@intent-systems/nexus 2026.1.5-3

package/dist/agents/auth-profiles.js

@@ -0,0 +1,626 @@
+import { execFileSync } from "node:child_process";
+import fs from "node:fs";
+import lockfile from "proper-lockfile";
+import { createSubsystemLogger } from "../logging.js";
+import { buildCredentialIndex, ensureCredentialIndexSync, listCredentialEntriesSync, readCredentialRecordSync, resolveCredentialIndexPath, resolveCredentialValue, writeCredentialIndexSync, writeCredentialRecordSync, } from "../credentials/store.js";
+import { refreshChutesTokens } from "./chutes-oauth.js";
+import { normalizeProviderId } from "./model-selection.js";
+export const CLAUDE_CLI_PROFILE_ID = "anthropic:claude-cli";
+export const CODEX_CLI_PROFILE_ID = "openai-codex:codex-cli";
+const log = createSubsystemLogger("agents/auth-profiles");
+const INDEX_LOCK_OPTIONS = {
+    retries: {
+        retries: 10,
+        factor: 2,
+        minTimeout: 100,
+        maxTimeout: 10_000,
+        randomize: true,
+    },
+    stale: 30_000,
+};
+function parseProfileId(profileId) {
+    const parts = profileId.split(":");
+    if (parts.length === 1)
+        return { provider: profileId, account: "default" };
+    return { provider: parts[0] ?? profileId, account: parts.slice(1).join(":") || "default" };
+}
+function isEmailLike(value) {
+    const trimmed = value.trim();
+    return Boolean(trimmed && trimmed.includes("@") && trimmed.includes("."));
+}
+function pickPreferredEntry(entries) {
+    if (entries.length === 0)
+        return null;
+    const byType = (type) => entries.find((entry) => entry.record.type === type);
+    return byType("api_key") ?? byType("token") ?? byType("oauth") ?? entries[0] ?? null;
+}
+function resolveCredentialEmail(entry) {
+    const metaEmail = entry.record.metadata?.email;
+    if (typeof metaEmail === "string" && metaEmail.trim())
+        return metaEmail.trim();
+    return isEmailLike(entry.account) ? entry.account : undefined;
+}
+function buildProfiles(entries) {
+    const grouped = new Map();
+    for (const entry of entries) {
+        const profileId = `${entry.service}:${entry.account}`;
+        const list = grouped.get(profileId) ?? [];
+        list.push(entry);
+        grouped.set(profileId, list);
+    }
+    const profiles = {};
+    for (const [profileId, list] of grouped.entries()) {
+        const preferred = pickPreferredEntry(list);
+        if (!preferred)
+            continue;
+        const email = resolveCredentialEmail(preferred);
+        const base = {
+            provider: preferred.service,
+            email,
+            credentialPath: preferred.filePath,
+        };
+        if (preferred.record.type === "api_key") {
+            profiles[profileId] = { type: "api_key", ...base };
+        }
+        else if (preferred.record.type === "token") {
+            profiles[profileId] = { type: "token", ...base };
+        }
+        else {
+            profiles[profileId] = { type: "oauth", ...base };
+        }
+    }
+    return profiles;
+}
+function readIndex() {
+    return ensureCredentialIndexSync();
+}
+function writeIndex(index) {
+    writeCredentialIndexSync(index);
+}
+async function updateIndexWithLock(updater) {
+    const indexPath = resolveCredentialIndexPath();
+    if (!fs.existsSync(indexPath)) {
+        const rebuilt = ensureCredentialIndexSync();
+        writeCredentialIndexSync(rebuilt);
+    }
+    let release;
+    try {
+        release = await lockfile.lock(indexPath, INDEX_LOCK_OPTIONS);
+        const index = readIndex();
+        const shouldWrite = updater(index);
+        if (shouldWrite)
+            writeIndex(index);
+        return index;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        if (release) {
+            try {
+                await release();
+            }
+            catch {
+                // ignore
