@midscene/cli 1.14.1-beta-20261008033312.0 → 1.15.0

package/dist/es/index.mjs

@@ -5,7 +5,7 @@ import { basename, dirname as external_node_path_dirname, extname, join, posix,
 import { interpolateEnvVars, midsceneYamlTargetKeys, parseYamlScript as yaml_parseYamlScript, resolveWebTarget } from "@midscene/core/yaml";
 import { getDebug } from "@midscene/shared/logger";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { lstat, readdir, readlink, realpath } from "node:fs/promises";
+import { lstat, mkdir, readFile, readdir, readlink, realpath, rename, rm, writeFile } from "node:fs/promises";
 import { EventEmitter } from "node:events";
 import node_stream from "node:stream";
 import { StringDecoder } from "node:string_decoder";
@@ -13,7 +13,7 @@ import { fileURLToPath as external_url_fileURLToPath } from "url";
 import node_process, { cwd as external_node_process_cwd } from "node:process";
 import lodash_merge from "lodash.merge";
 import { loadDotenvConfig, runModelCommand } from "@midscene/test/internal/model-command";
-import { createHash } from "node:crypto";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { getMidsceneRunSubDir } from "@midscene/shared/common";
 import { buildChromeArgs, buildDownloadBehavior, defaultViewportHeight, defaultViewportWidth } from "@midscene/web/puppeteer-agent-launcher";
 import puppeteer from "puppeteer";
@@ -21,6 +21,10 @@ import { createYamlPlayer as yaml_runtime_createYamlPlayer } from "@midscene/tes
 import { stripVTControlCharacters } from "node:util";
 import { createRequire } from "node:module";
 import { serializeError } from "@midscene/shared/agent-tools/error-formatter";
+import { spawn } from "node:child_process";
+import { homedir } from "node:os";
+import { createServer } from "node:http";
+import { createRemoteJWKSet, jwtVerify } from "jose";
 import { classifyWorkflowDocumentFormat } from "@midscene/core/internal/test-runner";
 import * as __rspack_external_assert from "assert";
 import * as __rspack_external_fs from "fs";
@@ -2796,7 +2800,9 @@ var __webpack_modules__ = {
         module.exports = (string, columns, options)=>String(string).normalize().replace(/\r\n/g, '\n').split('\n').map((line)=>exec(line, columns, options)).join('\n');
     },
     "./src/index.ts" (__unused_rspack_module, __unused_rspack___webpack_exports__, __webpack_require__) {
-        var package_namespaceObject = JSON.parse('{"rE":"1.14.1-beta-20261008033312.0"}');
+        var package_namespaceObject = {
+            rE: "1.15.0"
+        };
         var brace_expansion = __webpack_require__("../../node_modules/.pnpm/brace-expansion@2.0.1/node_modules/brace-expansion/index.js");
         const MAX_PATTERN_LENGTH = 65536;
         const assertValidPattern = (pattern)=>{
@@ -8407,6 +8413,7 @@ Homepage: https://midscenejs.com
 Github: https://github.com/web-infra-dev/midscene
 
 Usage: 
+      $0 model siwc <login|refresh> [options]
       $0 [options] <path-to-yaml-script-file-or-directory>
       $0 [options] --files <yaml-file1> <yaml-file2 ...>
       $0 [options] --config <path-to-config-yaml-file>
@@ -8468,7 +8475,7 @@ Usage:
                     type: 'boolean',
                     description: 'Whether to dismiss the HarmonyOS keyboard after text input'
                 }
-            }).version('version', 'Show version number', "1.14.1-beta-20261008033312.0").help().epilogue(`For complete list of configuration options, please visit:
+            }).version('version', 'Show version number', "1.15.0").help().epilogue(`For complete list of configuration options, please visit:
   • Web options: https://midscenejs.com/automate-with-scripts-in-yaml#the-web-part
   • Android options: https://midscenejs.com/automate-with-scripts-in-yaml#the-android-part
   • HarmonyOS options: https://midscenejs.com/automate-with-scripts-in-yaml#the-harmony-part
@@ -12483,17 +12490,431 @@ defineYamlBatchTest(test, testOptions);
             const success = printExecutionSummary(results, summaryPath);
             return success ? exitCode : 1;
         }
+        const defaultCredentialsPath = ()=>join(homedir(), '.midscene', 'siwc.json');
+        async function readCredentialsFile(path) {
+            const content = await readFile(path, 'utf8').catch((error)=>{
+                if ('ENOENT' === error.code) return;
+                throw new Error('Unable to read the local SIWC credentials file.');
+            });
+            if (void 0 === content) return;
