@modelprofile.com/authswitch 6.3.0 → 6.5.0

package/ts/classes.codexmanaged.ts

@@ -0,0 +1,339 @@
+import * as plugins from './plugins.js';
+import { commitinfo } from './00_commitinfo_data.js';
+import type { AuthSwitchAuthorityBroker } from './classes.authoritybroker.js';
+
+export interface IAuthSwitchManagedCodexOptions {
+  /** Private runtime root; only the disposable control socket lives here. */
+  runtimeDirectory: string;
+  /** Caller-owned, durable native Codex state home, reserved to one account and scope by SmartData. */
+  codexHomeDirectory: string;
+  workspaceDirectory: string;
+  executable?: string;
+  /** The daemon is the sole owner of this binding and its capability. */
+  broker: AuthSwitchAuthorityBroker;
+  bindingId: string;
+  capability: string;
+  onNotification?: (notification: plugins.crossharness.ICodexAppServerNotification) => void;
+  onServerRequest?: (request: plugins.crossharness.ICodexAppServerRequest,
+    reply: { respond: (result: unknown) => boolean; reject: (code: number, message: string) => boolean }) => void;
+  onUnavailable?: () => void;
+  onPreparedRun: (socketPath: string) => Promise<void>;
+  onChildSpawned: (pid: number, startedAt: string) => Promise<void>;
+}
+
+export interface IAuthSwitchCodexInteractiveCommand {
+  executable: string;
+  args: string[];
+  cwd: string;
+  env: NodeJS.ProcessEnv;
+}
+
+const isRecord = (value: unknown): value is Record<string, unknown> =>
+  value !== null && typeof value === 'object' && !Array.isArray(value);
+const isAlive = (child: plugins.childProcess.ChildProcess): boolean => child.exitCode === null && child.signalCode === null;
+const wait = (ms: number): Promise<void> => new Promise(resolve => setTimeout(resolve, ms));
+
+/** Same-user process inspection: a unique private --listen socket is the pre-PID crash identity. */
+export const findManagedCodexProcess = async (socketPath: string): Promise<{ pid: number; startedAt: string } | null> => {
+  if (process.platform === 'win32') throw new Error('Managed Codex Unix socket process inspection is unavailable on Windows.');
+  const output = await new Promise<string>((resolve, reject) => {
+    plugins.childProcess.execFile('ps', ['-ww', '-u', String(process.getuid?.()), '-o', 'pid=,lstart=,args='],
+      { timeout: 5_000, maxBuffer: 8 * 1024 * 1024, env: { ...process.env, LC_ALL: 'C' } },
+      (error, stdout) => error ? reject(new Error('Managed Codex process inspection failed.')) : resolve(stdout));
+  });
+  const marker = `app-server --listen unix://${socketPath}`;
+  const matches: Array<{ pid: number; startedAt: string }> = [];
+  for (const line of output.split('\n')) {
+    const parts = line.trim().split(/\s+/);
+    if (parts.length < 8) continue;
+    const pid = Number(parts[0]);
+    const date = Date.parse(parts.slice(1, 6).join(' '));
+    const args = parts.slice(6).join(' ');
+    if (Number.isSafeInteger(pid) && pid > 0 && Number.isFinite(date) && args.includes(marker)) {
+      matches.push({ pid, startedAt: new Date(date).toISOString() });
+    }
+  }
+  if (matches.length > 1) throw new Error('Multiple managed Codex processes claim one private socket.');
+  return matches[0] ?? null;
+};
+
+/** Daemon-owned Codex app-server. Only access tokens, never refresh grants, enter Codex. */
+export class AuthSwitchManagedCodex {
+  private child?: plugins.childProcess.ChildProcess;
+  private childExited?: Promise<void>;
+  private client?: plugins.crossharness.CodexAppServerClient;
+  private runDirectory?: string;
+  private homeDirectory?: string;
+  private socketPath?: string;
+  private workspaceId?: string;
+  private grantedGeneration?: number;
+  private startPromise?: Promise<void>;
+  private closePromise?: Promise<void>;
+  private closed = false;
+  private ready = false;
+
+  constructor(private readonly options: IAuthSwitchManagedCodexOptions) {
+    if (!plugins.path.isAbsolute(options.runtimeDirectory) || !plugins.path.isAbsolute(options.workspaceDirectory)
+      || !plugins.path.isAbsolute(options.codexHomeDirectory)) {
+      throw new Error('Managed Codex requires absolute runtime, home and workspace directories.');
+    }
+  }
+
+  public get isReady(): boolean { return this.ready && this.client?.state === 'connected' && !this.closed; }
+
+  private environment(): NodeJS.ProcessEnv {
+    const picked: NodeJS.ProcessEnv = {};
+    for (const key of ['PATH', 'HOME', 'USER', 'LOGNAME', 'LANG', 'LC_ALL', 'TERM', 'TMPDIR', 'XDG_RUNTIME_DIR']) {
