@armadra/agent 0.5.0 → 0.6.0

package/dist/auth/oauth/token-store.js

@@ -0,0 +1,125 @@
+/**
+ * OAuth 条目的存取与跨进程刷新锁（docs/wave6-plan.md §4.3、D15）。[W6-O]
+ *
+ * - 读：每次都从磁盘读（绕过 `ApiKeyResolver.fileCache`，长会话才能看到别的进程刷新后的 token）；文件不存在 /
+ *   坏掉 / 不是 oauth 条目 → undefined；
+ * - 写：读-改-写 `auth.json` 整个文件，经 `writeAuthFile`（同目录临时文件 0600 → rename → chmod），其它条目原样保留；
+ * - 锁：`<auth.json>.lock`，`open(O_CREAT|O_EXCL)`（flag `wx`）写 `{ pid, at }`；等待 ≤ 15 s；锁文件超过 60 s 且
+ *   pid 已死视为陈旧，删除后重试。取锁后由调用方**重读文件**再决定要不要刷新。
+ */
+import { closeSync, mkdirSync, openSync, readFileSync, statSync, unlinkSync, writeSync, } from "node:fs";
+import { dirname } from "node:path";
+import { writeAuthFile } from "../../config/auth-file.js";
+import { CONFIG_FILE_VERSION } from "../../config/types.js";
+import { isOAuthEntry } from "../../config/types-w6.js";
+import { AmaError } from "../../errors.js";
+export const LOCK_WAIT_MS = 15_000;
+export const LOCK_STALE_MS = 60_000;
+const LOCK_POLL_MS = 50;
+function readRaw(path) {
+    try {
+        const value = JSON.parse(readFileSync(path, "utf8"));
+        return typeof value === "object" && value !== null && typeof value.providers === "object"
+            ? value
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function readOAuthEntry(path, provider) {
+    const entry = readRaw(path)?.providers?.[provider];
+    return isOAuthEntry(entry) ? entry : undefined;
+}
+/** 写入（`undefined` 删除）该供应商的条目，其余条目不动。 */
+export function writeOAuthEntry(path, provider, entry) {
+    const file = readRaw(path) ?? { version: CONFIG_FILE_VERSION, providers: {} };
+    const providers = { ...file.providers };
+    if (entry === undefined)
+        delete providers[provider];
+    else
+        providers[provider] = entry;
+    writeAuthFile(path, { ...file, version: file.version ?? CONFIG_FILE_VERSION, providers });
+}
+export function lockPath(authFile) {
+    return `${authFile}.lock`;
+}
+function pidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === "EPERM";
+    }
+}
+/** 锁文件陈旧：超过 60 s 且写锁的进程已不在。 */
+export function isStaleLock(path, now = Date.now()) {
+    let age;
+    let pid;
+    try {
+        age = now - statSync(path).mtimeMs;
+        const value = JSON.parse(readFileSync(path, "utf8"));
+        pid = typeof value.pid === "number" ? value.pid : undefined;
+    }
+    catch {
+        // 读不到内容（正在写或已删）：只按时间判断
+        try {
+            age = now - statSync(path).mtimeMs;
+        }
+        catch {
+            return false;
+        }
+    }
+    return age > LOCK_STALE_MS && (pid === undefined || !pidAlive(pid));
+}
+function tryAcquire(path) {
+    try {
+        const fd = openSync(path, "wx", 0o600);
+        try {
+            writeSync(fd, JSON.stringify({ pid: process.pid, at: new Date().toISOString() }));
+        }
+        finally {
+            closeSync(fd);
+        }
+        return true;
+    }
+    catch (error) {
+        if (error.code === "EEXIST")
+            return false;
+        throw error;
+    }
+}
+/** 在 `auth.json.lock` 下执行 `fn`；等不到锁抛 `auth_lock_timeout`。 */
+export async function withRefreshLock(authFile, fn, options = {}) {
+    const path = lockPath(authFile);
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    const deadline = Date.now() + (options.waitMs ?? LOCK_WAIT_MS);
+    for (;;) {
+        if (tryAcquire(path))
+            break;
+        if (isStaleLock(path)) {
+            try {
+                unlinkSync(path);
+            }
+            catch {
+                // 别人先删了
+            }
+            continue;
+        }
+        if (Date.now() >= deadline)
+            throw new AmaError("auth_lock_timeout", `timed out waiting for ${path}`);
+        await new Promise((r) => setTimeout(r, LOCK_POLL_MS + Math.floor(Math.random() * LOCK_POLL_MS)));
+    }
+    try {
+        return await fn();
+    }
+    finally {
+        try {
+            unlinkSync(path);
+        }
+        catch {
+            // 已被当成陈旧锁删掉
+        }
+    }
+}

