@gaodefa/daocore 2026.5.73 → 2026.5.75

package/dist/session-binding-BCrf6P9-.js

@@ -1,2 +0,0 @@
-import { t as clearCodexAppServerBinding } from "./session-binding-Dv-7cruS.js";
-export { clearCodexAppServerBinding };

package/dist/session-binding-Dv-7cruS.js

@@ -1,219 +0,0 @@
-import { s as resolveDefaultAgentDir } from "./agent-scope-config-CJUQxn7u.js";
-import { r as resolveProviderIdForAuth } from "./provider-auth-aliases-BCoTTDl4.js";
-import { n as ensureAuthProfileStore } from "./store-Ik30AbRk.js";
-import { t as log } from "./logger-DYJ7BvAc.js";
-import "./agent-runtime-Cio-RAUW.js";
-import "./agent-harness-runtime-C09s_5eo.js";
-import { s as normalizeCodexServiceTier } from "./config-vVEQHNjq.js";
-import fs from "node:fs/promises";
-//#region extensions/codex/src/app-server/session-binding.ts
-const CODEX_APP_SERVER_NATIVE_AUTH_PROVIDER = "openai-codex";
-const PUBLIC_OPENAI_MODEL_PROVIDER = "openai";
-function resolveCodexAppServerBindingPath(sessionFile) {
-	return `${sessionFile}.codex-app-server.json`;
-}
-async function readCodexAppServerBinding(sessionFile, lookup = {}) {
-	const path = resolveCodexAppServerBindingPath(sessionFile);
-	let raw;
-	try {
-		raw = await fs.readFile(path, "utf8");
-	} catch (error) {
-		if (isNotFound(error)) return;
-		log.warn("failed to read codex app-server binding", {
-			path,
-			error
-		});
-		return;
-	}
-	try {
-		const parsed = JSON.parse(raw);
-		if (parsed.schemaVersion !== 1 || typeof parsed.threadId !== "string") return;
-		const authProfileId = typeof parsed.authProfileId === "string" ? parsed.authProfileId : void 0;
-		return {
-			schemaVersion: 1,
-			threadId: parsed.threadId,
-			sessionFile,
-			cwd: typeof parsed.cwd === "string" ? parsed.cwd : "",
-			authProfileId,
-			model: typeof parsed.model === "string" ? parsed.model : void 0,
-			modelProvider: normalizeCodexAppServerBindingModelProvider({
-				...lookup,
-				authProfileId,
-				modelProvider: typeof parsed.modelProvider === "string" ? parsed.modelProvider : void 0
-			}),
-			approvalPolicy: readApprovalPolicy(parsed.approvalPolicy),
-			sandbox: readSandboxMode(parsed.sandbox),
-			serviceTier: readServiceTier(parsed.serviceTier),
-			dynamicToolsFingerprint: typeof parsed.dynamicToolsFingerprint === "string" ? parsed.dynamicToolsFingerprint : void 0,
-			userMcpServersFingerprint: typeof parsed.userMcpServersFingerprint === "string" ? parsed.userMcpServersFingerprint : void 0,
-			mcpServersFingerprint: typeof parsed.mcpServersFingerprint === "string" ? parsed.mcpServersFingerprint : void 0,
-			pluginAppsFingerprint: typeof parsed.pluginAppsFingerprint === "string" ? parsed.pluginAppsFingerprint : void 0,
-			pluginAppsInputFingerprint: typeof parsed.pluginAppsInputFingerprint === "string" ? parsed.pluginAppsInputFingerprint : void 0,
-			pluginAppPolicyContext: readPluginAppPolicyContext(parsed.pluginAppPolicyContext),
-			contextEngine: readContextEngineBinding(parsed.contextEngine),
-			environmentSelectionFingerprint: typeof parsed.environmentSelectionFingerprint === "string" ? parsed.environmentSelectionFingerprint : void 0,
-			createdAt: typeof parsed.createdAt === "string" ? parsed.createdAt : (/* @__PURE__ */ new Date()).toISOString(),
-			updatedAt: typeof parsed.updatedAt === "string" ? parsed.updatedAt : (/* @__PURE__ */ new Date()).toISOString()
-		};
-	} catch (error) {
-		log.warn("failed to parse codex app-server binding", {
-			path,
-			error
-		});
-		return;
-	}
-}
-async function writeCodexAppServerBinding(sessionFile, binding, lookup = {}) {
-	const now = (/* @__PURE__ */ new Date()).toISOString();
