@dev-mainsequence/codex-plugin 0.3.0 → 0.7.9

package/dist/vendor/devtools/shared/session.js

@@ -44,6 +44,10 @@ const http = __importStar(require("http"));
 const config_1 = require("./config.js");
 const machineSession_1 = require("./machineSession.js");
 const models_1 = require("./models.js");
+const accountScope_1 = require("./accountScope.js");
+class AccountChangedError extends models_1.ToolingError {
+    constructor() { super('AUTH_REJECTED', 'The MainSequence account or session changed. Refresh the current view before continuing.'); }
+}
 function requireBackend(input) {
     const backend = (0, config_1.normalizeBackendUrl)(input);
     let url;
@@ -101,6 +105,7 @@ class MachineSessionService {
     env;
     renewals = new Map();
     secrets = new Set();
+    verifiedAccounts = new Map();
     constructor(host, options = {}) {
         this.host = host;
         this.options = options;
@@ -172,6 +177,12 @@ class MachineSessionService {
             throw new models_1.ToolingError('NOT_AUTHENTICATED', 'No session is saved for this backend. Run login.');
         return { session, source: 'machine' };
     }
+    async selectionIdentity(input) {
+        const backend = requireBackend(input), { session, source } = await this.selected(backend);
+        const expiresAt = expiry(session.access);
+        return { key: crypto.createHash('sha256').update(JSON.stringify([backend, source, session.username, session.access, session.refresh])).digest('hex'),
+            ...(expiresAt ? { expiresAt: Date.parse(expiresAt) } : {}) };
+    }
     async http(backend, method, apiPath, body, access, timeoutMs) {
         this.options.signal?.throwIfAborted();
         if ((apiPath !== '/mcp' && !/^\/(api|auth)\//.test(apiPath)) || apiPath.includes('..'))
@@ -179,19 +190,25 @@ class MachineSessionService {
         const controller = new AbortController();
         const abort = () => controller.abort();
         this.options.signal?.addEventListener('abort', abort, { once: true });
-        const timer = setTimeout(abort, this.options.requestTimeoutMs ?? timeoutMs ?? 30_000);
+        const budget = this.options.requestTimeoutMs ?? timeoutMs ?? 30_000;
+        let timedOut = false;
+        const timer = setTimeout(() => { timedOut = true; controller.abort(); }, budget);
         try {
             const response = await (this.options.fetch ?? fetch)(backend + apiPath, {
                 method, redirect: 'error', signal: controller.signal,
+                // Opt-in shared transports may deduplicate only these stateless platform
+                // reads. Never infer read safety from arbitrary project tool annotations.
+                ...(apiPath === '/mcp' && body && typeof body === 'object' && (['initialize', 'notifications/initialized', 'tools/list'].includes(body.method)
+                    || body.method === 'tools/call' && ['agent.list', 'agent.search', 'agent.get', 'resource_release.mcp_endpoints'].includes(body.params?.name)) ? { cache: 'force-cache' } : {}),
                 headers: { 'Content-Type': 'application/json', ...(apiPath === '/mcp' ? { Accept: 'application/json, text/event-stream', 'MCP-Protocol-Version': '2025-11-25' } : {}), ...(access ? { Authorization: `Bearer ${access}` } : {}) },
                 body: body === undefined ? undefined : JSON.stringify(body)
             });
             if (response.status === 401 || response.status === 403)
                 throw new models_1.ToolingError('AUTH_REJECTED', 'The backend rejected the selected credentials.');
             if (!response.ok)
-                throw new models_1.ToolingError('API_ERROR', `The backend returned HTTP ${response.status}.`);
+                throw new models_1.ToolingError('API_ERROR', `The backend ${backend} returned HTTP ${response.status} for ${method} ${apiPath}.`);
             if (apiPath === '/mcp')
-                return await (0, mcpTransport_1.readMcpResponse)(response, body);
+                return await (0, mcpTransport_1.readMcpResponse)(response, body, 'platform MCP ' + backend);
             if (response.status === 204)
                 return undefined;
             try {
@@ -206,22 +223,33 @@ class MachineSessionService {
                 throw new models_1.ToolingError('CANCELLED', 'The action was cancelled.');
             if (error instanceof models_1.ToolingError)
                 throw error;
-            throw new models_1.ToolingError('BACKEND_UNREACHABLE', 'The backend could not be reached. The saved session has been kept.');
+            throw new models_1.ToolingError('BACKEND_UNREACHABLE', `The backend ${backend} could not be reached for ${method} ${apiPath}: `
+                + (timedOut ? `the request timed out after ${(0, mcpTransport_1.describeSeconds)(budget)} s` : (0, mcpTransport_1.failureReason)(error) || 'the connection failed') + '. The saved session has been kept.');
         }
         finally {
             clearTimeout(timer);
             this.options.signal?.removeEventListener('abort', abort);
         }
     }
-    renew(backend) {
-        const running = this.renewals.get(backend);
+    renew(backend, expectedAccount, stale) {
+        const renewalKey = JSON.stringify([backend, expectedAccount]);
+        const running = this.renewals.get(renewalKey);
         if (running)
             return running;
-        const task = (async () => {
+        const run = async () => {
             // Bypass cached state: another SDK process may have rotated the refresh token.