+      if (process.env[key] !== undefined) picked[key] = process.env[key];
+    }
+    picked.CODEX_HOME = this.homeDirectory;
+    return picked;
+  }
+
+  private async requireVersion(): Promise<void> {
+    const executable = this.options.executable ?? 'codex';
+    const output = await new Promise<string>((resolve, reject) => {
+      plugins.childProcess.execFile(executable, ['--version'], { timeout: 5_000, maxBuffer: 4096,
+        windowsHide: true, env: this.environment() }, (error, stdout) => {
+        if (error) reject(new Error('Managed Codex version probe failed.'));
+        else resolve(stdout.trim());
+      });
+    });
+    if (output !== 'codex-cli 0.155.1') throw new Error('Managed Codex requires verified codex-cli 0.155.1.');
+  }
+
+  public start(): Promise<void> {
+    if (this.closed || this.startPromise) throw new Error('Managed Codex can start only once.');
+    this.startPromise = this.performStart();
+    return this.startPromise;
+  }
+
+  private async performStart(): Promise<void> {
+    try {
+      const root = this.options.runtimeDirectory;
+      await plugins.fs.promises.mkdir(root, { recursive: true, mode: 0o700 });
+      const rootStat = await plugins.fs.promises.lstat(root);
+      if (!rootStat.isDirectory() || rootStat.isSymbolicLink() || rootStat.uid !== process.getuid?.()) {
+        throw new Error('Managed Codex runtime directory is not private.');
+      }
+      await plugins.fs.promises.chmod(root, 0o700);
+      this.runDirectory = await plugins.fs.promises.mkdtemp(plugins.path.join(root, 'codex-'));
+      await plugins.fs.promises.chmod(this.runDirectory, 0o700);
+      this.homeDirectory = this.options.codexHomeDirectory;
+      this.socketPath = plugins.path.join(this.runDirectory, 'app.sock');
+      if (Buffer.byteLength(this.socketPath, 'utf8') > 100) throw new Error('Managed Codex socket path is too long.');
+      const homeStat = await plugins.fs.promises.lstat(this.homeDirectory);
+      if (!homeStat.isDirectory() || homeStat.isSymbolicLink() || homeStat.uid !== process.getuid?.()
+        || (homeStat.mode & 0o077) !== 0 || await plugins.fs.promises.realpath(this.homeDirectory) !== this.homeDirectory) {
+        throw new Error('Managed Codex home is not a private owned directory.');
+      }
+      try { await plugins.fs.promises.lstat(plugins.path.join(this.homeDirectory, 'auth.json'));
+        throw new Error('Managed Codex home contains a native credential file.');
+      } catch (error) {
+        if (!isRecord(error) || error.code !== 'ENOENT') throw error;
+      }
+      await this.requireVersion();
+      if (this.closed) throw new Error('Managed Codex startup was cancelled.');
+      const initial = await this.options.broker.resolveAccess(this.options.bindingId,
+        this.options.capability, 60_000);
+      if (this.closed) throw new Error('Managed Codex startup was cancelled.');
+      this.workspaceId = initial.accountId;
+      this.grantedGeneration = initial.grantGeneration;
+      await this.options.onPreparedRun(this.socketPath);
+      if (this.closed) throw new Error('Managed Codex startup was cancelled.');
+      const child = plugins.childProcess.spawn(this.options.executable ?? 'codex', [
+        'app-server', '--listen', `unix://${this.socketPath}`, '--strict-config',
+        '-c', 'cli_auth_credentials_store="ephemeral"',
+      ], { cwd: this.options.workspaceDirectory, env: this.environment(), shell: false,
+        detached: process.platform !== 'win32', stdio: 'ignore', windowsHide: true });
+      this.child = child;
+      this.childExited = new Promise(resolve => {
+        child.once('error', () => resolve());
+        child.once('exit', () => resolve());
+      });
+      if (!child.pid) throw new Error('Managed Codex app-server process has no PID.');
+      let observed: Awaited<ReturnType<typeof findManagedCodexProcess>> = null;
+      for (let attempt = 0; attempt < 20 && !observed; attempt++) {
+        observed = await findManagedCodexProcess(this.socketPath);
+        if (!observed) await wait(25);
+      }
+      if (!observed || observed.pid !== child.pid) throw new Error('Managed Codex app-server process identity could not be verified.');
+      await this.options.onChildSpawned(observed.pid, observed.startedAt);
+      const deadline = Date.now() + 10_000;
+      while (true) {
+        if (this.closed) throw new Error('Managed Codex startup was cancelled.');
+        if (!isAlive(child)) throw new Error('Managed Codex app-server exited before accepting connections.');
+        try {
