terminalhire 0.1.0

package/dist/bin/jpi.js

@@ -0,0 +1,106 @@
+#!/usr/bin/env node
+
+// bin/jpi.js
+import { readFileSync, writeFileSync, mkdirSync, existsSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+import { fileURLToPath } from "url";
+import { spawn } from "child_process";
+var TERMINALHIRE_DIR = join(homedir(), ".terminalhire");
+var INDEX_CACHE_FILE = join(TERMINALHIRE_DIR, "index-cache.json");
+var NUDGE_FILE = join(TERMINALHIRE_DIR, "nudged.json");
+var LEARNED_FILE = join(TERMINALHIRE_DIR, "learned-sessions.json");
+var INDEX_CACHE_TTL_MS = 15 * 60 * 1e3;
+var __dirname = fileURLToPath(new URL(".", import.meta.url));
+function readStdinSync() {
+  try {
+    const raw = readFileSync("/dev/stdin", "utf8").trim();
+    if (!raw) return {};
+    return JSON.parse(raw);
+  } catch {
+    return {};
+  }
+}
+function readNudged() {
+  try {
+    return JSON.parse(readFileSync(NUDGE_FILE, "utf8"));
+  } catch {
+    return {};
+  }
+}
+function readLearned() {
+  try {
+    return JSON.parse(readFileSync(LEARNED_FILE, "utf8"));
+  } catch {
+    return {};
+  }
+}
+function markLearned(sessionId) {
+  try {
+    mkdirSync(TERMINALHIRE_DIR, { recursive: true });
+    const learned = readLearned();
+    learned[sessionId] = Date.now();
+    const cutoff = Date.now() - 864e5;
+    for (const [k, v] of Object.entries(learned)) {
+      if (typeof v === "number" && v < cutoff) delete learned[k];
+    }
+    writeFileSync(LEARNED_FILE, JSON.stringify(learned), "utf8");
+  } catch {
+  }
+}
+function spawnLearnDetached(cwd) {
+  try {
+    const learnScript = join(__dirname, "jpi-learn.js");
+    const child = spawn(process.execPath, [learnScript, "--cwd", cwd], {
+      detached: true,
+      stdio: "ignore"
+    });
+    child.unref();
+  } catch {
+  }
+}
+function markNudged(sessionId) {
+  try {
+    mkdirSync(TERMINALHIRE_DIR, { recursive: true });
+    const nudged = readNudged();
+    nudged[sessionId] = Date.now();
+    const cutoff = Date.now() - 864e5;
+    for (const [k, v] of Object.entries(nudged)) {
+      if (typeof v === "number" && v < cutoff) delete nudged[k];
+    }
+    writeFileSync(NUDGE_FILE, JSON.stringify(nudged), "utf8");
+  } catch {
+  }
+}
+function getCachedMatchCount() {
+  try {
+    const raw = readFileSync(INDEX_CACHE_FILE, "utf8");
+    const entry = JSON.parse(raw);
+    if (Date.now() - entry.ts > INDEX_CACHE_TTL_MS) return null;
+    return typeof entry.matchCount === "number" ? entry.matchCount : null;
+  } catch {
+    return null;
+  }
+}
+try {
+  const input = readStdinSync();
+  const sessionId = input?.session_id;
+  if (!sessionId) process.exit(0);
+  const learned = readLearned();
+  if (!learned[sessionId]) {
+    const workDir = input?.workspace?.current_dir ?? process.cwd();
+    spawnLearnDetached(workDir);
+    markLearned(sessionId);
+  }
+  const nudged = readNudged();
+  if (nudged[sessionId]) process.exit(0);
+  const matchCount = getCachedMatchCount();
+  if (matchCount === null || matchCount === 0) process.exit(0);
+  const plural = matchCount === 1 ? "role" : "roles";
+  process.stdout.write(`\u2726 ${matchCount} ${plural} match your current work \u2014 run: terminalhire jobs
+`);
+  markNudged(sessionId);
+  process.exit(0);
+} catch {
+  process.exit(0);
+}

package/dist/src/github-auth.js

@@ -0,0 +1,206 @@
+// src/github-auth.ts
+import {
+  createCipheriv,
+  createDecipheriv,
+  randomBytes
+} from "crypto";
+import {
+  readFileSync,
+  writeFileSync,
+  mkdirSync,
+  existsSync,
+  rmSync
+} from "fs";
+import { join } from "path";
