sleev 0.0.12 → 0.0.15

package/dist/auth/command.js

@@ -1,109 +0,0 @@
-// Auth command flows for the CLI dispatcher.
-import { selectApps } from '../apps.js';
-import { authPath, clearAuth, createAuthFile, readAuth, writeAuth } from '../credentials/index.js';
-import { setupHarnesses, unpatchHarnesses } from '../harnesses.js';
-import { proxyUrl } from '../product.js';
-import { field, line, note, success } from '../terminal.js';
-import { login as browserLogin } from './login.js';
-import { validateAuth } from './validation.js';
-export function commandRuntime() {
-    return {
-        output: process.stdout,
-        authPath,
-        readAuth,
-        writeAuth,
-        clearAuth,
-        createAuthFile,
-        login: browserLogin,
-        validateAuth,
-        selectApps: () => selectApps(),
-        setupHarnesses,
-        unpatchHarnesses,
-    };
-}
-export async function loginCommand(options = {}, runtime = commandRuntime()) {
-    const path = runtime.authPath();
-    const existing = await readLocalAuth(path, runtime);
-    const local = existing ? canonicalAuth(existing) : null;
-    const state = local && !options.force ? await runtime.validateAuth(local) : 'invalid';
-    if (state === 'valid') {
-        note(runtime.output, 'Using existing valid local auth');
-    }
-    if (existing && options.force) {
-        note(runtime.output, 'Replacing existing local auth. The previous remote Sleeve token is not revoked');
-    }
-    if (existing && state === 'invalid' && !options.force) {
-        note(runtime.output, 'Existing local auth is expired or revoked. Creating a new token');
-    }
-    if (existing && state === 'unknown' && !options.force) {
-        note(runtime.output, 'Could not verify existing local auth. Creating a new token');
-    }
-    const useLocal = state === 'valid' && local;
-    const auth = useLocal ? local : runtime.createAuthFile(await runtime.login());
-    const changed = useLocal && existing?.proxyUrl !== auth.proxyUrl;
-    const written = useLocal && !changed ? { path } : await runtime.writeAuth(auth, path);
-    if (changed)
-        note(runtime.output, 'Updated local auth to use the current Sleev proxy');
-    line(runtime.output);
-    success(runtime.output, useLocal ? 'Already logged in' : 'Logged in');
-    field(runtime.output, 'credential', written.path);
-    field(runtime.output, 'proxy', auth.proxyUrl);
-    note(runtime.output, 'Keep auth.json and patched app configs private. They contain your live Sleeve token');
-    line(runtime.output);
-    const apps = await runtime.selectApps();
-    const harnesses = await runtime.setupHarnesses(auth, apps);
-    success(runtime.output, 'Setup complete');
-    field(runtime.output, 'applications configured to use sleev', harnesses.label);
-    return 0;
-}
-async function readLocalAuth(path, runtime) {
-    try {
-        return await runtime.readAuth(path);
-    }
-    catch (err) {
-        if (!recoverableAuthError(err))
-            throw err;
-        note(runtime.output, 'Replacing invalid local auth file');
-        return null;
-    }
-}
-export async function logoutCommand(runtime = commandRuntime()) {
-    const path = runtime.authPath();
-    const existing = await readLogoutAuth(path, runtime);
-    const cleanup = await runtime.unpatchHarnesses();
-    await runtime.clearAuth(path);
-    if (!existing) {
-        note(runtime.output, 'No local auth file found');
-        return 0;
-    }
-    success(runtime.output, 'Removed local auth');
-    field(runtime.output, 'removed', path);
-    note(runtime.output, 'Remote Sleeve token is not revoked and remains active');
-    if (cleanup.failures[0])
-        note(runtime.output, `Some harness config cleanup failed: ${cleanup.failures.join('; ')}`);
-    return 0;
-}
-function recoverableAuthError(err) {
-    if (err instanceof SyntaxError)
-        return true;
-    if (!(err instanceof Error))
-        return false;
-    return err.message.startsWith('Sleev auth ');
-}
-function canonicalAuth(auth) {
-    const proxy = proxyUrl();
-    if (auth.proxyUrl === proxy)
-        return auth;
-    return { ...auth, proxyUrl: proxy };
-}
-async function readLogoutAuth(path, runtime) {
-    try {
-        return await runtime.readAuth(path);
-    }
-    catch (err) {
-        if (!recoverableAuthError(err))
-            throw err;
-        note(runtime.output, 'Removing invalid local auth file');
-        return { version: 1, token: '', label: null, proxyUrl: '', createdAt: '' };
-    }
-}

