@ai-workbench/connect 0.7.6 → 0.7.9

package/lib/login.js

@@ -1,11 +1,11 @@
 import { createRequire } from 'node:module';
 const { isClaudeAuthorizeUrl, validateClaudePaste } = createRequire(import.meta.url)('../helper/claude-callback.cjs');
-import { fail, NeedError, need } from "./needs.js";
+import { fail, NeedError } from "./needs.js";
 export function extractLoginUrl(provider, text) {
-    for (const match of text.matchAll(/https:\/\/[^\s<>"']+/g)) {
+    for (const match of text.replace(/\x1b\[[0-?]*[ -/]*[@-~]/g, '').matchAll(/https:\/\/[^\s<>"']+/g)) {
         try {
             const u = new URL(match[0]);
-            if (!u.username && !u.password && u.protocol === 'https:' && ((provider === 'codex' && u.origin === 'https://auth.openai.com' && u.pathname === '/oauth/authorize') || (provider === 'claude' && isClaudeAuthorizeUrl(u))))
+            if (!u.username && !u.password && u.protocol === 'https:' && ((provider === 'codex' && u.href === 'https://auth.openai.com/codex/device') || (provider === 'claude' && isClaudeAuthorizeUrl(u))))
                 return u.href;
         }
         catch { /* not a complete URL yet */ }
@@ -18,8 +18,8 @@ export async function runLogin(t, p, ports, parentSignal) {
     parentSignal.addEventListener('abort', parentAbort, { once: true });
     if (parentSignal.aborted)
         controller.abort();
-    let remote, lease, window, remove = () => { };
-    let result = fail('LOGIN_FAILED'), leaseLost = false, releasing = false;
+    let remote, window, remove = () => { };
+    let result = fail('LOGIN_FAILED');
     try {
         if (signal.aborted)
             return result;
@@ -30,17 +30,19 @@ export async function runLogin(t, p, ports, parentSignal) {
             return url;
         if (typeof url.value !== 'string' || extractLoginUrl(p, url.value) !== url.value)
             return result;
-        lease = await ports.acquireProxy(t, signal);
-        const lost = () => { if (!releasing) {
-            leaseLost = true;
-            controller.abort();
-        } };
-        void lease.closed?.then(lost, lost);
-        if (signal.aborted)
-            throw new NeedError(need(leaseLost ? 'CONNECTION_LOST' : 'LOGIN_FAILED'));
+        let deviceCode;
+        if (p === 'codex') {
+            if (!remote.deviceCode)
+                return result;
+            const device = await Promise.race([remote.deviceCode, cancelled]);
+            if (!device.ok || typeof device.value !== 'string' || !device.value || /[\x00-\x1f\x7f]/.test(device.value))
+                return result;
+            deviceCode = device.value;
+        }
         let codeSent = false, codeError = () => { };
         const failedCode = new Promise(r => codeError = r);
-        window = await ports.open({ provider: p, url: url.value, proxy: { url: lease.url, username: lease.username, password: lease.password } }, async (code) => {
+        const boot = p === 'claude' ? { provider: p, url: url.value } : { provider: p, url: url.value, deviceCode: deviceCode };
+        window = await ports.open(boot, async (code) => {
             if (p !== 'claude' || codeSent || signal.aborted || !validateClaudePaste(url.value, code)) {
                 codeError(fail('LOGIN_FAILED'));
                 return;
@@ -65,17 +67,6 @@ export async function runLogin(t, p, ports, parentSignal) {
         const cleanup = await Promise.allSettled([window?.close(), remote?.close()]);
         if (cleanup.some(r => r.status === 'rejected'))
             result = fail('LOGIN_FAILED');
-        releasing = true;
-        if (lease) {
-            try {
-                await lease.release();
-            }
-            catch (error) {
-                result = error instanceof NeedError ? { ok: false, error: error.need } : fail('LOGIN_FAILED');
-            }
-        }
-        if (leaseLost)
-            result = fail('CONNECTION_LOST');
     }
     return result;
 }