+import { homedir } from "os";
+var TERMINALHIRE_DIR = join(homedir(), ".terminalhire");
+var TOKEN_FILE = join(TERMINALHIRE_DIR, "github-token.enc");
+var KEY_FILE = join(TERMINALHIRE_DIR, "key");
+var ALGO = "aes-256-gcm";
+var KEY_BYTES = 32;
+var IV_BYTES = 12;
+var GITHUB_SCOPE = "read:user";
+var DEVICE_CODE_URL = "https://github.com/login/device/code";
+var ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
+var DEV_PLACEHOLDER_CLIENT_ID = "Ov23lignE2ZSBe0J3a6B";
+async function loadKey() {
+  try {
+    const kt = await import("keytar");
+    const stored = await kt.getPassword("terminalhire", "profile-key");
+    if (stored) return Buffer.from(stored, "hex");
+    const key2 = randomBytes(KEY_BYTES);
+    await kt.setPassword("terminalhire", "profile-key", key2.toString("hex"));
+    return key2;
+  } catch {
+  }
+  mkdirSync(TERMINALHIRE_DIR, { recursive: true });
+  if (existsSync(KEY_FILE)) {
+    return Buffer.from(readFileSync(KEY_FILE, "utf8").trim(), "hex");
+  }
+  const key = randomBytes(KEY_BYTES);
+  writeFileSync(KEY_FILE, key.toString("hex"), { mode: 384, encoding: "utf8" });
+  return key;
+}
+function encrypt(plaintext, key) {
+  const iv = randomBytes(IV_BYTES);
+  const cipher = createCipheriv(ALGO, key, iv);
+  const ct = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return { iv: iv.toString("hex"), tag: tag.toString("hex"), ciphertext: ct.toString("hex") };
+}
+function decrypt(blob, key) {
+  const decipher = createDecipheriv(ALGO, key, Buffer.from(blob.iv, "hex"));
+  decipher.setAuthTag(Buffer.from(blob.tag, "hex"));
+  const plain = Buffer.concat([
+    decipher.update(Buffer.from(blob.ciphertext, "hex")),
+    decipher.final()
+  ]);
+  return plain.toString("utf8");
+}
+async function readGitHubToken() {
+  if (!existsSync(TOKEN_FILE)) return void 0;
+  try {
+    const key = await loadKey();
+    const raw = readFileSync(TOKEN_FILE, "utf8");
+    const blob = JSON.parse(raw);
+    return decrypt(blob, key);
+  } catch {
+    return void 0;
+  }
+}
+async function writeGitHubToken(token) {
+  mkdirSync(TERMINALHIRE_DIR, { recursive: true });
+  const key = await loadKey();
+  const blob = encrypt(token, key);
+  writeFileSync(TOKEN_FILE, JSON.stringify(blob, null, 2), { encoding: "utf8" });
+}
+async function deleteGitHubToken() {
+  try {
+    rmSync(TOKEN_FILE);
+  } catch {
+  }
+}
+async function hasGitHubToken() {
+  return existsSync(TOKEN_FILE);
+}
+var MOCK_TOKEN = "mock-github-token-jpi-dev";
+var MOCK_LOGIN = "janedev";
+async function runDeviceFlow() {
+  if (process.env["TERMINALHIRE_GITHUB_MOCK"] === "1" || process.env["TERMINALHIRE_GITHUB_MOCK"] === "1" || process.env["JPI_GITHUB_MOCK"] === "1") {
+    console.log("\n[mock] GitHub OAuth skipped (JPI_GITHUB_MOCK=1)");
+    console.log(`[mock] Using fixture profile: ${MOCK_LOGIN}`);
+    await writeGitHubToken(MOCK_TOKEN);
+    return MOCK_LOGIN;
+  }
+  const clientId = process.env["GITHUB_DEVICE_CLIENT_ID"] ?? process.env["GITHUB_CLIENT_ID"] ?? DEV_PLACEHOLDER_CLIENT_ID;
+  if (clientId === "Iv1.PLACEHOLDER_REGISTER_YOUR_APP") {
+    console.warn("\nWarning: GITHUB_CLIENT_ID env var looks like a placeholder.");
+    console.warn("Remove it to use the baked-in client ID, or set it to your own OAuth App Client ID.\n");
+  }
+  const deviceRes = await fetch(DEVICE_CODE_URL, {
+    method: "POST",
+    headers: {
+      Accept: "application/json",
+      "Content-Type": "application/x-www-form-urlencoded"
+    },
+    body: new URLSearchParams({ client_id: clientId, scope: GITHUB_SCOPE }).toString(),
+    signal: AbortSignal.timeout(15e3)
