syndai 0.1.1 → 0.4.0

package/src/connect.js

@@ -1,122 +0,0 @@
-// Orchestrates `syndai connect <code>`: claim the pairing, confirm the workspace
-// + phrase, wait for the owner's Approve click, mint/capture whatever plans are
-// present locally, and upload them in exactly ONE call. No token is ever printed.
-
-import os from "node:os";
-import { post, ok, errorMessage } from "./api.js";
-import { confirm } from "./prompt.js";
-import { connectClaude } from "./claude.js";
-import { connectCodex } from "./codex.js";
-
-const BASE = "/api/v1/coding/auth/pairings";
-const POLL_INTERVAL_MS = 3000;
-const POLL_TIMEOUT_MS = 5 * 60 * 1000; // 5 min — the owner has to click Approve.
-
-const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-
-// The code-authed routes: possession of the code is the credential (spec §4.1).
-// Poll re-uses /claim — the only code-authed status read the CLI can make; it
-// returns the current pairing state each time.
-// ponytail: if the backend adds a dedicated code-authed poll route, swap the path
-// in pollState — the shape ({code, hostname} -> {state, ...}) is unchanged.
-function claim(code) {
-  return post(`${BASE}/claim`, { code, hostname: os.hostname() });
-}
-
-async function pollForApproval(code, deps) {
-  const log = deps.log || console.log;
-  const started = deps.now ? deps.now() : Date.now();
-  log('Waiting for the workspace owner to click "Approve"…');
-  for (;;) {
-    const { status, body } = await claim(code);
-    if (!ok(status)) return { ok: false, message: errorMessage(body) };
-    const state = body && body.state;
-    if (state === "approved" || state === "uploaded" || state === "verified") {
-      return { ok: true };
-    }
-    if (state === "failed") return { ok: false, message: "the pairing was rejected or expired" };
-    const elapsed = (deps.now ? deps.now() : Date.now()) - started;
-    if (elapsed >= POLL_TIMEOUT_MS) {
-      return { ok: false, message: "timed out waiting for approval (15-min code TTL — mint a new one)" };
-    }
-    await sleep(deps.pollIntervalMs ?? POLL_INTERVAL_MS);
-  }
-}
-
-/**
- * Run the full connect flow. `deps` lets tests inject the network/prompt seams;
- * defaults use the real ones. Returns a process exit code.
- */
-export async function runConnect(code, deps = {}) {
-  const log = deps.log || console.log;
-  const err = deps.error || console.error;
-  const askConfirm = deps.confirm || confirm;
-
-  if (!code || typeof code !== "string") {
-    err("usage: syndai connect <code>");
-    return 2;
-  }
-
-  // 1. Claim — learn the destination workspace + phrase before anything is minted.
-  const claimed = await (deps.claim ? deps.claim(code) : claim(code));
-  if (!ok(claimed.status)) {
-    err(`connect: ${errorMessage(claimed.body)}`);
-    return 1;
-  }
-  const info = claimed.body || {};
-  const name = info.workspace_name || "your workspace";
-  const email = info.owner_email_masked || "the owner";
-  const phrase = info.phrase || "(no phrase)";
-
-  // 2. Two-sided confirm (default No, no --yes flag).
-  const yes = await askConfirm(
-    `Connect to workspace "${name}" (${email})? Phrase: ${phrase} [y/N] `,
-  );
-  if (!yes) {
-    log("Aborted. Nothing was sent.");
-    return 1;
-  }
-
-  // 3. Wait for the owner's Approve click.
-  const approval = deps.pollForApproval
-    ? await deps.pollForApproval(code, deps)
-    : await pollForApproval(code, deps);
-  if (!approval.ok) {
-    err(`connect: ${approval.message}`);
-    return 1;
-  }
-
-  // 4. Collect whatever plans are present on this machine.
-  const claudeToken = deps.connectClaude ? await deps.connectClaude(deps) : await connectClaude(deps);
-  const codexAuthJson = deps.connectCodex ? deps.connectCodex(deps) : connectCodex(deps);
-
-  if (!claudeToken && !codexAuthJson) {
-    err("connect: no Claude or ChatGPT plan could be connected. Nothing uploaded.");
-    return 1;
-  }
-
-  // 5. Exactly one upload, carrying whatever was collected.
-  const payload = { code };
-  if (claudeToken) payload.claude_oauth_token = claudeToken;
-  if (codexAuthJson) payload.codex_auth_json = codexAuthJson;
-
-  const uploaded = deps.upload ? await deps.upload(payload) : await post(`${BASE}/upload`, payload);
-  if (!ok(uploaded.status)) {
-    err(`connect: upload failed — ${errorMessage(uploaded.body)}`);
-    return 1;
-  }
-
-  // Report the SERVER's outcome, not what we sent: a token can be uploaded but fail server-side
-  // verification (a dead ChatGPT plan), and only the server knows which providers actually landed.
-  const body = uploaded.body || {};
-  const labels = { claude_max: "Claude plan", chatgpt: "ChatGPT plan" };
-  const connected = Array.isArray(body.connected) ? body.connected : [];
-  const failed = Array.isArray(body.failed) ? body.failed : [];
-  for (const p of connected) log(`Connected ✓ · ${labels[p] || p}`);
-  for (const p of failed) err(`Not connected · ${labels[p] || p} — the token could not be verified`);
-  if (connected.length === 0) {
-    err("connect: nothing was connected.");
-    return 1;
-  }
-  return 0;
-}