package/lib/needs.js

@@ -1,4 +1,12 @@
 const entries = {
+    REMOTE_DETAIL_INVALID: { layer: 'integration', message: '诊断内容格式无效或含未脱敏认证材料，已拒绝保存。', requires: '有效且已脱敏的诊断与可信连接', actor: 'plugin', action: { id: 'inspect-remote-details', label: '查看技术详情', available: false } },
+    REMOTE_DETAIL_SCOPE_INVALID: { layer: 'integration', message: '诊断内容与当前连接、原生会话或已核验品牌关联不符，已拒绝保存。', requires: '有效且已脱敏的诊断与可信连接', actor: 'plugin', action: { id: 'inspect-remote-details', label: '查看技术详情', available: false } },
+    REMOTE_DETAIL_STORAGE_FAILED: { layer: 'integration', message: '诊断记录无法持久保存或读取，结果无法确认，请联系管理员。', requires: '有效且已脱敏的诊断与可信连接', actor: 'plugin', action: { id: 'inspect-remote-details', label: '查看技术详情', available: false } },
+    REMOTE_DETAIL_TOO_LARGE: { layer: 'integration', message: '诊断事件超过 conversationDetails.maxEventBytes，已拒绝保存，未裁剪。', requires: '有效且已脱敏的诊断与可信连接', actor: 'plugin', action: { id: 'inspect-remote-details', label: '查看技术详情', available: false } },
+    REMOTE_DETAIL_SEQUENCE_INVALID: { layer: 'integration', message: '诊断事件序号没有严格递增，已拒绝保存。', requires: '有效且已脱敏的诊断与可信连接', actor: 'plugin', action: { id: 'inspect-remote-details', label: '查看技术详情', available: false } },
+    REMOTE_DETAIL_CONFLICT: { layer: 'integration', message: '此诊断事件编号已有不同内容，已拒绝保存。', requires: '有效且已脱敏的诊断与可信连接', actor: 'plugin', action: { id: 'inspect-remote-details', label: '查看技术详情', available: false } },
+    REMOTE_DETAIL_CURSOR_INVALID: { layer: 'integration', message: '详情分页位置与当前主机用户、会话、品牌或快照不符，请刷新详情。', requires: '有效且已脱敏的诊断与可信连接', actor: 'plugin', action: { id: 'inspect-remote-details', label: '查看技术详情', available: false } },
+    MODEL_CATALOG_CONTEXT_INVALID: { layer: 'integration', message: '模型目录查询的品牌无效。', requires: '有效且已脱敏的诊断与可信连接', actor: 'plugin', action: { id: 'inspect-remote-details', label: '查看技术详情', available: false } },
     ACTIVATION_CONFLICT: { layer: 'network', message: '已有另一项开通正在进行，已停止重复开通，请联系管理员。', requires: '唯一的开通请求', actor: 'administrator', action: { id: 'inspect-network-enrollment', label: '联系管理员', available: false } },
     ACTIVATION_CANCELLED: { layer: 'network', message: '本次网络开通已取消。', requires: '完成明确的开通操作', actor: 'plugin', action: { id: 'inspect-network-enrollment', label: '联系管理员', available: false } },
     ENROLLMENT_CLEANUP_UNBOUND: { layer: 'network', message: '连接资料与已保存的入网身份不匹配，已停止清理，请联系管理员。', requires: '匹配的入网身份与原始连接资料', actor: 'administrator', action: { id: 'inspect-network-enrollment', label: '联系管理员', available: false } },