+  });
+  if (!deviceRes.ok) {
+    throw new Error(`GitHub device code request failed: HTTP ${deviceRes.status}`);
+  }
+  const deviceData = await deviceRes.json();
+  console.log("");
+  console.log("  GitHub sign-in (device flow)");
+  console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  console.log(`  1. Open: ${deviceData.verification_uri}`);
+  console.log(`  2. Enter code: ${deviceData.user_code}`);
+  console.log('  3. Authorize "jpi" (scope: read:user \u2014 public data only)');
+  console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  console.log("  Waiting for authorization...");
+  console.log("");
+  let intervalSecs = deviceData.interval ?? 5;
+  const expiresAt = Date.now() + (deviceData.expires_in ?? 900) * 1e3;
+  const clientSecret = process.env["GITHUB_CLIENT_SECRET"];
+  while (Date.now() < expiresAt) {
+    await sleep(intervalSecs * 1e3);
+    const body = new URLSearchParams({
+      client_id: clientId,
+      device_code: deviceData.device_code,
+      grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+    });
+    if (clientSecret) body.set("client_secret", clientSecret);
+    const tokenRes = await fetch(ACCESS_TOKEN_URL, {
+      method: "POST",
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/x-www-form-urlencoded"
+      },
+      body: body.toString(),
+      signal: AbortSignal.timeout(15e3)
+    });
+    if (!tokenRes.ok) {
+      throw new Error(`GitHub token poll failed: HTTP ${tokenRes.status}`);
+    }
+    const tokenData = await tokenRes.json();
+    if (tokenData.access_token) {
+      await writeGitHubToken(tokenData.access_token);
+      const login = await fetchAuthedLogin(tokenData.access_token);
+      console.log(`  Authorized as: ${login}`);
+      return login;
+    }
+    if (tokenData.error === "authorization_pending") {
+      continue;
+    }
+    if (tokenData.error === "slow_down") {
+      intervalSecs = (tokenData.interval ?? intervalSecs) + 5;
+      continue;
+    }
+    if (tokenData.error === "expired_token") {
+      throw new Error("GitHub device code expired. Please run `terminalhire login` again.");
+    }
+    if (tokenData.error === "access_denied") {
+      throw new Error("GitHub authorization was denied by the user.");
+    }
+    throw new Error(
+      `GitHub device flow error: ${tokenData.error ?? "unknown"} \u2014 ${tokenData.error_description ?? ""}`
+    );
+  }
+  throw new Error("GitHub device code expired before authorization. Please run `terminalhire login` again.");
+}
+async function fetchAuthedLogin(token) {
+  if (token === MOCK_TOKEN) return MOCK_LOGIN;
+  const res = await fetch("https://api.github.com/user", {
+    headers: {
+      Authorization: `Bearer ${token}`,
+      Accept: "application/vnd.github+json",
+      "X-GitHub-Api-Version": "2022-11-28"
+    },
+    signal: AbortSignal.timeout(1e4)
+  });
+  if (!res.ok) throw new Error(`GitHub /user: HTTP ${res.status}`);
+  const data = await res.json();
+  return data.login;
+}
+async function resolveStoredLogin() {
+  if (process.env["TERMINALHIRE_GITHUB_MOCK"] === "1" || process.env["TERMINALHIRE_GITHUB_MOCK"] === "1" || process.env["JPI_GITHUB_MOCK"] === "1") return MOCK_LOGIN;
+  const token = await readGitHubToken();
+  if (!token) return void 0;
+  try {
+    return await fetchAuthedLogin(token);
+  } catch {
+    return void 0;
+  }
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+export {
+  GITHUB_SCOPE,
+  deleteGitHubToken,
+  hasGitHubToken,
+  readGitHubToken,
+  resolveStoredLogin,
+  runDeviceFlow,
+  writeGitHubToken
+};