@lark-codem/codem-cli 0.1.234-dev-browser-use-review.100102657797.0.g7a31979 → 0.1.234

package/profile/profile-snapshot.js

@@ -0,0 +1,120 @@
+import { createHash } from "node:crypto";
+import { open, stat } from "node:fs/promises";
+import { isAbsolute, join } from "node:path";
+import { readCredentialMetadata } from "./credential-metadata.js";
+import { CredentialStorageError } from "./credential-errors.js";
+import { withCodeMConfigLock } from "./profile-io.js";
+
+const string = value => typeof value === "string" && value.trim() ? value.trim() : null;
+const record = value => value && typeof value === "object" && !Array.isArray(value) ? value : null;
+const first = (...values) => values.map(string).find(Boolean) ?? null;
+
+export function resolveProfileUser(status, value) {
+  const config = record(value);
+  const oauth = record(record(config?.auth)?.oauth);
+  const info = record(oauth?.userInfo ?? oauth?.user_info);
+  const stored = record(config?.user);
+  return {
+    userId: first(status.userId, oauth?.userId, oauth?.user_id, stored?.id, oauth?.codemUserId, oauth?.codem_user_id),
+    tenantId: first(status.tenantId, oauth?.tenantId, oauth?.tenant_id),
+    displayName: first(status.displayName, oauth?.displayName, oauth?.display_name, info?.displayName, info?.display_name, info?.name, stored?.displayName, stored?.display_name),
+    avatarUrl: avatar(first(info?.avatarUrl, info?.avatar_url, stored?.avatarUrl, stored?.avatar_url))
+  };
+}
+
+function avatar(value) {
+  if (!value) return null;
+  try {
+    const url = new URL(value);
+    const allowed = ["feishucdn.com", "larksuitecdn.com", "feishu-boe.cn"].some(root => url.hostname === root || url.hostname.endsWith(`.${root}`));
+    return url.protocol === "https:" && allowed && !url.username && !url.password ? url.href : null;
+  } catch { return null; }
+}
+
+export async function readProfileSnapshot(home) {
+  if (!isAbsolute(home)) throw new Error("CodeM profile home must be absolute");
+  try {
+    if (!(await stat(home)).isDirectory()) throw new Error("CodeM profile home is not a directory");
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+    return { schemaVersion: 1, serverUrl: null,
+      user: { userId: null, tenantId: null, displayName: null, avatarUrl: null },
+      account: null, device: null, identityRevision: null };
+  }
+  return withCodeMConfigLock(join(home, "config.json"), () => readLockedProfileSnapshot(home));
+}
+
+async function readLockedProfileSnapshot(home) {
+  const configPath = join(home, "config.json");
+  const config = await readProfileObject(configPath);
+  let metadata;
+  try {
+    metadata = await readCredentialMetadata(join(home, "credential-storage.json"), config?.credentialStorageRef, "oauth");
+  } catch (error) {
+    if (!(error instanceof CredentialStorageError)) throw error;
+    const kind = ["oauth", "router-ak"].includes(error.kind) ? error.kind : null;
+    throw new CredentialStorageError(error.code.replace(/^credential_storage_/, ""), kind);
+  }
+  if (!config && metadata && !metadata.loggedOut) throw new CredentialStorageError("config_missing", "oauth");
+  const device = record(config?.device);
+  const last = record(config?.lastLoginUser ?? config?.last_login_user);
+  const user = resolveProfileUser({}, config);
+  const userId = user.userId ?? first(last?.userId, last?.user_id);
+  const tenantId = user.tenantId ?? first(last?.tenantId, last?.tenant_id);
+  const historicalMatches = (!first(last?.userId, last?.user_id) || userId === first(last?.userId, last?.user_id))
+    && (!first(last?.tenantId, last?.tenant_id) || tenantId === first(last?.tenantId, last?.tenant_id));
+  if (!historicalMatches) throw new Error("CodeM profile identity is inconsistent");
+  let serverUrl = null;
+  if (config?.serverUrl) {
+    let url;
+    try { url = new URL(config.serverUrl); }
+    catch { throw new Error("CodeM profile server origin is invalid"); }
+    if (!["https:", "http:"].includes(url.protocol) || url.username || url.password || url.search || url.hash) {
+      throw new Error("CodeM profile server origin is invalid");
+    }
+    serverUrl = url.origin;
+  }
+  const deviceId = first(device?.deviceId, device?.device_id);
+  if (deviceId && deviceId.length > 128) throw new Error("CodeM profile device identity is invalid");
+  const bound = Boolean(deviceId && first(device?.deviceSecret, device?.device_secret) && !metadata?.loggedOut);
+  const account = bound && userId && tenantId && serverUrl ? {
+    userId, tenantId,
+    displayName: user.displayName ?? first(last?.displayName, last?.display_name),
+    avatarUrl: user.avatarUrl
+  } : null;
+  // Full binding login replaces both fields; OAuth generation may instead be
+  // backfilled by scope-upgrade or a delayed mirror without any new login.
