Lines 1-37javascript
3 * Shared Vachi activation module — vendored byte-identically into every installer
4 * (vachi-claude, vachi-codex). A parity test asserts the copies never drift.
6 * Owns everything tool-agnostic: the device-authorization grant client (Stage 1),
7 * the concurrent paste-secret fallback, key validation (ping), credential storage,
8 * new-install/welcome bookkeeping, and the shared logger/util helpers. Each installer's
9 * bin/ file keeps only its tool-specific config writing (settings.json vs config.toml).
11 * Zero dependencies (Node >=18 built-ins + global fetch), so `npx` stays instant.
14const fs = require('fs');
15const os = require('os');
16const path = require('path');
17const readline = require('readline');
18const { spawn } = require('child_process');
19
HighChild Process
Package source references child process execution.
lib/activation.jsView on unpkg · L17 20// --- shared constants ------------------------------------------------------
21const HEADER_NAME = 'x-vachi-id';
22const HOME = os.homedir();
23const VACHI_DIR = path.join(HOME, '.vachi');
24const CRED_FILE = path.join(VACHI_DIR, 'credentials.json');
25const WELCOME_FILE = path.join(VACHI_DIR, 'welcome-pending');
27// Where the installer POSTs start/poll (the cli-activate edge function). The /activate
28// *page* URL is taken from `verification_uri_complete` in the start response, not built here.
29const ACTIVATE_BASE = normUrl(process.env.VACHI_ACTIVATE_URL) || 'https://vachiai.com/cli-activate';
30
HighSame File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
lib/activation.jsView on unpkg · L17 HighSandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
lib/activation.jsView on unpkg · L17 31function normUrl(u) { return u ? String(u).trim().replace(/\/+$/, '') : null; }
33// --- shared loggers (identical styling across installers) ------------------
34const ok = (m) => console.log(` \x1b[32m✓\x1b[0m ${m}`);
35const warn = (m) => console.log(` \x1b[33m!\x1b[0m ${m}`);
36const bad = (m) => console.log(` \x1b[31m✗\x1b[0m ${m}`);
37const info = (m) => console.log(` · ${m}`);