+            }
+        }
+    }
+}
+export function loadAuthProfileStore() {
+    const entries = listCredentialEntriesSync();
+    const existing = readIndex();
+    const rebuilt = buildCredentialIndex(entries);
+    rebuilt.order = existing.order;
+    rebuilt.lastGood = existing.lastGood;
+    rebuilt.usageStats = existing.usageStats;
+    const servicesChanged = JSON.stringify(rebuilt.services) !== JSON.stringify(existing.services ?? {});
+    if (servicesChanged) {
+        writeIndex(rebuilt);
+    }
+    return {
+        version: rebuilt.version ?? 1,
+        profiles: buildProfiles(entries),
+        order: rebuilt.order,
+        lastGood: rebuilt.lastGood,
+        usageStats: rebuilt.usageStats,
+    };
+}
+export function ensureAuthProfileStore(_agentDir, _options) {
+    return loadAuthProfileStore();
+}
+export function saveAuthProfileStore(store) {
+    const index = readIndex();
+    index.order = store.order;
+    index.lastGood = store.lastGood;
+    index.usageStats = store.usageStats;
+    index.lastUpdated = new Date().toISOString();
+    writeIndex(index);
+}
+export async function setAuthProfileOrder(params) {
+    const providerKey = normalizeProviderId(params.provider);
+    const sanitized = params.order && Array.isArray(params.order)
+        ? params.order.map((entry) => String(entry).trim()).filter(Boolean)
+        : [];
+    const deduped = [];
+    for (const entry of sanitized) {
+        if (!deduped.includes(entry))
+            deduped.push(entry);
+    }
+    const updated = await updateIndexWithLock((index) => {
+        index.order = index.order ?? {};
+        if (deduped.length === 0) {
+            if (!index.order[providerKey])
+                return false;
+            delete index.order[providerKey];
+            if (Object.keys(index.order).length === 0)
+                index.order = undefined;
+            return true;
+        }
+        index.order[providerKey] = deduped;
+        return true;
+    });
+    if (!updated)
+        return null;
+    return loadAuthProfileStore();
+}
+function resolveAuthIdForProvider(entry) {
+    return entry.authId;
+}
+export function upsertAuthProfile(params) {
+    const { provider, account } = parseProfileId(params.profileId);
+    const authId = resolveAuthIdForProvider({
+        service: provider,
+        account,
+        authId: params.credential.type,
+        filePath: "",
+        record: {
+            owner: "user",
+            type: params.credential.type,
+            storage: { provider: "plaintext" },
+        },
+    });
+    const record = {
+        owner: "user",
+        type: params.credential.type,
+        configuredAt: new Date().toISOString(),
+        storage: { provider: "plaintext" },
+        metadata: {
+            addedBy: "nexus upsertAuthProfile",
+        },
+    };
+    if (params.credential.type === "api_key") {
+        record.key = params.credential.key;
+    }
+    else if (params.credential.type === "token") {
+        record.token = params.credential.token;
+        record.expiresAt = params.credential.expires;
+    }
+    else {
+        record.accessToken = params.credential.access;
+        record.refreshToken = params.credential.refresh;
+        record.expiresAt = params.credential.expires;
+    }
+    const secretValue = record.key ?? record.token ?? record.accessToken;
+    const allowKeychain = process.env.NEXUS_KEYCHAIN_ENABLED === "1";
+    if (secretValue && allowKeychain && process.platform === "darwin") {
+        const keychainService = `nexus.${provider}`;
+        const keychainAccount = account;
+        try {
+            execFileSync("security", [
+                "add-generic-password",
+                "-U",
+                "-s",
+                keychainService,
+                "-a",
+                keychainAccount,
