slaunt 0.1.19 → 0.1.20

package/.github/workflows/publish.yml

@@ -0,0 +1,59 @@
+name: Publish npm package
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    runs-on: macos-14
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+          package-manager-cache: false
+      - name: Install dependencies
+        run: npm ci --ignore-scripts
+      - name: Run tests
+        run: npm test
+      - name: Verify bundled helper
+        run: |
+          node -e "const f=require('fs'),c=require('crypto'),m=require('./release/manifest.json'); if(m.format!==1 || m.arch!=='arm64' || m.signing!=='adhoc' || !/^[a-f0-9]{40}$/.test(m.cdhash) || c.createHash('sha256').update(f.readFileSync('release/SlauntKillBar.zip')).digest('hex')!==m.sha256) process.exit(1)"
+          mkdir "$RUNNER_TEMP/slaunt-helper"
+          ditto -x -k release/SlauntKillBar.zip "$RUNNER_TEMP/slaunt-helper"
+          codesign --verify --deep --strict "$RUNNER_TEMP/slaunt-helper/SlauntKillBar.app"
+          EXPECTED_CDHASH="$(node -p "require('./release/manifest.json').cdhash")"
+          codesign -dv --verbose=4 "$RUNNER_TEMP/slaunt-helper/SlauntKillBar.app" 2> "$RUNNER_TEMP/codesign-info"
+          grep -Fx "CDHash=$EXPECTED_CDHASH" "$RUNNER_TEMP/codesign-info"
+          grep -Fx "Identifier=ai.slaunt.killbar" "$RUNNER_TEMP/codesign-info"
+          grep -Fx "Signature=adhoc" "$RUNNER_TEMP/codesign-info"
+      - name: Prepare public package metadata
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          node <<'NODE'
+          const fs = require('fs');
+          const tag = process.env.RELEASE_TAG;
+          if (!/^v(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/.test(tag)) throw Error('Expected a stable version tag, e.g. v0.1.20');
+          const p = JSON.parse(fs.readFileSync('package.json', 'utf8'));
+          p.name = 'slaunt';
+          p.version = tag.slice(1);
+          delete p.private;
+          p.bin = { slaunt: 'bin/slaunt-hooks.js', 'slaunt-hooks': 'bin/slaunt-hooks.js' };
+          p.repository = { type: 'git', url: 'git+https://github.com/kerodem/slaunt-hook-cli.git' };
+          fs.writeFileSync('package.json', JSON.stringify(p, null, 2) + '\n');
+          NODE
+      - name: Verify package contents
+        run: |
+          npm pack --dry-run --json > "$RUNNER_TEMP/slaunt-pack.json"
+          node -e "const p=require(process.env.RUNNER_TEMP+'/slaunt-pack.json')[0]; for(const n of ['bin/slaunt-hooks.js','release/manifest.json','release/SlauntKillBar.zip']) if(!p.files.some(f=>f.path===n)) throw Error('Missing package file: '+n)"
+      - name: Publish to npm
+        env:
+          NPM_CONFIG_PROVENANCE: 'false'
+        run: npm publish --access public

package/bin/slaunt-hooks.js

@@ -81,7 +81,8 @@ async function main(args=process.argv.slice(2),dependencies={}) {
         }
         else if(error.setupStage==='authorization') {
           const details={'sign-in':'Slaunt sign-in could not be completed.','workspace':'Slaunt workspace identity could not be verified.','enrollment':'KillBar enrollment could not be completed.','client-grants':'Slaunt could not issue client authorization grants.'};
-          messages[error.message]=details[error.setupDetail] || 'Slaunt authorization or enrollment could not be completed.';
+          const enrollmentMessages={'killbar-helper-unavailable':'KillBar helper is unavailable.','killbar-helper-untrusted':'KillBar helper could not be verified.','killbar-authentication-failed':'KillBar could not use the sign-in grant.','killbar-identity-invalid':'KillBar workspace identity is invalid.','killbar-lock-unavailable':'KillBar enrollment lock could not be created.','killbar-enrollment-busy':'Another KillBar enrollment is in progress.','killbar-status-unavailable':'KillBar status could not be read.','killbar-status-invalid':'KillBar returned an invalid status.','killbar-restart-required':'KillBar requires a restart before enrollment.','killbar-already-enrolled':'KillBar is already enrolled.','killbar-enrollment-failed':'KillBar enrollment request failed.','killbar-enrollment-unverified':'KillBar enrollment could not be verified for this workspace.'};
+          messages[error.message]=(error.setupDetail==='enrollment' && enrollmentMessages[error.enrollmentReason]) || details[error.setupDetail] || 'Slaunt authorization or enrollment could not be completed.';
         }
         else if(error.setupStage==='timeout') messages[error.message]='Slaunt authorization timed out.';
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "slaunt",
-  "version": "0.1.19",
+  "version": "0.1.20",
   "bin": {
     "slaunt": "bin/slaunt-hooks.js",
     "slaunt-hooks": "bin/slaunt-hooks.js"

