vibeostheog 0.19.4 → 0.19.6

package/CHANGELOG.md

@@ -1,3 +1,8 @@
+## 0.19.6
+- feat: add OpenCode-style setup installer
+- docs: align install flow with OpenCode npm plugin pattern
+
+
 ## 0.19.4
 - feat: register trinity in OpenCode keymap
 - docs: clarify install and trinity usage

package/README.md

@@ -18,29 +18,25 @@ It also adds guardrails: delegation enforcement, flow and TDD controls, pattern
 
 ### OpenCode plugin
 
-1. Install the package:
+1. Register the plugin with the bundled setup command:
 
 ```bash
-npm install vibeostheog
+npx vibeostheog setup --project
 ```
 
-2. Let OpenCode load the built plugin from its plugin directory.
-   The package deploys `src/index.js` to `~/.config/opencode/plugins/vibeOS.js`
-   and can auto-register `./plugins/vibeOS.js` in `~/.config/opencode/opencode.json`.
+Use `npx vibeostheog setup` for a global OpenCode install under `~/.config/opencode/`.
 
-3. If you want to configure it manually, use:
+2. The setup command writes the package name into your OpenCode config. OpenCode installs npm plugins automatically at startup:
 
 ```json
 {
   "plugin": [
-    "./plugins/vibeOS.js"
+    "vibeostheog"
   ]
 }
 ```
 
-### Local plugin file
-
-If you keep a local checkout of the plugin, point OpenCode at the built file instead:
+3. If you keep a local checkout of the plugin, point OpenCode at the built file instead:
 
 ```json
 {
@@ -64,7 +60,7 @@ npm test
 npm run release:patch
 ```
 
-`npm run build` compiles `src/index.ts` to `src/index.js` and deploys the built plugin into the OpenCode plugin directory. `npm run typecheck` validates the TypeScript sources without emitting files.
+`npm run build` compiles `src/index.ts` to `src/index.js` for the local checkout. `npm run typecheck` validates the TypeScript sources without emitting files.
 
 ## Core Controls
 

package/bin/setup.js

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { homedir } from "node:os";
+
+const pkgName = "vibeostheog";
+const args = process.argv.slice(2);
+const command = args[0] ?? "setup";
+const isProject = args.includes("--project");
+
+if (command !== "setup") {
+  console.error(`Usage: ${pkgName} setup [--project]`);
+  process.exit(1);
+}
+
+const configPath = isProject
+  ? resolve(process.cwd(), "opencode.json")
+  : resolve(homedir(), ".config", "opencode", "opencode.json");
+
+let config = {};
+try {
+  config = JSON.parse(await readFile(configPath, "utf8"));
+} catch {
+  config = {};
+}
+
+if (!config || typeof config !== "object" || Array.isArray(config)) {
+  config = {};
+}
+
+if (!config.$schema) {
+  config.$schema = "https://opencode.ai/config.json";
+}
+
+if (!Array.isArray(config.plugin)) {
+  config.plugin = [];
+}
+
+if (!config.plugin.includes(pkgName)) {
+  config.plugin.push(pkgName);
+}
+
+await mkdir(dirname(configPath), { recursive: true });
+await writeFile(configPath, `${JSON.stringify(config, null, 2)}\n`);
+
+console.log(`${pkgName} registered in ${configPath}`);
+console.log("Restart OpenCode to activate the plugin.");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibeostheog",
-  "version": "0.19.4",
+  "version": "0.19.6",
   "description": "Cost-aware delegation enforcer for OpenCode. Tracks model usage, routes Task subagents to cheaper tiers, surfaces cumulative savings in chat. Includes research audit, reporting framework, project memory, progressive scratchpad decadence, and trinity CLI for brain/medium/cheap slot switching.",
   "scripts": {
     "release": "node scripts/release.mjs",
@@ -21,10 +21,13 @@
     "codex:hook:summary": "bash plugins/vibetheog-codex/hooks/post-command-summary.sh",
     "precommit": "node scripts/pre-commit.mjs",
     "audit-state": "node scripts/audit-state.mjs",
-    "migrate-ledger": "node scripts/migrate-ledger.mjs",
-    "postinstall": "node scripts/deploy.mjs"
+    "migrate-ledger": "node scripts/migrate-ledger.mjs"
   },
   "type": "module",
+  "main": "./src/index.js",
+  "bin": {
+    "vibeostheog": "./bin/setup.js"
+  },
   "exports": {
     ".": "./src/index.js",
     "./server": "./src/lib/vibeos-mcp-server.js",
@@ -47,8 +50,9 @@
     "@opencode-ai/plugin": "^1.15.7"
   },
   "files": [
-    "src/index.js",
-    "src/lib/vibeos-mcp-server.js",
+    "src/**/*.js",
+    "src/**/*.json",
+    "bin/setup.js",
     ".opencode/plugins/vibeOS-tui.tsx",
     "scripts/deploy.mjs",
     "model-tiers.sample.json",