+                "-w",
+                secretValue,
+            ]);
+            record.storage = { provider: "keychain", service: keychainService, account: keychainAccount };
+            record.key = undefined;
+            record.token = undefined;
+            record.accessToken = undefined;
+            record.refreshToken = undefined;
+        }
+        catch (err) {
+            log.warn("keychain write failed; storing plaintext credential", { err: String(err) });
+        }
+    }
+    writeCredentialRecordSync(provider, account, authId, record);
+    const index = readIndex();
+    index.lastUpdated = new Date().toISOString();
+    writeIndex(index);
+    log.info("upserted credential for profile", {
+        profileId: params.profileId,
+        provider,
+        account,
+    });
+}
+export function listProfilesForProvider(store, provider) {
+    const providerKey = normalizeProviderId(provider);
+    return Object.entries(store.profiles)
+        .filter(([, cred]) => normalizeProviderId(cred.provider) === providerKey)
+        .map(([id]) => id);
+}
+export function isProfileInCooldown(store, profileId) {
+    const stats = store.usageStats?.[profileId];
+    if (!stats?.cooldownUntil)
+        return false;
+    return Date.now() < stats.cooldownUntil;
+}
+export async function markAuthProfileUsed(params) {
+    const updated = await updateIndexWithLock((index) => {
+        index.usageStats = index.usageStats ?? {};
+        index.usageStats[params.profileId] = {
+            ...index.usageStats[params.profileId],
+            lastUsed: Date.now(),
+            errorCount: 0,
+            cooldownUntil: undefined,
+        };
+        return true;
+    });
+    if (updated) {
+        params.store.usageStats = updated.usageStats;
+    }
+}
+export function calculateAuthProfileCooldownMs(errorCount) {
+    const normalized = Math.max(1, errorCount);
+    return Math.min(60 * 60 * 1000, 60 * 1000 * 5 ** Math.min(normalized - 1, 3));
+}
+export async function markAuthProfileCooldown(params) {
+    const updated = await updateIndexWithLock((index) => {
+        index.usageStats = index.usageStats ?? {};
+        const existing = index.usageStats[params.profileId] ?? {};
+        const errorCount = (existing.errorCount ?? 0) + 1;
+        const backoffMs = calculateAuthProfileCooldownMs(errorCount);
+        index.usageStats[params.profileId] = {
+            ...existing,
+            errorCount,
+            cooldownUntil: Date.now() + backoffMs,
+        };
+        return true;
+    });
+    if (updated) {
+        params.store.usageStats = updated.usageStats;
+    }
+}
+export async function clearAuthProfileCooldown(params) {
+    const updated = await updateIndexWithLock((index) => {
+        if (!index.usageStats?.[params.profileId])
+            return false;
+        index.usageStats[params.profileId] = {
+            ...index.usageStats[params.profileId],
+            errorCount: 0,
+            cooldownUntil: undefined,
+        };
+        return true;
+    });
+    if (updated) {
+        params.store.usageStats = updated.usageStats;
+    }
+}
+export async function markAuthProfileGood(params) {
+    const providerKey = normalizeProviderId(params.provider);
+    const updated = await updateIndexWithLock((index) => {
+        index.lastGood = { ...(index.lastGood ?? {}), [providerKey]: params.profileId };
+        return true;
+    });
+    if (updated) {
+        params.store.lastGood = updated.lastGood;
+    }
+}
+export function resolveAuthStorePathForDisplay() {
+    return resolveCredentialIndexPath();
+}
+export function resolveAuthProfileDisplayLabel(params) {
+    const { cfg, store, profileId } = params;
+    const profile = store.profiles[profileId];
+    const configEmail = cfg?.auth?.profiles?.[profileId]?.email?.trim();
+    const email = configEmail || profile?.email?.trim();
