@midscene/cli 1.16.2 → 1.16.5

package/dist/es/index.mjs

@@ -13,18 +13,18 @@ import { fileURLToPath as external_url_fileURLToPath } from "url";
 import node_process, { cwd as external_node_process_cwd } from "node:process";
 import lodash_merge from "lodash.merge";
 import { loadDotenvConfig, runModelCommand } from "@midscene/test/internal/model-command";
-import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { getMidsceneRunSubDir } from "@midscene/shared/common";
 import { buildChromeArgs, buildDownloadBehavior, defaultViewportHeight, defaultViewportWidth } from "@midscene/web/puppeteer-agent-launcher";
 import puppeteer from "puppeteer";
 import { createYamlPlayer as yaml_runtime_createYamlPlayer } from "@midscene/test/internal/yaml-runtime";
-import { stripVTControlCharacters } from "node:util";
+import { inspect, stripVTControlCharacters } from "node:util";
 import { createRequire } from "node:module";
 import { serializeError } from "@midscene/shared/agent-tools/error-formatter";
 import { spawn } from "node:child_process";
+import { SiwcError, createSiwcAuthorization, exchangeSiwcCode, parseSiwcCallback, refreshSiwcCredentials, withSiwcStage } from "@midscene/core/ai-model";
 import { homedir } from "node:os";
 import { createServer } from "node:http";
-import { createRemoteJWKSet, jwtVerify } from "jose";
 import { classifyWorkflowDocumentFormat } from "@midscene/core/internal/test-runner";
 import * as __rspack_external_assert from "assert";
 import * as __rspack_external_fs from "fs";
@@ -2801,7 +2801,7 @@ var __webpack_modules__ = {
     },
     "./src/index.ts" (__unused_rspack_module, __unused_rspack___webpack_exports__, __webpack_require__) {
         var package_namespaceObject = {
-            rE: "1.16.2"
+            rE: "1.16.5"
         };
         var brace_expansion = __webpack_require__("../../node_modules/.pnpm/brace-expansion@2.0.1/node_modules/brace-expansion/index.js");
         const MAX_PATTERN_LENGTH = 65536;
@@ -8475,7 +8475,7 @@ Usage:
                     type: 'boolean',
                     description: 'Whether to dismiss the HarmonyOS keyboard after text input'
                 }
-            }).version('version', 'Show version number', "1.16.2").help().epilogue(`For complete list of configuration options, please visit:
+            }).version('version', 'Show version number', "1.16.5").help().epilogue(`For complete list of configuration options, please visit:
   • Web options: https://midscenejs.com/automate-with-scripts-in-yaml#the-web-part
   • Android options: https://midscenejs.com/automate-with-scripts-in-yaml#the-android-part
   • HarmonyOS options: https://midscenejs.com/automate-with-scripts-in-yaml#the-harmony-part
@@ -12490,19 +12490,31 @@ defineYamlBatchTest(test, testOptions);
             const success = printExecutionSummary(results, summaryPath);
             return success ? exitCode : 1;
         }
+        function describeSiwcError(error) {
+            return inspect(error, {
+                depth: null,
+                colors: false,
+                maxArrayLength: null,
+                maxStringLength: null
+            });
+        }
         const defaultCredentialsPath = ()=>join(homedir(), '.midscene', 'siwc.json');
         async function readCredentialsFile(path) {
             const content = await readFile(path, 'utf8').catch((error)=>{
                 if ('ENOENT' === error.code) return;
-                throw new Error('Unable to read the local SIWC credentials file.');
+                throw new SiwcError('Unable to read the local SIWC credentials file.', {
+                    cause: error
+                });
             });
             if (void 0 === content) return;
             try {
                 const value = JSON.parse(content);
-                if (!value || 'string' != typeof value.credentials?.ext_agent_host_id || !value.credentials.ext_agent_host_id) throw new Error('Invalid SIWC credentials record.');
+                if (!value || 'string' != typeof value.credentials?.ext_agent_host_id || !value.credentials.ext_agent_host_id) throw new SiwcError('Invalid SIWC credentials record.');
                 return value;
-            } catch  {
-                throw new Error('Invalid local SIWC credentials file.');
+            } catch (error) {
+                throw new SiwcError('Invalid local SIWC credentials file.', {
+                    cause: error
+                });
             }
         }
         async function readRegistration(path) {