package/src/flow-enforcer.js

@@ -0,0 +1 @@
+export { checkFlowRules, getFlowWarns, getSessionFlowCounts, recordFlowTodo, resetForTest, } from "./vibeOS-lib/flow-enforcer.js";

package/src/flow-rules.json

@@ -0,0 +1,39 @@
+{
+  "rules": [
+    {
+      "id": "new-md-file",
+      "severity": "warn",
+      "trigger": "Write",
+      "pattern": "\\.md$",
+      "description": "New markdown file created without explicit user request"
+    },
+    {
+      "id": "new-file-outside-src",
+      "severity": "hint",
+      "trigger": "Write",
+      "pattern": "^(?!src/|\\.)",
+      "description": "New file created outside src/ or hidden file — verify intent"
+    },
+    {
+      "id": "compat-shim",
+      "severity": "warn",
+      "trigger": "Edit",
+      "pattern": "_old|_legacy|# removed",
+      "description": "Backwards-compat shim pattern detected"
+    },
+    {
+      "id": "todo-comment",
+      "severity": "hint",
+      "trigger": "Edit",
+      "pattern": "TODO|FIXME|HACK",
+      "description": "TODO/FIXME left in output"
+    },
+    {
+      "id": "detect-secrets",
+      "severity": "flag",
+      "trigger": "Edit",
+      "pattern": "(?<![a-zA-Z0-9])(sk-[a-zA-Z0-9_-]{10,}|gh[pousr]_[a-zA-Z0-9]{15,}|github_pat_[a-zA-Z0-9_]{15,}|xox[bpras]-[a-zA-Z0-9-]{10,}|-----BEGIN (?:RSA|EC|OPENSSH|ENCRYPTED) PRIVATE KEY-----)",
+      "description": "Potential secret/API key detected in content"
+    }
+  ]
+}