+    if (email)
+        return `${profileId} (${email})`;
+    return profileId;
+}
+export async function resolveApiKeyForProfile(params) {
+    const { store, profileId } = params;
+    const cred = store.profiles[profileId];
+    if (!cred || !cred.credentialPath)
+        return null;
+    const record = readCredentialRecordSync(cred.credentialPath);
+    if (!record)
+        return null;
+    if (record.expiresAt) {
+        const expiresAt = typeof record.expiresAt === "number"
+            ? record.expiresAt
+            : Number.parseInt(String(record.expiresAt), 10);
+        if (Number.isFinite(expiresAt) && Date.now() >= expiresAt) {
+            const providerKey = normalizeProviderId(cred.provider);
+            if (providerKey === "chutes" && record.type === "oauth") {
+                try {
+                    const refreshed = await refreshChutesTokens({
+                        credential: {
+                            access: record.accessToken,
+                            refresh: record.refreshToken,
+                            expires: expiresAt,
+                            email: cred.email,
+                            clientId: typeof record.metadata?.clientId === "string" ? record.metadata.clientId : undefined,
+                        },
+                    });
+                    record.accessToken = refreshed.access;
+                    record.refreshToken = refreshed.refresh;
+                    record.expiresAt = refreshed.expires;
+                    record.lastVerified = new Date().toISOString();
+                    if (typeof refreshed.clientId === "string") {
+                        record.metadata = {
+                            ...(record.metadata ?? {}),
+                            clientId: refreshed.clientId,
+                        };
+                    }
+                    const { provider, account } = parseProfileId(profileId);
+                    writeCredentialRecordSync(provider, account, record.type, record);
+                }
+                catch (err) {
+                    record.lastError = err instanceof Error ? err.message : String(err);
+                    const { provider, account } = parseProfileId(profileId);
+                    writeCredentialRecordSync(provider, account, record.type, record);
+                    return null;
+                }
+            }
+            else {
+                return null;
+            }
+        }
+    }
+    const resolved = await resolveCredentialValue(record);
+    if (!resolved)
+        return null;
+    return { apiKey: resolved.value, provider: cred.provider, email: cred.email };
+}
+export function resolveAuthProfileOrder(params) {
+    const { cfg, store, provider, preferredProfile } = params;
+    const providerKey = normalizeProviderId(provider);
+    const storedOrder = (() => {
+        const order = store.order;
+        if (!order)
+            return undefined;
+        for (const [key, value] of Object.entries(order)) {
+            if (normalizeProviderId(key) === providerKey)
+                return value;
+        }
+        return undefined;
+    })();
+    const configuredOrder = (() => {
+        const order = cfg?.auth?.order;
+        if (!order)
+            return undefined;
+        for (const [key, value] of Object.entries(order)) {
+            if (normalizeProviderId(key) === providerKey)
+                return value;
+        }
+        return undefined;
+    })();
+    const explicitOrder = storedOrder ?? configuredOrder;
+    const explicitProfiles = cfg?.auth?.profiles
+        ? Object.entries(cfg.auth.profiles)
+            .filter(([, profile]) => normalizeProviderId(profile.provider) === providerKey)
+            .map(([profileId]) => profileId)
+        : [];
+    const baseOrder = explicitOrder ??