package/lib/processes.js

@@ -58,6 +58,29 @@ export async function createRemoteLogin(command, args, provider, maxBytes, signa
     void ownership.catch(() => { });
     let found = () => { };
     const url = new Promise(r => found = r);
+    let foundCode = () => { }, deviceUrlSeen = false, awaitingCode = false, deviceSent = false;
+    const deviceCode = new Promise(r => foundCode = r);
+    const observeDevice = (line, stdout) => {
+        if (provider !== 'codex' || !stdout || deviceSent)
+            return;
+        const text = line.replace(/\x1b\[[0-?]*[ -/]*[@-~]/g, '').trim();
+        if (!deviceUrlSeen) {
+            if (extractLoginUrl('codex', text) === text)
+                deviceUrlSeen = true;
+            return;
+        }
+        if (text === '2. Enter this one-time code (expires in 15 minutes)') {
+            awaitingCode = true;
+            return;
+        }
+        if (awaitingCode && text) {
+            awaitingCode = false;
+            if (!/[\x00-\x1f\x7f]/.test(text) && !text.startsWith('AW_LOGIN_')) {
+                deviceSent = true;
+                foundCode(ok(text));
+            }
+        }
+    };
     const pending = new Map();
     for (const stream of [child.stdout, child.stderr]) {
         const record = { decoder: new StringDecoder('utf8'), line: '' };
@@ -73,6 +96,7 @@ export async function createRemoteLogin(command, args, provider, maxBytes, signa
             const lines = record.line.split(/\r?\n/);
             record.line = lines.pop();
             for (const line of lines) {
+                observeDevice(line, stream === child.stdout);
                 if (protocol && line.startsWith('AW_LOGIN_PROCESS ')) {
                     try {
                         const v = JSON.parse(line.slice(17));
@@ -123,6 +147,8 @@ export async function createRemoteLogin(command, args, provider, maxBytes, signa
         ownReject();
         if (!urlSent)
             found(fail('LOGIN_FAILED'));
+        if (!deviceSent)
+            foundCode(fail('LOGIN_FAILED'));
         signal.removeEventListener('abort', abort);
         resolve(!invalid && !signal.aborted && code === 0 && (!protocol || (owned && terminal?.exitCode === 0 && !terminal.stopping)) ? ok(undefined) : fail('LOGIN_FAILED'));
     }));
@@ -131,9 +157,9 @@ export async function createRemoteLogin(command, args, provider, maxBytes, signa
     if (signal.aborted)
         abort();
     child.stdin.on('error', () => { invalid = true; });
-    return { url, completion, ...(protocol ? { ownership } : {}),
+    return { url, completion, ...(provider === 'codex' ? { deviceCode } : {}), ...(protocol ? { ownership } : {}),
         writeCode: async (code) => {
-            if (signal.aborted || child.exitCode !== null || child.signalCode !== null || child.stdin.writableEnded || /[\x00-\x20\x7f]/.test(code) || !code)
+            if (provider !== 'claude' || signal.aborted || child.exitCode !== null || child.signalCode !== null || child.stdin.writableEnded || /[\x00-\x20\x7f]/.test(code) || !code)
                 throw new Error('LOGIN_CODE_REJECTED');
             await new Promise((yes, no) => { const failed = () => no(new Error('LOGIN_STDIN_FAILED')); child.stdin.once('error', failed); const done = () => { child.stdin.removeListener('error', failed); yes(); }; if (protocol)
                 child.stdin.write(JSON.stringify({ type: 'code', value: code }) + '\n', done);