package/dist/auth/testing/fake-oauth.d.ts

@@ -0,0 +1,73 @@
+/**
+ * 测试用 fake OAuth / ChatGPT 后端（docs/wave6-plan.md §4.6）。`node:http` 随机端口；不进 bundle。
+ *
+ * OAuth：authorize（记参数、302 回 redirect_uri；SIWC 注册时带签发的 client_id 与 scope）、token（校验 PKCE；
+ * 授权码 / 刷新；刷新轮换，旧 refresh token 再用 → `refresh_token_reused`）、deviceauth、discovery + JWKS
+ * （现场生成 RSA 密钥对）、revoke。后端：`/v1/responses`、`/codex/responses`、`/v1/models`、`/codex/models`、
+ * `/wham/usage`，按脚本回放。
+ */
+export interface RecordedRequest {
+    method: string;
+    path: string;
+    headers: Record<string, string | string[] | undefined>;
+    body: string;
+    query: URLSearchParams;
+}
+export interface ScriptedResponse {
+    status?: number;
+    headers?: Record<string, string>;
+    /** SSE 事件（JSON 对象）或原始文本。 */
+    events?: unknown[];
+    body?: unknown;
+}
+export interface FakeOAuthOptions {
+    /** SIWC 注册时签发的 id。 */
+    issuedClientId?: string;
+    /** 回调与 token 响应里的 scope；缺省含 chatgpt.tokens.use.direct。 */
+    scope?: string;
+    accessTtlS?: number;
+    /** 改 id_token 声明（坏 nonce 等）。 */
+    idTokenClaims?: (claims: Record<string, unknown>) => Record<string, unknown>;
+    /** 用另一把钥签 id_token（验签失败）。 */
+    wrongKey?: boolean;
+    /** 刷新响应延迟（并发测试）。 */
+    refreshDelayMs?: number;
+    /** 刷新直接失败的错误码。 */
+    refreshError?: string;
+    /** 设备码轮询先返回几次 403。 */
+    devicePending?: number;
+    marker?: string;
+}
+export declare class FakeOAuthServer {
+    readonly options: FakeOAuthOptions;
+    readonly requests: RecordedRequest[];
+    readonly responses: ScriptedResponse[];
+    readonly revoked: string[];
+    refreshCalls: number;
+    exchangeCalls: number;
+    issuer: string;
+    private server;
+    private readonly key;
+    private readonly otherKey;
+    private readonly codes;
+    private current;
+    private readonly used;
+    private seq;
+    private devicePolls;
+    constructor(options?: FakeOAuthOptions);
+    start(): Promise<string>;
+    stop(): Promise<void>;
+    get marker(): string;
+    /** 预置一个可刷新的 refresh token（不经登录）。 */
+    seedRefreshToken(token: string, clientId: string): void;
+    private next;
+    idToken(claims: Record<string, unknown>): string;
+    private tokens;
+    private get scope();
+    private handle;
+    private backend;
+}
+/** 一段最小的成功 SSE（一个文本块）。 */
+export declare function completedEvents(text: string, extra?: unknown[]): unknown[];
+/** 跟随 302 打到本地回调（代替浏览器）。 */
+export declare function followAuthorize(url: string): Promise<void>;