package/src/proc.js

@@ -1,36 +0,0 @@
-// Small process helpers shared by the Claude and Codex flows. Node builtins only.
-
-import fs from "node:fs";
-import path from "node:path";
-
-/**
- * Is `name` an executable on PATH? A dependency-free `which`: scan PATH dirs for
- * an executable file. Windows PATHEXT is honored for the .exe/.cmd case.
- */
-export function onPath(name) {
-  const parts = (process.env.PATH || "").split(path.delimiter).filter(Boolean);
-  const exts = process.platform === "win32" ? (process.env.PATHEXT || ".EXE;.CMD;.BAT").split(";") : [""];
-  for (const dir of parts) {
-    for (const ext of exts) {
-      const candidate = path.join(dir, name + ext.toLowerCase());
-      const candidateUpper = path.join(dir, name + ext);
-      for (const c of new Set([candidate, candidateUpper])) {
-        try {
-          fs.accessSync(c, fs.constants.X_OK);
-          return true;
-        } catch {
-          /* keep scanning */
-        }
-      }
-    }
-  }
-  return false;
-}
-
-/**
- * True on the BSD family (macOS included), where script(1) takes
- * `script -q <file> <cmd...>`; util-linux takes `script -qec "<cmd>" <file>`.
- */
-export function isBsdScript() {
-  return ["darwin", "freebsd", "openbsd", "netbsd"].includes(process.platform);
-}

package/src/prompt.js

@@ -1,43 +0,0 @@
-// Terminal prompts: a default-No confirm and a no-echo paste. Both read one line
-// from the TTY using node:readline. The paste path disables terminal echo with
-// stty(1) so the token never reaches the scrollback — and never the clipboard,
-// because it is typed/pasted straight into the process, not through a copy.
-
-import readline from "node:readline";
-import { spawnSync } from "node:child_process";
-
-/** Ask a yes/no question; returns true ONLY for y/Y. Default (empty, EOF) is No. */
-export function confirm(question) {
-  return new Promise((resolve) => {
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-    rl.question(question, (answer) => {
-      rl.close();
-      resolve(/^y(es)?$/i.test(String(answer).trim()));
-    });
-  });
-}
-
-function setEcho(on) {
-  // Best effort; on a non-TTY (or Windows without stty) this is a no-op and the
-  // paste simply echoes, which is still correct — just not hidden.
-  try {
-    spawnSync("stty", [on ? "echo" : "-echo"], { stdio: "inherit" });
-  } catch {
-    /* ignore */
-  }
-}
-
-/** Read one line WITHOUT echoing it. Used for the Claude token paste fallback. */
-export function readHidden(promptText) {
-  return new Promise((resolve) => {
-    process.stdout.write(promptText);
-    setEcho(false);
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout, terminal: false });
-    rl.question("", (answer) => {
-      rl.close();
-      setEcho(true);
-      process.stdout.write("\n");
-      resolve(String(answer));
-    });
-  });
-}

package/src/tokens.js

@@ -1,45 +0,0 @@
-// Pure, dependency-free string helpers for the connect flow. Kept apart from the
-// network/PTY code (api.js, claude.js, codex.js) so the parsing logic that turns
-// terminal output and pasted values into credentials is unit-testable without a
-// subprocess or a socket. Node builtins only; no state, no side effects.
-
-// Matches the escape sequences `claude setup-token` draws its full-screen UI with:
-// CSI (`ESC [ … final`), the two-char sequences (`ESC =`, `ESC >`), and OSC strings
-// (`ESC ] … BEL` or `ESC ] … ST`). Broad on purpose — the token we extract afterward
-// is validated by its own strict prefix regex, so over-stripping here is harmless.
-const ANSI = new RegExp(
-  [
-    "[\\u001B\\u009B][[\\]()#;?]*(?:(?:(?:[a-zA-Z0-9]*;)*[a-zA-Z0-9]*)?\\u0007)", // OSC … BEL
-    "(?:[\\u001B\\u009B][[\\]()#;?]*(?:(?:\\d{1,4}(?:;\\d{0,4})*)?[0-9A-ORZcf-nqry=><~]))", // CSI/private
-    "[\\u001B\\u009B][=>]", // keypad mode toggles
-  ].join("|"),
-  "g",
-);
-
-/** Strip ANSI/VT escape codes from terminal output. */
-export function stripAnsi(text) {
-  return String(text).replace(ANSI, "");
-}
-
-// A Claude plan OAuth token minted by `claude setup-token`. Prefix `sk-ant-oat`
-// then the version + payload; the char class is exactly the plan's spec.
-const OAT = /sk-ant-oat[0-9a-zA-Z_-]+/;
-
-/**
- * Pull the first `sk-ant-oat…` token out of (already ANSI-stripped) text.
- * Returns the token string, or null when none is present.
- */
-export function extractOatToken(text) {
-  const match = OAT.exec(stripAnsi(text));
-  return match ? match[0] : null;
-}
-
-/**
- * Remove ALL internal whitespace from a single pasted token. Terminals wrap the
- * 108-char Claude token across lines, so a copy carries a newline (often plus a
- * leading space); the provider then reports only "Invalid auth token". Callers
- * paste one token, so collapsing every space/newline/tab is always safe here.
- */
-export function stripInternalWhitespace(value) {
-  return String(value).replace(/\s+/g, "");
-}