@crievo/omni 0.0.0-stage → 0.1.1

package/tools/lib/oauth-client.mjs

@@ -0,0 +1,295 @@
+/* The CLI side of the studio's OAuth login (cloud/studio/src/oauth.mjs; docs/specs/phase-2-plugin-cli.md,
+   step 2): PKCE, the loopback callback, the token exchange, and the tokens in the macOS Keychain, refreshed
+   under a lock.
+
+     login(studioUrl, …)   opens the approval page in the browser, waits on http://127.0.0.1:<port>/callback,
+                           trades the code and stores the tokens
+     accessToken(…)        a valid access token, refreshing it when it has under a minute left
+     logout(…)             signs this machine out in the cloud and forgets the tokens
+
+   Two processes (the studio's runner and a CLI command) may refresh at once. The server treats a rotated
+   refresh token used twice as a leak and signs the machine out, so a refresh holds a lock and rereads the
+   Keychain inside it: the second process finds the tokens the first one just stored.
+
+   The Keychain item: service "omni", account = the studio's host, the password a JSON with the tokens.
+   `security` (and the lock dir, the clock, fetch, the browser) are injected for the tests. Messages in
+   Portuguese: they reach the user as they are. */
+
+import { spawnSync } from "node:child_process";
+import { createHash, randomBytes } from "node:crypto";
+import { mkdirSync, rmSync, statSync } from "node:fs";
+import { createServer } from "node:http";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+export const CLI_CLIENT = "omnivideo-cli";
+/* an access token's prefix (cloud/studio/src/oauth.mjs): tells it from a Phase 1 key (`ovr_`) */
+export const ACCESS_PREFIX = "ova_";
+export const KEYCHAIN_SERVICE = "omni";
+const REFRESH_MARGIN_MS = 60_000;
+const LOGIN_TIMEOUT_MS = 10 * 60_000;
+const LOCK_STALE_MS = 30_000;
+
+const b64url = (/** @type {Buffer} */ b) => b.toString("base64url");
+
+/** a PKCE verifier and its S256 challenge (RFC 7636) */
+export function pkce() {
+  const verifier = b64url(randomBytes(48));
+  return { verifier, challenge: b64url(createHash("sha256").update(verifier).digest()) };
+}
+
+/**
+ * @typedef {{ access_token: string, refresh_token: string, expires_at: number, device_id: string, device_name: string }} Tokens
+ * @typedef {{
+ *   fetch?: typeof fetch,
+ *   now?: () => number,
+ *   security?: string,
+ *   lockDir?: string,
+ *   open?: (url: string) => void,
+ *   log?: (line: string) => void,
+ * }} Deps
+ */
+
+const hostOf = (/** @type {string} */ studioUrl) => new URL(studioUrl).host;
+
+/* --- the Keychain ------------------------------------------------------------------------ */
+
+/** @param {string} studioUrl @param {Deps} [d] @returns {Tokens | null} */
+export function readTokens(studioUrl, d = {}) {
+  const r = spawnSync(
+    d.security ?? "security",
+    ["find-generic-password", "-s", KEYCHAIN_SERVICE, "-a", hostOf(studioUrl), "-w"],
+    { encoding: "utf8" },
+  );
+  if (r.status !== 0) return null;
+  try {
+    const t = JSON.parse(r.stdout.trim());
+    return t?.access_token && t?.refresh_token ? t : null;
+  } catch {
+    return null;
+  }
+}
+
+/** @param {string} studioUrl @param {Tokens} tokens @param {Deps} [d] */
+export function writeTokens(studioUrl, tokens, d = {}) {
+  /* -U updates the item in place; the secret goes as an argument, which `security` has no other way to take */
+  const r = spawnSync(
+    d.security ?? "security",
+    [
+      "add-generic-password",
+      "-U",
+      "-s",
+      KEYCHAIN_SERVICE,
+      "-a",
+      hostOf(studioUrl),
+      "-l",
+      "OmniVideo",
+      "-w",
+      JSON.stringify(tokens),
+    ],
+    { encoding: "utf8" },
+  );
+  if (r.status !== 0)
+    throw new Error(`não consegui gravar o login no Keychain: ${r.stderr.trim() || `código ${r.status}`}`);
