waitspin 0.1.2 → 0.1.4

package/assets/waitspin-opencode/opencode-statusline.mjs

@@ -0,0 +1,280 @@
+#!/usr/bin/env node
+
+// WaitSpin OpenCode Statusline Runtime
+// Installed by: waitspin opencode install
+//
+// Called periodically by the OpenCode TUI plugin. Fetches the next sponsored
+// message from the WaitSpin API, manages serve caching, and records
+// impressions after the minimum visible interval.
+//
+// Usage: node opencode-statusline.mjs --state STATE_PATH
+
+import {
+  mkdir,
+  readFile,
+  rename,
+  rm,
+  stat,
+  writeFile,
+} from "node:fs/promises"
+import os from "node:os"
+import path from "node:path"
+
+// ─── Constants ──────────────────────────────────────────────
+
+const FETCH_INTERVAL_MS = 15_000
+const FETCH_TIMEOUT_MS = 2_500
+const MAX_ACTIVE_AGE_MS = 60_000
+const LOCK_RETRY_MS = 40
+const LOCK_TIMEOUT_MS = 2_000
+const LOCK_STALE_MS = 10_000
+const DEFAULT_MIN_VISIBLE_MS = 5_000
+const CACHE_KEY = "opencode"
+const MANAGED_STATE_PATH = path.join(
+  os.homedir(),
+  ".waitspin",
+  "opencode-install.json",
+)
+
+// ─── Helpers ────────────────────────────────────────────────
+
+function argValue(name) {
+  for (let index = 2; index < process.argv.length; index += 1) {
+    if (process.argv[index] !== name) continue
+    const value = process.argv[index + 1]
+    return value && !value.startsWith("--") ? value : undefined
+  }
+  return undefined
+}
+
+function managedStatePath(value) {
+  if (!value) return null
+  const resolved = path.resolve(value)
+  return resolved === path.resolve(MANAGED_STATE_PATH) ? resolved : null
+}
+
+async function readJson(filePath, fallback) {
+  try {
+    return JSON.parse(await readFile(filePath, "utf8"))
+  } catch {
+    return fallback
+  }
+}
+
+function readInstallState(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null
+  const apiKey = typeof value.api_key === "string" ? value.api_key.trim() : ""
+  const installId =
+    typeof value.install_id === "string" ? value.install_id.trim() : ""
+  const baseUrl =
+    typeof value.base_url === "string" ? value.base_url.trim() : ""
+  const cachePath =
+    typeof value.cache_path === "string" ? value.cache_path.trim() : ""
+  if (!apiKey || !installId || !baseUrl || !cachePath) return null
+  return {
+    ...value,
+    api_key: apiKey,
+    install_id: installId,
+    base_url: baseUrl,
+    cache_path: cachePath,
+  }
+}
+
+async function writeJson(filePath, value) {
+  const tmp = filePath + "." + process.pid + ".tmp"
+  await writeFile(tmp, JSON.stringify(value, null, 2) + "\n", {
+    encoding: "utf8",
+    mode: 0o600,
+  })
+  await rename(tmp, filePath)
+}
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms))
+}
+
+async function acquireCacheLock(cachePath) {
+  const lockPath = cachePath + ".lock"
+  const startedAt = Date.now()
+
+  while (Date.now() - startedAt < LOCK_TIMEOUT_MS) {
+    try {
+      await mkdir(lockPath)
+      return async () => {
+        await rm(lockPath, { recursive: true, force: true })
+      }
+    } catch {
+      try {
+        const lockStat = await stat(lockPath)
+        if (Date.now() - lockStat.mtimeMs > LOCK_STALE_MS) {
+          await rm(lockPath, { recursive: true, force: true })
+          continue
+        }
+      } catch {
+        // Another process may have released the lock between mkdir/stat
+      }
+      await sleep(LOCK_RETRY_MS)
+    }
+  }
+
+  throw new Error("Timed out waiting for WaitSpin OpenCode cache lock.")
