@hellcoder/companion 0.119.0 → 0.120.0

package/server/codex-auth.test.ts

@@ -0,0 +1,254 @@
+import { describe, expect, it, vi, beforeEach, afterEach } from "vitest";
+import { EventEmitter } from "node:events";
+import { PassThrough } from "node:stream";
+
+/**
+ * Tests for the Codex ChatGPT device-code login manager.
+ *
+ * The manager drives a real `codex app-server` child process over newline
+ * delimited JSON-RPC, so these tests stub the spawn boundary with a fake child
+ * that speaks the same framing. That lets us assert the state machine
+ * (pending → success/error/canceled), idempotency, and the auth propagation
+ * behaviour without needing an authenticated Codex install.
+ */
+
+const spawnMock = vi.fn();
+const buildSpawnMock = vi.fn(() => ({ cmd: ["codex", "app-server"], env: {} }));
+
+vi.mock("node:child_process", () => ({ spawn: spawnMock }));
+vi.mock("./codex-app-server.js", () => ({ buildCodexAppServerSpawn: buildSpawnMock }));
+
+/** A fake `codex app-server` child speaking NDJSON JSON-RPC. */
+class FakeChild extends EventEmitter {
+  stdout = new PassThrough();
+  stdin: { write: (chunk: string) => boolean };
+  killed = false;
+  /** Every request the manager sent, parsed. */
+  sent: Array<{ method: string; id?: number; params?: unknown }> = [];
+  /** Response factories keyed by method; return undefined to stay silent. */
+  responders: Record<string, (params: unknown) => unknown> = {};
+
+  constructor() {
+    super();
+    this.stdin = {
+      write: (chunk: string) => {
+        for (const line of chunk.split("\n")) {
+          if (!line.trim()) continue;
+          const msg = JSON.parse(line);
+          this.sent.push(msg);
+          if (msg.method === "initialize") {
+            this.reply(msg.id, { userAgent: "test" });
+          } else if (this.responders[msg.method]) {
+            const result = this.responders[msg.method](msg.params);
+            if (result !== undefined && typeof msg.id === "number") this.reply(msg.id, result);
+          }
+        }
+        return true;
+      },
+    };
+  }
+
+  reply(id: number, result: unknown): void {
+    // Async so the manager's promise handlers are already attached.
+    setImmediate(() => this.stdout.write(JSON.stringify({ id, result }) + "\n"));
+  }
+
+  notify(method: string, params: unknown): void {
+    this.stdout.write(JSON.stringify({ method, params }) + "\n");
+  }
+
+  kill(): void {
+    this.killed = true;
+  }
+}
+
+let child: FakeChild;
+let auth: typeof import("./codex-auth.js");
+
+/** Poll until `predicate` holds, so we don't rely on fixed sleeps. */
+async function until(predicate: () => boolean, timeoutMs = 1000): Promise<void> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (predicate()) return;
+    await new Promise((r) => setTimeout(r, 5));
+  }
+  throw new Error("Condition not met in time");
+}
+
+const DEVICE_CODE_RESULT = {
+  type: "chatgptDeviceCode",
+  loginId: "login-1",
+  userCode: "ABCD-1234",
+  verificationUrl: "https://auth.openai.com/codex/device",
+};
+
+beforeEach(async () => {
+  vi.resetModules();
+  child = new FakeChild();
+  spawnMock.mockReset();
+  spawnMock.mockImplementation(() => child);
+  buildSpawnMock.mockReturnValue({ cmd: ["codex", "app-server"], env: {} });
+  auth = await import("./codex-auth.js");
+});
+
+afterEach(() => {
+  auth._resetCodexAuthState();
+});
+
+describe("startDeviceLogin", () => {
+  it("returns the device code and enters the pending state", async () => {
+    child.responders["account/login/start"] = () => DEVICE_CODE_RESULT;
+
+    const status = await auth.startDeviceLogin();
+
+    expect(status.state).toBe("pending");
+    expect(status.userCode).toBe("ABCD-1234");
+    expect(status.verificationUrl).toBe("https://auth.openai.com/codex/device");
+    // Device code must be requested explicitly — the plain `chatgpt` type would
+    // use a localhost OAuth callback, which breaks for a remote server.