-	const payload = {
-		schemaVersion: 1,
-		sessionFile,
-		threadId: binding.threadId,
-		cwd: binding.cwd,
-		authProfileId: binding.authProfileId,
-		model: binding.model,
-		modelProvider: normalizeCodexAppServerBindingModelProvider({
-			...lookup,
-			authProfileId: binding.authProfileId,
-			modelProvider: binding.modelProvider
-		}),
-		approvalPolicy: binding.approvalPolicy,
-		sandbox: binding.sandbox,
-		serviceTier: binding.serviceTier,
-		dynamicToolsFingerprint: binding.dynamicToolsFingerprint,
-		userMcpServersFingerprint: binding.userMcpServersFingerprint,
-		mcpServersFingerprint: binding.mcpServersFingerprint,
-		pluginAppsFingerprint: binding.pluginAppsFingerprint,
-		pluginAppsInputFingerprint: binding.pluginAppsInputFingerprint,
-		pluginAppPolicyContext: binding.pluginAppPolicyContext,
-		contextEngine: binding.contextEngine,
-		environmentSelectionFingerprint: binding.environmentSelectionFingerprint,
-		createdAt: binding.createdAt ?? now,
-		updatedAt: now
-	};
-	await fs.writeFile(resolveCodexAppServerBindingPath(sessionFile), `${JSON.stringify(payload, null, 2)}\n`);
-}
-function readContextEngineBinding(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) return;
-	const record = value;
-	if (record.schemaVersion !== 1 || typeof record.engineId !== "string" || typeof record.policyFingerprint !== "string") return;
-	return {
-		schemaVersion: 1,
-		engineId: record.engineId,
-		policyFingerprint: record.policyFingerprint,
-		projection: readContextEngineProjectionBinding(record.projection)
-	};
-}
-function readContextEngineProjectionBinding(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) return;
-	const record = value;
-	if (record.schemaVersion !== 1 || record.mode !== "thread_bootstrap" || typeof record.epoch !== "string" || !record.epoch.trim()) return;
-	return {
-		schemaVersion: 1,
-		mode: "thread_bootstrap",
-		epoch: record.epoch,
-		fingerprint: typeof record.fingerprint === "string" ? record.fingerprint : void 0
-	};
-}
-function readPluginAppPolicyContext(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) return;
-	const record = value;
-	if (typeof record.fingerprint !== "string") return;
-	const apps = record.apps;
-	if (!apps || typeof apps !== "object" || Array.isArray(apps)) return;
-	const parsedApps = {};
-	for (const [appId, rawEntry] of Object.entries(apps)) {
-		if (!rawEntry || typeof rawEntry !== "object" || Array.isArray(rawEntry)) return;
-		const entry = rawEntry;
-		if ("appId" in entry || typeof entry.configKey !== "string" || entry.marketplaceName !== "openai-curated" || typeof entry.pluginName !== "string" || typeof entry.allowDestructiveActions !== "boolean" || !Array.isArray(entry.mcpServerNames) || entry.mcpServerNames.some((serverName) => typeof serverName !== "string")) return;
-		parsedApps[appId] = {
-			configKey: entry.configKey,
-			marketplaceName: entry.marketplaceName,
-			pluginName: entry.pluginName,
-			allowDestructiveActions: entry.allowDestructiveActions,
-			mcpServerNames: entry.mcpServerNames
-		};
-	}
-	const parsedPluginAppIds = {};
-	const rawPluginAppIds = record.pluginAppIds;
-	if (rawPluginAppIds && (typeof rawPluginAppIds !== "object" || Array.isArray(rawPluginAppIds))) return;
-	if (rawPluginAppIds && typeof rawPluginAppIds === "object") for (const [configKey, appIds] of Object.entries(rawPluginAppIds)) {
-		if (!Array.isArray(appIds) || appIds.some((appId) => typeof appId !== "string")) return;
-		parsedPluginAppIds[configKey] = appIds;
-	}
-	return {
-		fingerprint: record.fingerprint,
-		apps: parsedApps,