+        (explicitProfiles.length > 0
+            ? explicitProfiles
+            : listProfilesForProvider(store, providerKey));
+    if (baseOrder.length === 0)
+        return [];
+    const filtered = baseOrder.filter((profileId) => {
+        const cred = store.profiles[profileId];
+        return cred ? normalizeProviderId(cred.provider) === providerKey : true;
+    });
+    const deduped = [];
+    for (const entry of filtered) {
+        if (!deduped.includes(entry))
+            deduped.push(entry);
+    }
+    if (explicitOrder && explicitOrder.length > 0) {
+        const now = Date.now();
+        const available = [];
+        const inCooldown = [];
+        for (const profileId of deduped) {
+            const cooldownUntil = store.usageStats?.[profileId]?.cooldownUntil;
+            if (typeof cooldownUntil === "number" &&
+                Number.isFinite(cooldownUntil) &&
+                cooldownUntil > 0 &&
+                now < cooldownUntil) {
+                inCooldown.push({ profileId, cooldownUntil });
+            }
+            else {
+                available.push(profileId);
+            }
+        }
+        const cooldownSorted = inCooldown
+            .sort((a, b) => a.cooldownUntil - b.cooldownUntil)
+            .map((entry) => entry.profileId);
+        const ordered = [...available, ...cooldownSorted];
+        if (preferredProfile && ordered.includes(preferredProfile)) {
+            return [
+                preferredProfile,
+                ...ordered.filter((e) => e !== preferredProfile),
+            ];
+        }
+        return ordered;
+    }
+    const sorted = orderProfilesByMode(deduped, store);
+    if (preferredProfile && sorted.includes(preferredProfile)) {
+        return [preferredProfile, ...sorted.filter((e) => e !== preferredProfile)];
+    }
+    return sorted;
+}
+function orderProfilesByMode(order, store) {
+    const now = Date.now();
+    const available = [];
+    const inCooldown = [];
+    for (const profileId of order) {
+        if (isProfileInCooldown(store, profileId)) {
+            inCooldown.push(profileId);
+        }
+        else {
+            available.push(profileId);
+        }
+    }
+    const scored = available.map((profileId) => {
+        const type = store.profiles[profileId]?.type;
+        const typeScore = type === "oauth" ? 0 : type === "token" ? 1 : type === "api_key" ? 2 : 3;
+        const lastUsed = store.usageStats?.[profileId]?.lastUsed ?? 0;
+        return { profileId, typeScore, lastUsed };
+    });
+    const sorted = scored
+        .sort((a, b) => {
+        if (a.lastUsed !== b.lastUsed)
+            return a.lastUsed - b.lastUsed;
+        return a.typeScore - b.typeScore;
+    })
+        .map((entry) => entry.profileId);
+    const cooldownSorted = inCooldown
+        .map((profileId) => ({
+        profileId,
+        cooldownUntil: store.usageStats?.[profileId]?.cooldownUntil ?? now,
+    }))
+        .sort((a, b) => a.cooldownUntil - b.cooldownUntil)
+        .map((entry) => entry.profileId);
+    return [...sorted, ...cooldownSorted];
+}
+export function suggestOAuthProfileIdForLegacyDefault(params) {
+    const providerKey = normalizeProviderId(params.provider);
+    const legacySuffix = params.legacyProfileId.split(":").slice(1).join(":");
+    if (legacySuffix !== "default")
+        return null;
+    const legacyCfg = params.cfg?.auth?.profiles?.[params.legacyProfileId];
+    if (legacyCfg &&
+        normalizeProviderId(legacyCfg.provider) === providerKey &&
+        legacyCfg.mode !== "oauth") {
+        return null;
+    }
+    const oauthProfiles = listProfilesForProvider(params.store, providerKey).filter((id) => params.store.profiles[id]?.type === "oauth");
+    if (oauthProfiles.length === 0)
+        return null;
+    const configuredEmail = legacyCfg?.email?.trim();
+    if (configuredEmail) {
+        const byEmail = oauthProfiles.find((id) => {
+            const cred = params.store.profiles[id];
+            if (!cred || cred.type !== "oauth")
+                return false;
+            const email = cred.email?.trim();
+            return (email === configuredEmail || id === `${providerKey}:${configuredEmail}`);
+        });
+        if (byEmail)
+            return byEmail;
+    }
+    const lastGood = params.store.lastGood?.[providerKey] ??