@@ -12541,8 +12553,10 @@ defineYamlBatchTest(test, testOptions);
                     mode: 448
                 });
             } catch (error) {
-                if ('EEXIST' === error.code) throw new Error(`Another SIWC command holds ${lockPath}. If it was interrupted, remove this lock only after confirming that no SIWC command is running.`);
-                throw new Error('Unable to lock the local SIWC credentials file.');
+                if ('EEXIST' === error.code) throw new SiwcError(`Another SIWC command holds ${lockPath}. If it was interrupted, remove this lock only after confirming that no SIWC command is running.`);
+                throw new SiwcError('Unable to lock the local SIWC credentials file.', {
+                    cause: error
+                });
             }
             return ()=>rm(lockPath, {
                     recursive: true,
@@ -12557,18 +12571,13 @@ defineYamlBatchTest(test, testOptions);
                 'access_token',
                 'refresh_token',
                 'id_token'
-            ].some((key)=>'string' != typeof value[key] || !value[key]) || !Array.isArray(value.scopes) || !value.scopes.every((scope)=>'string' == typeof scope) || !Number.isFinite(value.expires_at)) throw new Error('No valid SIWC credentials. Run midscene model siwc login first.');
+            ].some((key)=>'string' != typeof value[key] || !value[key]) || !Array.isArray(value.scopes) || !value.scopes.every((scope)=>'string' == typeof scope) || !Number.isFinite(value.expires_at)) throw new SiwcError('No valid SIWC credentials. Run midscene model siwc login first.');
             return value;
         }
-        const ISSUER = 'https://auth.openai.com';
-        const RESOURCE = 'https://api.openai.com/v1';
-        const SCOPES = 'openid profile email offline_access resource.invoke chatgpt.tokens.use.direct';
         async function loginWithOpenAI(options, dependencies) {
             const hostId = options.hostId ?? `urn:uuid:${randomUUID()}`;
             const existingClientId = options.clientId;
-            const state = randomBytes(32).toString('base64url');
-            const nonce = randomBytes(32).toString('base64url');
-            const verifier = randomBytes(32).toString('base64url');
+            const context = {};
             const signal = options.signal;
             signal.throwIfAborted();
             const server = createServer();
@@ -12582,17 +12591,24 @@ defineYamlBatchTest(test, testOptions);
                     response.setHeader('Referrer-Policy', 'no-referrer');
                     const url = new URL(request.url || '/', 'http://127.0.0.1');
                     if ('GET' !== request.method || '/auth/callback' !== url.pathname) return void response.writeHead(404).end('Not found');
-                    if (1 !== url.searchParams.getAll('state').length || url.searchParams.get('state') !== state) return void response.writeHead(400).end('Invalid login state. Use the original authorization link.');
+                    if (!context.attempt) return void response.writeHead(400).end('Authorization has not started.');
                     if (consumed.value) return void response.writeHead(409).end('Authorization already received.');
-                    if (url.searchParams.has('error')) {
-                        consumed.value = true;
-                        response.writeHead(400).end('Authorization was not granted. Return to the terminal.');
-                        reject(new Error('OpenAI authorization was denied or failed.'));
+                    const parsed = (()=>{
+                        try {
+                            return parseSiwcCallback(new URL(request.url || '/', context.attempt.redirectUri).toString(), context.attempt);
+                        } catch (error) {
+                            response.writeHead(400).end('Invalid authorization callback.');
+                            if (url.searchParams.has('error')) {
+                                consumed.value = true;
+                                reject(error);
+                            }
+                            return;
+                        }
+                    })();
+                    if (!parsed) {
+                        if (!response.writableEnded) response.writeHead(400).end('Invalid login state. Use the original authorization link.');
                         return;
                     }
-                    const code = url.searchParams.get('code');
-                    const clientId = url.searchParams.get('client_id') || existingClientId;