package/dist/auth/testing/fake-oauth.js

@@ -0,0 +1,271 @@
+/**
+ * 测试用 fake OAuth / ChatGPT 后端（docs/wave6-plan.md §4.6）。`node:http` 随机端口；不进 bundle。
+ *
+ * OAuth：authorize（记参数、302 回 redirect_uri；SIWC 注册时带签发的 client_id 与 scope）、token（校验 PKCE；
+ * 授权码 / 刷新；刷新轮换，旧 refresh token 再用 → `refresh_token_reused`）、deviceauth、discovery + JWKS
+ * （现场生成 RSA 密钥对）、revoke。后端：`/v1/responses`、`/codex/responses`、`/v1/models`、`/codex/models`、
+ * `/wham/usage`，按脚本回放。
+ */
+import { createHash, generateKeyPairSync, randomBytes, sign } from "node:crypto";
+import { createServer } from "node:http";
+function b64url(value) {
+    return Buffer.from(JSON.stringify(value)).toString("base64url");
+}
+export class FakeOAuthServer {
+    options;
+    requests = [];
+    responses = [];
+    revoked = [];
+    refreshCalls = 0;
+    exchangeCalls = 0;
+    issuer = "";
+    server;
+    key;
+    otherKey;
+    codes = new Map();
+    current = new Map(); // refresh token → client id
+    used = new Set();
+    seq = 0;
+    devicePolls = 0;
+    constructor(options = {}) {
+        this.options = options;
+        this.key = generateKeyPairSync("rsa", { modulusLength: 2048 });
+        this.otherKey = generateKeyPairSync("rsa", { modulusLength: 2048 }).privateKey;
+    }
+    async start() {
+        this.server = createServer((req, res) => void this.handle(req, res));
+        await new Promise((resolve) => this.server?.listen(0, "127.0.0.1", resolve));
+        const address = this.server.address();
+        const port = typeof address === "object" && address !== null ? address.port : 0;
+        this.issuer = `http://127.0.0.1:${port}`;
+        return this.issuer;
+    }
+    async stop() {
+        this.server?.closeAllConnections();
+        await new Promise((resolve) => this.server?.close(resolve));
+    }
+    get marker() {
+        return this.options.marker ?? "MARK";
+    }
+    /** 预置一个可刷新的 refresh token（不经登录）。 */
+    seedRefreshToken(token, clientId) {
+        this.current.set(token, clientId);
+    }
+    next(prefix) {
+        this.seq++;
+        return `${prefix}-${this.seq}-${this.marker}-${randomBytes(4).toString("hex")}`;
+    }
+    idToken(claims) {
+        const header = { alg: "RS256", kid: "k1", typ: "JWT" };
+        const final = this.options.idTokenClaims ? this.options.idTokenClaims(claims) : claims;
+        const input = `${b64url(header)}.${b64url(final)}`;
+        const key = this.options.wrongKey ? this.otherKey : this.key.privateKey;
+        return `${input}.${sign("sha256", Buffer.from(input), key).toString("base64url")}`;
+    }
+    tokens(clientId, nonce) {
+        const refresh = this.next("rt");
+        this.current.set(refresh, clientId);
+        const now = Math.floor(Date.now() / 1000);
+        return {
+            access_token: this.next("at"),
+            refresh_token: refresh,
+            id_token: this.idToken({
+                iss: this.issuer,
+                aud: clientId,
+                sub: "user-sub-1",
+                nonce,
+                exp: now + 3600,
+                iat: now,
+                email: "alice@example.com",
+                "https://api.openai.com/auth": { chatgpt_account_id: "acct-1", chatgpt_plan_type: "plus" },
+            }),
+            token_type: "Bearer",
+            expires_in: this.options.accessTtlS ?? 3600,
+            scope: this.scope,
+        };
+    }
+    get scope() {
+        return (this.options.scope ??
+            "openid profile email offline_access resource.invoke chatgpt.tokens.use.direct");
+    }
+    async handle(req, res) {
+        const chunks = [];
+        for await (const chunk of req)
+            chunks.push(chunk);
+        const body = Buffer.concat(chunks).toString("utf8");
+        const url = new URL(req.url ?? "/", this.issuer);
+        const record = {
+            method: req.method ?? "GET",
+            path: url.pathname,
+            headers: req.headers,
+            body,
+            query: url.searchParams,
+        };
+        this.requests.push(record);
+        const json = (status, value, headers = {}) => {
+            res.writeHead(status, { "content-type": "application/json", ...headers });