+    const start = child.sent.find((m) => m.method === "account/login/start");
+    expect(start?.params).toEqual({ type: "chatgptDeviceCode" });
+  });
+
+  it("is idempotent while a login is in flight so the user's code stays valid", async () => {
+    child.responders["account/login/start"] = () => DEVICE_CODE_RESULT;
+
+    const first = await auth.startDeviceLogin();
+    const second = await auth.startDeviceLogin();
+
+    expect(second).toEqual(first);
+    // Only one app-server spawned: a second spawn would orphan the first child
+    // and invalidate a code the user may already be typing.
+    expect(spawnMock).toHaveBeenCalledTimes(1);
+  });
+
+  it("transitions to success when Codex reports login completed", async () => {
+    child.responders["account/login/start"] = () => DEVICE_CODE_RESULT;
+    await auth.startDeviceLogin();
+
+    child.notify("account/login/completed", { loginId: "login-1", success: true });
+
+    await until(() => auth.getLoginStatus().state === "success");
+    expect(child.killed).toBe(true);
+  });
+
+  it("surfaces the upstream error message when login fails", async () => {
+    child.responders["account/login/start"] = () => DEVICE_CODE_RESULT;
+    await auth.startDeviceLogin();
+
+    child.notify("account/login/completed", {
+      loginId: "login-1", success: false, error: "Login was not completed",
+    });
+
+    await until(() => auth.getLoginStatus().state === "error");
+    expect(auth.getLoginStatus().error).toBe("Login was not completed");
+  });
+
+  it("ignores a completion notification for a superseded login id", async () => {
+    child.responders["account/login/start"] = () => DEVICE_CODE_RESULT;
+    await auth.startDeviceLogin();
+
+    child.notify("account/login/completed", { loginId: "some-older-login", success: true });
+
+    await new Promise((r) => setTimeout(r, 30));
+    expect(auth.getLoginStatus().state).toBe("pending");
+  });
+
+  it("fails clearly when the CLI is too old to return a device code", async () => {
+    // An older Codex answers the RPC but without device-code fields.
+    child.responders["account/login/start"] = () => ({ type: "chatgpt", authUrl: "https://x" });
+
+    await expect(auth.startDeviceLogin()).rejects.toThrow(/device code/i);
+    expect(child.killed).toBe(true);
+  });
+
+  it("reports an error when the codex binary cannot be resolved", async () => {
+    buildSpawnMock.mockReturnValue(null as never);
+    await expect(auth.startDeviceLogin()).rejects.toThrow(/not found/i);
+  });
+
+  it("marks the login failed if the app-server dies before completing", async () => {
+    child.responders["account/login/start"] = () => DEVICE_CODE_RESULT;
+    await auth.startDeviceLogin();
+
+    child.emit("exit", 1);
+
+    await until(() => auth.getLoginStatus().state === "error");
+    expect(auth.getLoginStatus().error).toMatch(/exited/i);
+  });
+});
+
+describe("cancelLogin", () => {
+  it("cancels an in-flight login and kills the child", async () => {
+    child.responders["account/login/start"] = () => DEVICE_CODE_RESULT;
+    await auth.startDeviceLogin();
+
+    const status = await auth.cancelLogin();
+
+    expect(status.state).toBe("canceled");
+    expect(child.killed).toBe(true);
+    // The terminal result is retained so a poll arriving after cancel sees it.