-                    if (!code || !clientId || 'dynamic_agent_client' === clientId || existingClientId && clientId !== existingClientId || 1 !== url.searchParams.getAll('code').length || url.searchParams.getAll('client_id').length > 1) return void response.writeHead(400).end('Invalid authorization callback.');
                     consumed.value = true;
                     response.setHeader('Content-Type', 'text/html; charset=utf-8');
                     response.end(`<!doctype html>
@@ -12618,10 +12634,7 @@ defineYamlBatchTest(test, testOptions);
   </main>
 </body>
 </html>`);
-                    resolve({
-                        code,
-                        clientId
-                    });
+                    resolve(parsed);
                 });
                 server.on('error', reject);
             });
@@ -12640,132 +12653,22 @@ defineYamlBatchTest(test, testOptions);
                 });
                 signal.throwIfAborted();
                 const redirectUri = `http://127.0.0.1:${server.address().port}/auth/callback`;
-                const authorization = new URL(`${ISSUER}/api/accounts/authorize`);
-                authorization.search = new URLSearchParams({
-                    client_id: existingClientId ?? 'dynamic_agent_client',
-                    ...existingClientId ? {} : {
-                        agent_name_hint: 'Midscene'
-                    },
-                    ext_agent_host_id: hostId,
-                    response_type: 'code',
-                    redirect_uri: redirectUri,
-                    scope: SCOPES,
-                    resource: RESOURCE,
-                    state,
-                    nonce,
-                    code_challenge_method: 'S256',
-                    code_challenge: createHash('sha256').update(verifier).digest('base64url')
-                }).toString();
-                await options.onAuthorization(authorization.toString());
-                const { code, clientId } = await callback;
-                signal.throwIfAborted();
-                const request = dependencies?.fetch ?? fetch;
-                const result = await request(`${ISSUER}/api/accounts/oauth/token`, {
-                    method: 'POST',
-                    headers: {
-                        'Content-Type': 'application/x-www-form-urlencoded'
-                    },
-                    body: new URLSearchParams({
-                        grant_type: 'authorization_code',
-                        client_id: clientId,
-                        code,
-                        code_verifier: verifier,
-                        redirect_uri: redirectUri,
-                        resource: RESOURCE
-                    }),
-                    signal,
-                    redirect: 'error'
+                const { attempt, url } = await createSiwcAuthorization({
+                    hostId,
+                    clientId: existingClientId,
+                    redirectUri,
+                    agentName: 'Midscene'
                 });
-                if (!result.ok) throw new Error(`OpenAI token exchange failed (HTTP ${result.status}). Run midscene model siwc login again.`);
-                const tokens = await result.json();
-                if (!tokens || 'string' != typeof tokens.access_token || !tokens.access_token || 'string' != typeof tokens.refresh_token || !tokens.refresh_token || 'string' != typeof tokens.id_token || 'string' != typeof tokens.scope || 'number' != typeof tokens.expires_in || !Number.isFinite(tokens.expires_in) || tokens.expires_in <= 0 || 'string' != typeof tokens.token_type || 'bearer' !== tokens.token_type.toLowerCase()) throw new Error('OpenAI returned an invalid token response.');
-                const scopes = tokens.scope.split(/\s+/);
-                if (!scopes.includes('chatgpt.tokens.use.direct')) throw new Error('ChatGPT plan usage was not authorized. Run midscene model siwc login again and grant access.');
-                const keys = dependencies?.keys ?? createRemoteJWKSet(new URL(`${ISSUER}/.well-known/jwks.json`));
-                const { payload } = await jwtVerify(tokens.id_token, keys, {
-                    issuer: ISSUER,
-                    audience: clientId,
-                    algorithms: [
-                        'RS256'
-                    ],
-                    requiredClaims: [
-                        'sub',
-                        'exp',
-                        'iat',
-                        'nonce'
-                    ]
-                });
