synabun 2.0.5 → 2.0.9

package/neural-interface/lib/cli-update-planner.js

@@ -110,11 +110,22 @@ export function detectInstallSource(binPath) {
   if (p.includes('/.bun/')) return 'bun';
   if (p.includes('/pnpm/') || p.includes('/.local/share/pnpm/')) return 'pnpm';
   if (p.includes('/.yarn/') || p.includes('/yarn/global/')) return 'yarn';
-  if (p.includes('/.volta/')) return 'volta';
+  if (p.includes('/.volta/') || p.includes('/appdata/local/volta/')) return 'volta';
 
-  // Tool-owned installers.
+  // Version managers that install tools themselves (`mise use -g
+  // github:anomalyco/opencode`, an asdf plugin). A package npm installed
+  // under a Node they manage is still npm's: the npm of that Node updates it.
+  if ((p.includes('/mise/') || p.includes('/.asdf/')) && !p.includes('/node_modules/')) {
+    return p.includes('/.asdf/') ? 'asdf' : 'mise';
+  }
+
+  // Tool-owned installers. The native installer's launcher (~/.local/bin/claude)
+  // is a link into ~/.local/share/claude/versions/, and the Codex installer's
+  // into ~/.codex/packages/standalone/ (on Windows behind
+  // %LOCALAPPDATA%\Programs\OpenAI\Codex\bin): the followed path is what arrives here.
   if (p.includes('/.opencode/')) return 'standalone';
-  if (p.includes('/.claude/local/') || p.includes('/anthropicclaude/')) return 'native';
+  if (p.includes('/.codex/packages/standalone/') || p.includes('/programs/openai/codex/')) return 'standalone';
+  if (p.includes('/.claude/local/') || p.includes('/anthropicclaude/') || p.includes('/.local/share/claude/')) return 'native';
 
   // Windows package managers — before the Program Files native rule, since
   // scoop/choco shims can live under a user profile that also matches.
@@ -126,12 +137,39 @@ export function detectInstallSource(binPath) {
   if (/\/\.local\/bin\//.test(p)) return 'native';
   if (/\/program files( \(x86\))?\//.test(p)) return 'native';
 
-  // Generic npm global — LAST.
+  // Generic npm global — LAST of the package managers.
   if (p.includes('/node_modules/')) return 'npm';
 
+  // Built from source with cargo, a snap, and a Linux package (apt, dnf, rpm,
+  // pacman, apk), which lives in the system's own folders and is updated by
+  // that package manager with the system's other software.
+  if (p.includes('/.cargo/bin/')) return 'cargo';
+  if (p.startsWith('/snap/')) return 'snap';
+  if (/^\/(?:usr\/(?:bin|lib|lib64|libexec|share)|bin)\//.test(p)) return 'system';
+
   return 'other';
 }
 
+/**
+ * The install source of a found CLI, from the path it was found at and the
+ * path that link leads to. A version manager's shim (mise, asdf), Volta's,
+ * Scoop's, Chocolatey's and WinGet's links say who owns the tool only by where
+ * they are: what they lead to is the manager's own program (a mise shim is a
+ * link to mise) or a copy somewhere else.
+ */
+export function detectInstallSourceOf({ path: found = null, realPath = null } = {}) {
+  const p = String(found || '').replace(/\\/g, '/').toLowerCase();
+  if (p) {
+    if (p.includes('/mise/shims/')) return 'mise';
+    if (p.includes('/.asdf/shims/')) return 'asdf';
+    if (p.includes('/.volta/bin/') || p.includes('/appdata/local/volta/bin/')) return 'volta';
+    if (p.includes('/scoop/shims/')) return 'scoop';
+    if (p.includes('/chocolatey/bin/')) return 'choco';
+    if (p.includes('/winget/links/')) return 'winget';
+  }
+  return detectInstallSource(realPath || found);
+}
+
 /**
  * Derive the Homebrew token from a Caskroom/Cellar path, e.g.
  *   /opt/homebrew/Caskroom/claude-code/2.1.224/claude  -> claude-code
@@ -153,15 +191,53 @@ export function resolveBrewToken(toolKey, binPath) {
   return brewTokenFromPath(binPath) || BREW_FALLBACK_TOKENS[toolKey] || toolKey;
 }
 