+        params.store.lastGood?.[params.provider];
+    if (lastGood && oauthProfiles.includes(lastGood))
+        return lastGood;
+    const nonLegacy = oauthProfiles.filter((id) => id !== params.legacyProfileId);
+    if (nonLegacy.length === 1)
+        return nonLegacy[0] ?? null;
+    const emailLike = nonLegacy.filter((id) => isEmailLike(id.split(":").slice(1).join(":")));
+    if (emailLike.length === 1)
+        return emailLike[0] ?? null;
+    return null;
+}
+export function repairOAuthProfileIdMismatch(params) {
+    const legacyProfileId = params.legacyProfileId ?? `${normalizeProviderId(params.provider)}:default`;
+    const legacyCfg = params.cfg.auth?.profiles?.[legacyProfileId];
+    if (!legacyCfg) {
+        return { config: params.cfg, changes: [], migrated: false };
+    }
+    if (legacyCfg.mode !== "oauth") {
+        return { config: params.cfg, changes: [], migrated: false };
+    }
+    if (normalizeProviderId(legacyCfg.provider) !==
+        normalizeProviderId(params.provider)) {
+        return { config: params.cfg, changes: [], migrated: false };
+    }
+    const toProfileId = suggestOAuthProfileIdForLegacyDefault({
+        cfg: params.cfg,
+        store: params.store,
+        provider: params.provider,
+        legacyProfileId,
+    });
+    if (!toProfileId || toProfileId === legacyProfileId) {
+        return { config: params.cfg, changes: [], migrated: false };
+    }
+    const toCred = params.store.profiles[toProfileId];
+    const toEmail = toCred?.type === "oauth" ? toCred.email?.trim() : undefined;
+    const nextProfiles = {
+        ...params.cfg.auth?.profiles,
+    };
+    delete nextProfiles[legacyProfileId];
+    nextProfiles[toProfileId] = {
+        ...legacyCfg,
+        ...(toEmail ? { email: toEmail } : {}),
+    };
+    const providerKey = normalizeProviderId(params.provider);
+    const nextOrder = (() => {
+        const order = params.cfg.auth?.order;
+        if (!order)
+            return undefined;
+        const resolvedKey = Object.keys(order).find((key) => normalizeProviderId(key) === providerKey);
+        if (!resolvedKey)
+            return order;
+        const existing = order[resolvedKey];
+        if (!Array.isArray(existing))
+            return order;
+        const replaced = existing
+            .map((id) => (id === legacyProfileId ? toProfileId : id))
+            .filter((id) => typeof id === "string" && id.trim().length > 0);
+        const deduped = [];
+        for (const entry of replaced) {
+            if (!deduped.includes(entry))
+                deduped.push(entry);
+        }
+        return { ...order, [resolvedKey]: deduped };
+    })();
+    const nextCfg = {
+        ...params.cfg,
+        auth: {
+            ...params.cfg.auth,
+            profiles: nextProfiles,
+            ...(nextOrder ? { order: nextOrder } : {}),
+        },
+    };
+    const changes = [
+        `Auth: migrate ${legacyProfileId} → ${toProfileId} (OAuth profile id)`,
+    ];
+    return {
+        config: nextCfg,
+        changes,
+        migrated: true,
+        fromProfileId: legacyProfileId,
+        toProfileId,
+    };
+}
+export function formatAuthDoctorHint(params) {
+    const providerKey = normalizeProviderId(params.provider);
+    if (providerKey !== "anthropic")
+        return "";
+    const legacyProfileId = params.profileId ?? "anthropic:default";
+    const suggested = suggestOAuthProfileIdForLegacyDefault({
+        cfg: params.cfg,
+        store: params.store,
+        provider: providerKey,
+        legacyProfileId,
+    });
+    if (!suggested || suggested === legacyProfileId)
+        return "";
+    const storeOauthProfiles = listProfilesForProvider(params.store, providerKey)
+        .filter((id) => params.store.profiles[id]?.type === "oauth")
+        .join(", ");
+    const cfgMode = params.cfg?.auth?.profiles?.[legacyProfileId]?.mode;
+    const cfgProvider = params.cfg?.auth?.profiles?.[legacyProfileId]?.provider;
+    return [
+        "Doctor hint:",
+        `- provider: ${providerKey}`,
+        `- config: ${legacyProfileId}${cfgProvider || cfgMode ? ` (provider=${cfgProvider ?? "?"}, mode=${cfgMode ?? "?"})` : ""}`,
+        `- auth store oauth profiles: ${storeOauthProfiles || "(none)"}`,
+        `- suggested profile: ${suggested}`,
+    ].join("\n");
+}