+            res.end(JSON.stringify(value));
+        };
+        const params = () => String(req.headers["content-type"]).includes("json")
+            ? JSON.parse(body || "{}")
+            : Object.fromEntries(new URLSearchParams(body));
+        switch (url.pathname) {
+            case "/.well-known/openid-configuration":
+                return json(200, {
+                    issuer: this.issuer,
+                    jwks_uri: `${this.issuer}/jwks`,
+                    revocation_endpoint: `${this.issuer}/revoke`,
+                });
+            case "/jwks":
+                return json(200, {
+                    keys: [
+                        {
+                            ...this.key.publicKey.export({ format: "jwk" }),
+                            kid: "k1",
+                            use: "sig",
+                            alg: "RS256",
+                        },
+                    ],
+                });
+            case "/api/accounts/authorize":
+            case "/oauth/authorize": {
+                const q = url.searchParams;
+                const code = this.next("code");
+                const registering = q.get("client_id") === "dynamic_agent_client";
+                const clientId = registering
+                    ? (this.options.issuedClientId ?? "oaiapp_issued")
+                    : (q.get("client_id") ?? "");
+                this.codes.set(code, {
+                    challenge: q.get("code_challenge") ?? "",
+                    nonce: q.get("nonce") ?? "",
+                    clientId,
+                    redirectUri: q.get("redirect_uri") ?? "",
+                });
+                const back = new URL(q.get("redirect_uri") ?? "");
+                back.searchParams.set("code", code);
+                back.searchParams.set("state", q.get("state") ?? "");
+                if (url.pathname.startsWith("/api/")) {
+                    if (registering)
+                        back.searchParams.set("client_id", clientId);
+                    back.searchParams.set("scope", this.scope);
+                }
+                res.writeHead(302, { location: back.toString() }).end();
+                return;
+            }
+            case "/api/accounts/oauth/token":
+            case "/oauth/token": {
+                const p = params();
+                if (p["grant_type"] === "authorization_code") {
+                    this.exchangeCalls++;
+                    const saved = this.codes.get(p["code"] ?? "");
+                    if (!saved)
+                        return json(400, { error: "invalid_grant" });
+                    const challenge = createHash("sha256")
+                        .update(p["code_verifier"] ?? "")
+                        .digest("base64url");
+                    if (challenge !== saved.challenge)
+                        return json(400, { error: "invalid_grant" });
+                    if (p["redirect_uri"] !== saved.redirectUri)
+                        return json(400, { error: "invalid_grant" });
+                    if (p["client_id"] !== saved.clientId)
+                        return json(400, { error: "invalid_client" });
+                    this.codes.delete(p["code"] ?? "");
+                    return json(200, this.tokens(saved.clientId, saved.nonce));
+                }
+                if (p["grant_type"] === "refresh_token") {
+                    this.refreshCalls++;
+                    if (this.options.refreshDelayMs)
+                        await new Promise((r) => setTimeout(r, this.options.refreshDelayMs));
+                    if (this.options.refreshError)
+                        return json(400, { error: this.options.refreshError });
+                    const token = p["refresh_token"] ?? "";
+                    if (this.used.has(token))
+                        return json(400, { error: "refresh_token_reused" });
+                    const clientId = this.current.get(token);
+                    if (clientId === undefined)
+                        return json(400, { error: "invalid_grant" });
+                    this.used.add(token);
+                    this.current.delete(token);
+                    const out = this.tokens(clientId, "");