+/** The command each tool is started with, as its self-updater names it. */
+const TOOL_COMMANDS = {
+  'claude-code': 'claude',
+  'codex': 'codex',
+  'opencode': 'opencode',
+  'gemini': 'gemini',
+};
+
+/**
+ * A file path as one word of a command typed into a terminal tab: single
+ * quotes for a POSIX shell, double quotes for cmd.exe (a Windows file name
+ * cannot hold a double quote). A path that needs no quoting is left as it is.
+ */
+export function quoteCommandPath(file, platform = process.platform) {
+  const value = String(file || '');
+  if (platform === 'win32') return /[\s&()^%!;,=]/.test(value) ? `"${value}"` : value;
+  return /^[\w@%+=:,./-]+$/.test(value) ? value : `'${value.replace(/'/g, `'\\''`)}'`;
+}
+
 /**
  * Build the command that actually updates a tool, given how it was installed.
  * Returns null when there is no safe automated path (e.g. winget with no
  * self-updater) — the caller should show a "use your installer" hint instead.
+ *
+ * `binPath`: the CLI SynaBun found (lib/cli-resolver.js). A self-updater is
+ * then started by that path rather than by name, so the update reaches the
+ * very installation the panels use, also when a terminal's PATH does not name
+ * its folder (a Windows server started before the CLI was installed, a folder
+ * found among the known install locations).
  */
-export function buildUpdateCommand(toolKey, installSource, { brewToken = null } = {}) {
+export function buildUpdateCommand(toolKey, installSource, { brewToken = null, binPath = null, platform = null } = {}) {
+  const command = planUpdateCommand(toolKey, installSource, { brewToken, platform });
+  const name = TOOL_COMMANDS[toolKey];
+  if (!command || !binPath || !name) return command;
+  if (command !== name && !command.startsWith(`${name} `)) return command;
+  return `${quoteCommandPath(binPath, platform || process.platform)}${command.slice(name.length)}`;
+}
+
+function planUpdateCommand(toolKey, installSource, { brewToken = null, platform = null } = {}) {
   const npmPkg = NPM_PKGS[toolKey];
   const selfUpdate = SELF_UPDATERS[toolKey] || null;
 
+  // A version manager, cargo, a snap or the system's package manager owns the
+  // binary: only it can replace it, and SynaBun does not drive any of them
+  // (the system's needs an administrator). The caller shows a hint.
+  if (['mise', 'asdf', 'cargo', 'snap', 'system'].includes(installSource)) return null;
+
   // A package manager owns the binary — only that manager can replace it.
   if (isBrewSource(installSource)) {
     const token = brewToken || BREW_FALLBACK_TOKENS[toolKey] || toolKey;
@@ -193,7 +269,11 @@ export function buildUpdateCommand(toolKey, installSource, { brewToken = null }
       return null;
     case 'standalone':
       // The tool's own installer put it here, so its own updater is right.
-      return toolKey === 'opencode' ? 'opencode upgrade --method curl' : selfUpdate;
+      // OpenCode's `curl` method runs its bash install script, which Windows
+      // does not have: a copy in %USERPROFILE%\.opencode\bin there came from
+      // the release archive (lib/cli-install.js) and has no updater to call.
+      if (toolKey === 'opencode') return platform === 'win32' ? null : 'opencode upgrade --method curl';
+      return selfUpdate;
     case 'native':
       return selfUpdate;
     default:
@@ -281,17 +361,56 @@ export function installSourceLabel(source) {
     case 'winget': return 'winget';
     case 'scoop': return 'Scoop';
     case 'choco': return 'Chocolatey';
+    case 'mise': return 'mise';
+    case 'asdf': return 'asdf';
+    case 'cargo': return 'cargo';
+    case 'snap': return 'snap';
+    case 'system': return 'your system\'s package manager';
     default: return 'your installer';
   }
 }
 