+    expect(auth.getLoginStatus().state).toBe("canceled");
+  });
+
+  it("is a no-op when nothing is in flight", async () => {
+    expect((await auth.cancelLogin()).state).toBe("idle");
+  });
+});
+
+describe("getAccountStatus", () => {
+  it("reports a signed-in ChatGPT account with email and plan", async () => {
+    child.responders["account/read"] = () => ({
+      account: { type: "chatgpt", email: "user@example.com", planType: "pro" },
+      requiresOpenaiAuth: false,
+    });
+
+    const status = await auth.getAccountStatus();
+
+    expect(status).toMatchObject({
+      cliAvailable: true, authenticated: true, method: "chatgpt",
+      email: "user@example.com", planType: "pro",
+    });
+    expect(child.killed).toBe(true); // short-lived probe must not leak a process
+  });
+
+  it("distinguishes API-key auth from a ChatGPT subscription", async () => {
+    child.responders["account/read"] = () => ({ account: { type: "apiKey" }, requiresOpenaiAuth: false });
+
+    const status = await auth.getAccountStatus();
+
+    expect(status.method).toBe("apiKey");
+    expect(status.authenticated).toBe(true);
+    expect(status.email).toBeNull();
+  });
+
+  it("reports unauthenticated when Codex has no account", async () => {
+    child.responders["account/read"] = () => ({ account: null, requiresOpenaiAuth: true });
+
+    const status = await auth.getAccountStatus();
+
+    expect(status.authenticated).toBe(false);
+    expect(status.method).toBeNull();
+  });
+
+  it("reports the CLI as unavailable rather than throwing", async () => {
+    buildSpawnMock.mockReturnValue(null as never);
+
+    const status = await auth.getAccountStatus();
+
+    expect(status.cliAvailable).toBe(false);
+    expect(status.error).toMatch(/not found/i);
+  });
+});
+
+describe("logout", () => {
+  it("calls account/logout and reports success", async () => {
+    child.responders["account/logout"] = () => ({});
+
+    const res = await auth.logout();
+
+    expect(res.ok).toBe(true);
+    expect(child.sent.some((m) => m.method === "account/logout")).toBe(true);
+    expect(child.killed).toBe(true);
+  });
+});

package/server/codex-auth.ts

@@ -0,0 +1,315 @@
+import { spawn, type ChildProcess } from "node:child_process";
+import { copyFileSync, existsSync, mkdirSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { buildCodexAppServerSpawn } from "./codex-app-server.js";
+import { DEFAULT_COMPANION_CODEX_HOME, getLegacyCodexHome } from "./codex-home.js";
+
+/**
+ * Codex ChatGPT-subscription login, driven from the Companion UI.
+ *
+ * Why device code: the plain `chatgpt` login type returns an OAuth `authUrl`
+ * that redirects to a localhost callback owned by the Codex process. That only
+ * works when the browser and the CLI are on the same machine, which is exactly
+ * not the case for Companion (the whole point is driving a remote box from a
+ * browser). `chatgptDeviceCode` instead returns a short user code plus a
+ * verification URL, so the user can approve on whatever device their browser is
+ * on. This removes the need to SSH in and run `codex login` by hand.
+ *
+ * Lifecycle: `account/login/start` needs the same app-server process to stay
+ * alive until the login resolves, because Codex polls the device-code endpoint
+ * internally and reports the outcome via the `account/login/completed`
+ * notification. So we hold one child process for the duration of a login and
+ * expose a pollable status, following the same poll-a-status-endpoint pattern
+ * the image-pull and dashboard-run features already use.
+ */
+
+/** Device codes are short-lived upstream; give up well before that silently. */
+const LOGIN_TIMEOUT_MS = 15 * 60 * 1000;
+/** Bound short-lived RPCs (account read/logout) so a wedged CLI can't hang a request. */
+const RPC_TIMEOUT_MS = 15_000;
+
+export type CodexLoginState = "idle" | "pending" | "success" | "error" | "canceled";
+
+export interface CodexLoginStatus {
+  state: CodexLoginState;
+  /** The code the user types at `verificationUrl`. Present while pending. */
+  userCode?: string;
+  verificationUrl?: string;
+  loginId?: string;
+  error?: string;
+  /** Epoch ms after which this attempt is abandoned. */
+  expiresAt?: number;
+}
+
+export interface CodexAccountStatus {
+  /** False when the codex binary can't be resolved at all. */
+  cliAvailable: boolean;
+  authenticated: boolean;
+  /** How Codex is authenticated, when it is. */
+  method: "chatgpt" | "apiKey" | null;
+  email: string | null;
+  planType: string | null;
+  error?: string;
+}
+
+interface ActiveLogin {
+  child: ChildProcess;
+  status: CodexLoginStatus;
+  timer: ReturnType<typeof setTimeout>;
+}
+
+let activeLogin: ActiveLogin | null = null;
+/** Terminal result of the most recent attempt, so a poll after completion still sees it. */
+let lastResult: CodexLoginStatus = { state: "idle" };
+
+/**
+ * Env for auth operations. Pinned to the real Codex home (~/.codex) because
+ * that is the file cli-launcher seeds per-session Codex homes from, and what
+ * `hasContainerCodexAuth()` probes. Writing anywhere else would produce a login
+ * that appears to succeed but never reaches sessions.