package/src/oauth-cohort.js

@@ -12,7 +12,7 @@ async function authorizeCohort({ clients, issuer, approve, login = runHiddenLogi
   let timer;
   let rejectOverall;
   const failedPromise = new Promise((_, reject) => { rejectOverall = reject; });
-  const fail = (stage, client, detail) => {
+  const fail = (stage, client, detail, enrollmentReason) => {
     if (failed) return;
     failed = true;
     clearTimeout(timer);
@@ -21,6 +21,8 @@ async function authorizeCohort({ clients, issuer, approve, login = runHiddenLogi
     const error = new Error('cohort-failed');
     error.setupStage = stage;
     if (['sign-in','workspace','enrollment','client-grants'].includes(detail)) error.setupDetail = detail;
+    const enrollmentReasons=['killbar-helper-unavailable','killbar-helper-untrusted','killbar-authentication-failed','killbar-identity-invalid','killbar-lock-unavailable','killbar-enrollment-busy','killbar-status-unavailable','killbar-status-invalid','killbar-restart-required','killbar-already-enrolled','killbar-enrollment-failed','killbar-enrollment-unverified'];
+    if(stage==='authorization' && detail==='enrollment' && enrollmentReasons.includes(enrollmentReason)) error.enrollmentReason=enrollmentReason;
     if (client === 'codex' || client === 'claude') error.setupClient = client;
     if (stage === 'native-login' && ['launch','request','waiting-approval','callback','client-exit'].includes(detail)) error.nativeStage = detail;
     rejectOverall(error);
@@ -36,7 +38,7 @@ async function authorizeCohort({ clients, issuer, approve, login = runHiddenLogi
       if (failed) return;
       if (!callbacks || typeof callbacks !== 'object' || Array.isArray(callbacks) || Object.keys(callbacks).length !== clients.length || clients.some(name => typeof callbacks[name] !== 'string')) throw new Error('cohort-invalid-response');
       for (const name of clients) pending.get(name).resolve(callbacks[name]);
-    }).catch(error => fail('authorization', undefined, error?.setupDetail));
+    }).catch(error => fail('authorization', undefined, error?.setupDetail, error?.enrollmentReason));
   });
   const runs = clients.map(executable => Promise.resolve().then(() => login({executable,commandPath:executablePaths[executable] || executable,issuer,authorize,timeoutMs,signal:controller.signal})).catch(error => { fail('native-login', executable, error?.nativeStage); throw error; }));
   try { await Promise.race([Promise.all(runs), failedPromise]); } finally { clearTimeout(timer); }

package/src/setup-flow.js

@@ -59,7 +59,10 @@ async function runSetupFlow({clients,issuer=ISSUER,fetchImpl=fetch,shell={openEx
         }
       }
       return payload.callbacks;
-      } catch { const error=new Error('setup-step-failed'); error.setupDetail=diagnosticStage; throw error; }
+      } catch (cause) { const error=new Error('setup-step-failed'); error.setupDetail=diagnosticStage;
+        const allowed=['killbar-helper-unavailable','killbar-helper-untrusted','killbar-authentication-failed','killbar-identity-invalid','killbar-lock-unavailable','killbar-enrollment-busy','killbar-status-unavailable','killbar-status-invalid','killbar-restart-required','killbar-already-enrolled','killbar-enrollment-failed','killbar-enrollment-unverified'];
+        if(diagnosticStage==='enrollment' && allowed.includes(cause?.message)) error.enrollmentReason=cause.message;
+        throw error; }
     }});
   } finally {session=null;}
 }

package/test/killbar-enrollment.test.js

@@ -113,3 +113,9 @@ test('setup failures report only an allowlisted stage and never the underlying s
   }),error=>error.message==='cohort-failed'&&error.setupDetail===stage&&!JSON.stringify(error).includes(secret));
  }
 });
+
+test('enrollment diagnostics expose only allowed failure categories',async()=>{
+ for(const [message,expected] of [['killbar-status-unavailable','killbar-status-unavailable'],['killbar-enrollment-failed','killbar-enrollment-failed'],['token-secret-not-allowed',undefined]]){
+  await assert.rejects(runSetupFlow({clients:['codex'],issuer:'https://example.test',authenticate:async({sessionSink})=>sessionSink.save({accessToken:'private'}),killbarEnrollment:async()=>{throw new Error(message)},login:async({authorize})=>authorize({client:'codex',authorizationUrl:'request'}),fetchImpl:async()=>identityResponse()}),error=>error.setupDetail==='enrollment'&&error.enrollmentReason===expected&&!JSON.stringify(error).includes('token-secret-not-allowed'));
+ }
+});