@aipoch/open-science 0.0.0-stage → 1.0.2

package/codex-login.mjs

@@ -0,0 +1,298 @@
+/* eslint-disable @typescript-eslint/explicit-function-return-type */
+
+import { spawn } from 'node:child_process'
+import { access, mkdir, readFile } from 'node:fs/promises'
+import { isAbsolute, join, normalize } from 'node:path'
+
+import { resolveConfigRoot } from './config-root.mjs'
+import { locateBackend } from './locate-backend.mjs'
+import { connectToOpenScience } from './index.mjs'
+
+const CODEX_CONFIG_OVERRIDE = 'cli_auth_credentials_store="file"'
+const CODEX_ENV_KEYS = [
+  'CODEX_API_KEY',
+  'OPENAI_API_KEY',
+  'CODEX_CONFIG',
+  'CODEX_HOME',
+  'CODEX_PATH',
+  'DEFAULT_AUTH_REQUEST',
+  'HOME',
+  'MODEL_PROVIDER',
+  'NO_BROWSER',
+  'USERPROFILE'
+]
+const PROXY_ENV_KEYS = [
+  'HTTP_PROXY',
+  'HTTPS_PROXY',
+  'http_proxy',
+  'https_proxy',
+  'ALL_PROXY',
+  'all_proxy',
+  'NO_PROXY',
+  'no_proxy'
+]
+const PROXY_SERVER_ENV_KEYS = PROXY_ENV_KEYS.slice(0, 6)
+const LOOPBACK_PROXY_BYPASS = [
+  'localhost',
+  '.localhost',
+  '127.0.0.1',
+  '127.0.0.0/8',
+  '::1',
+  '[::1]'
+]
+const SUPPORTED_PROXY_PROTOCOLS = new Set(['http:', 'https:', 'socks:', 'socks4:', 'socks5:'])
+
+export class CodexLoginError extends Error {
+  constructor(message, code = 'codex_login_failed', exitCode = 1) {
+    super(message)
+    this.name = 'CodexLoginError'
+    this.code = code
+    this.exitCode = exitCode
+  }
+}
+
+const normalizedProxySettings = (value) => {
+  if (!value || typeof value !== 'object') return { mode: 'system' }
+  if (value.mode === 'direct') return { mode: 'direct' }
+  if (value.mode !== 'manual' || typeof value.server !== 'string') return { mode: 'system' }
+
+  try {
+    const url = new URL(value.server.trim())
+    if (
+      !SUPPORTED_PROXY_PROTOCOLS.has(url.protocol) ||
+      !url.hostname ||
+      url.username ||
+      url.password ||
+      (url.pathname !== '' && url.pathname !== '/') ||
+      url.search ||
+      url.hash
+    ) {
+      return { mode: 'system' }
+    }
+    const bypassRules =
+      typeof value.bypassRules === 'string'
+        ? value.bypassRules
+            .split(/[,;\n]/)
+            .map((entry) => entry.trim())
+            .filter(Boolean)
+        : []
+    return {
+      mode: 'manual',
+      server: `${url.protocol}//${url.host}`,
+      bypassRules
+    }
+  } catch {
+    return { mode: 'system' }
+  }
+}
+
+const withLoopbackProxyBypass = (env, configuredRules = []) => {
+  const inheritedRules = [env.NO_PROXY, env.no_proxy]
+    .flatMap((value) => value?.split(',') ?? [])
+    .map((entry) => entry.trim())
+    .filter(Boolean)
+  const bypass = [
+    ...new Set([...configuredRules, ...inheritedRules, ...LOOPBACK_PROXY_BYPASS])
+  ].join(',')
+  env.NO_PROXY = bypass
+  env.no_proxy = bypass
+}
+
+export const applyCodexLoginProxyPolicy = (env, value) => {
+  const settings = normalizedProxySettings(value)
+  if (settings.mode === 'system') {
+    if (PROXY_SERVER_ENV_KEYS.some((key) => Boolean(env[key]))) withLoopbackProxyBypass(env)
+    return env
+  }
+
+  for (const key of PROXY_ENV_KEYS) delete env[key]
+  if (settings.mode === 'direct') return env
+
+  for (const key of PROXY_SERVER_ENV_KEYS) env[key] = settings.server
+  withLoopbackProxyBypass(env, settings.bypassRules)
+  return env
+}
+
+export const createCodexLoginEnvironment = (
+  codexHome,
+  sourceEnv = process.env,
+  platform = process.platform,
+  networkProxy
+) => {
+  const env = { ...sourceEnv }
+  for (const key of CODEX_ENV_KEYS) delete env[key]
+  env.CODEX_HOME = codexHome
+  env.HOME = codexHome
+  if (platform === 'win32') env.USERPROFILE = codexHome
+  return applyCodexLoginProxyPolicy(env, networkProxy)
+}
+
+export const resolveCodexLoginConfiguration = async (configRoot, dependencies = {}) => {
+  const deps = {
+    readFile: (path) => readFile(path, 'utf8'),
+    access: (path) => access(path),