+ */
+function authEnv(): Record<string, string | undefined> {
+  return { CODEX_HOME: getLegacyCodexHome() };
+}
+
+/** Minimal newline-delimited JSON-RPC client over a spawned app-server. */
+function createRpcClient(child: ChildProcess, onNotification?: (method: string, params: Record<string, unknown>) => void) {
+  let nextId = 1;
+  const pending = new Map<number, { resolve: (v: unknown) => void; reject: (e: Error) => void }>();
+  let buf = "";
+
+  child.stdout?.on("data", (chunk: Buffer) => {
+    buf += chunk.toString();
+    let idx: number;
+    while ((idx = buf.indexOf("\n")) >= 0) {
+      const line = buf.slice(0, idx);
+      buf = buf.slice(idx + 1);
+      if (!line.trim()) continue;
+      let msg: { id?: number; result?: unknown; error?: { message?: string }; method?: string; params?: Record<string, unknown> };
+      try { msg = JSON.parse(line); } catch { continue; }
+
+      if (typeof msg.id === "number" && (msg.result !== undefined || msg.error !== undefined)) {
+        const waiter = pending.get(msg.id);
+        if (waiter) {
+          pending.delete(msg.id);
+          if (msg.error) waiter.reject(new Error(msg.error.message || "Codex RPC error"));
+          else waiter.resolve(msg.result);
+        }
+      } else if (msg.method) {
+        onNotification?.(msg.method, msg.params || {});
+      }
+    }
+  });
+
+  const send = (obj: Record<string, unknown>) => {
+    try { child.stdin?.write(JSON.stringify(obj) + "\n"); } catch { /* pipe closed */ }
+  };
+
+  const call = (method: string, params?: unknown, timeoutMs = RPC_TIMEOUT_MS): Promise<unknown> =>
+    new Promise((resolve, reject) => {
+      const id = nextId++;
+      const timer = setTimeout(() => {
+        pending.delete(id);
+        reject(new Error(`Codex RPC "${method}" timed out`));
+      }, timeoutMs);
+      pending.set(id, {
+        resolve: (v) => { clearTimeout(timer); resolve(v); },
+        reject: (e) => { clearTimeout(timer); reject(e); },
+      });
+      send({ method, id, params: params ?? {} });
+    });
+
+  const rejectAll = (err: Error) => {
+    for (const [, waiter] of pending) waiter.reject(err);
+    pending.clear();
+  };
+
+  return { call, notify: (method: string, params?: unknown) => send({ method, params: params ?? {} }), rejectAll };
+}
+
+/** Spawn an app-server and complete the `initialize`/`initialized` handshake. */
+async function startAppServer(onNotification?: (m: string, p: Record<string, unknown>) => void) {
+  const plan = buildCodexAppServerSpawn("codex", authEnv());
+  if (!plan) throw new Error("Codex CLI not found on PATH");
+
+  const child = spawn(plan.cmd[0], plan.cmd.slice(1), { env: plan.env, stdio: ["pipe", "pipe", "ignore"] });
+  const rpc = createRpcClient(child, onNotification);
+
+  child.on("error", (e) => rpc.rejectAll(e instanceof Error ? e : new Error(String(e))));
+  child.on("exit", () => rpc.rejectAll(new Error("Codex app-server exited")));
+
+  await rpc.call("initialize", {
+    clientInfo: { name: "thecompanion", title: "The Companion", version: "1.0.0" },
+    capabilities: { experimentalApi: true },
+  });
+  rpc.notify("initialized", {});
+  return { child, rpc };
+}
+
+function killChild(child: ChildProcess): void {
+  try { child.kill(); } catch { /* already dead */ }
+}
+
+/**
+ * After a successful login, push the fresh auth.json into Codex homes that were
+ * already materialised for existing sessions. cli-launcher only seeds auth.json
+ * when the destination is absent, so without this an existing session would
+ * keep using the stale (or missing) credentials it was created with.