package/lib/profile-runtime.js

@@ -3,7 +3,10 @@ import { createProfileEnrollment } from "./profile-enrollment.js";
 import { createWorkspaceBindings } from "./workspace-bindings.js";
 import { NeedError, need, fail } from "./needs.js";
 import { createNativeImportPicker } from "./native-import-picker.js";
-import { L_DEFAULTS } from "./defaults.js";
+import { createHash } from 'node:crypto';
+import { readPrivate } from "./private-files.js";
+import { createConversationDetails } from "./conversation-details.js";
+import { CONVERSATION_DETAIL_DEFAULTS, L_DEFAULTS } from "./defaults.js";
 import { createProfileActivation } from "./profile-activation.js";
 // Composition only: consume official services; never provide replacements or alter default entries.
 export function attachProfileRuntime(ctx, api, ports, config, network) {
@@ -37,6 +40,29 @@ export function attachProfileRuntime(ctx, api, ports, config, network) {
                     throw new NeedError(need('DEPENDENCY_REQUIRED'));
                 return (await persistence.list()).find(s => s.header.id === id)?.header;
             }, nextRevision: () => ++workspaceRevision, onState: state => ctx.emit('ai-workbench/workspace-binding-state', state), diagnostic: error => { lastWorkspaceError = error; ctx.emit('ai-workbench/workspace-diagnostic', error); } });
+        const settings = ctx.get('aiWorkbenchConversationDetailSettings');
+        const details = createConversationDetails({ profileDir: profile.dir, get maxEventBytes() { return settings ? settings.values()?.maxEventBytes ?? 0 : config.conversationDetails?.maxEventBytes ?? CONVERSATION_DETAIL_DEFAULTS.maxEventBytes; }, get pageSize() { return settings ? settings.values()?.pageSize ?? 0 : config.conversationDetails?.pageSize ?? CONVERSATION_DETAIL_DEFAULTS.pageSize; }, getConnectionState: api.getConnectionState,
+            context: async () => { const current = api.getModelCatalogTarget('codex'); if (!current.ok)
+                return current; const t = current.value.target; try {
+                const trust = await readPrivate(t.knownHostsFile, config.enrollmentMetadataMaxBytes ?? L_DEFAULTS.enrollmentMetadataMaxBytes);
+                return { ok: true, value: { identity: createHash('sha256').update(JSON.stringify([t.host, t.username, t.port, trust])).digest('hex') } };
+            }
+            catch {
+                return fail('REMOTE_DETAIL_SCOPE_INVALID');
+            } },
+            scope: async (sessionId, provider) => { const current = api.getModelCatalogTarget(provider); if (!current.ok)
+                return current; return bindings.verifyRemoteConversationScope(sessionId, provider, current.value.target); },
+            onState: state => ctx.emit('ai-workbench/remote-conversation-detail-state', state) });
+        api.appendRemoteConversationDetail = details.appendRemoteConversationDetail;
+        api.getRemoteConversationDetailReceipt = details.getRemoteConversationDetailReceipt;
+        api.getRemoteConversationDetailState = details.getRemoteConversationDetailState;
+        api.onRemoteConversationDetailState = details.onRemoteConversationDetailState;
+        api.listRemoteConversationDetails = details.listRemoteConversationDetails;
+        const previousContractInfo = api.getContractInfo, detailContractInfo = () => ({ ...previousContractInfo(), remoteConversationDetails: 1 });
+        api.getContractInfo = detailContractInfo;
+        native.effect(() => { details.observeConnection(api.getConnectionState()); return api.onConnectionState(details.observeConnection); });
+        native.effect(() => () => { if (api.getContractInfo === detailContractInfo)
+            api.getContractInfo = previousContractInfo; return details.dispose(); });
         native.effect(() => api.onConnectionState(bindings.observeConnection));
         api.getWorkspaceBindingState = bindings.getWorkspaceBindingState;
         api.onWorkspaceBindingState = bindings.onWorkspaceBindingState;

package/lib/profile-settings.js

@@ -1,13 +1,13 @@
 import { isAbsolute, join } from 'node:path';
 import { COMPONENT_SOURCES, preset } from "./component-source.js";
-import { L_DEFAULTS, ELECTRON_PIN } from "./defaults.js";
+import { L_DEFAULTS, ELECTRON_PIN, CONVERSATION_DETAIL_DEFAULTS } from "./defaults.js";
 // Owner approved technical values, 2026-10-20 settings decision, part two.
-// 组件直接来自自己的官方地址；OAuth网页仍通过N主机出口。
+// 组件直接下载；Claude网页遵循员工系统网络，Codex暂保留N主机代理。
 export function profileSettings(config, profileDir, platform = process.platform, arch = process.arch) {
     if (typeof profileDir !== 'string' || !isAbsolute(profileDir))
         return config;
     const runtime = platform === 'darwin' && arch === 'arm64' ? { ...ELECTRON_PIN, source: COMPONENT_SOURCES.npmmirror.source } : {};
     const chosen = config.helper?.componentDownloadSource;
     const selected = chosen === undefined ? {} : { source: preset(chosen) ? COMPONENT_SOURCES[chosen].source : '' };
-    return { ...config, commandOutputMaxBytes: config.commandOutputMaxBytes === undefined ? L_DEFAULTS.commandOutputMaxBytes : config.commandOutputMaxBytes, helper: { ...runtime, componentDownloadMaxRedirects: L_DEFAULTS.componentDownloadMaxRedirects, componentObservationIntervalMs: L_DEFAULTS.componentObservationIntervalMs, maxDownloadBytes: L_DEFAULTS.maxDownloadBytes, maxExtractedBytes: L_DEFAULTS.maxExtractedBytes, loginOutputMaxBytes: L_DEFAULTS.loginOutputMaxBytes, ipcMaxBytes: L_DEFAULTS.ipcMaxBytes, remoteKillGraceMs: L_DEFAULTS.remoteKillGraceMs, ...config.helper, ...selected, cacheDir: config.helper?.cacheDir === undefined ? join(profileDir, 'ai-workbench-connect', 'login-component-cache') : config.helper.cacheDir } };
+    return { ...config, conversationDetails: { ...CONVERSATION_DETAIL_DEFAULTS, ...config.conversationDetails }, commandOutputMaxBytes: config.commandOutputMaxBytes === undefined ? L_DEFAULTS.commandOutputMaxBytes : config.commandOutputMaxBytes, helper: { ...runtime, componentDownloadMaxRedirects: L_DEFAULTS.componentDownloadMaxRedirects, componentObservationIntervalMs: L_DEFAULTS.componentObservationIntervalMs, maxDownloadBytes: L_DEFAULTS.maxDownloadBytes, maxExtractedBytes: L_DEFAULTS.maxExtractedBytes, loginOutputMaxBytes: L_DEFAULTS.loginOutputMaxBytes, ipcMaxBytes: L_DEFAULTS.ipcMaxBytes, remoteKillGraceMs: L_DEFAULTS.remoteKillGraceMs, ...config.helper, ...selected, cacheDir: config.helper?.cacheDir === undefined ? join(profileDir, 'ai-workbench-connect', 'login-component-cache') : config.helper.cacheDir } };
 }