-		pluginAppIds: parsedPluginAppIds
-	};
-}
-async function clearCodexAppServerBinding(sessionFile, _lookup = {}) {
-	try {
-		await fs.unlink(resolveCodexAppServerBindingPath(sessionFile));
-	} catch (error) {
-		if (!isNotFound(error)) log.warn("failed to clear codex app-server binding", {
-			sessionFile,
-			error
-		});
-	}
-}
-function isNotFound(error) {
-	return Boolean(error && typeof error === "object" && "code" in error && error.code === "ENOENT");
-}
-function isCodexAppServerNativeAuthProfile(lookup) {
-	const authProfileId = lookup.authProfileId?.trim();
-	if (!authProfileId) return false;
-	try {
-		return isCodexAppServerNativeAuthProvider({
-			provider: resolveCodexAppServerAuthProfileCredential({
-				...lookup,
-				authProfileId
-			})?.provider,
-			config: lookup.config
-		});
-	} catch (error) {
-		log.debug("failed to resolve codex app-server auth profile provider", {
-			authProfileId,
-			error
-		});
-		return false;
-	}
-}
-function normalizeCodexAppServerBindingModelProvider(params) {
-	const modelProvider = params.modelProvider?.trim();
-	if (!modelProvider) return;
-	if (isCodexAppServerNativeAuthProfile(params) && modelProvider.toLowerCase() === PUBLIC_OPENAI_MODEL_PROVIDER) return;
-	return modelProvider;
-}
-function resolveCodexAppServerAuthProfileCredential(lookup) {
-	const authProfileId = lookup.authProfileId?.trim();
-	if (!authProfileId) return;
-	return (lookup.authProfileStore ?? loadCodexAppServerAuthProfileStore({
-		agentDir: lookup.agentDir,
-		authProfileId,
-		config: lookup.config
-	})).profiles[authProfileId];
-}
-function loadCodexAppServerAuthProfileStore(params) {
-	return ensureAuthProfileStore(params.agentDir?.trim() || resolveDefaultAgentDir(params.config ?? {}), {
-		allowKeychainPrompt: false,
-		config: params.config,
-		externalCliProviderIds: [CODEX_APP_SERVER_NATIVE_AUTH_PROVIDER],
-		externalCliProfileIds: [params.authProfileId]
-	});
-}
-function isCodexAppServerNativeAuthProvider(params) {
-	const provider = params.provider?.trim();
-	return Boolean(provider && resolveProviderIdForAuth(provider, { config: params.config }) === CODEX_APP_SERVER_NATIVE_AUTH_PROVIDER);
-}
-function readApprovalPolicy(value) {
-	return value === "never" || value === "on-request" || value === "on-failure" || value === "untrusted" ? value : void 0;
-}
-function readSandboxMode(value) {
-	return value === "read-only" || value === "workspace-write" || value === "danger-full-access" ? value : void 0;
-}
-function readServiceTier(value) {
-	return normalizeCodexServiceTier(value);
-}
-//#endregion
-export { resolveCodexAppServerBindingPath as a, readCodexAppServerBinding as i, isCodexAppServerNativeAuthProfile as n, writeCodexAppServerBinding as o, normalizeCodexAppServerBindingModelProvider as r, clearCodexAppServerBinding as t };

package/dist/session-kill-http-BJFrJrtN.js

@@ -1,121 +0,0 @@
-import { c as normalizeOptionalString } from "./string-coerce-DyL154ka.js";
-import { o as isLocalDirectRequest } from "./auth-zk3HFDT6.js";
-import { i as getRuntimeConfig } from "./io-Dlv1CClM.js";
-import { n as authorizeOperatorScopesForMethod } from "./method-scopes-Ce2SpYo5.js";
-import { c as loadSessionEntry } from "./session-utils-BkvnIQ_I.js";
-import { o as getLatestSubagentRunByChildSessionKey } from "./subagent-registry-DkLEo8Gw.js";
-import { a as killSubagentRunAdmin, c as resolveSubagentController, i as killControlledSubagentRun } from "./subagent-control-C4koBB2g.js";
-import { a as sendJson, i as sendInvalidRequest, o as sendMethodNotAllowed, s as sendMissingScopeForbidden } from "./http-common-BuKjxzdr.js";