+            try {
+                const value = JSON.parse(content);
+                if (!value || 'string' != typeof value.credentials?.ext_agent_host_id || !value.credentials.ext_agent_host_id) throw new Error('Invalid SIWC credentials record.');
+                return value;
+            } catch  {
+                throw new Error('Invalid local SIWC credentials file.');
+            }
+        }
+        async function readRegistration(path) {
+            return (await readCredentialsFile(path))?.credentials;
+        }
+        async function saveRegistration(path, value) {
+            const saved = await readCredentialsFile(path);
+            const now = new Date().toISOString();
+            const record = {
+                ...saved,
+                created_at: saved?.created_at ?? now,
+                updated_at: now,
+                credentials: value
+            };
+            const temporary = `${path}.${randomUUID()}.tmp`;
+            try {
+                await writeFile(temporary, `${JSON.stringify(record, null, 2)}\n`, {
+                    mode: 384,
+                    flag: 'wx'
+                });
+                await rename(temporary, path);
+            } finally{
+                await rm(temporary, {
+                    force: true
+                });
+            }
+        }
+        async function lockCredentials(path) {
+            await mkdir(external_node_path_dirname(path), {
+                recursive: true,
+                mode: 448
+            });
+            const lockPath = `${path}.lock`;
+            try {
+                await mkdir(lockPath, {
+                    mode: 448
+                });
+            } catch (error) {
+                if ('EEXIST' === error.code) throw new Error(`Another SIWC command holds ${lockPath}. If it was interrupted, remove this lock only after confirming that no SIWC command is running.`);
+                throw new Error('Unable to lock the local SIWC credentials file.');
+            }
+            return ()=>rm(lockPath, {
+                    recursive: true,
+                    force: true
+                });
+        }
+        function requireCredentials(value) {
+            if (!value || [
+                'client_id',
+                'subject',
+                'issuer',
+                'access_token',
+                'refresh_token',
+                'id_token'
+            ].some((key)=>'string' != typeof value[key] || !value[key]) || !Array.isArray(value.scopes) || !value.scopes.every((scope)=>'string' == typeof scope) || !Number.isFinite(value.expires_at)) throw new Error('No valid SIWC credentials. Run midscene model siwc login first.');
+            return value;
+        }
+        const ISSUER = 'https://auth.openai.com';
+        const RESOURCE = 'https://api.openai.com/v1';
+        const SCOPES = 'openid profile email offline_access resource.invoke chatgpt.tokens.use.direct';
+        async function loginWithOpenAI(options, dependencies) {
+            const hostId = options.hostId ?? `urn:uuid:${randomUUID()}`;
+            const existingClientId = options.clientId;
+            const state = randomBytes(32).toString('base64url');
+            const nonce = randomBytes(32).toString('base64url');
+            const verifier = randomBytes(32).toString('base64url');
+            const signal = options.signal;
+            signal.throwIfAborted();
+            const server = createServer();
+            const callback = new Promise((resolve, reject)=>{
+                const consumed = {
+                    value: false
+                };
+                server.on('request', (request, response)=>{
+                    response.setHeader('Content-Type', 'text/plain; charset=utf-8');
+                    response.setHeader('Cache-Control', 'no-store');
+                    response.setHeader('Referrer-Policy', 'no-referrer');
+                    const url = new URL(request.url || '/', 'http://127.0.0.1');
+                    if ('GET' !== request.method || '/auth/callback' !== url.pathname) return void response.writeHead(404).end('Not found');
+                    if (1 !== url.searchParams.getAll('state').length || url.searchParams.get('state') !== state) return void response.writeHead(400).end('Invalid login state. Use the original authorization link.');
+                    if (consumed.value) return void response.writeHead(409).end('Authorization already received.');