             const previous = await this.saved(backend);
             if (!previous?.refresh)
                 throw new models_1.ToolingError('NOT_AUTHENTICATED', 'No refreshable machine session is saved for this backend.');
+            if (expectedAccount !== undefined && previous.username && previous.username !== expectedAccount)
+                throw this.accountChanged();
+            // Another host process may have renewed while this one waited for the
+            // shared lease. Reuse its saved pair; never rotate it a second time.
+            if (stale && previous.access && previous.access !== stale.access) {
+                if (expectedAccount !== undefined)
+                    await this.verifyAccount(backend, previous, expectedAccount);
+                return previous;
+            }
             let data;
             try {
                 data = await this.http(backend, 'POST', '/auth/jwt-token/token/refresh/', { refresh: previous.refresh });
@@ -232,11 +260,24 @@ class MachineSessionService {
                 throw error;
             }
             const session = this.remember(tokenPair(data, previous));
+            if (expectedAccount !== undefined) {
+                const current = await this.saved(backend);
+                // A shared transport can coalesce simultaneous rotations. Another client
+                // may already have saved this exact returned pair; that is the same login.
+                if (!current || (current.access !== previous.access || current.refresh !== previous.refresh)
+                    && (current.access !== session.access || current.refresh !== session.refresh))
+                    throw this.accountChanged();
+            }
+            // Refresh may rotate the old token. Keep the new pair even if the subsequent
+            // profile check is unavailable; no domain request runs before that check passes.
             await this.persist(backend, session);
+            if (expectedAccount !== undefined)
+                await this.verifyAccount(backend, session, expectedAccount);
             return session;
-        })();
-        this.renewals.set(backend, task);
-        void task.finally(() => this.renewals.delete(backend)).catch(() => { });
+        };
+        const task = this.options.sessionLock ? this.options.sessionLock(backend, run, this.options.signal) : run();
+        this.renewals.set(renewalKey, task);
+        void task.finally(() => this.renewals.delete(renewalKey)).catch(() => { });
         return task;
     }
     async persist(backend, session) {
@@ -281,32 +322,110 @@ class MachineSessionService {
         };
     }
     async request(input, method, apiPath, body, retrySafe = method === 'GET', options) {
+        return this.accountRequest(input, method, apiPath, body, retrySafe, options);
+    }
+    accountChanged() {
+        return new AccountChangedError();
+    }
+    recordAccount(backend, session, profile, expectedAccount) {
+        const username = profile?.user?.username || profile?.username;
+        if (username !== expectedAccount) {
+            this.verifiedAccounts.delete(JSON.stringify([backend, session.access]));
+            throw this.accountChanged();
+        }
+        if (this.verifiedAccounts.size >= 32)
+            this.verifiedAccounts.delete(this.verifiedAccounts.keys().next().value);
+        this.verifiedAccounts.set(JSON.stringify([backend, session.access]), username);
+    }
+    async verifyAccount(backend, session, expectedAccount) {
+        if (this.verifiedAccounts.get(JSON.stringify([backend, session.access])) === expectedAccount)
+            return;
+        this.recordAccount(backend, session, await this.http(backend, 'GET', '/api/v1/users/me/', undefined, session.access), expectedAccount);
+    }
+    /** The same selected credential is verified and used. A 401 retry must verify its new credential too. */
+    async withAccount(input, expectedAccount) {
+        const backend = requireBackend(input);
+        (0, accountScope_1.validateExpectedAccount)(expectedAccount);
+        const target = (value) => { if (requireBackend(value) !== backend)
+            throw new models_1.ToolingError('BACKEND_MISMATCH', 'The request belongs to another backend.'); };
+        const unsupported = async () => { throw new models_1.ToolingError('UNSUPPORTED_ACTION', 'Account-bound operations cannot change authentication.'); };
+        const scoped = {
+            request: (value, method, apiPath, body, retrySafe = method === 'GET', options) => {
+                target(value);
+                return this.accountRequest(backend, method, apiPath, body, retrySafe, options, expectedAccount);
+            },
+            status: async (value, check = true) => {
+                target(value);
+                // During one account-bound operation, reuse the identity verified for this
+                // exact access token. Still reread shared credentials on every boundary;
+                // a changed token must be verified before it can access the remote service.