-import { f as resolveTrustedHttpOperatorScopes, t as authorizeGatewayHttpRequestOrReply } from "./http-auth-utils-CcoEOh33.js";
-import "./http-utils-g2yMrcjq.js";
-//#region src/gateway/session-kill-http.ts
-const REQUESTER_SESSION_KEY_HEADER = "x-daocore-requester-session-key";
-function resolveSessionKeyFromPath(pathname) {
-	const match = pathname.match(/^\/sessions\/([^/]+)\/kill$/);
-	if (!match) return { matched: false };
-	try {
-		const decoded = decodeURIComponent(match[1] ?? "").trim();
-		if (!decoded) return {
-			error: "invalid-session-key",
-			matched: true
-		};
-		return {
-			matched: true,
-			sessionKey: decoded
-		};
-	} catch {
-		return {
-			error: "invalid-session-key",
-			matched: true
-		};
-	}
-}
-async function handleSessionKillHttpRequest(req, res, opts) {
-	const cfg = getRuntimeConfig();
-	const sessionKeyResolution = resolveSessionKeyFromPath(new URL(req.url ?? "/", "http://localhost").pathname);
-	if (!sessionKeyResolution.matched) return false;
-	if ("error" in sessionKeyResolution) {
-		sendInvalidRequest(res, "invalid session key");
-		return true;
-	}
-	const { sessionKey } = sessionKeyResolution;
-	if (req.method !== "POST") {
-		sendMethodNotAllowed(res, "POST");
-		return true;
-	}
-	const requestAuth = await authorizeGatewayHttpRequestOrReply({
-		req,
-		res,
-		auth: opts.auth,
-		trustedProxies: opts.trustedProxies ?? cfg.gateway?.trustedProxies,
-		allowRealIpFallback: opts.allowRealIpFallback ?? cfg.gateway?.allowRealIpFallback,
-		rateLimiter: opts.rateLimiter
-	});
-	if (!requestAuth) return true;
-	const trustedProxies = opts.trustedProxies ?? cfg.gateway?.trustedProxies;
-	const allowRealIpFallback = opts.allowRealIpFallback ?? cfg.gateway?.allowRealIpFallback;
-	const requesterSessionKey = normalizeOptionalString(req.headers[REQUESTER_SESSION_KEY_HEADER]?.toString());
-	const allowLocalAdminKill = isLocalDirectRequest(req, trustedProxies, allowRealIpFallback);
-	const requestedScopes = resolveTrustedHttpOperatorScopes(req, requestAuth);
-	if (!requesterSessionKey && !allowLocalAdminKill) {
-		sendJson(res, 403, {
-			ok: false,
-			error: {
-				type: "forbidden",
-				message: "Session kills require a local admin request or requester session ownership."
-			}
-		});
-		return true;
-	}
-	const scopeAuth = authorizeOperatorScopesForMethod(requesterSessionKey && !allowLocalAdminKill ? "sessions.abort" : "sessions.delete", requestedScopes);
-	if (!scopeAuth.allowed) {
-		sendMissingScopeForbidden(res, scopeAuth.missingScope);
-		return true;
-	}
-	const { entry, canonicalKey } = loadSessionEntry(sessionKey);
-	if (!entry) {
-		sendJson(res, 404, {
-			ok: false,
-			error: {
-				type: "not_found",
-				message: `Session not found: ${sessionKey}`
-			}
-		});
-		return true;
-	}
-	let killed = false;
-	if (!allowLocalAdminKill && requesterSessionKey) {
-		const runEntry = getLatestSubagentRunByChildSessionKey(canonicalKey);
-		if (runEntry) {
-			const result = await killControlledSubagentRun({
-				cfg,
-				controller: resolveSubagentController({
-					cfg,
-					agentSessionKey: requesterSessionKey
-				}),
-				entry: runEntry
-			});
-			if (result.status === "forbidden") {
-				sendJson(res, 403, {
-					ok: false,
-					error: {
-						type: "forbidden",
-						message: result.error
-					}
-				});
-				return true;
-			}
-			killed = result.status === "ok";
-		}
-	} else killed = (await killSubagentRunAdmin({
-		cfg,
-		sessionKey: canonicalKey
-	})).killed;
-	sendJson(res, 200, {
-		ok: true,
-		killed
-	});
-	return true;
-}
-//#endregion
-export { handleSessionKillHttpRequest };