@cortexkit/opencode-antigravity-auth 2.2.0 → 3.0.0

package/src/tui-raw/common-auth-embedded/quota/merge.js

@@ -0,0 +1,162 @@
+// Merging one observation into a stored quota map.
+//
+// One freshness rule applies everywhere: an observation applies to a key when
+// it is not older than what the key holds, so an equal time applies and the
+// observation applied last wins, as openai-auth's `freshestWindow` does.
+//
+// An observation carries readings plus a coverage list: the (scope, label)
+// pairs it speaks for with authority. Every reading is implicitly covered. A
+// covered pair the observation carries no reading for is reported as having
+// no limit: an existing reading becomes a retirement tombstone, and a key with
+// no entry gets an absence record. A pair outside the coverage is never
+// touched, so a header-shaped partial observation (which covers only what it
+// carries) cannot erase a family limit or the budget.
+import { ALL_SCOPE, entryTime, isQuotaMap, limitKey, } from "./map.js";
+/** Thrown by `mergeQuotaObservation` when either argument is malformed. */
+export class QuotaCodecError extends TypeError {
+    constructor(message) {
+        super(message);
+        this.name = 'QuotaCodecError';
+    }
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function isFiniteNumber(value) {
+    return typeof value === 'number' && Number.isFinite(value);
+}
+function isScope(value) {
+    return value === undefined || (typeof value === 'string' && value !== '');
+}
+function isLabel(value) {
+    return typeof value === 'string' && value !== '';
+}
+function optionalFinite(record, key) {
+    return record[key] === undefined || isFiniteNumber(record[key]);
+}
+function optionalString(record, key) {
+    return record[key] === undefined || typeof record[key] === 'string';
+}
+function isObservedReading(value) {
+    return (isRecord(value) &&
+        isScope(value.scope) &&
+        isLabel(value.label) &&
+        isFiniteNumber(value.usedPercent) &&
+        optionalString(value, 'resetsAt') &&
+        (value.windowMinutes === undefined ||
+            (isFiniteNumber(value.windowMinutes) && value.windowMinutes > 0)));
+}
+function isObservedPair(value) {
+    return isRecord(value) && isScope(value.scope) && isLabel(value.label);
+}
+function isObservedBudget(value) {
+    if (!isRecord(value))
+        return false;
+    if (value.kind === 'cleared')
+        return true;
+    return (value.kind === 'reading' &&
+        typeof value.reached === 'boolean' &&
+        optionalFinite(value, 'remainingPercent') &&
+        optionalFinite(value, 'usedPercent') &&
+        optionalString(value, 'resetsAt') &&
+        optionalFinite(value, 'limit') &&
+        optionalFinite(value, 'used') &&
+        optionalFinite(value, 'remaining') &&
+        optionalString(value, 'unit'));
+}
+/** True when `value` is a well-formed observation; a pair read twice is not. */
+export function isQuotaObservation(value) {
+    if (!isRecord(value) || !isFiniteNumber(value.checkedAt))
+        return false;
+    const readings = value.readings ?? [];
+    const coverage = value.coverage ?? [];
+    if (!Array.isArray(readings) || !Array.isArray(coverage))
+        return false;
+    const read = new Set();
+    for (const reading of readings) {
+        if (!isObservedReading(reading))
+            return false;
+        const key = limitKey(reading.scope ?? ALL_SCOPE, reading.label);
+        if (read.has(key))
+            return false;
+        read.add(key);
+    }
+    if (!coverage.every(isObservedPair))
+        return false;
+    return value.budget === undefined || isObservedBudget(value.budget);
+}
+function compareEntries(left, right) {
+    if (left.scope !== right.scope)
+        return left.scope < right.scope ? -1 : 1;
+    if (left.label !== right.label)
+        return left.label < right.label ? -1 : 1;
+    return 0;
+}
+function mergeBudget(stored, observed, checkedAt) {
+    if (observed === undefined)
+        return stored;
+    if (stored !== undefined && checkedAt < stored.checkedAt)
+        return stored;
+    return { ...observed, checkedAt };
+}
+/**
+ * Applies `observation` to `stored` (undefined for a row with no map yet) and
+ * returns the new map. Pure: neither argument is modified. Throws
+ * `QuotaCodecError` when either argument is malformed, so a store refuses the
+ * write rather than persisting a map it could not read back.