package/lib/workspace-bindings.d.ts

@@ -1,4 +1,4 @@
-import type { ConnectApi, SessionProjectTarget, Result, ConnectionState, WorkspaceBindingState, WorkspaceNoticeReceipt, WorkspaceUse } from './api.ts';
+import type { ConnectApi, SessionProjectTarget, Result, ConnectionState, WorkspaceBindingState, WorkspaceNoticeReceipt, WorkspaceUse, Provider, SshTarget } from './api.ts';
 export interface NativeWorkspace {
     id: string;
     path: string;
@@ -25,6 +25,9 @@ export interface WorkspaceBindingOptions {
 export declare function createWorkspaceBindings(options: WorkspaceBindingOptions): {
     observeConnection(state: ConnectionState): void;
     dispose(): Promise<unknown>;
+    verifyRemoteConversationScope: (sessionId: string, provider: Provider, target: SshTarget) => Promise<Result<{
+        identity: string;
+    }>>;
     getWorkspaceBindingState: () => WorkspaceBindingState;
     onWorkspaceBindingState(listener: (state: WorkspaceBindingState) => void): () => void;
     acknowledgeWorkspaceNotice: (receipt: WorkspaceNoticeReceipt) => Promise<Result<void>>;

package/lib/workspace-bindings.js

@@ -8,7 +8,7 @@ import { ok, fail, NeedError, need } from "./needs.js";
 const queues = new Map();
 const hash = (v) => createHash('sha256').update(JSON.stringify(v)).digest('hex');
 const token = (v) => typeof v === 'string' && v.length > 0 && !/[\x00-\x1f\x7f]/.test(v);
-const integrity = (r) => hash([r.identity, r.workspaceId, r.localPath, r.localDev, r.localIno, r.project, r.bindingId, r.noticeId, r.sessionIds]);
+const integrity = (r) => hash([r.identity, r.workspaceId, r.localPath, r.localDev, r.localIno, r.project, r.bindingId, r.noticeId, r.sessionIds, ...(r.accepted === undefined ? [] : [r.accepted])]);
 export function createWorkspaceBindings(options) {
     const root = join(options.profileDir, 'ai-workbench-connect'), file = join(root, 'workspaces.json'), owner = randomUUID();
     let revision = 0, disposed = false, tail = Promise.resolve(), snapshot = { instanceId: options.api.getConnectionState().instanceId, revision: 0, items: [] };
@@ -52,6 +52,8 @@ export function createWorkspaceBindings(options) {
                 throw Error('BINDING_INVALID');
             if (r.provider === 'pending' ? r.claim !== undefined : (!r.claim || !token(r.claim.id) || !token(r.claim.sessionId) || !['claude', 'codex'].includes(r.claim.provider) || !token(r.claim.owner) || (r.provider === 'delivered' && !token(r.claim.deliveryId))))
                 throw Error('BINDING_CLAIM_INVALID');
+            if (r.accepted !== undefined && (!Array.isArray(r.accepted) || r.accepted.some(a => !r.sessionIds.includes(a.sessionId) || !['claude', 'codex'].includes(a.provider)) || new Set(r.accepted.map(a => a.sessionId + '\0' + a.provider)).size !== r.accepted.length))
+                throw Error('BINDING_ACCEPTANCE_INVALID');
             ids.add(r.workspaceId);
             paths.add(r.identity + '\0' + r.project.path);
             notices.add(r.noticeId);
@@ -249,6 +251,12 @@ export function createWorkspaceBindings(options) {
                 return stale();
             if (!sameNative(current, await native(sessionId)))
                 throw new NeedError(need('PROJECT_BINDING_INVALID'));
+            if (!same(before))
+                return stale();
+            binding.accepted ??= [];
+            if (!binding.accepted.some(a => a.sessionId === sessionId && a.provider === use.provider))
+                binding.accepted.push({ sessionId, provider: use.provider });
+            await save(stored);
             if (!same(before))
                 return stale();
             publish(stored);