+}
+
+async function withCacheLock(cachePath, callback) {
+  const release = await acquireCacheLock(cachePath)
+  try {
+    return await callback()
+  } finally {
+    await release()
+  }
+}
+
+function cleanLine(value) {
+  return String(value || "")
+    .replace(
+      /(?:\u001B\[[0-?]*[ -/]*[@-~]|\u001B\][^\u0007]*(?:\u0007|\u001B\\)|\u001B[P^_][\s\S]*?\u001B\\|\u001B[@-Z\\-_]|\u009B[0-?]*[ -/]*[@-~])/g,
+      " ",
+    )
+    .replace(/[\r\n\u0000-\u001F\u007F-\u009F]/g, " ")
+    .replace(/\s+/g, " ")
+    .trim()
+    .slice(0, 120)
+}
+
+function parseServe(payload) {
+  if (!payload || typeof payload !== "object") return null
+  const creative = payload.creative
+  if (!creative || typeof creative !== "object") return null
+  const line = cleanLine(creative.line)
+  if (!line) return null
+  if (
+    typeof payload.serve_id !== "string" ||
+    typeof payload.serve_receipt !== "string"
+  ) {
+    return null
+  }
+  return {
+    serveId: payload.serve_id,
+    serveReceipt: payload.serve_receipt,
+    line,
+    shownAt: Date.now(),
+    minVisibleMs:
+      typeof payload.min_visible_ms === "number" && payload.min_visible_ms >= DEFAULT_MIN_VISIBLE_MS
+        ? payload.min_visible_ms
+        : DEFAULT_MIN_VISIBLE_MS,
+    impressionRecorded: false,
+  }
+}
+
+// ─── WaitSpin API Calls ─────────────────────────────────────
+
+async function waitspinFetch(url, init) {
+  const controller = new AbortController()
+  const timeout = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS)
+  try {
+    return await fetch(url, { ...init, signal: controller.signal })
+  } finally {
+    clearTimeout(timeout)
+  }
+}
+
+async function fetchNextServe(state, session) {
+  const response = await waitspinFetch(state.base_url + "/v1/serve/next", {
+    method: "POST",
+    headers: {
+      Authorization: "Bearer " + state.api_key,
+      "Content-Type": "application/json",
+    },
+    body: JSON.stringify({ install_id: state.install_id }),
+  })
+  session.lastFetchAt = Date.now()
+  if (response.status === 204) {
+    session.activeServe = null
+    return
+  }
+  if (!response.ok) return
+  const parsed = parseServe(await response.json())
+  if (parsed) session.activeServe = parsed
+}
+
+async function recordImpression(state, session) {
+  const serve = session.activeServe
+  if (!serve || serve.impressionRecorded) return
+  const visibleMs = Date.now() - serve.shownAt
+  if (visibleMs < serve.minVisibleMs) return
+  const response = await waitspinFetch(state.base_url + "/v1/events/impression", {
+    method: "POST",
+    headers: {
+      Authorization: "Bearer " + state.api_key,
+      "Content-Type": "application/json",
+    },
+    body: JSON.stringify({
+      serve_id: serve.serveId,
+      serve_receipt: serve.serveReceipt,
+      install_id: state.install_id,
+      visible_ms: Math.max(visibleMs, serve.minVisibleMs),
+    }),
+  })
+  if (response.ok) serve.impressionRecorded = true
+}
+
+function pruneSessions(cache) {
+  const cutoff = Date.now() - 24 * 60 * 60 * 1000
+  for (const [key, value] of Object.entries(cache.sessions || {})) {
+    if ((value.lastSeenAt || 0) < cutoff) delete cache.sessions[key]
+  }
+}
+
+// ─── Main ───────────────────────────────────────────────────
+
+async function main() {
+  const statePath = managedStatePath(argValue("--state"))
+  if (!statePath) return
+
+  const state = readInstallState(await readJson(statePath, null))
+  if (!state) return
+
+  let sponsorLine = ""
+
+  try {
+    sponsorLine = await withCacheLock(state.cache_path, async () => {
+      const cache = await readJson(state.cache_path, { sessions: {} })
+      if (!cache.sessions || typeof cache.sessions !== "object") cache.sessions = {}
+
+      // OpenCode uses a single session key
+      const session = cache.sessions[CACHE_KEY] || {}
+      session.lastSeenAt = Date.now()
+      cache.sessions[CACHE_KEY] = session
+
+      // Expire stale active serve
+      if (
+        session.activeServe &&