-                if (payload.nonce !== nonce || !payload.sub) throw new Error('OpenAI login identity or nonce did not match.');
-                signal.throwIfAborted();
-                return {
-                    ext_agent_host_id: hostId,
-                    client_id: clientId,
-                    subject: payload.sub,
-                    issuer: ISSUER,
-                    ...'string' == typeof payload.email ? {
-                        email: payload.email
-                    } : {},
-                    access_token: tokens.access_token,
-                    refresh_token: tokens.refresh_token,
-                    id_token: tokens.id_token,
-                    scopes,
-                    expires_at: Date.now() + 1000 * tokens.expires_in
-                };
+                context.attempt = attempt;
+                await options.onAuthorization(url);
+                const result = await withSiwcStage('Authorization callback', ()=>callback);
+                return await exchangeSiwcCode(attempt, result, signal, dependencies);
             } finally{
                 signal.removeEventListener('abort', abort);
                 server.closeAllConnections();
                 await new Promise((resolve)=>server.close(()=>resolve()));
             }
         }
-        async function refreshOpenAICredentials(saved, signal, dependencies) {
-            const issuer = 'https://auth.openai.com';
-            signal.throwIfAborted();
-            const response = await (dependencies?.fetch ?? fetch)(`${issuer}/api/accounts/oauth/token`, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/x-www-form-urlencoded'
-                },
-                body: new URLSearchParams({
-                    grant_type: 'refresh_token',
-                    client_id: saved.client_id,
-                    refresh_token: saved.refresh_token,
-                    resource: 'https://api.openai.com/v1'
-                }),
-                signal,
-                redirect: 'error'
-            });
-            if (!response.ok) throw new Error('OpenAI refresh failed.');
-            const tokens = await response.json();
-            if (!tokens || 'string' != typeof tokens.access_token || !tokens.access_token || 'string' != typeof tokens.refresh_token || !tokens.refresh_token || 'number' != typeof tokens.expires_in || !Number.isFinite(tokens.expires_in) || tokens.expires_in <= 0 || 'string' != typeof tokens.token_type || 'bearer' !== tokens.token_type.toLowerCase() || 'string' != typeof tokens.scope) throw new Error('OpenAI returned an invalid refresh response.');
-            const scopes = tokens.scope.split(/\s+/);
-            if (!scopes.includes('chatgpt.tokens.use.direct')) throw new Error('ChatGPT plan usage is no longer authorized.');
-            if (void 0 !== tokens.id_token) {
-                if ('string' != typeof tokens.id_token || !tokens.id_token) throw new Error('Invalid refreshed ID token.');
-                const keys = dependencies?.keys ?? createRemoteJWKSet(new URL(`${issuer}/.well-known/jwks.json`));
-                const { payload } = await jwtVerify(tokens.id_token, keys, {
-                    issuer,
-                    audience: saved.client_id,
-                    algorithms: [
-                        'RS256'
-                    ],
-                    requiredClaims: [
-                        'sub',
-                        'exp',
-                        'iat'
-                    ]
-                });
-                if (payload.sub !== saved.subject) throw new Error('Refreshed identity does not match the saved account.');
-            }
-            signal.throwIfAborted();
-            return {
-                ...saved,
-                access_token: tokens.access_token,
-                refresh_token: tokens.refresh_token,
-                id_token: tokens.id_token ?? saved.id_token,
-                scopes,
-                expires_at: Date.now() + 1000 * tokens.expires_in
-            };
-        }
         const USAGE = `Usage:
   midscene model siwc login [--no-open] [--port <port>]
   midscene model siwc refresh
@@ -12838,7 +12741,7 @@ Options (login):
                 }
             }
             const unlock = await lockCredentials(credentialsPath).catch((error)=>{
-                io.stderr(error.message);
+                io.stderr(describeSiwcError(error));
             });
             if (!unlock) return 1;
             const controller = new AbortController();
@@ -12848,31 +12751,31 @@ Options (login):
             process.once('SIGTERM', cancel);