+ */
+export function mergeQuotaObservation(stored, observation) {
+    if (stored !== undefined && !isQuotaMap(stored)) {
+        throw new QuotaCodecError('stored quota map is malformed');
+    }
+    if (!isQuotaObservation(observation)) {
+        throw new QuotaCodecError('quota observation is malformed');
+    }
+    const base = stored ?? { limits: [] };
+    const at = observation.checkedAt;
+    const entries = new Map();
+    for (const entry of base.limits) {
+        entries.set(limitKey(entry.scope, entry.label), entry);
+    }
+    const applies = (key) => {
+        const existing = entries.get(key);
+        return existing === undefined || at >= entryTime(existing);
+    };
+    const carried = new Set();
+    for (const reading of observation.readings ?? []) {
+        const scope = reading.scope ?? ALL_SCOPE;
+        const key = limitKey(scope, reading.label);
+        carried.add(key);
+        if (!applies(key))
+            continue;
+        entries.set(key, {
+            scope,
+            label: reading.label,
+            kind: 'reading',
+            checkedAt: at,
+            usedPercent: reading.usedPercent,
+            ...(reading.resetsAt === undefined ? {} : { resetsAt: reading.resetsAt }),
+            ...(reading.windowMinutes === undefined
+                ? {}
+                : { windowMinutes: reading.windowMinutes }),
+        });
+    }
+    for (const pair of observation.coverage ?? []) {
+        const scope = pair.scope ?? ALL_SCOPE;
+        const key = limitKey(scope, pair.label);
+        if (carried.has(key) || !applies(key))
+            continue;
+        const existing = entries.get(key);
+        entries.set(key, existing === undefined || existing.kind === 'absent'
+            ? { scope, label: pair.label, kind: 'absent', checkedAt: at }
+            : { scope, label: pair.label, kind: 'retired', retiredAt: at });
+    }
+    // Keys this module does not recognise are carried over untouched.
+    const { limits: _limits, budget: _budget, ...unknownKeys } = base;
+    const budget = mergeBudget(base.budget, observation.budget, at);
+    return {
+        ...unknownKeys,
+        limits: [...entries.values()].sort(compareEntries),
+        ...(budget === undefined ? {} : { budget }),
+    };
+}

package/src/tui-raw/common-auth-embedded/quota/projection.js

@@ -0,0 +1,134 @@
+// Projection of a keyed quota map onto one request scope.
+//
+// The selection primitives carried from openai-auth judge an account by a
+// short list of windows; the keyed map can hold many (scope, label) keys. The
+// projection resolves exactly one entry per window label for the request's
+// scope, orders the result the way the primitives expect, and carries each
+// entry's (scope, label) so a decision names the limit it judged rather than
+// the position it occupied.