package/src/lib/api-client.js

@@ -0,0 +1,415 @@
+// @ts-nocheck
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
+import { dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { homedir } from "node:os";
+import { markApiConnected, markApiDisconnected, resetApiConnection } from "./runtime-state.js";
+const DEFAULT_API_URL = "https://api.vibetheog.com";
+const REQUEST_TIMEOUT = 10000;
+const MAX_RETRIES = 3;
+const BASE_RETRY_DELAY = 1000;
+export class VibeOSAuthError extends Error {
+    statusCode;
+    code;
+    constructor(message, statusCode, code) {
+        super(message);
+        this.name = "VibeOSAuthError";
+        this.statusCode = statusCode;
+        this.code = code;
+    }
+}
+export class VibeOSTimeoutError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "VibeOSTimeoutError";
+    }
+}
+export class VibeOSNetworkError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "VibeOSNetworkError";
+    }
+}
+export class VibeOSApiClient {
+    baseUrl;
+    apiToken;
+    masterKey;
+    timeout;
+    fallbackMode;
+    fallbackStubs;
+    constructor(options = {}) {
+        this.baseUrl = options.baseUrl || process.env.VIBEOS_API_URL || DEFAULT_API_URL;
+        this.apiToken = options.apiToken || process.env.VIBEOS_API_TOKEN || null;
+        this.masterKey = options.masterKey || process.env.VIBEOS_API_MASTER_KEY || null;
+        this.timeout = options.timeout || REQUEST_TIMEOUT;
+        this.fallbackMode = false;
+        this.fallbackStubs = options.fallbackStubs || null;
+    }
+    async request(path, body = null, isAdmin = false) {
+        if (!this.apiToken && !isAdmin) {
+            throw new Error("VIBEOS_API_TOKEN is not set");
+        }
+        const url = this.baseUrl + path;
+        const headers = {
+            "Content-Type": "application/json",
+            Authorization: "Bearer " + (isAdmin ? this.masterKey : this.apiToken),
+        };
+        let lastError = null;
+        let attempt = 0;
+        while (attempt <= MAX_RETRIES) {
+            if (attempt > 0) {
+                const delay = BASE_RETRY_DELAY * Math.pow(2, attempt - 1);
+                await new Promise(r => setTimeout(r, delay));
+            }
+            attempt++;
+            try {
+                const controller = new AbortController();
+                const timeoutId = setTimeout(() => controller.abort(), this.timeout);
+                const res = await fetch(url, {
+                    method: body ? "POST" : "GET",
+                    headers,
+                    body: body ? JSON.stringify(body) : null,
+                    signal: controller.signal,
+                });
+                clearTimeout(timeoutId);
+                if (res.status === 401 || res.status === 403) {
+                    const errorBody = await res.json().catch(() => ({}));
+                    this.fallbackMode = true;
+                    throw new VibeOSAuthError(errorBody.message || "Authentication failed", res.status, errorBody.code);
+                }
+                if (!res.ok) {
+                    const errorBody = await res.json().catch(() => ({}));
+                    if (res.status >= 500 && attempt <= MAX_RETRIES) {
+                        lastError = new Error("API error " + res.status + ": " + (errorBody.error || res.statusText));
+                        continue;
+                    }
+                    throw new Error("API error " + res.status + ": " + (errorBody.error || res.statusText));
+                }
+                this.fallbackMode = false;
+                return res.json();
+            }
+            catch (err) {
+                if (err instanceof VibeOSAuthError)
+                    throw err;
+                const error = err;
+                if (error.name === "AbortError") {
+                    if (attempt <= MAX_RETRIES) {
+                        lastError = new VibeOSTimeoutError("Request to " + url + " timed out after " + this.timeout + "ms");
+                        continue;
+                    }
+                    this.fallbackMode = true;
+                    throw new VibeOSTimeoutError("Request to " + url + " timed out after " + this.timeout + "ms");
+                }
+                lastError = err;
+                if (attempt <= MAX_RETRIES && error.message && (error.message.includes("fetch") || error.message.includes("network") || error.message.includes("ECONNREFUSED"))) {