+/**
+ * The install command each vendor documents first for an operating system
+ * (checked 2026-10-17): Anthropic's native installer (code.claude.com/docs/en/setup),
+ * OpenAI's standalone installer (learn.chatgpt.com/docs/codex/cli), OpenCode's
+ * install script (opencode.ai/docs; on Windows, where the script does not run,
+ * npm, the first method its docs list that works in any terminal). These are
+ * the same official sources the Install button runs (lib/cli-install.js).
+ */
+export function vendorInstallCommand(toolKey, platform = process.platform) {
+  const windows = platform === 'win32';
+  switch (toolKey) {
+    case 'claude-code':
+      return windows ? 'irm https://claude.ai/install.ps1 | iex' : 'curl -fsSL https://claude.ai/install.sh | bash';
+    case 'codex':
+      return windows
+        ? 'powershell -ExecutionPolicy ByPass -c "irm https://chatgpt.com/codex/install.ps1 | iex"'
+        : 'curl -fsSL https://chatgpt.com/codex/install.sh | sh';
+    case 'opencode':
+      return windows ? `npm install -g ${NPM_PKGS.opencode}` : 'curl -fsSL https://opencode.ai/install | bash';
+    default:
+      return NPM_PKGS[toolKey] ? `npm install -g ${NPM_PKGS[toolKey]}` : '';
+  }
+}
+
 /**
  * The command that INSTALLS a tool that is missing. Mirrors the update
  * matrix so a Homebrew user is not told to `npm install -g`, which would
  * create a second, conflicting install.
+ *
+ * With `platform`, a machine that shows no package manager of its own (and,
+ * for Claude Code, one that uses npm: Anthropic recommends its native
+ * installer over the npm package) is told the vendor's own installer for
+ * that system (vendorInstallCommand), and a Windows machine that uses Scoop,
+ * Chocolatey or WinGet is told the one each vendor publishes there.
  */
-export function buildInstallCommand(toolKey, installSource = 'unknown') {
+export function buildInstallCommand(toolKey, installSource = 'unknown', { platform = null } = {}) {
   const npmPkg = NPM_PKGS[toolKey];
+  if (platform && !isBrewSource(installSource)) {
+    const own = platformInstallCommand(toolKey, installSource, platform);
+    if (own) return own;
+  }
   if (isBrewSource(installSource)) {
     const token = BREW_FALLBACK_TOKENS[toolKey] || toolKey;
     // Use the package's OWN flavour, not the one inferred from sibling tools:
@@ -310,3 +429,20 @@ export function buildInstallCommand(toolKey, installSource = 'unknown') {
     default:      return `npm install -g ${npmPkg}`;
   }
 }
+
+/** buildInstallCommand's answer for one operating system, or null to use its package-manager table. */
+function platformInstallCommand(toolKey, installSource, platform) {
+  const windows = platform === 'win32';
+  const vendor = vendorInstallCommand(toolKey, platform);
+  if (toolKey === 'claude-code') {
+    if (windows && installSource === 'winget') return 'winget install Anthropic.ClaudeCode';
+    return vendor;
+  }
+  if (toolKey === 'opencode' && windows) {
+    if (installSource === 'scoop') return 'scoop install opencode';
+    if (installSource === 'choco') return 'choco install opencode';
+  }
+  // A JavaScript package manager this machine already uses: keep to it.
+  if (['npm', 'bun', 'pnpm', 'yarn', 'volta'].includes(installSource)) return null;
+  return vendor || null;
+}