+        Date.now() - session.activeServe.shownAt > MAX_ACTIVE_AGE_MS
+      ) {
+        session.activeServe = null
+      }
+
+      await recordImpression(state, session)
+
+      const shouldFetchNext = !session.activeServe
+        ? Date.now() - (session.lastFetchAt || 0) >= FETCH_INTERVAL_MS
+        : session.activeServe.impressionRecorded &&
+          Date.now() - (session.lastFetchAt || 0) >= FETCH_INTERVAL_MS
+
+      if (shouldFetchNext) {
+        await fetchNextServe(state, session)
+      }
+
+      pruneSessions(cache)
+      await writeJson(state.cache_path, cache)
+      return session
+    })
+  } catch {
+    // Statusline rendering must never interrupt the host
+  }
+
+  const line = sponsorLine?.activeServe?.line || ""
+  if (line) process.stdout.write(line)
+}
+
+main().catch(() => {})

package/assets/waitspin-opencode/waitspin-opencode.plugin.tsx

@@ -0,0 +1,267 @@
+// WaitSpin OpenCode TUI Plugin
+// Installed by: waitspin opencode install
+// Slot: app_bottom
+//
+// Displays a WaitSpin sponsored message in the OpenCode TUI app_bottom slot.
+// Polls the WaitSpin API every 15s and records impressions after 5s visible.
+
+import type { TuiPlugin, TuiPluginApi } from "@opencode-ai/plugin/tui"
+import { execFile } from "node:child_process"
+import { readFile } from "node:fs/promises"
+import { createSignal, Show } from "solid-js"
+
+const POLL_INTERVAL_MS = 15_000
+const MIN_VISIBLE_MS = 5_000
+const FETCH_TIMEOUT_MS = 5_000
+
+const INSTALL_CONFIG = {
+  statePath: "__WAITSPIN_STATE_PATH__",
+}
+
+interface WaitSpinConfig {
+  baseUrl: string
+  apiKey: string
+  installId: string
+}
+
+interface ActiveServe {
+  serveId: string
+  line: string
+  destinationUrl: string
+  serveReceipt: string
+  shownAt: number
+  minVisibleMs: number
+}
+
+const plugin: TuiPlugin = async (api: TuiPluginApi) => {
+  const [sponsorLine, setSponsorLine] = createSignal("")
+  const [destinationUrl, setDestinationUrl] = createSignal("")
+
+  let activeServe: ActiveServe | null = null
+  let pollTimer: ReturnType<typeof setInterval> | undefined
+  let impressionTimer: ReturnType<typeof setTimeout> | undefined
+  let isPolling = false
+  let cachedConfig: WaitSpinConfig | null | undefined
+
+  function kvGet(key: string): string {
+    try {
+      return api.kv.get<string>(key) || ""
+    } catch {
+      return ""
+    }
+  }
+
+  async function readStateConfig(): Promise<WaitSpinConfig | null> {
+    if (cachedConfig !== undefined) return cachedConfig
+    try {
+      const raw = await readFile(INSTALL_CONFIG.statePath, "utf8")
+      const state = JSON.parse(raw) as Record<string, unknown>
+      const baseUrl = typeof state.base_url === "string" ? state.base_url.trim() : ""
+      const apiKey = typeof state.api_key === "string" ? state.api_key.trim() : ""
+      const installId = typeof state.install_id === "string" ? state.install_id.trim() : ""
+      cachedConfig = baseUrl && apiKey && installId
+        ? { baseUrl, apiKey, installId }
+        : null
+    } catch {
+      cachedConfig = null
+    }
+    return cachedConfig
+  }
+
+  async function resolveConfig(): Promise<WaitSpinConfig | null> {
+    const apiKey = kvGet("waitspin_api_key")
+    const installId = kvGet("waitspin_install_id")
+    const baseUrl = kvGet("waitspin_base_url") || "https://api.waitspin.com"
+    if (apiKey && installId) return { baseUrl, apiKey, installId }
+    return readStateConfig()
+  }
+
+  function isSafeUrl(url: string): boolean {
+    try {
+      const rawHost = rawHostname(url)
+      if (/^(?:\d+|0x[0-9a-f]+|0[0-7]+)$/i.test(rawHost)) return false
+      const parsed = new URL(url)
+      if (parsed.protocol !== "https:") return false
+      if (parsed.username || parsed.password) return false
+      const host = parsed.hostname.toLowerCase()
+      if (["localhost", "::1", "0.0.0.0"].includes(host)) return false
+      if (/^(127\.|10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.|169\.254\.)/.test(host)) return false