@@ -306,6 +314,47 @@ export function createWorkspaceBindings(options) {
             return fail('PROJECT_BINDING_INVALID');
         }
     }
+    // Pure verification: never resolves a project, checks login, creates or claims a notice.
+    async function verifyRemoteConversationScope(sessionId, provider, target) {
+        const before = options.api.getConnectionState();
+        if (!same(before))
+            return stale();
+        if (!token(sessionId) || !['claude', 'codex'].includes(provider))
+            return fail('REMOTE_DETAIL_SCOPE_INVALID');
+        try {
+            if (!isAbsolute(options.profileDir) || await realpath(options.profileDir) !== options.profileDir)
+                return fail('REMOTE_DETAIL_SCOPE_INVALID');
+            if (!same(before))
+                return stale();
+            const directory = await lstat(root);
+            if (!same(before))
+                return stale();
+            if (!directory.isDirectory() || directory.isSymbolicLink() || await realpath(root) !== root)
+                return fail('REMOTE_DETAIL_SCOPE_INVALID');
+            if (!same(before))
+                return stale();
+            const stored = await records();
+            if (!same(before))
+                return stale();
+            const binding = stored.find(r => r.sessionIds.includes(sessionId));
+            if (!binding || binding.phase !== 'bound' || statuses.get(binding.bindingId) === 'invalid' || !binding.accepted?.some(a => a.sessionId === sessionId && a.provider === provider))
+                return fail('REMOTE_DETAIL_SCOPE_INVALID');
+            const trust = await readPrivate(target.knownHostsFile, options.metadataMaxBytes);
+            if (!same(before))
+                return stale();
+            if (binding.identity !== hash([target.host, target.username, target.port, target.projectRoot, target.session, trust]))
+                return fail('REMOTE_DETAIL_SCOPE_INVALID');
+            const current = await native(sessionId);
+            if (!same(before))
+                return stale();
+            if (binding.workspaceId !== current.workspaceId || binding.localPath !== current.localPath || binding.localDev !== current.localDev || binding.localIno !== current.localIno || binding.project.name !== current.name || binding.project.path !== target.projectRoot + '/' + current.name)
+                return fail('REMOTE_DETAIL_SCOPE_INVALID');
+            return ok({ identity: hash([target.host, target.username, target.port, trust]) });
+        }
+        catch {
+            return same(before) ? fail('REMOTE_DETAIL_SCOPE_INVALID') : stale();
+        }
+    }
     // Loading metadata never resolves a remote project or creates either a local or remote directory.
     void serialized(async () => { try {
         await prepare();
@@ -320,6 +369,7 @@ export function createWorkspaceBindings(options) {
             if (status === 'ready')
                 statuses.set(id, 'unavailable'); publish(latest); },
         dispose() { disposed = true; listeners.clear(); return tail; },
+        verifyRemoteConversationScope: (sessionId, provider, target) => serialized(() => verifyRemoteConversationScope(sessionId, provider, target)),
         getWorkspaceBindingState: () => structuredClone(snapshot),
         onWorkspaceBindingState(listener) { listeners.add(listener); return () => { listeners.delete(listener); }; },
         acknowledgeWorkspaceNotice: (receipt) => serialized(() => acknowledge(receipt)),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-workbench/connect",
-  "version": "0.7.6",
+  "version": "0.7.9",
   "type": "module",
   "engines": {
     "node": ">=24.13.1"