+          if ((await plugins.fs.promises.lstat(this.socketPath)).isSocket()) break;
+        } catch (error) {
+          if (!isRecord(error) || error.code !== 'ENOENT') throw error;
+        }
+        if (Date.now() >= deadline) throw new Error('Managed Codex app-server socket startup timed out.');
+        await wait(25);
+      }
+      const client = new plugins.crossharness.CodexAppServerClient({
+        transport: { type: 'unix', socketPath: this.socketPath },
+        clientInfo: { name: 'authswitch', title: 'Authswitch', version: commitinfo.version },
+        experimentalApi: true, handshakeTimeoutMs: 5_000, initializeTimeoutMs: 5_000,
+        onNotification: notification => this.options.onNotification?.(notification),
+        onServerRequest: request => { void this.handleServerRequest(request); },
+        onClose: () => {
+          const wasReady = this.ready;
+          this.ready = false;
+          if (wasReady && !this.closed) this.options.onUnavailable?.();
+        },
+      });
+      this.client = client;
+      await client.connect();
+      if (client.serverVersion !== '0.155.1') throw new Error('Managed Codex app-server version changed.');
+      const login: unknown = await client.request('account/login/start', {
+        type: 'chatgptAuthTokens', accessToken: initial.accessToken, chatgptAccountId: initial.accountId,
+      }, 5_000);
+      if (!isRecord(login) || login.type !== 'chatgptAuthTokens') {
+        throw new Error('Managed Codex external-token login was not acknowledged.');
+      }
+      if (this.closed) throw new Error('Managed Codex startup was cancelled.');
+      this.ready = true;
+    } catch (error) {
+      try { await this.close(); } catch (cleanupError) {
+        throw new AggregateError([error, cleanupError], 'Managed Codex startup and cleanup failed.');
+      }
+      throw error;
+    }
+  }
+
+  private async handleServerRequest(request: plugins.crossharness.ICodexAppServerRequest): Promise<void> {
+    const client = this.client;
+    if (!client || this.closed || !this.ready) return;
+    if (request.method !== 'account/chatgptAuthTokens/refresh') {
+      if (!this.options.onServerRequest) {
+        client.rejectRequest(request.id, -32601, 'Managed Codex request requires an owner handler.');
+        return;
+      }
+      try {
+        this.options.onServerRequest(request, {
+          respond: result => client.respond(request.id, result),
+          reject: (code, message) => client.rejectRequest(request.id, code, message),
+        });
+      } catch {
+        client.rejectRequest(request.id, -32603, 'Managed Codex owner request failed.');
+      }
+      return;
+    }
+    const prior = this.grantedGeneration;
+    const workspaceId = this.workspaceId;
+    const params = request.params;
+    if (params.reason !== 'unauthorized' || !workspaceId || prior === undefined
+      || (params.previousAccountId !== undefined && params.previousAccountId !== null
+        && params.previousAccountId !== workspaceId)) {
+      client.rejectRequest(request.id, -32602, 'Managed Codex account identity is invalid.');
+      return;
+    }
+    try {
+      const refreshed = await this.options.broker.resolveAccess(this.options.bindingId,
+        this.options.capability, 60_000, prior);
+      if (this.closed || request.signal.aborted) return;
+      if (refreshed.accountId !== workspaceId || refreshed.grantGeneration <= prior) {
+        client.rejectRequest(request.id, -32603, 'Managed Codex account refresh did not advance.');
+        return;
+      }
+      this.grantedGeneration = refreshed.grantGeneration;
+      client.respond(request.id, { accessToken: refreshed.accessToken,
+        chatgptAccountId: refreshed.accountId, chatgptPlanType: null });
+    } catch {
+      if (!request.signal.aborted) client.rejectRequest(request.id, -32603, 'Managed Codex account needs reauthentication.');
+    }
+  }
+
+  /** The interactive CLI attaches to the owned app-server; the daemon remains its auth control peer. */
+  public interactiveCommand(): IAuthSwitchCodexInteractiveCommand {
+    if (!this.isReady || !this.socketPath) throw new Error('Managed Codex is unavailable.');
+    return { executable: this.options.executable ?? 'codex', args: ['--remote', `unix://${this.socketPath}`],
+      cwd: this.options.workspaceDirectory, env: this.environment() };
+  }
+
+  /** Native app-server thread/turn API for noninteractive consumers; notifications go to onNotification. */