+import { ALL_SCOPE, } from "./map.js";
+function project(entry) {
+    if (entry.kind === 'retired') {
+        return {
+            scope: entry.scope,
+            label: entry.label,
+            kind: 'retired',
+            checkedAt: entry.retiredAt,
+        };
+    }
+    if (entry.kind === 'absent') {
+        return {
+            scope: entry.scope,
+            label: entry.label,
+            kind: 'absent',
+            checkedAt: entry.checkedAt,
+        };
+    }
+    return {
+        scope: entry.scope,
+        label: entry.label,
+        kind: 'reading',
+        checkedAt: entry.checkedAt,
+        usedPercent: entry.usedPercent,
+        remainingPercent: 100 - entry.usedPercent,
+        ...(entry.windowMinutes === undefined
+            ? {}
+            : { windowMinutes: entry.windowMinutes }),
+        ...(entry.resetsAt === undefined ? {} : { resetsAt: entry.resetsAt }),
+    };
+}
+function compareLimits(left, right) {
+    const leftKnown = left.windowMinutes !== undefined;
+    const rightKnown = right.windowMinutes !== undefined;
+    if (leftKnown !== rightKnown)
+        return leftKnown ? -1 : 1;
+    if (leftKnown && rightKnown && left.windowMinutes !== right.windowMinutes) {
+        return (right.windowMinutes ?? 0) - (left.windowMinutes ?? 0);
+    }
+    if (left.label !== right.label)
+        return left.label < right.label ? -1 : 1;
+    return 0;
+}
+function projectBudget(budget) {
+    return {
+        checkedAt: budget.checkedAt,
+        reached: budget.reached,
+        ...(budget.remainingPercent === undefined
+            ? {}
+            : { remainingPercent: budget.remainingPercent }),
+        ...(budget.resetsAt === undefined ? {} : { resetsAt: budget.resetsAt }),
+    };
+}
+/**
+ * Resolves `map` for a request in `scope` (`all` or a model family). A family
+ * request sees only its own family's keys and the `all` keys.
+ *
+ * The label decides how a family limit relates to a general one. Under the
+ * same label, the family reading replaces the `all` reading: use this only
+ * when the provider's family figure is a more specific view of the same cap.
+ * Under different labels both limits are projected and every consumer judges
+ * both, so a family cap that applies on top of a general cap must be stored
+ * under its own label; otherwise the general cap is hidden from a family
+ * request. A family tombstone or absence record says only that no
+ * family-specific limit exists, so it does not hide an `all` entry for the
+ * same label and is used only when there is none.
+ */
+export function projectQuota(map, scope = ALL_SCOPE) {
+    const byLabel = new Map();
+    for (const entry of map?.limits ?? []) {
+        if (entry.scope !== scope && entry.scope !== ALL_SCOPE)
+            continue;
+        const current = byLabel.get(entry.label);
+        if (current === undefined) {
+            byLabel.set(entry.label, entry);
+            continue;
+        }
+        const family = entry.scope === ALL_SCOPE ? current : entry;
+        const general = entry.scope === ALL_SCOPE ? entry : current;
+        byLabel.set(entry.label, family.kind === 'reading' ? family : general);
+    }
+    const limits = [...byLabel.values()].map(project).sort(compareLimits);
+    const readings = limits.filter((limit) => limit.kind === 'reading');
+    const stamped = readings.length > 0 ? readings : limits;
+    const checkedAt = stamped.length > 0
+        ? Math.min(...stamped.map((limit) => limit.checkedAt))
+        : undefined;
+    const budget = map?.budget?.kind === 'reading' ? projectBudget(map.budget) : undefined;
+    return {
+        scope,
+        limits,
+        ...(checkedAt === undefined ? {} : { checkedAt }),
+        ...(budget === undefined ? {} : { budget }),
+    };
+}
+/**
+ * The credit budget's own exhaustion signal. Admission and the sticky
+ * routing decision to move a session off its pinned row both use it, so the
+ * two agree on what "spent" means. `reached` is the provider's
+ * verdict (the percentage is only a display value), and the check fails open
+ * on a missing, unparsable or already-passed reset.