+                    if (url.searchParams.has('error')) {
+                        consumed.value = true;
+                        response.writeHead(400).end('Authorization was not granted. Return to the terminal.');
+                        reject(new Error('OpenAI authorization was denied or failed.'));
+                        return;
+                    }
+                    const code = url.searchParams.get('code');
+                    const clientId = url.searchParams.get('client_id') || existingClientId;
+                    if (!code || !clientId || 'dynamic_agent_client' === clientId || existingClientId && clientId !== existingClientId || 1 !== url.searchParams.getAll('code').length || url.searchParams.getAll('client_id').length > 1) return void response.writeHead(400).end('Invalid authorization callback.');
+                    consumed.value = true;
+                    response.setHeader('Content-Type', 'text/html; charset=utf-8');
+                    response.end(`<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Authorization received · Midscene</title>
+  <style>
+    * { box-sizing: border-box; }
+    body { margin: 0; min-height: 100vh; display: grid; place-items: center; padding: 24px; background: #f6f7f9; color: #202124; font-family: system-ui, sans-serif; }
+    main { width: 100%; max-width: 480px; padding: 40px 28px; text-align: center; background: white; border: 1px solid #e5e7eb; border-radius: 20px; box-shadow: 0 8px 32px #00000008; }
+    h1 { margin: 0 0 20px; font-size: 24px; line-height: 1.4; }
+    h1 span { color: #16834a; }
+    p { margin: 8px 0 0; color: #596273; font-size: 15px; line-height: 1.6; }
+  </style>
+</head>
+<body>
+  <main>
+    <h1><span aria-hidden="true">✓</span> Authorization received</h1>
+    <p>You can close this tab.</p>
+    <p>Check your terminal for the sign-in result and access token.</p>
+  </main>
+</body>
+</html>`);
+                    resolve({
+                        code,
+                        clientId
+                    });
+                });
+                server.on('error', reject);
+            });
+            callback.catch(()=>void 0);
+            const abort = ()=>server.emit('error', new Error('OpenAI login cancelled or timed out.'));
+            signal.addEventListener('abort', abort, {
+                once: true
+            });
+            try {
+                await new Promise((resolve, reject)=>{
+                    server.once('error', reject);
+                    server.listen(options.port ?? 0, '127.0.0.1', ()=>{
+                        server.removeListener('error', reject);
+                        resolve();
+                    });
+                });
+                signal.throwIfAborted();
+                const redirectUri = `http://127.0.0.1:${server.address().port}/auth/callback`;
+                const authorization = new URL(`${ISSUER}/api/accounts/authorize`);
+                authorization.search = new URLSearchParams({
+                    client_id: existingClientId ?? 'dynamic_agent_client',
+                    ...existingClientId ? {} : {
+                        agent_name_hint: 'Midscene'
+                    },
+                    ext_agent_host_id: hostId,
+                    response_type: 'code',
+                    redirect_uri: redirectUri,
+                    scope: SCOPES,
+                    resource: RESOURCE,
+                    state,
+                    nonce,
+                    code_challenge_method: 'S256',
+                    code_challenge: createHash('sha256').update(verifier).digest('base64url')
+                }).toString();
+                await options.onAuthorization(authorization.toString());
+                const { code, clientId } = await callback;
+                signal.throwIfAborted();
+                const request = dependencies?.fetch ?? fetch;
+                const result = await request(`${ISSUER}/api/accounts/oauth/token`, {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/x-www-form-urlencoded'
+                    },
+                    body: new URLSearchParams({
+                        grant_type: 'authorization_code',
+                        client_id: clientId,
+                        code,
+                        code_verifier: verifier,
+                        redirect_uri: redirectUri,