+  const generation = [string(config?.clientId), string(config?.createdAt)];
+  return {
+    schemaVersion: 1,
+    serverUrl,
+    user: metadata?.loggedOut
+      ? { userId: null, tenantId: null, displayName: null, avatarUrl: null }
+      : { userId, tenantId, displayName: user.displayName ?? first(last?.displayName, last?.display_name), avatarUrl: user.avatarUrl },
+    account,
+    device: deviceId ? { id: deviceId, name: first(device?.deviceName, device?.device_name), binding: bound ? "ready" : "missing" } : null,
+    identityRevision: account ? createHash("sha256").update(JSON.stringify([serverUrl, userId, tenantId, deviceId, first(device?.deviceSecret, device?.device_secret), generation])).digest("hex") : null
+  };
+}
+
+async function readProfileObject(path) {
+  let file;
+  try { file = await open(path, "r"); }
+  catch (error) { if (error.code === "ENOENT") return null; throw new Error("Cannot read CodeM profile metadata", { cause: error }); }
+  try {
+    const info = await file.stat();
+    if (!info.isFile() || info.size > 1024 * 1024) throw new Error("Invalid profile metadata size");
+    const buffer = Buffer.alloc(info.size + 1);
+    let count = 0;
+    while (count < buffer.length) {
+      const part = await file.read(buffer, count, buffer.length - count, count);
+      if (!part.bytesRead) break;
+      count += part.bytesRead;
+    }
+    if (count > info.size) throw new Error("Profile metadata changed during read");
+    let parsed;
+    try { parsed = record(JSON.parse(buffer.toString("utf8", 0, count))); } catch { /* Do not surface credential bytes. */ }
+    if (!parsed) throw new Error("Invalid CodeM profile metadata");
+    return parsed;
+  } finally { await file.close(); }
+}

package/profile/profile-writers.js

@@ -0,0 +1,296 @@
+import { lstat, readFile, readdir, readlink, realpath } from 'node:fs/promises';
+import { isAbsolute, join, resolve, sep } from 'node:path';
+import { setTimeout as delay } from 'node:timers/promises';
+import { isProcessExit, requireProcessSuccess, runProcess, runProcessResult } from './profile-io.js';
+const isCodeMBoeTtEnv = (value)=>value === 'boe' || /^boe_[A-Za-z0-9_-]+$/u.test(value ?? '');
+export const CODEM_PROFILE_SESSION_TREES = [
+    'sessions',
+    'sessions.legacy-account-merge-v1',
+    'sessions.account-profile-staging-v1'
+];
+export class CodeMProfileWriterBusyError extends Error {
+    code = 'CODEM_PROFILE_BUSY';
+    home;
+    blockers;
+    constructor(home, blockers){
+        super(`资料仍被命令行或旧 App 使用，请完成任务并关闭对应窗口后重试：${home}`);
+        this.name = 'CodeMProfileWriterBusyError';
+        this.home = home;
+        this.blockers = blockers;
+    }
+}
+export class CodeMProfileWriterInspectionError extends Error {
+    code = 'CODEM_PROFILE_WRITER_INSPECTION_FAILED';
+    home;
+    constructor(home, cause){
+        const code = errorCode(cause);
+        super(`无法确认资料是否仍被命令行或旧 App 使用${code ? `（${code}）` : ''}，请结束任务并关闭相关进程后重试：${home}`, {
+            cause
+        });
+        this.name = 'CodeMProfileWriterInspectionError';
+        this.home = home;
+    }
+}
+export async function requireIdleProfileSessions(home) {
+    const roots = [];
+    for (const name of CODEM_PROFILE_SESSION_TREES){
+        const path = join(home, name);
+        try {
+            if ((await lstat(path)).isDirectory()) roots.push(path);
+        } catch (error) {
+            if (!missing(error)) throw error;
+        }
+    }
+    let blockers;
+    try {
+        if (process.platform === 'linux') {
+            try {
+                blockers = await linuxProfileWriters(home, roots);
+            } catch (error) {
+                if (!(error instanceof Error && 'code' in error && error.code === 'EACCES')) throw error;
+                await delay(25);
+                blockers = await linuxProfileWriters(home, roots);
+            }
+        } else if (process.platform === 'darwin') blockers = await macProfileWriters(home, roots);
+        else if (process.platform === 'win32') blockers = await windowsCodeMProcesses();
+        else throw new Error('Unsupported process inspection');
+    } catch (error) {
+        throw new CodeMProfileWriterInspectionError(home, error);
+    }
+    if (blockers.length > 0) {
+        throw new CodeMProfileWriterBusyError(home, deduplicateBlockers(blockers));
+    }
+}
+async function linuxProfileWriters(home, roots) {
+    if (!process.getuid) throw new Error('Process owner is unavailable');
+    const uid = process.getuid();
+    for (const pid of (await readdir('/proc'))){
+        if (!/^\d+$/u.test(pid)) continue;
+        const directory = join('/proc', pid);