+ */
+export function budgetExhaustedResetAt(quota, now) {
+    const budget = quota?.budget;
+    if (budget?.reached !== true || typeof budget.resetsAt !== 'string') {
+        return undefined;
+    }
+    const resetAtMs = Date.parse(budget.resetsAt);
+    if (!Number.isFinite(resetAtMs) || resetAtMs <= now)
+        return undefined;
+    return { resetsAt: budget.resetsAt, resetAtMs };
+}
+/** True for a reading at or beyond its whole window. */
+export function readsExhausted(limit) {
+    return (limit.kind === 'reading' &&
+        typeof limit.usedPercent === 'number' &&
+        Number.isFinite(limit.usedPercent) &&
+        limit.usedPercent >= 100);
+}
+/** The reset time of a limit when it parses and lies after `now`. */
+export function futureResetAt(limit, now) {
+    if (typeof limit.resetsAt !== 'string')
+        return undefined;
+    const resetAtMs = Date.parse(limit.resetsAt);
+    return Number.isFinite(resetAtMs) && resetAtMs > now ? resetAtMs : undefined;
+}

package/src/tui-raw/common-auth-embedded/rpc/client.js

@@ -0,0 +1,2 @@
+export { discoverPortFile, } from "./port-file.js";
+export * from "./rpc-client.js";

package/src/tui-raw/common-auth-embedded/rpc/port-file.js

@@ -0,0 +1,217 @@
+import { createHash, randomUUID } from "node:crypto";
+import { chmod, mkdir, open, readdir, readFile, rename, rmdir, stat, unlink, } from "node:fs/promises";
+import { join, resolve } from "node:path";
+/**
+ * A PID a liveness probe may address. `process.kill(0 | negative, 0)` signals
+ * a process group rather than a process, and an unsafe integer cannot name a
+ * real process, so neither is ever probed.
+ */
+function isProbeablePid(pid) {
+    return typeof pid === 'number' && Number.isSafeInteger(pid) && pid > 0;
+}
+function pidAlive(pid) {
+    if (!isProbeablePid(pid))
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === 'EPERM';
+    }
+}
+export function createManagedRpcStateDirPredicate(directoryPrefix) {
+    return (name) => isManagedRpcStateDir(name, directoryPrefix);
+}
+export function isManagedRpcStateDir(name, directoryPrefix) {
+    if (/^[0-9a-f]{16}$/.test(name))
+        return true;
+    return (name.startsWith(directoryPrefix) &&
+        /^[0-9a-f]{16}$/.test(name.slice(directoryPrefix.length)));
+}
+export function getRpcDir(rpcRoot, directoryPrefix, projectDirectory) {
+    return join(rpcRoot, directoryPrefix +
+        createHash('sha256').update(projectDirectory).digest('hex').slice(0, 16));
+}
+/** The PID a port file's name claims, or undefined for a malformed name. */
+function filenamePid(name) {
+    const match = /^port-(\d+)\.json$/.exec(name);
+    return match ? Number(match[1]) : undefined;
+}
+/**
+ * An entry a client may connect to: its PID is probeable and matches the PID
+ * in its file name (a mismatch means the file was not written by the server
+ * it names), its port is a real TCP port, and its token is non-empty (an
+ * absent token would otherwise be sent as `Bearer undefined`).
+ */
+function isUsablePortFileEntry(value, name) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const { pid, port, token } = value;
+    return (isProbeablePid(pid) &&
+        filenamePid(name) === pid &&
+        typeof port === 'number' &&
+        Number.isInteger(port) &&
+        port >= 1 &&
+        port <= 65_535 &&
+        typeof token === 'string' &&
+        token.length > 0);
+}
+async function removeCorruptPortFile(portFile, log) {
+    log?.debug('rpc corrupt port file', { pid: process.pid, portFile });
+    await unlink(portFile).catch(() => { });
+}
+export async function writePortFile(dir, entry, options = {}) {
+    // The directory can be removed by another project's sweep between our
+    // mkdir and the first open/rename, so the whole create-then-rename
+    // unit is retried once on ENOENT. The retry recreates the directory; a
+    // persistent ENOENT (e.g. permission, read-only parent) will surface on
+    // the second attempt — failing fast beats an unbounded loop.