package/neural-interface/lib/codex-account-auth.js

@@ -0,0 +1,180 @@
+// Codex account sign-in state and changes (docs/codex-sidepanel.md → Codex
+// accounts). Codex owns its ChatGPT login and its store; SynaBun owns only the
+// API key it keeps per account (lib/codex-accounts.js). This adapter asks
+// Codex what an account's own store holds (`account/read` from an app-server
+// started under that account), signs a credential out, saves a pasted key
+// after OpenAI accepts it, and changes an account's mode, each through
+// `changeCredentials` so the account's idle panel processes restart under the
+// new credential and busy ones refuse the change.
+import { spawn } from 'node:child_process';
+import { verifyOpenAiApiKey } from './claude-profile-api-key.js';
+import { validateProviderApiKey } from './provider-panel-api-key-auth.js';
+import { applyCodexLaunchEnv, codexLaunchArgs } from './codex-accounts.js';
+
+const fail = (message, status = 409, code = null) => Object.assign(new Error(message), { status, ...(code ? { code } : {}) });
+
+export function createCodexAccountAuth({
+  accounts,
+  codexBin = () => 'codex',
+  env = () => process.env,
+  spawnProcess = spawn,
+  prepareConfig = () => {},
+  statusTimeoutMs = 15_000,
+  verifyKey = verifyOpenAiApiKey,
+  changeCredentials = async (_id, change) => change(),
+} = {}) {
+  if (!accounts) throw new Error('createCodexAccountAuth requires accounts');
+  function account(id) {
+    if (typeof id !== 'string' || !/^[a-z0-9-]{1,64}$/.test(id)) throw fail('Unknown Codex account', 404);
+    const row = accounts.profileFor(id);
+    if (!row || row.id !== id) throw fail('Unknown Codex account', 404);
+    return row;
+  }
+  // Codex run under the account's own store: inherited credentials out, its
+  // CODEX_HOME in, never the key SynaBun holds (that is not Codex's store).
+  // The launch's overrides (the Windows sandbox of the Admin sandbox setting) follow the subcommand.
+  function launch(id, words) {
+    account(id);
+    const plan = accounts.launchFor(id);
+    if (!plan.ok) throw fail(plan.message, 404);
+    prepareConfig(plan.home);
+    let file = codexBin();
+    if (!file) throw fail('Codex CLI not found. Install Codex to sign in.', 503);
+    const args = [...words, ...codexLaunchArgs(plan)];
+    const script = /\.[cm]?js$/i.test(file);
+    const shell = process.platform === 'win32' && /\.(cmd|bat)$/i.test(file);
+    const proc = spawnProcess(script ? process.execPath : file, script ? [file, ...args] : args, {
+      env: { ...applyCodexLaunchEnv(env(), { unset: plan.unset, env: plan.env }), NO_COLOR: '1' },
+      stdio: ['pipe', 'pipe', 'pipe'], shell, windowsHide: true,
+    });
+    proc.stdin?.on('error', () => {});
+    return proc;
+  }
+  /** What Codex says the account's own store holds: { account: { type, email, planType } | null }. Never a credential. */
+  function nativeRead(id, method, params, { signal, timeoutMs = statusTimeoutMs } = {}) {
+    return new Promise((resolve, reject) => {
+      let proc;
+      try { proc = launch(id, ['app-server']); } catch (error) { reject(error); return; }
+      let buffer = '', settled = false, nextId = 1;
+      const waiting = new Map();
+      const finish = (error, result) => {
+        if (settled) return;
+        settled = true; clearTimeout(timer); signal?.removeEventListener('abort', abort);
+        try { proc.stdin.end(); } catch {}
+        try { proc.kill(); } catch {}
+        error ? reject(error) : resolve(result);
+      };
+      const abort = () => finish(new Error('Codex account read cancelled.'));
+      const timer = setTimeout(() => finish(new Error('Codex did not answer in time. Try Refresh.')), timeoutMs);
+      timer.unref?.();
+      signal?.addEventListener('abort', abort, { once: true });
+      if (signal?.aborted) { abort(); return; }
+      const call = (method, params) => new Promise((ok, no) => {
+        const callId = nextId++;
+        waiting.set(callId, { ok, no });
+        try { proc.stdin.write(`${JSON.stringify({ jsonrpc: '2.0', id: callId, method, params })}\n`); }
+        catch (error) { waiting.delete(callId); no(error); }
+      });
+      proc.stdout.setEncoding?.('utf8');
+      proc.stdout.on('data', (chunk) => {
+        buffer = (buffer + chunk).slice(-1_048_576);
+        let index;
+        while ((index = buffer.indexOf('\n')) >= 0) {
+          const line = buffer.slice(0, index).trim();
+          buffer = buffer.slice(index + 1);
+          if (!line) continue;
+          let msg;
+          try { msg = JSON.parse(line); } catch { continue; }
+          if (msg.id === undefined || msg.method) continue;
+          const entry = waiting.get(msg.id);
+          if (!entry) continue;
+          waiting.delete(msg.id);
+          if (msg.error) entry.no(new Error('Codex could not read the account.'));