+                        resource: RESOURCE
+                    }),
+                    signal,
+                    redirect: 'error'
+                });
+                if (!result.ok) throw new Error(`OpenAI token exchange failed (HTTP ${result.status}). Run midscene model siwc login again.`);
+                const tokens = await result.json();
+                if (!tokens || 'string' != typeof tokens.access_token || !tokens.access_token || 'string' != typeof tokens.refresh_token || !tokens.refresh_token || 'string' != typeof tokens.id_token || 'string' != typeof tokens.scope || 'number' != typeof tokens.expires_in || !Number.isFinite(tokens.expires_in) || tokens.expires_in <= 0 || 'string' != typeof tokens.token_type || 'bearer' !== tokens.token_type.toLowerCase()) throw new Error('OpenAI returned an invalid token response.');
+                const scopes = tokens.scope.split(/\s+/);
+                if (!scopes.includes('chatgpt.tokens.use.direct')) throw new Error('ChatGPT plan usage was not authorized. Run midscene model siwc login again and grant access.');
+                const keys = dependencies?.keys ?? createRemoteJWKSet(new URL(`${ISSUER}/.well-known/jwks.json`));
+                const { payload } = await jwtVerify(tokens.id_token, keys, {
+                    issuer: ISSUER,
+                    audience: clientId,
+                    algorithms: [
+                        'RS256'
+                    ],
+                    requiredClaims: [
+                        'sub',
+                        'exp',
+                        'iat',
+                        'nonce'
+                    ]
+                });
+                if (payload.nonce !== nonce || !payload.sub) throw new Error('OpenAI login identity or nonce did not match.');
+                signal.throwIfAborted();
+                return {
+                    ext_agent_host_id: hostId,
+                    client_id: clientId,
+                    subject: payload.sub,
+                    issuer: ISSUER,
+                    ...'string' == typeof payload.email ? {
+                        email: payload.email
+                    } : {},
+                    access_token: tokens.access_token,
+                    refresh_token: tokens.refresh_token,
+                    id_token: tokens.id_token,
+                    scopes,
+                    expires_at: Date.now() + 1000 * tokens.expires_in
+                };
+            } finally{
+                signal.removeEventListener('abort', abort);
+                server.closeAllConnections();
+                await new Promise((resolve)=>server.close(()=>resolve()));
+            }
+        }
+        async function refreshOpenAICredentials(saved, signal, dependencies) {
+            const issuer = 'https://auth.openai.com';
+            signal.throwIfAborted();
+            const response = await (dependencies?.fetch ?? fetch)(`${issuer}/api/accounts/oauth/token`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/x-www-form-urlencoded'
+                },
+                body: new URLSearchParams({
+                    grant_type: 'refresh_token',
+                    client_id: saved.client_id,
+                    refresh_token: saved.refresh_token,
+                    resource: 'https://api.openai.com/v1'
+                }),
+                signal,
+                redirect: 'error'
+            });
+            if (!response.ok) throw new Error('OpenAI refresh failed.');
+            const tokens = await response.json();
+            if (!tokens || 'string' != typeof tokens.access_token || !tokens.access_token || 'string' != typeof tokens.refresh_token || !tokens.refresh_token || 'number' != typeof tokens.expires_in || !Number.isFinite(tokens.expires_in) || tokens.expires_in <= 0 || 'string' != typeof tokens.token_type || 'bearer' !== tokens.token_type.toLowerCase() || 'string' != typeof tokens.scope) throw new Error('OpenAI returned an invalid refresh response.');
+            const scopes = tokens.scope.split(/\s+/);
+            if (!scopes.includes('chatgpt.tokens.use.direct')) throw new Error('ChatGPT plan usage is no longer authorized.');
+            if (void 0 !== tokens.id_token) {
+                if ('string' != typeof tokens.id_token || !tokens.id_token) throw new Error('Invalid refreshed ID token.');
+                const keys = dependencies?.keys ?? createRemoteJWKSet(new URL(`${issuer}/.well-known/jwks.json`));