+    const writeOnce = async () => {
+        await mkdir(dir, {
+            recursive: true,
+            mode: options.secureDir ? 0o700 : undefined,
+        });
+        if (options.secureDir)
+            await chmod(dir, 0o700);
+        await options.beforeWrite?.();
+        const full = { ...entry, startedAt: Date.now() };
+        const target = join(dir, `port-${entry.pid}.json`);
+        const tmp = `${target}.${(options.stageName ?? randomUUID)()}.tmp`;
+        let handle;
+        let created = false;
+        try {
+            handle = await open(tmp, 'wx', 0o600);
+            created = true;
+            await handle.writeFile(JSON.stringify(full), 'utf8');
+            await handle.chmod(0o600);
+            await handle.close();
+            handle = undefined;
+            await rename(tmp, target);
+            created = false;
+        }
+        finally {
+            await handle?.close().catch(() => { });
+            // Remove token-bearing staging bytes only if this call created them.
+            if (created)
+                await unlink(tmp).catch(() => { });
+        }
+        return target;
+    };
+    try {
+        return await writeOnce();
+    }
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            return await writeOnce();
+        }
+        throw error;
+    }
+}
+export async function sweepRpcState(root, activeDir, isManagedDir, log) {
+    let projectDirs;
+    try {
+        projectDirs = await readdir(root, { withFileTypes: true });
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return;
+        throw error;
+    }
+    const active = resolve(activeDir);
+    for (const projectDir of projectDirs) {
+        if (!projectDir.isDirectory() || !isManagedDir(projectDir.name)) {
+            continue;
+        }
+        const dir = join(root, projectDir.name);
+        let names;
+        try {
+            names = await readdir(dir);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                continue;
+            throw error;
+        }
+        for (const name of names) {
+            if (!name.startsWith('port-') || !name.endsWith('.json'))
+                continue;
+            const portFile = join(dir, name);
+            let raw;
+            try {
+                raw = await readFile(portFile, 'utf8');
+            }
+            catch {
+                continue;
+            }
+            if (raw === undefined)
+                continue;
+            let parsed;
+            try {
+                parsed = JSON.parse(raw);
+            }
+            catch {
+                await removeCorruptPortFile(portFile, log);
+                continue;
+            }
+            if (!isUsablePortFileEntry(parsed, name)) {
+                await removeCorruptPortFile(portFile, log);
+                continue;
+            }
+            const entry = parsed;
+            if (!pidAlive(entry.pid))
+                await unlink(portFile).catch(() => { });
+        }
+        if (resolve(dir) !== active)
+            await rmdir(dir).catch(() => { });
+    }
+}
+/** Internal cache validation: probe only the selected file and its PID. */
+export async function portFileIdentity(dir, entry) {
+    if (!pidAlive(entry.pid))
+        return null;
+    const path = join(resolve(dir), `port-${entry.pid}.json`);
+    try {
+        const info = await stat(path);
+        return `${path}:${info.dev}:${info.ino}:${info.mtimeMs}:${info.size}`;
+    }
+    catch {
+        return null;
+    }
+}
+export async function discoverPortFile(dir, expectedPid, options = {}) {
+    let names;
+    try {
+        names = await readdir(dir);
+    }
+    catch {
+        return null;
+    }
+    const live = [];
+    for (const name of names) {
+        if (!name.startsWith('port-') || !name.endsWith('.json'))
+            continue;
+        try {
+            const parsed = JSON.parse(await readFile(join(dir, name), 'utf8'));
+            if (isUsablePortFileEntry(parsed, name)) {
+                if (pidAlive(parsed.pid))
+                    live.push(parsed);
+                else
+                    await unlink(join(dir, name)).catch(() => { });
+            }
+        }
+        catch { }
+    }
+    if (live.length === 0)
+        return null;
+    const candidates = expectedPid !== undefined && expectedPid >= 1
+        ? live.filter((entry) => entry.pid === expectedPid)
+        : [];
+    if (options.exactPid === true && candidates.length === 0)
+        return null;
+    const entries = candidates.length > 0 ? candidates : live;
+    const sortTime = (entry) => typeof entry.startedAt === 'number' && Number.isFinite(entry.startedAt)
+        ? entry.startedAt
+        : -Infinity;
+    return entries.sort((a, b) => sortTime(b) - sortTime(a))[0] ?? null;
+}