package/dist/auth/index.js

@@ -1,2 +0,0 @@
-// Public auth module API.
-export { login } from './login.js';

package/dist/auth/login.js

@@ -1,55 +0,0 @@
-// Browser login orchestration for `sleev auth login`.
-import { randomBytes } from 'node:crypto';
-import { hostname } from 'node:os';
-import { webOrigin as defaultWebOrigin } from '../product.js';
-import { brand, field, line, note, step, success } from '../terminal.js';
-import { openBrowser } from './browser.js';
-import { startLoopback } from './loopback.js';
-const LOGIN_TIMEOUT_MS = 10 * 60 * 1000;
-export async function login(options = {}) {
-    const output = options.output ?? process.stdout;
-    brand(output);
-    return runHandoff({ ...options, mode: options.mode ?? 'signup', output });
-}
-async function runHandoff(options) {
-    const output = options.output;
-    const mode = options.mode;
-    const origin = options.webOrigin ?? defaultWebOrigin();
-    const opener = options.opener ?? openBrowser;
-    const state = randomBytes(32).toString('base64url');
-    const loopback = await startLoopback({
-        state,
-        webOrigin: origin,
-        timeoutMs: options.timeoutMs ?? LOGIN_TIMEOUT_MS,
-    });
-    const url = loginUrl(origin, mode, state, loopback.callback);
-    const action = mode === 'signup' ? 'create your account' : 'log in';
-    step(output, `Opening browser to ${action}`);
-    field(output, 'url', url);
-    try {
-        const opened = await opener(url);
-        if (!opened) {
-            note(output, 'Could not open a browser automatically. Open the URL above instead');
-        }
-        note(output, 'Waiting for the browser confirmation...');
-        const payload = await loopback.wait;
-        success(output, 'Browser login confirmed');
-        return {
-            token: payload.token,
-            label: payload.label,
-            proxyUrl: payload.proxyUrl,
-            createdAt: (options.now ?? (() => new Date()))().toISOString(),
-        };
-    }
-    finally {
-        await loopback.close();
-    }
-}
-function loginUrl(origin, mode, state, callback) {
-    const url = new URL('/cli/login', origin);
-    url.searchParams.set('mode', mode);
-    url.searchParams.set('state', state);
-    url.searchParams.set('callback', callback);
-    url.searchParams.set('device', hostname().slice(0, 80));
-    return url.toString();
-}