+  public async startThread(options: { approvalPolicy: 'never' | 'on-request'; model?: string;
+    signal?: AbortSignal }): Promise<string> {
+    if (!this.isReady || !this.client || !options || !['never', 'on-request'].includes(options.approvalPolicy)
+      || (options.model !== undefined && (typeof options.model !== 'string' || options.model.length > 128))) {
+      throw new Error('Managed Codex thread request is unavailable or invalid.');
+    }
+    const started: unknown = await this.client.request('thread/start', {
+      cwd: this.options.workspaceDirectory, approvalPolicy: options.approvalPolicy,
+      ...(options.model ? { model: options.model } : {}),
+    }, 30_000, options.signal);
+    if (!isRecord(started) || !isRecord(started.thread) || typeof started.thread.id !== 'string') {
+      throw new Error('Managed Codex returned an invalid thread.');
+    }
+    return started.thread.id;
+  }
+
+  public async resumeThread(threadId: string, options: { approvalPolicy: 'never' | 'on-request';
+    model?: string; signal?: AbortSignal }): Promise<void> {
+    if (!this.isReady || !this.client || typeof threadId !== 'string' || !threadId || threadId.length > 256
+      || !options || !['never', 'on-request'].includes(options.approvalPolicy)
+      || (options.model !== undefined && (typeof options.model !== 'string' || options.model.length > 128))) {
+      throw new Error('Managed Codex resume request is unavailable or invalid.');
+    }
+    const resumed: unknown = await this.client.request('thread/resume', { threadId,
+      cwd: this.options.workspaceDirectory, approvalPolicy: options.approvalPolicy,
+      ...(options.model ? { model: options.model } : {}),
+    }, 30_000, options.signal);
+    if (!isRecord(resumed) || !isRecord(resumed.thread) || resumed.thread.id !== threadId) {
+      throw new Error('Managed Codex could not resume the requested thread from its assigned home.');
+    }
+  }
+
+  public async startTextTurn(text: string, options: { approvalPolicy: 'never' | 'on-request';
+    model?: string; threadId?: string; signal?: AbortSignal }): Promise<{ threadId: string; turnId: string }> {
+    if (!this.isReady || !this.client || typeof text !== 'string' || !text.trim() || text.length > 1_000_000
+      || !options || !['never', 'on-request'].includes(options.approvalPolicy)
+      || (options.model !== undefined && (typeof options.model !== 'string' || options.model.length > 128))
+      || (options.threadId !== undefined && (typeof options.threadId !== 'string' || options.threadId.length > 256))) {
+      throw new Error('Managed Codex turn request is unavailable or invalid.');
+    }
+    let threadId = options.threadId;
+    if (threadId) {
+      await this.resumeThread(threadId, options);
+    } else {
+      threadId = await this.startThread(options);
+    }
+    const turn: unknown = await this.client.request('turn/start', { threadId,
+      input: [{ type: 'text', text, text_elements: [] }],
+      approvalPolicy: options.approvalPolicy,
+      ...(options.model ? { model: options.model } : {}),
+    }, 30_000, options.signal);
+    if (!isRecord(turn) || !isRecord(turn.turn) || typeof turn.turn.id !== 'string') {
+      throw new Error('Managed Codex returned an invalid turn.');
+    }
+    return { threadId, turnId: turn.turn.id };
+  }
+
+  public close(): Promise<void> {
+    if (this.closePromise) return this.closePromise;
+    const wasReady = this.ready;
+    this.closed = true;
+    this.ready = false;
+    this.closePromise = this.performClose();
+    if (wasReady) this.options.onUnavailable?.();
+    return this.closePromise;
+  }
+
+  private async performClose(): Promise<void> {
+    this.client?.close('Managed Codex stopped.');
+    const child = this.child;
+    if (child && isAlive(child) && child.pid) {
+      try { process.kill(process.platform === 'win32' ? child.pid : -child.pid, 'SIGTERM'); }
+      catch (error) { if (!isRecord(error) || error.code !== 'ESRCH') throw error; }
+      await Promise.race([this.childExited, wait(3_000)]);
+      if (isAlive(child)) {
+        try { process.kill(process.platform === 'win32' ? child.pid : -child.pid, 'SIGKILL'); }
+        catch (error) { if (!isRecord(error) || error.code !== 'ESRCH') throw error; }
+        await Promise.race([this.childExited, wait(3_000)]);
+      }
+      if (isAlive(child)) throw new Error('Managed Codex process did not stop.');
+    }
+    if (this.runDirectory) await plugins.fs.promises.rm(this.runDirectory, { recursive: true, force: true });
+  }
+}

