeCohort({ clients, issuer, approve, login = runHiddenLogi
   let timer;
   let rejectOverall;
   const failedPromise = new Promise((_, reject) => { rejectOverall = reject; });
-  const fail = (stage, client, detail) => {
+  const fail = (stage, client, detail, enrollmentReason) => {
     if (failed) return;
     failed = true;
     clearTimeout(timer);
@@ -21,7 +21,10 @@ async function authorizeCohort({ clients, issuer, approve, login = runHiddenLogi
     const error = new Error('cohort-failed');
     error.setupStage = stage;
     if (['sign-in','workspace','enrollment','client-grants'].includes(detail)) error.setupDetail = detail;
+    const enrollmentReasons=['killbar-helper-unavailable','killbar-helper-untrusted','killbar-authentication-failed','killbar-identity-invalid','killbar-lock-unavailable','killbar-enrollment-busy','killbar-status-unavailable','killbar-status-invalid','killbar-restart-required','killbar-already-enrolled','killbar-enrollment-failed','killbar-enrollment-unverified'];
+    if(stage==='authorization' && detail==='enrollment' && enrollmentReasons.includes(enrollmentReason)) error.enrollmentReason=enrollmentReason;
     if (client === 'codex' || client === 'claude') error.setupClient = client;
+    if (stage === 'native-login' && ['launch','request','waiting-approval','callback','client-exit'].includes(detail)) error.nativeStage = detail;
     rejectOverall(error);
   };
   timer = setTimeout(() => fail('timeout'), timeoutMs);
@@ -35,9 +38,9 @@ async function authorizeCohort({ clients, issuer, approve, login = runHiddenLogi
       if (failed) return;
       if (!callbacks || typeof callbacks !== 'object' || Array.isArray(callbacks) || Object.keys(callbacks).length !== clients.length || clients.some(name => typeof callbacks[name] !== 'string')) throw new Error('cohort-invalid-response');
       for (const name of clients) pending.get(name).resolve(callbacks[name]);
-    }).catch(error => fail('authorization', undefined, error?.setupDetail));
+    }).catch(error => fail('authorization', undefined, error?.setupDetail, error?.enrollmentReason));
   });
-  const runs = clients.map(executable => Promise.resolve().then(() => login({executable,commandPath:executablePaths[executable] || executable,issuer,authorize,timeoutMs,signal:controller.signal})).catch(error => { fail('native-login', executable); throw error; }));
+  const runs = clients.map(executable => Promise.resolve().then(() => login({executable,commandPath:executablePaths[executable] || executable,issuer,authorize,timeoutMs,signal:controller.signal})).catch(error => { fail('native-login', executable, error?.nativeStage); throw error; }));
   try { await Promise.race([Promise.all(runs), failedPromise]); } finally { clearTimeout(timer); }
 }
 module.exports = { authorizeCohort };

package/src/setup-flow.js

@@ -59,7 +59,10 @@ async function runSetupFlow({clients,issuer=ISSUER,fetchImpl=fetch,shell={openEx
         }
       }
       return payload.callbacks;
-      } catch { const error=new Error('setup-step-failed'); error.setupDetail=diagnosticStage; throw error; }
+      } catch (cause) { const error=new Error('setup-step-failed'); error.setupDetail=diagnosticStage;
+        const allowed=['killbar-helper-unavailable','killbar-helper-untrusted','killbar-authentication-failed','killbar-identity-invalid','killbar-lock-unavailable','killbar-enrollment-busy','killbar-status-unavailable','killbar-status-invalid','killbar-restart-required','killbar-already-enrolled','killbar-enrollment-failed','killbar-enrollment-unverified'];
+        if(diagnosticStage==='enrollment' && allowed.includes(cause?.message)) error.enrollmentReason=cause.message;
+        throw error; }
     }});
   } finally {session=null;}
 }

package/test/hidden-oauth.test.js

@@ -42,3 +42,15 @@ test('does not report success when client exits before callback is supplied', as
   child.stdout.write(request + '\n'); child.emit('close',0);
   await assert.rejects(running,/login-failed/);
 });
+
+test('reports bounded native handoff stages without child output', async () => {
+  const create = () => { const c = new EventEmitter(); c.stdin = new PassThrough(); c.stdout = new PassThrough(); c.stderr = new PassThrough(); c.kill = () => {}; return c; };
+  for (const phase of ['launch','request','waiting-approval','callback','client-exit']) {
+    const child = create();
+    const running = runHiddenLogin({executable:'claude',issuer,spawnImpl:()=>child,authorize:async()=>phase==='callback' ? 'http://bad.example/secret' : phase==='waiting-approval' ? new Promise(()=>{}) : 'http://127.0.0.1:1234/callback?code=ok&state=xyz'});
+    if (phase === 'launch') child.emit('error',new Error('secret-child-output'));
+    else if (phase === 'request') { child.stderr.write('secret-child-output\n'); child.emit('close',1); }
+    else { child.stdout.write(request+'\n'); if (phase==='waiting-approval') child.emit('close',1); if (phase==='client-exit') child.stdin.on('end',()=>child.emit('close',1)); if (phase==='client-exit') child.stdin.resume(); }
+    await assert.rejects(running,e=>e.nativeStage===phase && !JSON.stringify(e).includes('secret'));
+  }
+});

package/test/killbar-enrollment.test.js

@@ -113,3 +113,9 @@ test('setup failures report only an allowlisted stage and never the underlying s
   }),error=>error.message==='cohort-failed'&&error.setupDetail===stage&&!JSON.stringify(error).includes(secret));
  }
 });
+
+test('enrollment diagnostics expose only allowed failure categories',async()=>{
+ for(const [message,expected] of [['killbar-status-unavailable','killbar-status-unavailable'],['killbar-enrollment-failed','killbar-enrollment-failed'],['token-secret-not-allowed',undefined]]){
+  await assert.rejects(runSetupFlow({clients:['codex'],issuer:'https://example.test',authenticate:async({sessionSink})=>sessionSink.save({accessToken:'private'}),killbarEnrollment:async()=>{throw new Error(message)},login:async({authorize})=>authorize({client:'codex',authorizationUrl:'request'}),fetchImpl:async()=>identityResponse()}),error=>error.setupDetail==='enrollment'&&error.enrollmentReason===expected&&!JSON.stringify(error).includes('token-secret-not-allowed'));
+ }
+});