package/dist/auth/loopback.js

@@ -1,134 +0,0 @@
-// Temporary loopback server that receives the browser login handoff.
-import { createServer } from 'node:http';
-import { parseHandoff } from './schema.js';
-const MAX_BODY_BYTES = 16 * 1024;
-export async function startLoopback(options) {
-    let settled = false;
-    let finish = () => undefined;
-    let fail = () => undefined;
-    const wait = new Promise((resolve, reject) => {
-        finish = resolve;
-        fail = reject;
-    });
-    const server = createServer(async (req, res) => {
-        try {
-            await handleRequest(req, res, options, (payload) => {
-                if (settled)
-                    return;
-                settled = true;
-                finish(payload);
-            }, (err) => {
-                if (settled)
-                    return;
-                settled = true;
-                fail(err);
-            });
-        }
-        catch (err) {
-            sendJson(res, 400, { error: err instanceof Error ? err.message : 'Invalid request.' }, options.webOrigin);
-        }
-    });
-    await listen(server);
-    const address = server.address();
-    if (!address || typeof address === 'string') {
-        await closeServer(server);
-        throw new Error('Could not bind local login callback server.');
-    }
-    const timeout = setTimeout(() => {
-        if (settled)
-            return;
-        settled = true;
-        fail(new Error('Timed out waiting for browser login.'));
-        void closeServer(server);
-    }, options.timeoutMs);
-    wait.finally(() => clearTimeout(timeout)).catch(() => undefined);
-    return {
-        callback: `http://127.0.0.1:${address.port}/callback`,
-        wait,
-        close: () => closeServer(server),
-    };
-}
-async function handleRequest(req, res, options, accept, reject) {
-    if (req.method === 'OPTIONS') {
-        handleOptions(req, res, options.webOrigin);
-        return;
-    }
-    if (req.method !== 'POST' || req.url !== '/callback') {
-        sendJson(res, 404, { error: 'Not found.' }, options.webOrigin);
-        return;
-    }
-    if (!hasAllowedOrigin(req, options.webOrigin)) {
-        sendJson(res, 403, { error: 'Origin is not allowed.' }, options.webOrigin);
-        return;
-    }
-    const body = await readBody(req);
-    const payload = parseHandoff(JSON.parse(body));
-    if (payload.state !== options.state) {
-        sendJson(res, 403, { error: 'Login state did not match.' }, options.webOrigin);
-        return;
-    }
-    accept(payload);
-    sendJson(res, 200, { ok: true }, options.webOrigin);
-}
-function handleOptions(req, res, origin) {
-    if (!hasAllowedOrigin(req, origin)) {
-        sendJson(res, 403, { error: 'Origin is not allowed.' }, origin);
-        return;
-    }
-    writeCors(res, origin);
-    res.writeHead(204);
-    res.end();
-}
-function hasAllowedOrigin(req, origin) {
-    const actual = req.headers.origin;
-    return !actual || actual === origin;
-}
-function readBody(req) {
-    return new Promise((resolve, reject) => {
-        const chunks = [];
-        let size = 0;
-        req.on('data', (chunk) => {
-            size += chunk.length;
-            if (size > MAX_BODY_BYTES) {
-                reject(new Error('Login callback body is too large.'));
-                req.destroy();
-                return;
-            }
-            chunks.push(chunk);
-        });
-        req.once('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
-        req.once('error', () => reject(new Error('Could not read login callback.')));
-    });
-}
-function sendJson(res, status, body, origin) {
-    if (res.writableEnded)
-        return;
-    writeCors(res, origin);
-    res.writeHead(status, { 'content-type': 'application/json; charset=utf-8' });
-    res.end(JSON.stringify(body));
-}
-function writeCors(res, origin) {
-    res.setHeader('access-control-allow-origin', origin);
-    res.setHeader('access-control-allow-methods', 'POST, OPTIONS');
-    res.setHeader('access-control-allow-headers', 'content-type');
-}
-function listen(server) {
-    return new Promise((resolve, reject) => {
-        server.once('error', reject);
-        server.listen(0, '127.0.0.1', () => {
-            server.removeListener('error', reject);
-            resolve();
-        });
-    });
-}
-function closeServer(server) {
-    if (!server.listening)
-        return Promise.resolve();
-    return new Promise((resolve, reject) => {
-        server.close((err) => {
-            if (err)
-                reject(err);
-            resolve();
-        });
-    });
-}

package/dist/auth/schema.js

@@ -1,46 +0,0 @@
-// Validation for the browser-to-CLI auth handoff payload.
-export function parseHandoff(input) {
-    if (!isRecord(input))
-        throw new Error('Login callback payload must be an object.');
-    const state = stringField(input, 'state');
-    const token = stringField(input, 'token');
-    const label = nullableStringField(input, 'label');
-    const proxyUrl = stringField(input, 'proxyUrl');
-    if (!state)
-        throw new Error('Login callback state is missing.');
-    if (!token.startsWith('slv_live_'))
-        throw new Error('Login callback token is invalid.');
-    validateUrl(proxyUrl, 'Login callback proxy URL');
-    return { state, token, label, proxyUrl };
-}
-function stringField(input, key) {
-    const value = input[key];
-    if (typeof value !== 'string')
-        throw new Error(`${key} must be a string.`);
-    return value;
-}
-function nullableStringField(input, key) {
-    const value = input[key];
-    if (value === null || typeof value === 'undefined')
-        return null;
-    if (typeof value !== 'string')
-        throw new Error(`${key} must be a string or null.`);
-    return value;
-}
-function validateUrl(raw, name) {
-    const url = parseUrl(raw, name);
-    if (url.protocol !== 'https:' && url.protocol !== 'http:') {
-        throw new Error(`${name} must use http or https.`);
-    }
-}
-function parseUrl(raw, name) {
-    try {
-        return new URL(raw);
-    }
-    catch {
-        throw new Error(`${name} must be a valid URL.`);
-    }
-}
-function isRecord(input) {
-    return typeof input === 'object' && input !== null && !Array.isArray(input);
-}