+        let authenticationSupervisor = false;
+        let processName = '';
+        try {
+            if ((await lstat(directory)).uid !== uid) continue;
+            const name = (await readFile(join(directory, 'comm'), 'utf8')).trim();
+            processName = name;
+            authenticationSupervisor = name === 'sshd' || name === '(sd-pam)';
+            const command = (await readFile(join(directory, 'cmdline'), 'utf8')).split('\0');
+            if (command.some((argument)=>argument.startsWith('--type='))) continue;
+            const kind = codeMProcessKind(`${name} ${command.join(' ')}`);
+            if (Number(pid) !== process.pid && kind !== 'other') {
+                if (kind === 'app') {
+                    return [
+                        processBlocker(kind, Number(pid), name)
+                    ];
+                } else {
+                    const environment = (await readFile(join(directory, 'environ'), 'utf8')).split('\0');
+                    if (await profileMatchesEnvironment(home, environment)) {
+                        return [
+                            processBlocker(kind, Number(pid), name)
+                        ];
+                    }
+                }
+            }
+            for (const descriptor of (await readdir(join(directory, 'fd')))){
+                try {
+                    const path = await readlink(join(directory, 'fd', descriptor));
+                    if (roots.some((root)=>path === root || path.startsWith(`${root}${sep}`))) {
+                        return [
+                            {
+                                kind: 'session-handle',
+                                processId: Number(pid),
+                                processName: processName || null
+                            }
+                        ];
+                    }
+                } catch (error) {
+                    if (!missing(error)) throw error;
+                }
+            }
+        } catch (error) {
+            if (authenticationSupervisor && error instanceof Error && 'code' in error && error.code === 'EACCES') continue;
+            if (error instanceof Error && 'code' in error && error.code === 'EACCES') {
+                const status = await readFile(join(directory, 'status'), 'utf8').catch((cause)=>{
+                    if (missing(cause)) return null;
+                    throw cause;
+                });
+                if (status === null || /^State:\s+[ZX]\b/mu.test(status)) continue;
+            }
+            if (!missing(error)) {
+                console.warn('Cannot inspect profile writer', {
+                    processId: Number(pid),
+                    processName,
+                    code: error instanceof Error && 'code' in error ? error.code : null
+                });
+                throw error;
+            }
+        }
+    }
+    return [];
+}
+async function macProfileWriters(home, roots) {
+    if (!process.getuid) throw new Error('Process owner is unavailable');
+    const { stdout: processes } = await runProcess({
+        executable: '/bin/ps',
+        arguments: [
+            'eww',
+            '-U',
+            String(process.getuid()),
+            '-o',
+            'pid=,comm=,command='
+        ],
+        timeoutMilliseconds: 10_000,
+        maximumOutputBytes: 16 * 1024 * 1024
+    });
+    for (const line of processes.split('\n')){
+        const match = /^\s*(\d+)\s+(.*)$/u.exec(line);
+        if (!match || Number(match[1]) === process.pid || /(?:^|\s)--type=/u.test(match[2])) continue;
+        const kind = codeMProcessKind(match[2].split(/\s+[A-Za-z_][A-Za-z0-9_]*=/u, 1)[0]);
+        if (kind === 'app') {
+            return [
+                processBlocker(kind, Number(match[1]), 'CodeM')
+            ];
+        }
+        if (kind === 'cli') {
+            const environment = [
+                ...match[2].matchAll(/(?:^|\s)(CODEM_STATE_HOME|LINCO_HOME|CODEM_HOME|CODEM_X_TT_ENV|HOME)=([^\n]*?)(?=\s+[A-Za-z_][A-Za-z0-9_]*=|$)/gu)
+            ].map((entry)=>`${entry[1]}=${entry[2]}`);
+            if (await profileMatchesEnvironment(home, environment)) {
+                return [
+                    processBlocker(kind, Number(match[1]), 'codem-cli')
+                ];
+            }
+        }
+    }
+    for (const root of roots){
+        const outcome = await runProcessResult({
+            executable: '/usr/sbin/lsof',
+            arguments: [
+                '-t',
+                '+D',
+                root
+            ],
+            timeoutMilliseconds: 10_000,
+            maximumOutputBytes: 1024 * 1024
+        });