+}
+
+/** @param {string} studioUrl @param {Deps} [d] */
+export function forgetTokens(studioUrl, d = {}) {
+  spawnSync(d.security ?? "security", ["delete-generic-password", "-s", KEYCHAIN_SERVICE, "-a", hostOf(studioUrl)], {
+    encoding: "utf8",
+  });
+}
+
+/* --- the token endpoint ------------------------------------------------------------------ */
+
+/** @param {string} studioUrl @param {Record<string, string>} fields @param {Deps} d */
+async function tokenCall(studioUrl, fields, d) {
+  const r = await (d.fetch ?? fetch)(`${studioUrl}/oauth/token`, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({ client_id: CLI_CLIENT, ...fields }),
+  });
+  const body = /** @type {any} */ (await r.json().catch(() => ({})));
+  return { status: r.status, ok: r.ok, body };
+}
+
+/** @param {any} body @param {Deps} d @returns {Tokens} */
+const toTokens = (body, d) => ({
+  access_token: body.access_token,
+  refresh_token: body.refresh_token,
+  expires_at: (d.now ?? Date.now)() + Number(body.expires_in ?? 900) * 1000,
+  device_id: body.device_id,
+  device_name: body.device_name,
+});
+
+/* --- the lock ---------------------------------------------------------------------------- */
+
+/** runs `fn` while holding a lock dir (a crashed holder's lock goes stale after 30 s)
+ *  @template T @param {string} dir @param {() => Promise<T>} fn @returns {Promise<T>} */
+async function withLock(dir, fn) {
+  const deadline = Date.now() + 15_000;
+  for (;;) {
+    try {
+      mkdirSync(dir, { recursive: false });
+      break;
+    } catch (e) {
+      if (/** @type {NodeJS.ErrnoException} */ (e).code === "ENOENT") {
+        mkdirSync(join(dir, ".."), { recursive: true });
+        continue;
+      }
+      try {
+        if (Date.now() - statSync(dir).mtimeMs > LOCK_STALE_MS) rmSync(dir, { recursive: true, force: true });
+      } catch {
+        /* someone else just released it */
+      }
+      if (Date.now() > deadline) throw new Error("outro processo está renovando o login; tente de novo");
+      await new Promise(r => setTimeout(r, 100));
+    }
+  }
+  try {
+    return await fn();
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+const lockDirOf = (/** @type {Deps} */ d) => d.lockDir ?? join(homedir(), ".omni", "refresh.lock");
+
+/* --- login, refresh, logout -------------------------------------------------------------- */
+
+/**
+ * Opens the approval page and waits for the browser to come back with the code.
+ * @param {string} studioUrl @param {{ deviceName: string } & Deps} o
+ * @returns {Promise<Tokens>}
+ */
+export async function login(studioUrl, o) {
+  const { verifier, challenge } = pkce();
+  const state = b64url(randomBytes(16));
+  const log = o.log ?? (() => {});
+
+  /** @type {(v: { code: string } | { error: string }) => void} */
+  let settle = () => {};
+  const arrived = new Promise(r => (settle = r));
+  const server = createServer((req, res) => {
+    const u = new URL(req.url ?? "/", "http://127.0.0.1");
+    if (u.pathname !== "/callback") {
+      res.writeHead(404).end();
+      return;
+    }
+    const page = (/** @type {string} */ msg) =>
+      `<!doctype html><meta charset="utf-8"><title>OmniVideo</title><body style="font:16px system-ui;padding:48px;max-width:32em">${msg}</body>`;
+    if (u.searchParams.get("state") !== state) {
+      res
+        .writeHead(400, { "content-type": "text/html; charset=utf-8" })
+        .end(page("Esse retorno não é deste login. Rode o comando de novo."));
+      return;
+    }
+    const code = u.searchParams.get("code");
+    const error = u.searchParams.get("error");
+    res
+      .writeHead(code ? 200 : 400, { "content-type": "text/html; charset=utf-8" })
+      .end(
+        page(
+          code
+            ? "Pronto: este computador entrou no OmniVideo. Pode fechar esta aba."