+ */
+export function propagateAuthToSessionHomes(): number {
+  const src = join(getLegacyCodexHome(), "auth.json");
+  if (!existsSync(src)) return 0;
+
+  let copied = 0;
+  let entries: string[];
+  try {
+    entries = readdirSync(DEFAULT_COMPANION_CODEX_HOME);
+  } catch {
+    return 0; // No per-session homes yet.
+  }
+
+  for (const entry of entries) {
+    const dir = join(DEFAULT_COMPANION_CODEX_HOME, entry);
+    try {
+      mkdirSync(dir, { recursive: true });
+      copyFileSync(src, join(dir, "auth.json"));
+      copied++;
+    } catch {
+      // Best effort: one unwritable session home must not fail the login.
+    }
+  }
+  return copied;
+}
+
+/** Current login status (in-flight attempt, else the last terminal result). */
+export function getLoginStatus(): CodexLoginStatus {
+  return activeLogin ? { ...activeLogin.status } : { ...lastResult };
+}
+
+function finishLogin(state: CodexLoginState, error?: string): void {
+  if (!activeLogin) return;
+  clearTimeout(activeLogin.timer);
+  killChild(activeLogin.child);
+  lastResult = { ...activeLogin.status, state, error };
+  delete lastResult.expiresAt;
+  activeLogin = null;
+  if (state === "success") propagateAuthToSessionHomes();
+}
+
+/**
+ * Begin a ChatGPT device-code login. Idempotent while one is in flight: a
+ * second call returns the same code rather than orphaning the first child
+ * process and invalidating a code the user may already be typing.
+ */
+export async function startDeviceLogin(): Promise<CodexLoginStatus> {
+  if (activeLogin) return { ...activeLogin.status };
+
+  const { child, rpc } = await startAppServer((method, params) => {
+    if (method !== "account/login/completed") return;
+    if (!activeLogin) return;
+    // Ignore results for a superseded attempt.
+    const loginId = typeof params.loginId === "string" ? params.loginId : undefined;
+    if (loginId && activeLogin.status.loginId && loginId !== activeLogin.status.loginId) return;
+
+    if (params.success === true) finishLogin("success");
+    else finishLogin("error", typeof params.error === "string" ? params.error : "Login was not completed");
+  });
+
+  let result: { loginId?: string; userCode?: string; verificationUrl?: string };
+  try {
+    result = (await rpc.call("account/login/start", { type: "chatgptDeviceCode" })) as typeof result;
+  } catch (e) {
+    killChild(child);
+    throw e;
+  }
+
+  if (!result?.userCode || !result?.verificationUrl) {
+    killChild(child);
+    throw new Error("Codex did not return a device code. Update the Codex CLI and try again.");
+  }
+
+  const expiresAt = Date.now() + LOGIN_TIMEOUT_MS;
+  activeLogin = {
+    child,
+    status: {
+      state: "pending",
+      loginId: result.loginId,
+      userCode: result.userCode,
+      verificationUrl: result.verificationUrl,
+      expiresAt,
+    },
+    timer: setTimeout(() => finishLogin("error", "Login timed out. Start a new login and try again."), LOGIN_TIMEOUT_MS),
+  };
+
+  // A child that dies before completing means the login can never resolve.