+                    continue;
+                }
+            }
+        }
+        this.fallbackMode = true;
+        throw new VibeOSNetworkError("Failed to reach API after " + MAX_RETRIES + " retries: " + (lastError ? lastError.message : "unknown error"));
+    }
+    async delegateCheck(tool, tier, model, prompt, dynamicCache = {}) {
+        return this.request("/api/v1/delegate/check", { tool, tier, model, prompt, dynamic_cache: dynamicCache });
+    }
+    async delegateSoftQuota(tool, currentCount, limit = 5) {
+        return this.request("/api/v1/delegate/soft-quota", { tool, current_count: currentCount, limit });
+    }
+    async delegateCost(model, dynamicCache = {}) {
+        return this.request("/api/v1/delegation/cost", { model, dynamic_cache: dynamicCache });
+    }
+    async routeModel(prompt, currentTier, trinityCheap, trinityMedium, learnedExploratory = [], stressScore = 0) {
+        return this.request("/api/v1/route/model", {
+            prompt,
+            current_tier: currentTier,
+            trinity_cheap: trinityCheap,
+            trinity_medium: trinityMedium,
+            learned_exploratory: learnedExploratory,
+            stress_score: stressScore,
+        });
+    }
+    async classifyTier(model, customRegex = null) {
+        return this.request("/api/v1/tier/classify", { model, custom_regex: customRegex });
+    }
+    async isExploratory(prompt, learnedExploratory = []) {
+        return this.request("/api/v1/tier/exploratory", { prompt, learned_exploratory: learnedExploratory });
+    }
+    async scoreStress(text) {
+        return this.request("/api/v1/stress/score", { text });
+    }
+    async stressLevel(score) {
+        return this.request("/api/v1/stress/level", { score });
+    }
+    async blackboxAnalyze(sessionId, entry) {
+        return this.request("/api/v1/blackbox/analyze", {
+            session_id: sessionId,
+            project_id: entry.project_id || null,
+            user_text: entry.userText || "",
+            features: entry.features || {},
+            action: entry.action || "explore",
+            entropy: entry.entropy ?? 1.0,
+            uncertainty: entry.uncertainty ?? 50,
+            embedding: entry.embedding || null,
+        });
+    }
+    async blackboxState(sessionId) {
+        return this.request("/api/v1/blackbox/state", { session_id: sessionId });
+    }
+    async blackboxReset(sessionId) {
+        return this.request("/api/v1/blackbox/reset", { session_id: sessionId });
+    }
+    async blackboxOutcome(sessionId, outcome) {
+        return this.request("/api/v1/blackbox/outcome", { session_id: sessionId, outcome });
+    }
+    async blackboxCalibrate(projectId) {
+        return this.request("/api/v1/blackbox/calibrate", { project_id: projectId || "global" });
+    }
+    async blackboxCalibration(projectId) {
+        return this.request("/api/v1/blackbox/calibration?project_id=" + (projectId || "global"), null);
+    }
+    async blackboxControlVector(state, action, optimizationMode) {
+        return this.request("/api/v1/blackbox/control-vector", { ...state, action, optimization_mode: optimizationMode });
+    }
+    async blackboxSelectMode(subRegime, stressMultiplier) {
+        return this.request("/api/v1/blackbox/select-mode", { sub_regime: subRegime, stress_multiplier: stressMultiplier });
+    }
+    async tddExports(sourceContent, ext) {
+        return this.request("/api/v1/tdd/exports", { source_content: sourceContent, ext });
+    }
+    async tddParams(sourceContent, funcName) {
+        return this.request("/api/v1/tdd/params", { source_content: sourceContent, func_name: funcName });
+    }
+    async tddInferType(paramName, defaultValue) {
+        return this.request("/api/v1/tdd/infer-type", { param_name: paramName, default_value: defaultValue });
+    }
+    async tddSkeleton(language, fileName, exports, options = {}) {
+        return this.request("/api/v1/tdd/skeleton", { language, file_name: fileName, exports, options });
+    }
+    async patternsObserve(sessionId, toolName, input, output, directory) {
+        return this.request("/api/v1/patterns/observe", {
+            session_id: sessionId,
+            tool_name: toolName,
+            input,
+            output,
+            directory,