+                const { payload } = await jwtVerify(tokens.id_token, keys, {
+                    issuer,
+                    audience: saved.client_id,
+                    algorithms: [
+                        'RS256'
+                    ],
+                    requiredClaims: [
+                        'sub',
+                        'exp',
+                        'iat'
+                    ]
+                });
+                if (payload.sub !== saved.subject) throw new Error('Refreshed identity does not match the saved account.');
+            }
+            signal.throwIfAborted();
+            return {
+                ...saved,
+                access_token: tokens.access_token,
+                refresh_token: tokens.refresh_token,
+                id_token: tokens.id_token ?? saved.id_token,
+                scopes,
+                expires_at: Date.now() + 1000 * tokens.expires_in
+            };
+        }
+        const USAGE = `Usage:
+  midscene model siwc login [--no-open] [--port <port>]
+  midscene model siwc refresh
+
+Sign in with ChatGPT or refresh the saved credentials.
+Full credentials are saved to ~/.midscene/siwc.json. Only the access token is printed to stdout.
+Midscene does not collect your credentials.
+
+Options (login):
+  --no-open           Print the authorization URL without opening a browser
+  --port <port>       Loopback callback port (default: an available port)
+  --help, -h          Show this help
+`;
+        async function openBrowser(url) {
+            const command = 'darwin' === process.platform ? 'open' : 'win32' === process.platform ? 'rundll32' : 'xdg-open';
+            const args = 'win32' === process.platform ? [
+                'url.dll,FileProtocolHandler',
+                url
+            ] : [
+                url
+            ];
+            await new Promise((resolve, reject)=>{
+                const child = spawn(command, args, {
+                    stdio: 'ignore',
+                    shell: false
+                });
+                child.once('error', reject);
+                child.once('spawn', ()=>{
+                    child.unref();
+                    resolve();
+                });
+            });
+        }
+        async function runSiwcCommand(args, io = {
+            stdout: console.log,
+            stderr: console.error
+        }, credentialsPath = defaultCredentialsPath()) {
+            if (!args.length || args.includes('--help') || args.includes('-h')) {
+                io.stdout(USAGE);
+                return 0;
+            }
+            const [action, ...options] = args;
+            if ('login' !== action && 'refresh' !== action) {
+                io.stderr(`Unknown SIWC command: ${action}\n${USAGE}`);
+                return 1;
+            }
+            const portOptions = {
+                port: 0,
+                noOpen: false
+            };
+            const seen = new Set();
+            for(let index = 0; index < options.length; index++){
+                const option = options[index];
+                if ('login' !== action || seen.has(option) || ![
+                    '--port',
+                    '--no-open'
+                ].includes(option)) {
+                    io.stderr(`Invalid midscene model siwc arguments.\n${USAGE}`);
+                    return 1;
+                }
+                seen.add(option);
+                if ('--no-open' === option) portOptions.noOpen = true;
+                else {
+                    const value = options[++index];
+                    if (!value || !/^\d+$/.test(value) || Number(value) > 65535) {
+                        io.stderr('--port must be an integer between 0 and 65535.');
+                        return 1;
+                    }
+                    portOptions.port = Number(value);
+                }
+            }
+            const unlock = await lockCredentials(credentialsPath).catch((error)=>{
+                io.stderr(error.message);
+            });
+            if (!unlock) return 1;
+            const controller = new AbortController();
+            const cancel = ()=>controller.abort();
+            const timer = setTimeout(cancel, 300000);
+            process.once('SIGINT', cancel);
+            process.once('SIGTERM', cancel);
+            try {
+                io.stderr(source_default().cyan.bold(`🔄 Starting OpenAI SIWC ${action}...`));