package/dist/auth/validation.js

@@ -1,27 +0,0 @@
-// Auth validation owns Sleeve token checks against the proxy.
-export async function validateAuth(auth) {
-    const base = trim(auth.proxyUrl);
-    try {
-        const res = await fetch(`${base}/messages`, {
-            method: 'POST',
-            headers: {
-                'content-type': 'application/json',
-                'sleeve-token': auth.token,
-                'sleeve-provider': 'anthropic',
-                'sleeve-harness': 'claude code',
-            },
-            body: '{}',
-        });
-        if (res.status === 401)
-            return 'invalid';
-        if (res.status === 400)
-            return 'valid';
-    }
-    catch {
-        return 'unknown';
-    }
-    return 'unknown';
-}
-function trim(url) {
-    return url.replace(/\/+$/, '');
-}

package/dist/cli.js

@@ -1,69 +0,0 @@
-#!/usr/bin/env node
-// Thin command dispatcher for the `sleev` executable.
-import { existsSync, realpathSync } from 'node:fs';
-import { pathToFileURL } from 'node:url';
-import { loginCommand, logoutCommand } from './auth/command.js';
-import { failure } from './terminal.js';
-const HELP = `sleev\n\nUsage:\n  sleev login [--force]\n  sleev install [--force]\n  sleev auth login [--force]\n  sleev auth <command>\n\nCommands:\n  login          Open the Sleev web app when needed and store a local auth token\n  install        Alias for login\n  auth login     Open the Sleev web app when needed and store a local auth token\n  auth logout    Delete the local auth file\n`;
-const LOGIN_HELP = `Usage:\n  sleev login [--force]\n  sleev install [--force]\n  sleev auth login [--force]\n`;
-const AUTH_HELP = `Usage:\n  sleev auth login [--force]\n  sleev auth logout\n`;
-export async function main(argv = process.argv.slice(2)) {
-    if (argv.length === 0 || argv[0] === '--help' || argv[0] === '-h') {
-        process.stdout.write(HELP);
-        return 0;
-    }
-    if (argv[0] === 'login' || argv[0] === 'install') {
-        if (argv[1] === '--help' || argv[1] === '-h') {
-            process.stdout.write(LOGIN_HELP);
-            return 0;
-        }
-        return login(argv[0], argv.slice(1), LOGIN_HELP);
-    }
-    if (argv[0] !== 'auth') {
-        process.stderr.write(`Unknown command: ${argv[0]}\n\n${HELP}`);
-        return 1;
-    }
-    if (argv[1] === '--help' || argv[1] === '-h') {
-        process.stdout.write(AUTH_HELP);
-        return 0;
-    }
-    const command = argv[1];
-    if (command !== 'login' && command !== 'logout') {
-        process.stderr.write(`Unknown auth command: ${command ?? ''}\n\n${AUTH_HELP}`);
-        return 1;
-    }
-    if (command === 'logout') {
-        if (argv.length !== 2)
-            return usageError(`auth ${command} does not accept flags yet.`, AUTH_HELP);
-        return logoutCommand();
-    }
-    return login(`auth ${command}`, argv.slice(2), AUTH_HELP);
-}
-function login(command, flags, help) {
-    if (flags.some((flag) => flag !== '--force'))
-        return usageError(`Unknown ${command} flag.`, help);
-    return loginCommand({ force: flags.includes('--force') });
-}
-function usageError(message, help) {
-    process.stderr.write(`${message}\n\n${help}`);
-    return 1;
-}
-if (isEntry()) {
-    main().then((code) => {
-        process.exitCode = code;
-    }, (err) => {
-        const message = err instanceof Error ? err.message : 'Command failed.';
-        failure(process.stderr, message);
-        process.exitCode = 1;
-    });
-}
-function isEntry() {
-    const entry = process.argv[1];
-    if (!entry)
-        return false;
-    if (import.meta.url === pathToFileURL(entry).href)
-        return true;
-    if (!existsSync(entry))
-        return false;
-    return realpathSync(new URL(import.meta.url)) === realpathSync(entry);
-}