+      if (host.startsWith("::ffff:")) return false
+      if (host.startsWith("fe80:") || host.startsWith("fc") || host.startsWith("fd")) return false
+      return true
+    } catch {
+      return false
+    }
+  }
+
+  function rawHostname(url: string): string {
+    const withoutProtocol = url.trim().replace(/^[a-z][a-z\d+.-]*:\/\//i, "")
+    const authority = withoutProtocol.split(/[/?#]/, 1)[0] || ""
+    const hostPort = authority.includes("@") ? authority.slice(authority.lastIndexOf("@") + 1) : authority
+    if (hostPort.startsWith("[")) {
+      return hostPort.slice(1, hostPort.indexOf("]")).toLowerCase()
+    }
+    return hostPort.split(":")[0].toLowerCase()
+  }
+
+  function openExternalUrl(url: string): void {
+    if (!isSafeUrl(url)) return
+    const platform = typeof process === "object" ? process.platform : ""
+    const command =
+      platform === "darwin" ? "open" : platform === "linux" ? "xdg-open" : ""
+    if (!command) return
+    try {
+      const child = execFile(command, [url], { timeout: 2000 }, () => {})
+      child.unref()
+    } catch {
+      // Opening destinations is best-effort; display must never fail.
+    }
+  }
+
+  function cleanLine(value: unknown): string {
+    return String(value || "")
+      .replace(
+        /(?:\u001B\[[0-?]*[ -/]*[@-~]|\u001B\][^\u0007]*(?:\u0007|\u001B\\)|\u001B[P^_][\s\S]*?\u001B\\|\u001B[@-Z\\-_]|\u009B[0-?]*[ -/]*[@-~])/g,
+        " ",
+      )
+      .replace(/[\r\n\u0000-\u001F\u007F-\u009F]/g, " ")
+      .replace(/\s+/g, " ")
+      .trim()
+      .slice(0, 120)
+  }
+
+  function parseServePayload(payload: unknown): ActiveServe | null {
+    if (!payload || typeof payload !== "object") return null
+    const r = payload as Record<string, unknown>
+    const serveId = typeof r.serve_id === "string" ? r.serve_id.trim() : ""
+    if (serveId.length < 8) return null
+    const serveReceipt = typeof r.serve_receipt === "string" ? r.serve_receipt.trim() : ""
+    if (serveReceipt.length < 32) return null
+    const creative = r.creative
+    if (!creative || typeof creative !== "object") return null
+    const c = creative as Record<string, unknown>
+    const line = cleanLine(c.line)
+    if (!line) return null
+    const destinationUrl = typeof c.destination_url === "string" ? c.destination_url.trim() : ""
+    if (!destinationUrl || !isSafeUrl(destinationUrl)) return null
+    const minVisibleMs = typeof r.min_visible_ms === "number" && r.min_visible_ms >= MIN_VISIBLE_MS
+      ? r.min_visible_ms
+      : MIN_VISIBLE_MS
+    return { serveId, line, destinationUrl, serveReceipt, shownAt: Date.now(), minVisibleMs }
+  }
+
+  async function fetchNextServe(): Promise<void> {
+    if (isPolling) return
+    const cfg = await resolveConfig()
+    if (!cfg) return
+    isPolling = true
+    const controller = new AbortController()
+    const timeout = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS)
+    try {
+      const response = await fetch(`${cfg.baseUrl}/v1/serve/next`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${cfg.apiKey}`, "Content-Type": "application/json" },
+        body: JSON.stringify({ install_id: cfg.installId }),
+        signal: controller.signal,
+      })
+
+      if (response.status === 204) { clearAd(); return }
+      if (!response.ok) return
+
+      const parsed = parseServePayload(await response.json())
+      if (!parsed) return
+
+      activeServe = parsed
+      setSponsorLine(parsed.line)
+      setDestinationUrl(parsed.destinationUrl)
+
+      if (impressionTimer) clearTimeout(impressionTimer)
+      impressionTimer = setTimeout(() => {
+        impressionTimer = undefined
+        if (!activeServe || activeServe.serveId !== parsed.serveId) return
+        recordImpression(parsed.serveId, parsed.serveReceipt, Math.max(Date.now() - parsed.shownAt, parsed.minVisibleMs))
+      }, parsed.minVisibleMs)
+    } catch {
+      // Network errors are non-fatal.