+        if (isProcessExit(outcome, 0) && outcome.stdout.trim()) {
+            const pid = outcome.stdout.trim().split(/\s+/u)[0];
+            return [
+                {
+                    kind: 'session-handle',
+                    processId: /^\d+$/u.test(pid) ? Number(pid) : null,
+                    processName: null
+                }
+            ];
+        }
+        if (!isProcessExit(outcome, 1) || outcome.stdout !== '' || outcome.stderr !== '') {
+            requireProcessSuccess(outcome);
+        }
+    }
+    return [];
+}
+function codeMProcessKind(command) {
+    if (/codem-bridge\/.*src\/index\.js(?:\s|$)/u.test(command) || /node_modules\/(?:@lark-codem|@byted-meego)\/codem-cli\//u.test(command)) return 'cli';
+    if (/\/Contents\/MacOS\/(?:飞书 )?CodeM(?:\s|$)/u.test(command) || /^CodeM(?:\s|$)/u.test(command)) return 'app';
+    if (/(?:^|[\s/])(?:codem|codem-cli|codem-core|linco)(?:\s|$)/iu.test(command)) return 'cli';
+    return 'other';
+}
+async function profileMatchesEnvironment(home, environment) {
+    const values = new Map(environment.map((entry)=>{
+        const separator = entry.indexOf('=');
+        return [
+            entry.slice(0, separator),
+            entry.slice(separator + 1)
+        ];
+    }));
+    const configured = [
+        'CODEM_STATE_HOME',
+        'LINCO_HOME',
+        'CODEM_HOME'
+    ].flatMap((key)=>{
+        const value = values.get(key)?.trim();
+        return value ? [
+            value
+        ] : [];
+    });
+    const base = values.get('HOME');
+    const homes = configured.length ? configured : base ? [
+        join(base, '.codem', ...isCodeMBoeTtEnv(values.get('CODEM_X_TT_ENV')) ? [
+            '.boe'
+        ] : [])
+    ] : [];
+    if (!homes.length) return true;
+    for (const candidate of homes){
+        if (!isAbsolute(candidate)) return true;
+        let canonical;
+        try {
+            canonical = await realpath(candidate);
+        } catch (error) {
+            if (!missing(error)) return true;
+            canonical = resolve(candidate);
+        }
+        if (canonical === resolve(home)) return true;
+    }
+    return false;
+}
+async function windowsCodeMProcesses() {
+    const script = `$ErrorActionPreference='Stop'; Get-CimInstance Win32_Process | Where-Object {
+    $_.ProcessId -ne ${process.pid} -and $_.CommandLine -notmatch '--type=' -and (
+      $_.Name -match '^(codem|codem-cli|codem-core|linco)(\\.exe)?$' -or
+      ($_.Name -match '^node(\\.exe)?$' -and $_.CommandLine -match '(codem-cli[\\\\/]|codem-bridge[\\\\/].*src[\\\\/]index\\.js)')
+    )
+  } | ForEach-Object { "$($_.ProcessId)|$($_.Name)" }`;
+    const { stdout } = await runProcess({
+        executable: 'powershell.exe',
+        arguments: [
+            '-NoProfile',
+            '-NonInteractive',
+            '-Command',
+            script
+        ],
+        windowsHide: true,
+        timeoutMilliseconds: 10_000,
+        maximumOutputBytes: 1024 * 1024
+    });
+    return parseWindowsCodeMProcesses(stdout);
+}
+export function parseWindowsCodeMProcesses(stdout) {
+    return deduplicateBlockers(stdout.split(/\r?\n/u).flatMap((line)=>{
+        if (!line.trim()) return [];
+        const match = /^\s*(\d+)\|((?:codem|codem-cli|codem-core|linco|node)(?:\.exe)?)\s*$/iu.exec(line);
+        const processId = match ? Number(match[1]) : NaN;
+        if (!match || !Number.isSafeInteger(processId) || processId <= 0) {
+            throw new Error('Unexpected Windows process inspection output');
+        }
+        const processName = match[2];
+        const cli = /^(?:codem-cli|codem-core|linco|node)(?:\.exe)?$/iu.test(processName);
+        return [
+            {
+                kind: cli ? 'cli-process' : 'codem-process',
+                processId,
+                processName
+            }
+        ];
+    }));
+}
+function processBlocker(kind, processId, processName) {
+    return {
+        kind: kind === 'app' ? 'app-process' : 'cli-process',
+        processId,
+        processName
+    };
+}
+function deduplicateBlockers(blockers) {
+    return [
+        ...new Map(blockers.map((blocker)=>[
+                `${blocker.kind}:${blocker.processId ?? 'none'}:${blocker.processName ?? 'none'}`,
+                blocker
+            ])).values()
+    ];
+}
+function errorCode(error) {
+    return error && typeof error === 'object' && 'code' in error && typeof error.code === 'string' && /^[A-Z_]+$/u.test(error.code) ? error.code : null;
+}
+function missing(error) {
+    return error instanceof Error && 'code' in error && (error.code === 'ENOENT' || error.code === 'ESRCH');
+}