+            : "O login foi recusado. Pode fechar esta aba.",
+        ),
+      );
+    settle(code ? { code } : { error: error ?? "recusado" });
+  });
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => resolve(undefined));
+  });
+  try {
+    const port = /** @type {import("node:net").AddressInfo} */ (server.address()).port;
+    const redirectUri = `http://127.0.0.1:${port}/callback`;
+    const url = new URL("/oauth/authorize", studioUrl);
+    for (const [k, v] of Object.entries({
+      client_id: CLI_CLIENT,
+      response_type: "code",
+      redirect_uri: redirectUri,
+      code_challenge: challenge,
+      code_challenge_method: "S256",
+      state,
+      device_name: o.deviceName,
+    }))
+      url.searchParams.set(k, v);
+    log(`Abrindo o navegador para entrar. Se ele não abrir, use este link:\n  ${url}`);
+    (o.open ?? openBrowser)(url.toString());
+
+    const timeout = new Promise(r =>
+      setTimeout(() => r({ error: "o login não voltou em 10 minutos" }), LOGIN_TIMEOUT_MS).unref(),
+    );
+    const result = /** @type {{ code?: string, error?: string }} */ (await Promise.race([arrived, timeout]));
+    if (!result.code)
+      throw new Error(result.error === "access_denied" ? "o login foi recusado na página" : String(result.error));
+
+    const t = await tokenCall(
+      studioUrl,
+      { grant_type: "authorization_code", code: result.code, code_verifier: verifier, redirect_uri: redirectUri },
+      o,
+    );
+    if (!t.ok)
+      throw new Error(
+        `o studio não entregou o login (${t.status}: ${t.body?.error_description ?? t.body?.error ?? "?"})`,
+      );
+    const tokens = toTokens(t.body, o);
+    writeTokens(studioUrl, tokens, o);
+    return tokens;
+  } finally {
+    server.close();
+  }
+}
+
+/**
+ * A valid access token for this machine, refreshed when needed, or null when it has to log in again
+ * (never logged in, signed out in the studio, plan ended). An unreachable studio throws: it says nothing
+ * about the login.
+ * @param {string} studioUrl @param {Deps} [d] @returns {Promise<string | null>}
+ */
+export async function accessToken(studioUrl, d = {}) {
+  const now = d.now ?? Date.now;
+  const current = readTokens(studioUrl, d);
+  if (!current) return null;
+  if (current.expires_at - now() > REFRESH_MARGIN_MS) return current.access_token;
+  return withLock(lockDirOf(d), async () => {
+    /* another process may have refreshed while this one waited */
+    const fresh = readTokens(studioUrl, d);
+    if (!fresh) return null;
+    if (fresh.expires_at - now() > REFRESH_MARGIN_MS) return fresh.access_token;
+    const t = await tokenCall(studioUrl, { grant_type: "refresh_token", refresh_token: fresh.refresh_token }, d);
+    if (t.ok) {
+      const tokens = toTokens(t.body, d);
+      writeTokens(studioUrl, tokens, d);
+      return tokens.access_token;
+    }
+    if (t.status === 400 || t.status === 401 || t.status === 403) {
+      forgetTokens(studioUrl, d);
+      return null;
+    }
+    throw new Error(`o studio não renovou o login (${t.status}: ${t.body?.error_description ?? t.body?.error ?? "?"})`);
+  });
+}
+
+/** Signs this machine out in the cloud (when reachable) and forgets the tokens here.
+ *  @param {string} studioUrl @param {Deps} [d] @returns {Promise<boolean>} whether the cloud confirmed */
+export async function logout(studioUrl, d = {}) {
+  const token = await accessToken(studioUrl, d).catch(() => null);
+  let confirmed = false;
+  if (token) {
+    const r = await (d.fetch ?? fetch)(`${studioUrl}/oauth/logout`, {
+      method: "POST",
+      headers: { authorization: `Bearer ${token}` },
+    }).catch(() => null);
+    confirmed = !!r?.ok;
+  }
+  forgetTokens(studioUrl, d);
+  return confirmed;
+}
+
+/** @param {string} url */
+function openBrowser(url) {
+  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "explorer" : "xdg-open";
+  spawnSync(cmd, [url], { stdio: "ignore" });
+}

package/tools/lib/omnichat/config.mjs

@@ -0,0 +1,139 @@
+/* omnichat.instagram in the config, with the defaults filled in. Pure. */
+
+import { DAY } from "../http.mjs";
+
+/**
+ * @typedef {object} OmnichatConfig
+ * @property {number} max_per_pass
+ * @property {number} pause_between_s
+ * @property {number} attempts
+ * @property {number} rate_limit_pause_min
+ * @property {string} default_dm