package/ts/index.ts

@@ -23,10 +23,36 @@ export * from './classes.service.js';
 export * from './classes.watch.js';
 export * from './classes.watchlock.js';
 export * from './watchpolicy.js';
+export * from './classes.authorityclient.js';
+export * from './classes.authoritydaemon.js';
+export * from './classes.authorityservice.js';
 
 import { AuthSwitchCli } from './classes.cli.js';
+import { AuthSwitchAuthorityService, resolveAuthSwitchAuthorityPaths, runAuthSwitchAuthorityDaemon } from './classes.authorityservice.js';
 
 export const runCli = async (argvArg: string[] = process.argv.slice(2)): Promise<void> => {
+  if (argvArg[0] === 'authority') {
+    const paths = resolveAuthSwitchAuthorityPaths();
+    if (argvArg[1] === 'daemon' && argvArg.length === 2) {
+      await runAuthSwitchAuthorityDaemon(paths);
+      return;
+    }
+    if (argvArg[1] === 'service' && argvArg.length === 3) {
+      const service = new AuthSwitchAuthorityService(paths.runtimeDirectory);
+      const action = argvArg[2];
+      const result = action === 'install' ? await service.install()
+        : action === 'status' ? await service.inspect()
+        : action === 'enable' ? await service.enable()
+        : action === 'start' ? await service.start()
+        : action === 'stop' ? await service.stop()
+        : null;
+      if (result !== null) {
+        process.stdout.write(JSON.stringify(result) + '\n');
+        return;
+      }
+    }
+    throw new Error('Usage: authswitch authority daemon | service install|status|enable|start|stop');
+  }
   const exitCode = await new AuthSwitchCli().run(argvArg);
   process.exitCode = exitCode;
 };

package/ts/plugins.ts

@@ -4,10 +4,12 @@ import * as os from 'node:os';
 import * as path from 'node:path';
 import * as childProcess from 'node:child_process';
 import * as crypto from 'node:crypto';
+import * as net from 'node:net';
 import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
 import type { DatabaseSync } from 'node:sqlite';
 
-export { childProcess, crypto, fs, os, path };
+export { childProcess, crypto, fileURLToPath, fs, net, os, path };
 export type { DatabaseSync };
 const nativeRequire = createRequire(import.meta.url);
 /** SQLite is needed only when accessing a Codex state database, not when hosting account APIs. */
@@ -24,11 +26,17 @@ export const loadProperLockfile = (): Promise<TProperLockfile> => import('proper
 
 // @push.rocks modules
 import * as smartconsole from '@push.rocks/smartconsole';
-export { smartconsole };
+import * as smartdata from '@push.rocks/smartdata';
+import * as smartdb from '@push.rocks/smartdb';
+import * as smartsecret from '@push.rocks/smartsecret';
+import * as smartdaemon from '@push.rocks/smartdaemon';
+import * as typedrequest from '@api.global/typedrequest';
+export { smartconsole, smartdata, smartdb, smartsecret, smartdaemon, typedrequest };
 
 // @modelprofile.com modules
 import * as flexModels from '@modelprofile.com/flexharness-models';
 import * as flexOpenAi from '@modelprofile.com/flexharness-providers/openai';
 import * as flexAuth from '@modelprofile.com/flexharness-providers/auth';
 import * as flexAccounts from '@modelprofile.com/flexharness-providers/accounts';
-export { flexModels, flexOpenAi, flexAuth, flexAccounts };
+import * as crossharness from '@modelprofile.com/mcp-crossharness';
+export { flexModels, flexOpenAi, flexAuth, flexAccounts, crossharness };