package/dist/credentials/index.js

@@ -1,3 +0,0 @@
-// Public credential storage API.
-export { authPath, clearAuth, readAuth, writeAuth } from './store.js';
-export { createAuthFile, parseAuthInput } from './schema.js';

package/dist/credentials/schema.js

@@ -1,63 +0,0 @@
-// Validation for the on-disk Sleev auth file.
-export function createAuthFile(input) {
-    const parsed = parseAuthInput(input);
-    return { version: 1, ...parsed };
-}
-export function parseAuthInput(input) {
-    if (!isRecord(input))
-        throw new Error('Sleev auth input must be an object.');
-    return parseAuthRecord(input);
-}
-export function parseAuthFile(input) {
-    if (!isRecord(input))
-        throw new Error('Sleev auth file must be an object.');
-    const version = input.version;
-    if (version !== 1)
-        throw new Error('Sleev auth file version is unsupported.');
-    return { version, ...parseAuthInput(input) };
-}
-function parseAuthRecord(input) {
-    if (!isRecord(input))
-        throw new Error('Sleev auth input must be an object.');
-    const token = stringField(input, 'token');
-    const label = nullableStringField(input, 'label');
-    const proxyUrl = stringField(input, 'proxyUrl');
-    const createdAt = stringField(input, 'createdAt');
-    if (!token.startsWith('slv_live_'))
-        throw new Error('Sleev auth token is invalid.');
-    validateUrl(proxyUrl, 'Sleev auth proxy URL');
-    if (Number.isNaN(Date.parse(createdAt)))
-        throw new Error('Sleev auth createdAt is invalid.');
-    return { token, label, proxyUrl, createdAt };
-}
-function stringField(input, key) {
-    const value = input[key];
-    if (typeof value !== 'string')
-        throw new Error(`${key} must be a string.`);
-    return value;
-}
-function nullableStringField(input, key) {
-    const value = input[key];
-    if (value === null || typeof value === 'undefined')
-        return null;
-    if (typeof value !== 'string')
-        throw new Error(`${key} must be a string or null.`);
-    return value;
-}
-function validateUrl(raw, name) {
-    const url = parseUrl(raw, name);
-    if (url.protocol !== 'https:' && url.protocol !== 'http:') {
-        throw new Error(`${name} must use http or https.`);
-    }
-}
-function parseUrl(raw, name) {
-    try {
-        return new URL(raw);
-    }
-    catch {
-        throw new Error(`${name} must be a valid URL.`);
-    }
-}
-function isRecord(input) {
-    return typeof input === 'object' && input !== null && !Array.isArray(input);
-}

package/dist/credentials/store.js

@@ -1,52 +0,0 @@
-// Credential storage owns auth.json path resolution, validation, and safe writes.
-import { chmod, mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
-import { dirname, join } from 'node:path';
-import { homedir } from 'node:os';
-import { parseAuthFile } from './schema.js';
-export function authPath(env = process.env, platform = process.platform) {
-    return join(configRoot(env, platform), 'sleev', 'auth.json');
-}
-export async function readAuth(path = authPath()) {
-    try {
-        const raw = await readFile(path, 'utf8');
-        return parseAuthFile(JSON.parse(raw));
-    }
-    catch (err) {
-        if (errorCode(err) === 'ENOENT')
-            return null;
-        throw err;
-    }
-}
-export async function writeAuth(auth, path = authPath()) {
-    const checked = parseAuthFile(auth);
-    const dir = dirname(path);
-    const tmp = join(dir, `.auth.${process.pid}.${Date.now()}.tmp`);
-    const body = `${JSON.stringify(checked, null, 2)}\n`;
-    await mkdir(dir, { recursive: true, mode: 0o700 });
-    await writeFile(tmp, body, { mode: 0o600 });
-    await rename(tmp, path);
-    await chmod(path, 0o600);
-    return { path };
-}
-export async function clearAuth(path = authPath()) {
-    try {
-        await rm(path);
-    }
-    catch (err) {
-        if (errorCode(err) === 'ENOENT')
-            return;
-        throw err;
-    }
-}
-function configRoot(env, platform) {
-    if (platform === 'win32') {
-        return env.APPDATA || join(homedir(), 'AppData', 'Roaming');
-    }
-    return env.XDG_CONFIG_HOME || join(homedir(), '.config');
-}
-function errorCode(err) {
-    if (typeof err !== 'object' || err === null || !('code' in err))
-        return undefined;
-    const code = err.code;
-    return typeof code === 'string' ? code : undefined;
-}