+                const saved = await readRegistration(credentialsPath);
+                const credentials = await (async ()=>{
+                    if ('refresh' === action) return refreshOpenAICredentials(requireCredentials(saved), controller.signal);
+                    const registration = saved ?? {
+                        ext_agent_host_id: `urn:uuid:${randomUUID()}`
+                    };
+                    if (!saved) await saveRegistration(credentialsPath, registration);
+                    const result = await loginWithOpenAI({
+                        port: portOptions.port,
+                        hostId: registration.ext_agent_host_id,
+                        clientId: registration.client_id,
+                        signal: controller.signal,
+                        onAuthorization: async (url)=>{
+                            io.stderr(`\n${source_default().bold('Continue with ChatGPT:')}\n${url}\n\n${source_default().gray('Waiting for authorization...')}`);
+                            if (!portOptions.noOpen) try {
+                                await openBrowser(url);
+                            } catch  {
+                                io.stderr('Open the URL above in your browser to continue.');
+                            }
+                        }
+                    });
+                    if (registration.subject && result.subject !== registration.subject) throw new Error('Login identity does not match the saved account.');
+                    return result;
+                })();
+                await saveRegistration(credentialsPath, credentials);
+                io.stderr('\n🔑 your Access token:');
+                io.stdout(credentials.access_token);
+                const expiresAt = new Intl.DateTimeFormat('en-GB', {
+                    dateStyle: 'medium',
+                    timeStyle: 'long'
+                }).format(credentials.expires_at);
+                const remainingMinutes = Math.ceil((credentials.expires_at - Date.now()) / 60000);
+                const expiresIn = new Intl.RelativeTimeFormat('en', {
+                    numeric: 'always'
+                }).format(60 === remainingMinutes ? 1 : remainingMinutes, 60 === remainingMinutes ? 'hour' : 'minute');
+                io.stderr(`\nExpires at: ${expiresAt} (${expiresIn})`);
+                io.stderr(`\n${source_default().green(`✅ SIWC ${action} succeeded.`)}\n\nYou can use this access token as your model API Key in Midscene by setting MIDSCENE_MODEL_API_KEY.\n\nFull credentials are saved locally to:\n${source_default().cyan(credentialsPath)}\n\n${source_default().gray('Midscene does not collect your credentials.')}`);
+                return 0;
+            } catch  {
+                io.stderr(source_default().red(controller.signal.aborted ? `OpenAI ${action} cancelled or timed out.` : `OpenAI ${action} failed. Check the local credentials file permissions or run midscene model siwc login to authorize again.`));
+                return 1;
+            } finally{
+                clearTimeout(timer);
+                process.removeListener('SIGINT', cancel);
+                process.removeListener('SIGTERM', cancel);
+                await unlock();
+            }
+        }
         const model_command_runModelCommand = (rawArgs, deps, io = {
             stdout: console.log,
             stderr: console.error
-        })=>runModelCommand(rawArgs, {
+        })=>{
+            const [, action, ...restArgs] = rawArgs;
+            if ('siwc' === action) return runSiwcCommand(restArgs, io);
+            const withSiwcUsage = (message)=>message.replace('  midscene model verify\n', '  midscene model verify\n  midscene model siwc <login|refresh> [options]\n');
+            return runModelCommand(rawArgs, {
                 loadDotenv: ()=>loadDotenvConfig({
                         dotenvDebug: true,
                         dotenvOverride: true,
                         log: io.stdout
                     }),
                 ...deps
-            }, io, 'midscene');
+            }, {
+                stdout: (message)=>io.stdout(withSiwcUsage(message)),
+                stderr: (message)=>io.stderr(withSiwcUsage(message))
+            }, 'midscene');
+        };
         const probeWorkflowFormat = (file)=>{
             try {
                 const content = (0, __rspack_external_node_fs_5ea92f0c.readFileSync)(file, 'utf8').replace(/\$\{[^}\r\n]*\}/g, 'MIDSCENE_ENV');