| import { BashClient } from "@openhands/typescript-client/clients"; | |
| import type { BashOutput } from "@openhands/typescript-client"; | |
| import { getAgentServerClientOptions } from "../agent-server-client-options"; | |
| export type AcpAuthStatus = "authenticated" | "unauthenticated" | "unknown"; | |
| // Hard cap (seconds) for a single detection command. These are fast local | |
| // status checks (no npx download), so 10s is ample for a healthy CLI while | |
| // keeping the onboarding spinner short before falling back to "unknown". | |
| const PROBE_TIMEOUT_SECONDS = 10; | |
| interface AcpAuthProbe { | |
| /** Shell command run on the (local) agent-server host to detect login. */ | |
| command: string; | |
| /** Classify the command's output into an auth status. */ | |
| classify: (out: BashOutput) => AcpAuthStatus; | |
| } | |
| /** Combined stdout+stderr — CLIs are inconsistent about which stream they use | |
| * (e.g. ``codex login status`` writes to stderr). */ | |
| function streams(out: BashOutput): string { | |
| return `${out.stdout ?? ""}\n${out.stderr ?? ""}`; | |
| } | |
| // Claude Code: ``claude auth status --json`` prints {"loggedIn": bool, …}. The | |
| // CLI exits non-zero when logged out, so we read the JSON, not the exit code. | |
| // No parseable ``loggedIn`` (e.g. the CLI isn't installed → "command not | |
| // found", empty stdout) ⇒ unknown, so onboarding shows the API-key fields | |
| // rather than guessing. | |
| function classifyClaude(out: BashOutput): AcpAuthStatus { | |
| let parsed: unknown; | |
| try { | |
| parsed = JSON.parse((out.stdout ?? "").trim()); | |
| } catch { | |
| return "unknown"; | |
| } | |
| const loggedIn = (parsed as { loggedIn?: unknown } | null)?.loggedIn; | |
| if (typeof loggedIn === "boolean") { | |
| return loggedIn ? "authenticated" : "unauthenticated"; | |
| } | |
| return "unknown"; | |
| } | |
| // Codex: ``codex login status`` prints "Logged in using …" / "Not logged in" | |
| // (to stderr), so check both streams. Match "not logged in" first since it | |
| // contains the "logged in" substring. Neither phrase (e.g. CLI missing) ⇒ | |
| // unknown. | |
| function classifyCodex(out: BashOutput): AcpAuthStatus { | |
| const text = streams(out).toLowerCase(); | |
| if (text.includes("not logged in")) return "unauthenticated"; | |
| if (text.includes("logged in")) return "authenticated"; | |
| return "unknown"; | |
| } | |
| // Gemini CLI signs in via Google OAuth and has no status command, so we check | |
| // its credentials file. The command echoes present/absent and exits 0 either | |
| // way; anything else (a shell failure) ⇒ unknown. | |
| function classifyGemini(out: BashOutput): AcpAuthStatus { | |
| // The command echoes exactly `present` / `absent` to stdout, so match trimmed | |
| // stdout exactly. Reading only stdout (not stderr) means a stray shell | |
| // warning can't turn a real result into `unknown`. | |
| const text = (out.stdout ?? "").trim(); | |
| if (text === "present") return "authenticated"; | |
| if (text === "absent") return "unauthenticated"; | |
| return "unknown"; | |
| } | |
| // Per-provider login detection, keyed by ``acp_server`` / OnboardingAgentId. | |
| // Providers absent here (OpenHands, custom, unknown) report ``unknown``. | |
| const ACP_AUTH_PROBES: Record<string, AcpAuthProbe> = { | |
| "claude-code": { | |
| command: "claude auth status --json", | |
| classify: classifyClaude, | |
| }, | |
| codex: { | |
| command: "codex login status", | |
| classify: classifyCodex, | |
| }, | |
| "gemini-cli": { | |
| command: | |
| 'test -f "$HOME/.gemini/oauth_creds.json" && echo present || echo absent', | |
| classify: classifyGemini, | |
| }, | |
| }; | |
| /** | |
| * Detects whether the selected ACP provider is already logged in — entirely | |
| * client-side, with **no dedicated agent-server endpoint**. It runs the | |
| * provider's own status command (or, for Gemini, a credentials-file check) | |
| * through the existing agent-server bash endpoint and classifies the output. | |
| * | |
| * Gated by the caller to **local backends**: the command runs wherever the | |
| * agent-server runs, and on a user's own machine the provider CLIs and | |
| * credential files live at their standard paths. No prompt is sent, so no model | |
| * tokens are spent. A provider that can't be classified — CLI not installed, | |
| * unexpected output, or the bash call failing — comes back as ``unknown`` so | |
| * onboarding falls back to the API-key fields rather than a misleading banner. | |
| */ | |
| class AcpService { | |
| static async getAuthStatus(server: string): Promise<AcpAuthStatus> { | |
| const probe = ACP_AUTH_PROBES[server]; | |
| if (!probe) return "unknown"; | |
| const out = await new BashClient( | |
| getAgentServerClientOptions(), | |
| ).executeCommand(probe.command, undefined, PROBE_TIMEOUT_SECONDS); | |
| return probe.classify(out); | |
| } | |
| } | |
| export default AcpService; | |