+ * @property {string} default_opening_dm the DM with the button, before the tap
+ * @property {string} default_button_label
+ * @property {string} default_not_following_dm
+ * @property {string} default_retry_label
+ * @property {string} default_link_label the button that opens the link (rule.link_button)
+ * @property {string} default_skip_label the button that delivers without following (rule.follow_skip)
+ * @property {string} default_skip_dm the DM of whoever got the link through that button
+ * @property {string[]} default_public_replies
+ * @property {string[]} generic_phrases
+ * @property {string[]} filler_words
+ * @property {string} context_model
+ * @property {boolean} enable_on_publish
+ * @property {boolean} quote_post
+ * @property {{ first_48h: number, first_week: number, after: number }} interval_min
+ */
+
+export const DEFAULTS = {
+  max_per_pass: 15,
+  pause_between_s: 2,
+  attempts: 3,
+  rate_limit_pause_min: 30,
+  default_dm: "Oi, @{username}! Aqui está o link que você pediu: {link}",
+  default_opening_dm: "Oi, @{username}! Toca no botão aqui embaixo que eu te mando 👇",
+  default_button_label: "Quero o link",
+  /* an invitation, not a rule: what they gain by following (the link now and the next ones), how to do it
+     from the DM (the name at the top opens the profile) and the button to come back */
+  default_not_following_dm:
+    "Quase lá, @{username}! 🙌 Esse conteúdo eu libero pra quem acompanha o perfil. Toca no meu nome aqui em cima, segue e volta no botão: o link chega na hora, e você ainda fica por dentro dos próximos 🚀",
+  default_retry_label: "Pronto, já sigo!",
+  default_link_label: "Abrir link",
+  default_skip_label: "Receber sem seguir",
+  /* the link, thanks, and a soft ask to follow next time (no {link}: it goes after the text, or in the link button) */
+  default_skip_dm:
+    "@{username}, aqui está o link! Espero que ajude muito.\n\nSe em uma próxima você me seguir, vai ajudar bastante! 😁",
+  default_public_replies: [
+    "Te mandei no direct 👀",
+    "Acabei de te mandar no direct 📩",
+    "Corre no direct! 🚀",
+    "Já está no seu direct 📬",
+    "Mandei no seu direct, dá uma olhada 👀",
+    "Olha o direct, @{username}! 📩",
+    "Te enviei no direct agora mesmo 🚀",
+    "Chegou no seu direct, confere lá 👇",
+    "Direct enviado, @{username}! 🙌",
+    "Dá uma olhada no direct, mandei por lá 📲",
+    "Acabou de cair no seu direct ✅",
+    "Mandei lá no direct pra você 🔥",
+  ],
+  generic_phrases: ["quero", "eu quero", "me manda", "manda", "me envia", "envia", "me passa", "link"],
+  filler_words: [
+    "sim",
+    "por",
+    "favor",
+    "pfv",
+    "pfvr",
+    "pf",
+    "pls",
+    "please",
+    "plmds",
+    "ai",
+    "ae",
+    "aqui",
+    "o",
+    "a",
+    "isso",
+    "tambem",
+    "tbm",
+    "tb",
+    "eu",
+    "me",
+    "mim",
+    "pra",
+    "para",
+    "pro",
+    "no",
+    "na",
+    "dm",
+    "direct",
+    "pv",
+    "privado",
+    "inbox",
+    "muito",
+    "mto",
+    "demais",
+    "mano",
+    "mn",
+    "obrigado",
+    "obrigada",
+    "obg",
+    "vlw",
+    "valeu",
+    "ja",
+    "agora",
+    "tmj",
+    "kk",
+    "kkk",
+    "kkkk",
+    "rs",
+    "s",
+    "ss",
+    "sss",
+  ],
+  context_model: "haiku",
+  enable_on_publish: false,
+  quote_post: true,
+};
+
+/**
+ * @param {Record<string, any>} [ci] omnichat.instagram from the config
+ * @returns {OmnichatConfig}
+ */
+export const resolveOmnichatConfig = (ci = {}) => ({
+  ...DEFAULTS,
+  ...ci,
+  interval_min: { first_48h: 1, first_week: 5, after: 30, ...(ci.interval_min ?? {}) },
+});
+
+/** A private reply is valid up to 7 days after the comment; the margin covers the clock. */
+export const DM_DEADLINE = 7 * DAY - 30 * 60_000;
+/** Each read goes back this much before the last seen comment (timestamps are to the second, and late). */
+export const CURSOR_MARGIN = 10 * 60_000;
+/** Pages of 50 comments per pass; the rest resumes on the next pass. */
+export const MAX_PAGES = 20;
+/** Instagram's DM text limit. */
+export const DM_BYTE_LIMIT = 1000;
+/** Button template limits: text (characters) and button title (characters). */
+export const BUTTON_TEXT_LIMIT = 640;
+export const BUTTON_TITLE_LIMIT = 20;

package/tools/lib/omnichat/errors.mjs

@@ -0,0 +1,42 @@
+/* Meta errors, by what they mean for the queue. Pure.