+                if (check)
+                    await this.accountRequest(backend, 'GET', '/api/v1/users/me/', undefined, true, undefined, expectedAccount);
+                const current = await this.selected(backend);
+                await this.verifyAccount(backend, current.session, expectedAccount);
+                const final = await this.selected(backend);
+                if (final.source !== current.source || final.session.access !== current.session.access || final.session.refresh !== current.session.refresh)
+                    throw this.accountChanged();
+                const source = current.source === 'environment' ? 'environment' : this.options.persistence?.mode ?? 'machine';
+                return { backend, authenticated: true, source, persistence: source,
+                    store: source === 'environment' ? null : this.options.persistence?.name ?? this.store?.name ?? null,
+                    username: expectedAccount, expiresAt: expiry(current.session.access), checked: true };
+            },
+            login: unsupported, logout: unsupported, refresh: unsupported,
+            sanitize: text => this.sanitize(text),
+        };
+        await scoped.status(backend, true);
+        return scoped;
+    }
+    async accountRequest(input, method, apiPath, body, retrySafe, options, expectedAccount) {
         if (options?.timeoutMs !== undefined && (!Number.isFinite(options.timeoutMs) || options.timeoutMs <= 0 || options.timeoutMs > 300000))
             throw new models_1.ToolingError('INVALID_REQUEST', 'Request timeout must be between 1 and 300000 milliseconds.');
         const backend = requireBackend(input);
         let { session, source } = await this.selected(backend);
         if (!session.access || (expiry(session.access) && Date.parse(expiry(session.access)) <= Date.now() + 30_000)) {
             if (source === 'machine')
-                session = await this.renew(backend);
+                session = await this.renew(backend, expectedAccount, session);
             else if (!session.access)
                 throw new models_1.ToolingError('NOT_AUTHENTICATED', 'The explicit environment has no access token.');
         }
+        const send = async (selected) => {
+            const checkSelected = async () => {
+                if (expectedAccount === undefined)
+                    return;
+                const current = await this.selected(backend);
+                if (current.source !== source || current.session.access !== selected.access || current.session.refresh !== selected.refresh)
+                    throw this.accountChanged();
+            };
+            if (expectedAccount !== undefined && apiPath !== '/api/v1/users/me/')
+                await this.verifyAccount(backend, selected, expectedAccount);
+            await checkSelected();
+            const value = await this.http(backend, method, apiPath, body, selected.access, options?.timeoutMs);
+            if (expectedAccount !== undefined && apiPath === '/api/v1/users/me/')
+                this.recordAccount(backend, selected, value, expectedAccount);
+            await checkSelected();
+            return value;
+        };
         try {
-            return await this.http(backend, method, apiPath, body, session.access, options?.timeoutMs);
+            return await send(session);
         }
         catch (error) {
             if (!(error instanceof models_1.ToolingError) || error.code !== 'AUTH_REJECTED')
                 throw error;
+            // Scope failures are not expired-token failures and must never trigger a replay.
+            if (error instanceof AccountChangedError)
+                throw error;
             if (source === 'environment')
                 throw refusedCredentials('environment', backend, session.access);
             if (!retrySafe)
                 throw error;
             const latest = await this.saved(backend);
-            const retry = latest?.access && latest.access !== session.access ? latest : await this.renew(backend);
+            const retry = latest?.access && latest.access !== session.access ? latest : await this.renew(backend, expectedAccount, session);
             try {
-                return await this.http(backend, method, apiPath, body, retry.access, options?.timeoutMs);
+                return await send(retry);
             }
             catch (retryError) {
+                if (retryError instanceof AccountChangedError)
+                    throw retryError;
                 if (retryError instanceof models_1.ToolingError && retryError.code === 'AUTH_REJECTED')
                     throw refusedCredentials('machine', backend, retry.refresh || retry.access);
                 throw retryError;