+    } finally {
+      clearTimeout(timeout)
+      isPolling = false
+    }
+  }
+
+  async function recordImpression(serveId: string, serveReceipt: string, visibleMs: number): Promise<void> {
+    const cfg = await resolveConfig()
+    if (!cfg) return
+    const controller = new AbortController()
+    const timeout = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS)
+    try {
+      await fetch(`${cfg.baseUrl}/v1/events/impression`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${cfg.apiKey}`, "Content-Type": "application/json" },
+        body: JSON.stringify({ serve_id: serveId, serve_receipt: serveReceipt, install_id: cfg.installId, visible_ms: visibleMs }),
+        signal: controller.signal,
+      })
+    } catch {
+      // Impression failures are non-fatal.
+    } finally {
+      clearTimeout(timeout)
+    }
+  }
+
+  function clearAd(): void {
+    if (impressionTimer) { clearTimeout(impressionTimer); impressionTimer = undefined }
+    activeServe = null
+    setSponsorLine("")
+    setDestinationUrl("")
+  }
+
+  function startPolling(): void {
+    if (pollTimer) return
+    void fetchNextServe()
+    pollTimer = setInterval(() => { void fetchNextServe() }, POLL_INTERVAL_MS)
+  }
+
+  function stopPolling(): void {
+    if (pollTimer) { clearInterval(pollTimer); pollTimer = undefined }
+    if (impressionTimer) { clearTimeout(impressionTimer); impressionTimer = undefined }
+    activeServe = null
+    setSponsorLine("")
+    setDestinationUrl("")
+  }
+
+  startPolling()
+  api.lifecycle.onDispose(stopPolling)
+
+  api.slots.register({
+    slots: {
+      app_bottom() {
+        const [hovered, setHovered] = createSignal(false)
+
+        return (
+          <Show when={sponsorLine()}>
+            <box
+              flexShrink={0}
+              paddingLeft={1}
+              paddingRight={1}
+              backgroundColor={hovered() ? api.theme.current.backgroundElement : api.theme.current.backgroundPanel}
+              onMouseOver={() => setHovered(true)}
+              onMouseOut={() => setHovered(false)}
+              onMouseUp={() => {
+                const url = destinationUrl()
+                if (url) {
+                  openExternalUrl(url)
+                }
+              }}
+            >
+              <text fg={hovered() ? api.theme.current.text : api.theme.current.textMuted}>
+                ⧉ {sponsorLine()}
+              </text>
+            </box>
+          </Show>
+        )
+      },
+    },
+  })
+}
+
+export default plugin

package/assets/waitspin-vscode/out/extension.js

@@ -71,7 +71,7 @@ function resolveApiKey() {
     if (secretApiKey) {
         return secretApiKey;
     }
-    return process.env.WAITSPIN_API_KEY?.trim();
+    return undefined;
 }
 async function migratePublisherApiKeyToSecretStorage(context) {
     let stored;
@@ -127,20 +127,33 @@ function readGlobalWaitSpinSetting(name) {
 function allowDeveloperApiBase() {
     return process.env.WAITSPIN_ALLOW_DEV_API_BASE === "1";
 }
+function isLoopbackApiHostname(hostname) {
+    const normalized = hostname.toLowerCase().replace(/\.$/, "");
+    return (normalized === "localhost" ||
+        normalized === "::1" ||
+        normalized === "[::1]" ||
+        /^127(?:\.\d{1,3}){3}$/.test(normalized));
+}
 function normalizeTrustedApiBase(value) {
     try {
         const parsed = new URL(value);
         const hostname = parsed.hostname.toLowerCase().replace(/\.$/, "");
-        const isProductionApi = parsed.protocol === "https:" &&