+   Rate limit (4, 17, 32, 613, HTTP 429) and policy block (368) stop the whole account
+   for a while: insisting is what turns into a real block. Token and permission
+   (190, 3, 10, 200–299) also stop, without spending the comment. Server down (5xx),
+   network and "try again" (1, 2) retry on the next pass. The rest is not worth repeating. */
+
+const RATE_LIMIT_CODES = new Set(["4", "17", "32", "613"]);
+/** @param {string | null | undefined} c */
+const isAccountCode = c =>
+  ["190", "3", "10"].includes(/** @type {string} */ (c)) || (+(c ?? NaN) >= 200 && +(c ?? NaN) < 300);
+
+/**
+ * @param {{ code?: string | null, status?: number }} e
+ * @returns {"blocked" | "rate_limit" | "account" | "transient" | "permanent"}
+ */
+export function errorType(e) {
+  if (e.code === "368") return "blocked";
+  if (RATE_LIMIT_CODES.has(/** @type {string} */ (e.code)) || e.status === 429) return "rate_limit";
+  if (isAccountCode(e.code)) return "account";
+  if (!e.status || e.status >= 500 || e.code === "1" || e.code === "2") return "transient";
+  return "permanent";
+}
+
+/** Thrown when the whole account must pause (rate limit, block, token). */
+export class PauseError extends Error {}
+
+/**
+ * The account pause that follows a PauseError (or a limit while replying by hand).
+ * @param {string} reason @param {number} now @param {{ rate_limit_pause_min: number }} C
+ * @returns {{ until: string, reason: string, at: string }}
+ */
+export const pauseFor = (reason, now, C) => ({
+  until: new Date(now + C.rate_limit_pause_min * 60_000).toISOString(),
+  reason,
+  at: new Date(now).toISOString(),
+});
+
+/**
+ * Is the account paused?
+ * @param {{ until: string } | null | undefined} pause @param {number} now
+ */
+export const isPaused = (pause, now) => !!pause && Date.parse(pause.until) > now;

package/tools/lib/omnichat/extract.mjs

@@ -0,0 +1,82 @@
+/* What the content already says: the link the DM delivers and the keyword the
+   narration asks for. Pure text scanning; the caller gathers the texts. */
+
+/** Social links don't count as the delivery: they are the topic's source or the post itself. */
+export const SOCIAL_HOSTS = ["instagram.com", "x.com", "twitter.com", "youtube.com", "youtu.be", "tiktok.com"];
+/* stops at whitespace, quotes and the markdown link close; sentence-ending punctuation is stripped after */
+const URL_IN_TEXT = /https?:\/\/[^\s<>"'`()[\]{}]+/g;
+
+/**
+ * The first non-social http(s) URL in a text.
+ * @param {string} text
+ * @returns {string | null}
+ */
+export function firstLink(text) {
+  for (const [raw] of text.matchAll(URL_IN_TEXT)) {
+    const link = raw.replace(/[.,;:!?*]+$/, "");
+    let host;
+    try {
+      host = new URL(link).hostname.toLowerCase();
+    } catch {
+      continue;
+    }
+    if (SOCIAL_HOSTS.some(d => host === d || host.endsWith(`.${d}`))) continue;
+    return link;
+  }
+  return null;
+}
+
+/**
+ * The first link among labelled sources, in order.
+ * @param {Array<[string, string]>} sources [found_in, text]
+ * @returns {{ link: string, found_in: string } | null}
+ */
+export function linkIn(sources) {
+  for (const [foundIn, text] of sources) {
+    const link = firstLink(text);
+    if (link) return { link, found_in: foundIn };
+  }
+  return null;
+}
+
+/* "Comenta REA que eu te mando o link": the word after comentar, only with the promise to send
+   in the same sentence ("comenta o que achou" is not a request) */
+const REQUEST_PATTERN =
+  /\bcoment(?:a|e|em|ar)\s+(?:(?:a[ií]|aqui|embaixo|abaixo|a\s+palavra|o\s+termo)\s+)*["“'«]?([\p{L}\p{N}][\p{L}\p{N}_-]*)["”'»]?[^.!?\n]*?\b(?:mando|envio|passo|mandarei|enviarei|mandamos|enviamos)\b/giu;
+const NOT_KEYWORD = new Set([
+  "o",
+  "a",
+  "os",
+  "as",
+  "um",
+  "uma",
+  "que",
+  "se",
+  "sua",
+  "seu",
+  "suas",
+  "seus",
+  "isso",
+  "esse",
+  "essa",
+  "aqui",
+  "ai",
+  "aí",
+  "no",
+  "na",
+  "pra",
+  "para",
+]);
+
+/**
+ * The keyword the first matching text asks for, upper-cased, or null.
+ * @param {string[]} texts in priority order (the voice lines first, then the script)
+ * @returns {string | null}
+ */
+export function keywordIn(texts) {
+  for (const t of texts) {
+    for (const [, keyword] of t.matchAll(REQUEST_PATTERN))
+      if (!NOT_KEYWORD.has(keyword.toLowerCase())) return keyword.toUpperCase();
+  }
+  return null;
+}