package/dist/harnesses.js

@@ -1,66 +0,0 @@
-// Harness orchestration owns setup and cleanup across supported local tools.
-import { setupClaude, unpatchClaude } from './apps/claude.js';
-import { setupCodex, unpatchCodex } from './apps/codex.js';
-import { availableOpenCodeProviders, setupOpenCode, unpatchOpenCode } from './apps/opencode.js';
-export const HARNESSES = [
-    {
-        id: 'opencode',
-        label: 'opencode',
-        command: 'opencode',
-        available: async () => {
-            try {
-                return (await availableOpenCodeProviders()).length > 0;
-            }
-            catch {
-                return false;
-            }
-        },
-        setup: setupOpenCode,
-        unpatch: unpatchOpenCode,
-    },
-    {
-        id: 'claude-code',
-        label: 'claude code',
-        command: 'claude',
-        setup: setupClaude,
-        unpatch: unpatchClaude,
-    },
-    {
-        id: 'codex',
-        label: 'codex',
-        command: 'codex',
-        setup: setupCodex,
-        unpatch: unpatchCodex,
-    },
-];
-export async function setupHarnesses(auth, apps) {
-    for (const harness of HARNESSES) {
-        if (!apps.includes(harness.id))
-            continue;
-        await harness.setup(auth);
-    }
-    return { label: harnessLabels(apps) };
-}
-export async function unpatchHarnesses() {
-    const failures = [];
-    await Promise.all(HARNESSES.map(async (harness) => {
-        try {
-            await harness.unpatch();
-        }
-        catch (err) {
-            failures.push(`${harness.label}: ${message(err)}`);
-        }
-    }));
-    return { failures };
-}
-export function harnessLabels(ids) {
-    if (ids.length === 0)
-        return 'none';
-    const labels = ids.map((id) => HARNESSES.find((harness) => harness.id === id)?.label ?? id);
-    return labels.join(', ');
-}
-function message(err) {
-    if (err instanceof Error)
-        return err.message;
-    return String(err);
-}

package/dist/index.js

@@ -1,3 +0,0 @@
-// Public package API for programmatic callers.
-export { login } from './auth/index.js';
-export { authPath, clearAuth, createAuthFile, parseAuthInput, readAuth, writeAuth } from './credentials/index.js';

package/dist/product.js

@@ -1,27 +0,0 @@
-// Product defaults and environment escape hatches for local development.
-const DEFAULT_WEB_ORIGIN = 'https://sleev.ai';
-const DEFAULT_PROXY_URL = 'https://api.sleev.ai';
-export function webOrigin(env = process.env) {
-    const raw = env.SLEEV_WEB_ORIGIN?.trim();
-    if (!raw)
-        return DEFAULT_WEB_ORIGIN;
-    const url = parseUrl(raw, 'SLEEV_WEB_ORIGIN');
-    if (url.protocol !== 'https:' && url.protocol !== 'http:') {
-        throw new Error('SLEEV_WEB_ORIGIN must use http or https.');
-    }
-    if (url.pathname !== '/' || url.search || url.hash) {
-        throw new Error('SLEEV_WEB_ORIGIN must be an origin without a path.');
-    }
-    return url.origin;
-}
-export function proxyUrl() {
-    return DEFAULT_PROXY_URL;
-}
-function parseUrl(raw, name) {
-    try {
-        return new URL(raw);
-    }
-    catch {
-        throw new Error(`${name} must be a valid URL.`);
-    }
-}