-            hostname === "api.waitspin.com" &&
-            !parsed.username &&
+        const isCleanOrigin = !parsed.username &&
             !parsed.password &&
+            !parsed.search &&
+            !parsed.hash &&
             (parsed.pathname === "/" || parsed.pathname === "");
+        const isProductionApi = parsed.protocol === "https:" &&
+            hostname === "api.waitspin.com" &&
+            isCleanOrigin;
         if (isProductionApi) {
             return parsed.origin;
         }
-        if (allowDeveloperApiBase() && !parsed.username && !parsed.password) {
-            return parsed.origin.replace(/\/+$/, "");
+        if (allowDeveloperApiBase() &&
+            isCleanOrigin &&
+            (parsed.protocol === "http:" || parsed.protocol === "https:") &&
+            isLoopbackApiHostname(parsed.hostname)) {
+            return parsed.origin;
         }
     }
     catch {
@@ -196,6 +209,12 @@ function parseServePayload(payload) {
     if (typeof serveId !== "string" || serveId.trim().length < 8) {
         return undefined;
     }
+    const serveReceipt = record.serve_receipt;
+    if (typeof serveReceipt !== "string" ||
+        serveReceipt.trim().length < 32 ||
+        serveReceipt.length > 2048) {
+        return undefined;
+    }
     const creative = record.creative;
     if (!creative || typeof creative !== "object") {
         return undefined;
@@ -217,6 +236,7 @@ function parseServePayload(payload) {
         serveId: serveId.trim(),
         line: line.trim(),
         destinationUrl: destinationUrl.trim(),
+        serveReceipt: serveReceipt.trim(),
         minVisibleMs,
     };
 }
@@ -304,6 +324,7 @@ async function fetchNextCreative() {
             serveId: parsed.serveId,
             line: parsed.line,
             destinationUrl: parsed.destinationUrl,
+            serveReceipt: parsed.serveReceipt,
             shownAt: Date.now(),
             minVisibleMs: parsed.minVisibleMs,
         };
@@ -331,7 +352,7 @@ function showStatusBarAd(serve, minVisibleMs) {
             return;
         }
         const visibleMs = Math.max(Date.now() - serve.shownAt, minVisibleMs);
-        void recordImpression(serve.serveId, visibleMs, resolveInstallId());
+        void recordImpression(serve.serveId, serve.serveReceipt, visibleMs, resolveInstallId());
     }, minVisibleMs);
 }
 function flushPendingImpressionIfEligible() {
@@ -341,7 +362,7 @@ function flushPendingImpressionIfEligible() {
     }
     const visibleMs = Date.now() - serve.shownAt;
     if (visibleMs >= serve.minVisibleMs) {
-        void recordImpression(serve.serveId, visibleMs, resolveInstallId());
+        void recordImpression(serve.serveId, serve.serveReceipt, visibleMs, resolveInstallId());
     }
 }
 function clearImpressionSchedulingAndFlush() {
@@ -380,7 +401,7 @@ function startPollingIfConfigured() {
         void fetchNextCreative();
     }, POLL_INTERVAL_MS);
 }
-async function recordImpression(serveId, visibleMs, installId) {
+async function recordImpression(serveId, serveReceipt, visibleMs, installId) {
     const apiKey = resolveApiKey();
     const apiBase = resolveApiBase();
     if (!apiKey || !installId || !apiBase) {
@@ -395,6 +416,7 @@ async function recordImpression(serveId, visibleMs, installId) {
             },
             body: JSON.stringify({
                 serve_id: serveId,
+                serve_receipt: serveReceipt,
                 install_id: installId,
                 visible_ms: visibleMs,
             }),