+        });
+    }
+    async patternsRecord(sessionId, kind, key, summary, meta = {}) {
+        return this.request("/api/v1/patterns/record", {
+            session_id: sessionId,
+            kind,
+            key,
+            summary,
+            meta,
+        });
+    }
+    async patternsQuery(sessionId, kind = null) {
+        return this.request("/api/v1/patterns/query?kind=" + (kind || ""), null);
+    }
+    async patternsExploratoryWords(sessionId) {
+        return this.request("/api/v1/patterns/exploratory-words", null);
+    }
+    async patternsClear(sessionId) {
+        return this.request("/api/v1/patterns/clear", { session_id: sessionId });
+    }
+    async pricingFetch(openrouterKey, force = false) {
+        return this.request("/api/v1/pricing/fetch", { openrouter_key: openrouterKey, force });
+    }
+    async pricingLookup(model) {
+        return this.request("/api/v1/pricing/lookup", { model });
+    }
+    async pricingStatic() {
+        return this.request("/api/v1/pricing/static", null);
+    }
+    async compressContext(text, threshold = 2000) {
+        return this.request("/api/v1/compress/context", { text, threshold });
+    }
+    async adminCreateSeat(name, email) {
+        return this.request("/admin/seats", { name, email }, true);
+    }
+    async adminCreateSeatWithToken(name, email, tokenLabel = null) {
+        return this.request("/admin/seats", { name, email, with_token: tokenLabel || true }, true);
+    }
+    async adminListSeats() {
+        return this.request("/admin/seats", null, true);
+    }
+    async adminUpdateSeat(seatId, status) {
+        return this.request("/admin/seats/" + seatId, { status }, true);
+    }
+    async adminCreateToken(seatId, label, expiresAt) {
+        return this.request("/admin/tokens", { seat_id: seatId, label, expires_at: expiresAt }, true);
+    }
+    async adminListTokens() {
+        return this.request("/admin/tokens", null, true);
+    }
+    async adminUpdateToken(tokenId, status) {
+        return this.request("/admin/tokens/" + tokenId, { status }, true);
+    }
+    async adminDeleteToken(tokenId) {
+        return this.request("/admin/tokens/" + tokenId, null, true);
+    }
+    async adminUsage(days = 30) {
+        return this.request("/admin/usage?days=" + days, null, true);
+    }
+    async health() {
+        return this.request("/health", null, false);
+    }
+    isFallback() {
+        return this.fallbackMode;
+    }
+}
+// ── Remote API client (Phase 2) ─────────────────────────────────────
+export const VIBEOS_API_URL = process.env.VIBEOS_API_URL || "https://api.vibetheog.com";
+const _apiDir = typeof __dirname !== "undefined" ? __dirname : dirname(fileURLToPath(import.meta.url));
+const _envPaths = [homedir() + "/.claude", _apiDir, process.cwd(), homedir()];
+function readTokenFromDisk() {
+    for (const dir of _envPaths) {
+        try {
+            const env = readFileSync(dir + "/.env.production", "utf8");
+            const m = env.match(/^VIBEOS_API_TOKEN=(.+)$/m);
+            if (m)
+                return m[1].trim();
+        }
+        catch { }
+    }
+    return "";
+}
+export let VIBEOS_API_TOKEN = readTokenFromDisk() || process.env.VIBEOS_API_TOKEN || "";
+export let VIBEOS_API_ENABLED = process.env.VIBEOS_API_ENABLED !== "false" && !!VIBEOS_API_TOKEN;
+export function setApiToken(newToken) {
+    try {
+        VIBEOS_API_TOKEN = String(newToken || "").trim();
+        VIBEOS_API_ENABLED = process.env.VIBEOS_API_ENABLED !== "false" && !!VIBEOS_API_TOKEN;
+        const primaryPath = _envPaths[0] + "/.env.production";
+        try {
+            if (existsSync(primaryPath)) {
+                let envContent = readFileSync(primaryPath, "utf8");
+                if (/^VIBEOS_API_TOKEN=/m.test(envContent)) {
+                    envContent = envContent.replace(/^VIBEOS_API_TOKEN=.+$/m, `VIBEOS_API_TOKEN=${VIBEOS_API_TOKEN}`);
+                }
+                else {
+                    envContent = envContent.trimEnd() + `\nVIBEOS_API_TOKEN=${VIBEOS_API_TOKEN}\n`;
+                }
+                writeFileSync(primaryPath, envContent, "utf8");
+            }
+            else {
+                const parentDir = _envPaths[0];
+                if (!existsSync(parentDir))
+                    mkdirSync(parentDir, { recursive: true });