+                    delete out["id_token"];
+                    return json(200, out);
+                }
+                return json(400, { error: "unsupported_grant_type" });
+            }
+            case "/api/accounts/deviceauth/usercode":
+                return json(200, { device_auth_id: "dev-1", user_code: "ABCD-1234", interval: "1" });
+            case "/api/accounts/deviceauth/token": {
+                this.devicePolls++;
+                if (this.devicePolls <= (this.options.devicePending ?? 1))
+                    return json(403, { error: "authorization_pending" });
+                const code = this.next("code");
+                const verifier = "device-verifier-0123456789abcdef0123456789abcdef";
+                this.codes.set(code, {
+                    challenge: createHash("sha256").update(verifier).digest("base64url"),
+                    nonce: "",
+                    clientId: "app_EMoamEEZ73f0CkXaXp7hrann",
+                    redirectUri: `${this.issuer}/deviceauth/callback`,
+                });
+                return json(200, {
+                    authorization_code: code,
+                    code_verifier: verifier,
+                    code_challenge: "x",
+                });
+            }
+            case "/revoke":
+                this.revoked.push(params()["token"] ?? "");
+                res.writeHead(200).end();
+                return;
+            default:
+                return this.backend(res);
+        }
+    }
+    backend(res) {
+        const scripted = this.responses.shift() ?? { events: completedEvents("ok") };
+        const status = scripted.status ?? 200;
+        if (scripted.events === undefined || status !== 200) {
+            res.writeHead(status, { "content-type": "application/json", ...scripted.headers });
+            res.end(JSON.stringify(scripted.body ?? {}));
+            return;
+        }
+        res.writeHead(200, { "content-type": "text/event-stream", ...scripted.headers });
+        for (const event of scripted.events) {
+            const data = typeof event === "string" ? event : JSON.stringify(event);
+            res.write(`data: ${data}\n\n`);
+        }
+        res.end();
+    }
+}
+/** 一段最小的成功 SSE（一个文本块）。 */
+export function completedEvents(text, extra = []) {
+    return [
+        { type: "response.created", response: { id: "resp_1" } },
+        ...extra,
+        {
+            type: "response.output_item.added",
+            output_index: 0,
+            item: { type: "message", id: "msg_1" },
+        },
+        { type: "response.output_text.delta", output_index: 0, delta: text },
+        {
+            type: "response.output_item.done",
+            output_index: 0,
+            item: { type: "message", id: "msg_1", content: [{ type: "output_text", text }] },
+        },
+        {
+            type: "response.completed",
+            response: {
+                id: "resp_1",
+                status: "completed",
+                usage: { input_tokens: 10, output_tokens: 2, input_tokens_details: { cached_tokens: 4 } },
+            },
+        },
+    ];
+}
+/** 跟随 302 打到本地回调（代替浏览器）。 */
+export async function followAuthorize(url) {
+    const res = await fetch(url, { redirect: "manual" });
+    const location = res.headers.get("location");
+    if (location)
+        await fetch(location);
+}

package/dist/auth/testing/refresh-child.d.ts

@@ -0,0 +1,5 @@
+/**
+ * 并发刷新测试的子进程入口（esbuild 打包后由 `node` 运行）：对同一 auth.json 取一次新鲜条目，
+ * 只把 access token 的 SHA-256 打到 stdout（token 原文不进测试输出）。
+ */
+export {};

package/dist/auth/testing/refresh-child.js

@@ -0,0 +1,16 @@
+/**
+ * 并发刷新测试的子进程入口（esbuild 打包后由 `node` 运行）：对同一 auth.json 取一次新鲜条目，
+ * 只把 access token 的 SHA-256 打到 stdout（token 原文不进测试输出）。
+ */
+import { createHash } from "node:crypto";
+import { freshOAuthEntry } from "../oauth/refresh.js";
+const [authFile, provider] = process.argv.slice(2);
+freshOAuthEntry(authFile ?? "", provider ?? "chatgpt").then((entry) => {
+    const hash = createHash("sha256")
+        .update(entry?.accessToken ?? "")
+        .digest("hex");
+    process.stdout.write(`${hash}\n`);
+}, (error) => {
+    process.stdout.write(`error ${error.code ?? "unknown"}\n`);
+    process.exitCode = 1;
+});