+          else entry.ok(msg.result);
+        }
+      });
+      proc.stderr.on('data', () => {}); // Never forward CLI output: it can carry credential details.
+      proc.on('error', () => finish(new Error('Could not start Codex. Check its installation.')));
+      proc.on('close', () => finish(new Error('Codex closed before it answered.')));
+      (async () => {
+        try {
+          await call('initialize', { clientInfo: { name: 'synabun-codex-accounts', title: 'SynaBun Codex accounts', version: '0.0.1' } });
+          proc.stdin.write(`${JSON.stringify({ jsonrpc: '2.0', method: 'initialized' })}\n`);
+          finish(null, await call(method, params));
+        } catch (error) { finish(error); }
+      })();
+    });
+  }
+  async function nativeStatus(id) {
+    const result = await nativeRead(id, 'account/read', { refreshToken: false });
+    const native = result?.account && typeof result.account === 'object' ? result.account : null;
+    return { account: native ? { type: native.type || null, email: native.email || null, planType: native.planType || null } : null };
+  }
+  const rateLimits = (id, options) => nativeRead(id, 'account/rateLimits/read', {}, options);
+  // `codex logout` in the account's home: Codex removes its own login (auth.json or its keyring entry).
+  function nativeLogout(id) {
+    return new Promise((resolve, reject) => {
+      let proc, timer;
+      try { proc = launch(id, ['logout']); } catch { reject(fail('Could not sign out of Codex. Try again.', 500)); return; }
+      let settled = false;
+      const finish = (ok) => { if (settled) return; settled = true; clearTimeout(timer); ok ? resolve() : reject(fail('Could not sign out of Codex. Try again.', 500)); };
+      proc.stdout.on('data', () => {}); proc.stderr.on('data', () => {});
+      proc.on('error', () => finish(false));
+      proc.on('close', (code) => finish(code === 0));
+      timer = setTimeout(() => { try { proc.kill(); } catch {} finish(false); }, statusTimeoutMs);
+      timer.unref?.();
+    });
+  }
+  /** The account as every surface shows it, after asking Codex about its own store. */
+  async function read(id) {
+    account(id);
+    let failure = null;
+    try { await accounts.refreshStatus([id], { force: true }); } catch (error) { failure = error; }
+    account(id);
+    const row = accounts.describeForClient(id);
+    if (failure && !row) throw failure;
+    return { accountId: id, account: row };
+  }
+  const pending = new Set();
+  async function guarded(id, work) {
+    account(id);
+    if (pending.has(id)) throw fail('Another sign-in change for this account is still running.');
+    pending.add(id);
+    try { return await work(); } finally { pending.delete(id); }
+  }
+  async function signInApiKey(id, key) {
+    account(id); key = validateProviderApiKey('codex', key);
+    try {
+      return await guarded(id, async () => {
+        await verifyKey(key);
+        account(id); // A removed account is never recreated by a late answer.
+        await changeCredentials(id, () => { account(id); accounts.saveApiKey(id, key); });
+      });
+    } finally { key = null; }
+  }
+  // `credential`: 'apiKey' removes the account's key (SynaBun's file, or Codex's own stored key),
+  // 'subscription' runs Codex's own logout in the account's home, 'all' both.
+  async function signOut(id, credential = 'all') {
+    account(id);
+    if (!['all', 'apiKey', 'subscription'].includes(credential)) throw fail('Choose which sign-in to remove.', 400);
+    return guarded(id, () => changeCredentials(id, async () => {
+      const row = accounts.describe(id);
+      const ownKey = row?.apiKey?.source === 'synabun';
+      const codexKey = row?.apiKey?.source === 'codex';
+      if (credential === 'apiKey' && !row?.apiKey?.present && !row?.apiKey?.error) throw fail(`${row?.label || id} has no API key.`);
+      if (credential === 'subscription' && codexKey) throw fail(`${row.label} has no ChatGPT sign-in: Codex holds an API key for it.`);
+      if (credential !== 'subscription' && (ownKey || row?.apiKey?.error)) accounts.clearApiKey(id);
+      // Codex's own store is cleared for a ChatGPT sign-out, or for a key Codex itself holds.
+      if (credential === 'subscription' || (credential === 'all' && !ownKey) || (credential === 'apiKey' && codexKey)) {
+        await nativeLogout(id);
+        accounts.noteNativeStatus(id, { account: null });
+      }
+      return accounts.describeForClient(id);
+    }));
+  }
+  /** What the account's sessions use from now on: its idle panel processes restart under it. */
+  async function setMode(id, mode) {
+    return guarded(id, () => changeCredentials(id, () => accounts.setMode(id, mode)));
+  }
+  return { read, nativeStatus, rateLimits, signInApiKey, signOut, setMode };
+}