+                writeFileSync(primaryPath, `VIBEOS_API_TOKEN=${VIBEOS_API_TOKEN}\n`, "utf8");
+            }
+        }
+        catch (diskErr) {
+            console.error("[vibeOS] Failed to persist API token to disk:", diskErr.message);
+        }
+        console.error("[vibeOS] API token updated via setApiToken");
+    }
+    catch (e) {
+        console.error("[vibeOS] Failed to update API token:", e.message);
+    }
+}
+let _apiClient = null;
+let _apiFallbackMode = false;
+let _apiFallbackSince = null;
+function syncApiTokenFromDisk() {
+    const diskToken = readTokenFromDisk() || "";
+    const envToken = process.env.VIBEOS_API_TOKEN || "";
+    if (diskToken && diskToken !== VIBEOS_API_TOKEN) {
+        VIBEOS_API_TOKEN = diskToken;
+        VIBEOS_API_ENABLED = process.env.VIBEOS_API_ENABLED !== "false" && !!VIBEOS_API_TOKEN;
+        _apiClient = null;
+        _apiFallbackMode = false;
+        _apiFallbackSince = null;
+        resetApiConnection();
+        console.error("[vibeOS] API token synced from disk (disk is newer)");
+    }
+    else if (!diskToken && VIBEOS_API_TOKEN) {
+        const primaryPath = _envPaths[0] + "/.env.production";
+        try {
+            if (existsSync(primaryPath)) {
+                let envContent = readFileSync(primaryPath, "utf8");
+                if (/^VIBEOS_API_TOKEN=/m.test(envContent)) {
+                    envContent = envContent.replace(/^VIBEOS_API_TOKEN=.+$/m, `VIBEOS_API_TOKEN=${VIBEOS_API_TOKEN}`);
+                }
+                else {
+                    envContent = envContent.trimEnd() + `\nVIBEOS_API_TOKEN=${VIBEOS_API_TOKEN}\n`;
+                }
+                writeFileSync(primaryPath, envContent, "utf8");
+            }
+            else {
+                const parentDir = _envPaths[0];
+                if (!existsSync(parentDir))
+                    mkdirSync(parentDir, { recursive: true });
+                writeFileSync(primaryPath, `VIBEOS_API_TOKEN=${VIBEOS_API_TOKEN}\n`, "utf8");
+            }
+            console.error("[vibeOS] API token persisted to disk from memory (disk was empty)");
+        }
+        catch (diskErr) {
+            console.error("[vibeOS] Failed to persist API token to disk from sync:", diskErr.message);
+        }
+        VIBEOS_API_ENABLED = process.env.VIBEOS_API_ENABLED !== "false" && !!VIBEOS_API_TOKEN;
+    }
+    else if (envToken && !diskToken && !VIBEOS_API_TOKEN) {
+        VIBEOS_API_TOKEN = envToken;
+        VIBEOS_API_ENABLED = process.env.VIBEOS_API_ENABLED !== "false" && !!VIBEOS_API_TOKEN;
+        console.error("[vibeOS] API token loaded from VIBEOS_API_TOKEN env var");
+    }
+    else {
+        VIBEOS_API_ENABLED = process.env.VIBEOS_API_ENABLED !== "false" && !!VIBEOS_API_TOKEN;
+    }
+}
+export function getApiClient() {
+    syncApiTokenFromDisk();
+    if (!_apiClient && VIBEOS_API_ENABLED) {
+        _apiClient = new VibeOSApiClient({
+            baseUrl: VIBEOS_API_URL,
+            apiToken: VIBEOS_API_TOKEN,
+            timeout: 5000,
+        });
+    }
+    return _apiClient;
+}
+export function isApiFallback() {
+    return _apiFallbackMode || !VIBEOS_API_ENABLED;
+}
+export function isApiConnected() {
+    return VIBEOS_API_ENABLED && !_apiFallbackMode;
+}
+export async function remoteCall(method, args, fallbackFn) {
+    syncApiTokenFromDisk();
+    if (!VIBEOS_API_ENABLED || _apiFallbackMode) {
+        if (fallbackFn)
+            return fallbackFn();
+        return null;
+    }
+    try {
+        const client = getApiClient();
+        if (!client) {
+            if (fallbackFn)
+                return fallbackFn();
+            return null;
+        }
+        const result = await client[method](...args);
+        _apiFallbackMode = false;
+        _apiFallbackSince = null;
+        markApiConnected();
+        return result;
+    }
+    catch (err) {
+        if (!_apiFallbackMode) {
+            _apiFallbackMode = true;
+            _apiFallbackSince = new Date().toISOString();
+            console.error(`[vibeOS] API fallback activated: ${err.message}`);
+        }
+        markApiDisconnected();
+        if (fallbackFn) {
+            try {
+                return fallbackFn();
+            }
+            catch (fe) {
+                console.error(`[vibeOS] fallback also failed: ${fe.message}`);
+            }
+        }
+        return null;
+    }
+}