+    ...dependencies
+  }
+  let settings
+  try {
+    settings = JSON.parse(await deps.readFile(join(configRoot, 'settings.json')))
+  } catch (error) {
+    if (error?.code === 'ENOENT') {
+      throw new CodexLoginError(
+        'Codex is not configured for this Open-Science profile. Configure the Codex runtime first.',
+        'codex_not_configured'
+      )
+    }
+    throw new CodexLoginError(
+      'Open-Science could not read the configured Codex runtime.',
+      'codex_configuration_invalid'
+    )
+  }
+
+  const nativePath =
+    typeof settings?.codex?.nativePath === 'string' ? settings.codex.nativePath.trim() : ''
+  if (!nativePath || !isAbsolute(nativePath)) {
+    throw new CodexLoginError(
+      'The configured Codex runtime has no native CLI path. Repair the Codex installation first.',
+      'codex_not_configured'
+    )
+  }
+
+  const resolvedPath = normalize(nativePath)
+  try {
+    await deps.access(resolvedPath)
+  } catch {
+    throw new CodexLoginError(
+      'The configured Codex CLI does not exist: ' + resolvedPath,
+      'codex_not_found'
+    )
+  }
+  return { codexPath: resolvedPath, networkProxy: settings.networkProxy }
+}
+
+export const resolveConfiguredCodexNativePath = async (configRoot, dependencies = {}) =>
+  (await resolveCodexLoginConfiguration(configRoot, dependencies)).codexPath
+
+export const runCodexProcess = (codexPath, args, options = {}) =>
+  new Promise((resolveRun, rejectRun) => {
+    const needsShell = process.platform === 'win32' && /\.(?:cmd|bat)$/i.test(codexPath)
+    const child = spawn(needsShell ? '"' + codexPath + '"' : codexPath, args, {
+      env: options.env,
+      shell: needsShell,
+      stdio: options.inherit ? 'inherit' : ['ignore', 'pipe', 'pipe'],
+      windowsHide: true
+    })
+    let stdout = ''
+    let stderr = ''
+    if (!options.inherit) {
+      child.stdout?.setEncoding('utf8')
+      child.stderr?.setEncoding('utf8')
+      child.stdout?.on('data', (chunk) => {
+        stdout += chunk
+      })
+      child.stderr?.on('data', (chunk) => {
+        stderr += chunk
+      })
+    }
+    child.once('error', rejectRun)
+    child.once('exit', (code, signal) => resolveRun({ code, signal, stdout, stderr }))
+  })
+
+const DEFAULT_DEPS = {
+  connect: connectToOpenScience,
+  locateBackend: () => locateBackend({ required: false }),
+  resolveConfigRoot: (options) => resolveConfigRoot(options),
+  resolveConfiguration: (configRoot) => resolveCodexLoginConfiguration(configRoot),
+  mkdir: (path) => mkdir(path, { recursive: true }),
+  runCodex: runCodexProcess,
+  log: (...args) => console.log(...args)
+}
+
+export const codexLoginCommand = async (options, dependencies = {}) => {
+  const deps = { ...DEFAULT_DEPS, ...dependencies }
+  const backend = await deps.locateBackend()
+  const configRoot = deps.resolveConfigRoot({
+    packaged: !backend.development,
+    override: options.configRoot
+  })
+  let client
+  try {
+    client = await deps.connect({ configRoot })
+  } catch (error) {
+    if (error?.code !== 'daemon_unavailable' || error?.status !== undefined) throw error
+    // Already-configured profiles retain offline terminal login. First-run writes need the owner.
+    try {
+      await deps.resolveConfiguration(configRoot)
+    } catch {
+      throw new CodexLoginError(
+        'Start Open-Science first: open-science start --no-open; then retry codex login.',
+        'daemon_unavailable'
+      )
+    }
+  }
+  const bootstrap = async (action) => {
+    if (!client) return
+    const result = await client.bootstrap({ action }, { timeoutMs: 600_000 })
+    if (!result.ok) throw new CodexLoginError(`Codex setup failed: ${result.code}.`, result.code)
+  }
+  try {
+    await bootstrap('codex-prepare')
+  } catch (error) {
+    if (error?.status !== 404) throw error
+    // Older daemons cannot register readiness, but configured native login remains available.