+  child.on("exit", () => {
+    if (activeLogin?.child === child) finishLogin("error", "Codex exited before the login completed");
+  });
+
+  return { ...activeLogin.status };
+}
+
+/** Cancel an in-flight login, telling Codex to stop polling before we kill it. */
+export async function cancelLogin(): Promise<CodexLoginStatus> {
+  if (!activeLogin) return { ...lastResult };
+  finishLogin("canceled");
+  return { ...lastResult };
+}
+
+/** Read the current Codex account, spawning a short-lived app-server. */
+export async function getAccountStatus(): Promise<CodexAccountStatus> {
+  const base: CodexAccountStatus = {
+    cliAvailable: true, authenticated: false, method: null, email: null, planType: null,
+  };
+
+  if (!buildCodexAppServerSpawn("codex", authEnv())) {
+    return { ...base, cliAvailable: false, error: "Codex CLI not found on PATH" };
+  }
+
+  let child: ChildProcess | null = null;
+  try {
+    const started = await startAppServer();
+    child = started.child;
+    const res = (await started.rpc.call("account/read", {})) as {
+      account?: { type?: string; email?: string; planType?: string } | null;
+    };
+    const account = res?.account;
+    if (!account?.type) return base;
+    return {
+      ...base,
+      authenticated: true,
+      method: account.type === "apiKey" ? "apiKey" : "chatgpt",
+      email: account.email ?? null,
+      planType: account.planType ?? null,
+    };
+  } catch (e) {
+    return { ...base, error: e instanceof Error ? e.message : String(e) };
+  } finally {
+    if (child) killChild(child);
+  }
+}
+
+/** Sign the current Codex account out. */
+export async function logout(): Promise<{ ok: boolean; error?: string }> {
+  let child: ChildProcess | null = null;
+  try {
+    const started = await startAppServer();
+    child = started.child;
+    await started.rpc.call("account/logout", {});
+    return { ok: true };
+  } catch (e) {
+    return { ok: false, error: e instanceof Error ? e.message : String(e) };
+  } finally {
+    if (child) killChild(child);
+  }
+}
+
+/** Test helper: drop all in-memory login state. */
+export function _resetCodexAuthState(): void {
+  if (activeLogin) {
+    clearTimeout(activeLogin.timer);
+    killChild(activeLogin.child);
+  }
+  activeLogin = null;
+  lastResult = { state: "idle" };
+}

package/server/codex-models.ts

@@ -1,7 +1,5 @@
 import { spawn } from "node:child_process";
-import { existsSync, realpathSync } from "node:fs";
-import { join, resolve } from "node:path";
-import { getEnrichedPath, resolveBinary } from "./path-resolver.js";
+import { buildCodexAppServerSpawn } from "./codex-app-server.js";
 
 /**
  * A Codex model as surfaced to the frontend model picker.
@@ -70,45 +68,6 @@ export function _resetCodexModelsCache(): void {
   modelsCache.clear();
 }
 
-/**
- * Build the spawn command for `codex app-server`, resolving the binary and
- * applying the same sibling-node shim that cli-launcher uses so a CLI shipped
- * with a bundled node still launches correctly.
- */
-function buildCodexSpawn(binaryName: string): { cmd: string[]; env: NodeJS.ProcessEnv } | null {
-  const resolved = resolveBinary(binaryName);
-  if (!resolved) return null;
-
-  const binaryDir = resolve(resolved, "..");
-  const siblingNode = join(binaryDir, "node");
-  const enrichedPath = getEnrichedPath();
-  const pathSep = process.platform === "win32" ? ";" : ":";
-  const spawnPath = [binaryDir, ...enrichedPath.split(pathSep)].filter(Boolean).join(pathSep);
-
-  // `model/list` does not require auth or a sandbox, so we skip --enable flags
-  // and run a bare app-server purely for the handshake + listing.
-  const args = ["app-server"];
-
-  let cmd: string[];
-  if (existsSync(siblingNode)) {
-    let codexScript: string;
-    try {
-      codexScript = realpathSync(resolved);
-    } catch {
-      codexScript = resolved;
-    }
-    cmd = [siblingNode, codexScript, ...args];
-  } else {
-    const isCmdScript = process.platform === "win32" && (resolved.endsWith(".cmd") || resolved.endsWith(".bat"));
-    cmd = isCmdScript ? ["cmd.exe", "/c", resolved, ...args] : [resolved, ...args];
-  }
-
-  return {
-    cmd,
-    env: { ...process.env, CLAUDECODE: undefined, PATH: spawnPath },
-  };
-}
-
 /**
  * Fetch the list of available Codex models by briefly launching
  * `codex app-server`, performing the initialize handshake, and calling the
@@ -128,7 +87,7 @@ export async function fetchCodexModels(opts: { binary?: string; timeoutMs?: numb
     return cached.models;
   }
 
-  const spawnInfo = buildCodexSpawn(binaryName);
+  const spawnInfo = buildCodexAppServerSpawn(binaryName);
   if (!spawnInfo) return [];
 
   return new Promise<CodexModelOption[]>((resolvePromise) => {