             try {
                 io.stderr(source_default().cyan.bold(`🔄 Starting OpenAI SIWC ${action}...`));
-                const saved = await readRegistration(credentialsPath);
+                const saved = await withSiwcStage('Read credentials', ()=>readRegistration(credentialsPath));
                 const credentials = await (async ()=>{
-                    if ('refresh' === action) return refreshOpenAICredentials(requireCredentials(saved), controller.signal);
+                    if ('refresh' === action) return withSiwcStage('Refresh', ()=>refreshSiwcCredentials(requireCredentials(saved), controller.signal));
                     const registration = saved ?? {
                         ext_agent_host_id: `urn:uuid:${randomUUID()}`
                     };
-                    if (!saved) await saveRegistration(credentialsPath, registration);
-                    const result = await loginWithOpenAI({
-                        port: portOptions.port,
-                        hostId: registration.ext_agent_host_id,
-                        clientId: registration.client_id,
-                        signal: controller.signal,
-                        onAuthorization: async (url)=>{
-                            io.stderr(`\n${source_default().bold('Continue with ChatGPT:')}\n${url}\n\n${source_default().gray('Waiting for authorization...')}`);
-                            if (!portOptions.noOpen) try {
-                                await openBrowser(url);
-                            } catch  {
-                                io.stderr('Open the URL above in your browser to continue.');
+                    if (!saved) await withSiwcStage('Save registration', ()=>saveRegistration(credentialsPath, registration));
+                    const result = await withSiwcStage('Login', ()=>loginWithOpenAI({
+                            port: portOptions.port,
+                            hostId: registration.ext_agent_host_id,
+                            clientId: registration.client_id,
+                            signal: controller.signal,
+                            onAuthorization: async (url)=>{
+                                io.stderr(`\n${source_default().bold('Continue with ChatGPT:')}\n${url}\n\n${source_default().gray('Waiting for authorization...')}`);
+                                if (!portOptions.noOpen) try {
+                                    await openBrowser(url);
+                                } catch  {
+                                    io.stderr('Open the URL above in your browser to continue.');
+                                }
                             }
-                        }
-                    });
-                    if (registration.subject && result.subject !== registration.subject) throw new Error('Login identity does not match the saved account.');
+                        }));
+                    if (registration.subject && result.subject !== registration.subject) throw new SiwcError('Login identity does not match the saved account.');
                     return result;
                 })();
-                await saveRegistration(credentialsPath, credentials);
+                await withSiwcStage('Save credentials', ()=>saveRegistration(credentialsPath, credentials));
                 io.stderr('\n🔑 your Access token:');
                 io.stdout(credentials.access_token);
                 const expiresAt = new Intl.DateTimeFormat('en-GB', {
@@ -12886,8 +12789,8 @@ Options (login):
                 io.stderr(`\nExpires at: ${expiresAt} (${expiresIn})`);
                 io.stderr(`\n${source_default().green(`✅ SIWC ${action} succeeded.`)}\n\nYou can use this access token as your model API Key in Midscene by setting MIDSCENE_MODEL_API_KEY.\n\nFull credentials are saved locally to:\n${source_default().cyan(credentialsPath)}\n\n${source_default().gray('Midscene does not collect your credentials.')}`);
                 return 0;
-            } catch  {
-                io.stderr(source_default().red(controller.signal.aborted ? `OpenAI ${action} cancelled or timed out.` : `OpenAI ${action} failed. Check the local credentials file permissions or run midscene model siwc login to authorize again.`));
+            } catch (error) {
+                io.stderr(source_default().red(controller.signal.aborted ? `OpenAI ${action} cancelled or timed out.\n${describeSiwcError(error)}` : `OpenAI ${action} failed.\n${describeSiwcError(error)}`));
                 return 1;
             } finally{
                 clearTimeout(timer);