+    try {
+      await deps.resolveConfiguration(configRoot)
+    } catch {
+      throw new CodexLoginError(
+        'Update and restart Open-Science before setting up Codex for this profile.',
+        'bootstrap_unavailable'
+      )
+    }
+    client = undefined
+  }
+  const complete = async () => {
+    if (client) await bootstrap('codex-complete')
+    else
+      deps.log(
+        'Sign-in saved. Use a running, updated Open-Science daemon and run codex login again to validate and activate the provider.'
+      )
+  }
+  const { codexPath, networkProxy } = await deps.resolveConfiguration(configRoot)
+  const codexHome = join(configRoot, 'codex-subscription')
+  await deps.mkdir(codexHome)
+  const env = createCodexLoginEnvironment(codexHome, process.env, process.platform, networkProxy)
+  const baseArgs = ['-c', CODEX_CONFIG_OVERRIDE, 'login']
+
+  if (!options.force) {
+    const status = await deps.runCodex(codexPath, [...baseArgs, 'status'], {
+      env,
+      inherit: false
+    })
+    if (status.code === 0) {
+      await complete()
+      deps.log(
+        'Codex is already signed in for Open-Science. Use "open-science codex login --force" to sign in again.'
+      )
+      return
+    }
+    if (status.code !== 1 || status.signal) {
+      throw new CodexLoginError('Open-Science could not check the existing Codex sign-in.')
+    }
+  }
+
+  deps.log('Starting Codex device-code sign-in. Keep this terminal open until it completes...')
+  const login = await deps.runCodex(codexPath, [...baseArgs, '--device-auth'], {
+    env,
+    inherit: true
+  })
+  if (login.code !== 0 || login.signal) {
+    const suffix = login.signal ? ' after receiving ' + login.signal : ''
+    throw new CodexLoginError(
+      'Codex device-code sign-in did not complete' + suffix + '.',
+      'codex_login_failed',
+      login.code ?? 1
+    )
+  }
+  await complete()
+  deps.log('Codex is signed in for Open-Science.')
+}

package/config-root.mjs

@@ -0,0 +1,65 @@
+/* eslint-disable @typescript-eslint/explicit-function-return-type */
+
+import { access, readFile } from 'node:fs/promises'
+import { homedir } from 'node:os'
+import { isAbsolute, join, normalize } from 'node:path'
+
+export const DEV_CONFIG_DIR = '.open-science-project'
+export const PROD_CONFIG_DIR = '.open-science'
+export const STATE_FILE = 'web-service.json'
+export const TOKEN_FILE = 'web-token'
+
+const exists = async (path) => {
+  try {
+    await access(path)
+    return true
+  } catch {
+    return false
+  }
+}
+
+export const resolveConfigRoot = ({ packaged = false, override, env = process.env } = {}) => {
+  const requested = override ?? env.OPEN_SCIENCE_CONFIG_ROOT ?? env.OPEN_SCIENCE_STORAGE_ROOT
+  if (requested) {
+    if (!isAbsolute(requested)) throw new Error('The config root must be an absolute path.')
+    return normalize(requested)
+  }
+  return join(homedir(), packaged ? PROD_CONFIG_DIR : DEV_CONFIG_DIR)
+}
+
+export const candidateConfigRoots = ({ override, env = process.env } = {}) => {
+  if (override ?? env.OPEN_SCIENCE_CONFIG_ROOT ?? env.OPEN_SCIENCE_STORAGE_ROOT) {
+    return [resolveConfigRoot({ override, env })]
+  }
+  return [resolveConfigRoot({ packaged: false, env }), resolveConfigRoot({ packaged: true, env })]
+}
+
+export const readStateFromRoot = async (configRoot) => {
+  try {
+    const state = JSON.parse(await readFile(join(configRoot, STATE_FILE), 'utf8'))
+    if (
+      !Number.isInteger(state.pid) ||
+      !Number.isInteger(state.port) ||
+      typeof state.startedAt !== 'string'
+    ) {
+      return undefined
+    }
+    // The containing directory owns both the state and token. A stale or edited payload must not
+    // redirect credential reads or cleanup outside the enumerated candidate.
+    return { ...state, configRoot }
+  } catch {
+    return undefined
+  }
+}
+
+export const findServiceState = async (options = {}) => {
+  for (const configRoot of candidateConfigRoots(options)) {
+    if (!(await exists(join(configRoot, STATE_FILE)))) continue
+    const state = await readStateFromRoot(configRoot)
+    if (state && (!options.accept || (await options.accept(state)))) return state
+  }
+  return undefined
+}
+
+export const readWebToken = async (configRoot) =>
+  (await readFile(join(configRoot, TOKEN_FILE), 'utf8')).trim()