@modelprofile.com/authswitch 8.2.0 → 9.1.0

package/ts/classes.operations.ts

@@ -1,6 +1,8 @@
 import * as plugins from './plugins.js';
 import { authSwitchHome } from './classes.credentialstore.js';
 import { assertAuthSwitchMutation, type TAuthSwitchMutation } from './mutation.js';
+import { assertAuthSwitchMutationAllowed, assertStatedLegacyFence,
+  type TAuthSwitchLegacyFence } from './classes.legacyfence.js';
 import type { IAuthHarness, IHarnessOutcome } from './interfaces.harness.js';
 
 /**
@@ -8,6 +10,8 @@ import type { IAuthHarness, IHarnessOutcome } from './interfaces.harness.js';
  * through `@modelprofile.com/authswitch/mutation`; they stay exported here for every Node caller.
  */
 export { assertAuthSwitchMutation, authSwitchMutationReplacesLogin, type TAuthSwitchMutation } from './mutation.js';
+export { authSwitchHostLegacyFence, type TAuthSwitchLegacyFence,
+  type IAuthSwitchLegacyFenceLocations } from './classes.legacyfence.js';
 
 export interface IAuthSwitchCoordinationRequest {
   protocolVersion: 1;
@@ -41,9 +45,19 @@ export const authSwitchEnvironmentId = (env: NodeJS.ProcessEnv = process.env): s
   openCodeOverride: env.OPENCODE_AUTH_CONTENT !== undefined,
 })).digest('hex');
 
-export const runAuthSwitchMutation = async (harness: IAuthHarness, mutation: TAuthSwitchMutation): Promise<IHarnessOutcome> => {
+/**
+ * The one mutation chokepoint, and therefore the one place the legacy fence can sit.
+ *
+ * `AuthSwitchOperations.run` delegates here and the AGL-hosted `AuthSwitchService` calls it directly, so a
+ * fence inside the class would leave the hosted path open. Where it looks is stated by the caller rather
+ * than defaulted, for the reason the authority states its own legacy locations: a fence that reached for
+ * `process.env` from inside a test would read whichever host ran it.
+ */
+export const runAuthSwitchMutation = async (harness: IAuthHarness, mutation: TAuthSwitchMutation,
+  legacyFence: TAuthSwitchLegacyFence): Promise<IHarnessOutcome> => {
   assertAuthSwitchMutation(mutation);
   if (harness.id !== mutation.harnessId) throw new Error('Account operation targets a different harness.');
+  await assertAuthSwitchMutationAllowed(legacyFence, harness, mutation);
   switch (mutation.action) {
     case 'save': return harness.saveCurrent({ keepActive: mutation.keepActive, accountId: mutation.accountId });
     case 'switch': return harness.switchAccount(mutation.accountId);
@@ -53,10 +67,15 @@ export const runAuthSwitchMutation = async (harness: IAuthHarness, mutation: TAu
 
 /** One mutation path for command, guide and TUI. Supervisors own their complete restart transaction. */
 export class AuthSwitchOperations {
-  constructor(private readonly coordinator?: TAuthSwitchCoordinator) {}
+  /** `legacyFence` is stated, never defaulted: see `runAuthSwitchMutation`. */
+  constructor(private readonly coordinator: TAuthSwitchCoordinator | undefined,
+    private readonly legacyFence: TAuthSwitchLegacyFence) { assertStatedLegacyFence(legacyFence); }
   public async run(harness: IAuthHarness, mutation: TAuthSwitchMutation, confirm?: TAuthSwitchConfirmation, prepareLocal?: TAuthSwitchLocalPreparation): Promise<IHarnessOutcome> {
     assertAuthSwitchMutation(mutation);
     if (harness.id !== mutation.harnessId) throw new Error('Account operation targets a different harness.');
+    // Asked before AGL is, so a coordinated mutation is refused here rather than carried out by a host that
+    // may not fence it; `runAuthSwitchMutation` asks again, because the answer can change while it waits.
+    await assertAuthSwitchMutationAllowed(this.legacyFence, harness, mutation);
     if (this.coordinator && mutation.action !== 'remove') {
       const request: IAuthSwitchCoordinationRequest = { protocolVersion: 1, contextId: authSwitchEnvironmentId(), mutation, waitForIdle: false };
       let result = await this.coordinator(request);
@@ -68,7 +87,7 @@ export class AuthSwitchOperations {
       if (result.status === 'busy') return { lines: [], problems: [result.message] };
     }
     if (prepareLocal) await prepareLocal();
-    return runAuthSwitchMutation(harness, mutation);
+    return runAuthSwitchMutation(harness, mutation, this.legacyFence);
   }
 }
 

package/ts/classes.service.ts

@@ -4,6 +4,9 @@ import { OpenCodeHarness } from './classes.opencodeharness.js';
 import { ClaudeCodeHarness } from './classes.claudecodeharness.js';
 import { readAccountList } from './classes.accountlist.js';
 import { assertAuthSwitchMutation, authSwitchEnvironmentId, runAuthSwitchMutation, type IAuthSwitchCoordinationRequest, type TAuthSwitchCoordinationResult, type TAuthSwitchCoordinator } from './classes.operations.js';
+import { AuthSwitchRefusal } from './authority-contract.js';
+import { assertAuthSwitchMutationAllowed, assertStatedLegacyFence, authSwitchHostLegacyFence,
+  type TAuthSwitchLegacyFence } from './classes.legacyfence.js';
 import type { IAuthHarness, IHarnessLoginHandle, IHarnessLoginOptions, IHarnessLoginProvider, IHarnessLoginResult, IHarnessOutcome } from './interfaces.harness.js';
 import type { IAccountList } from './interfaces.list.js';
 import type { TAuthLoginPrompt } from './classes.login.js';
@@ -67,15 +70,51 @@ export const assertAuthSwitchServiceRequest: (value: unknown) => asserts value i
 export class AuthSwitchService {
   private readonly operations = new Map<string, IOperation>();
   private closed = false;
-  constructor(
-    private readonly harnesses: IAuthHarness[] = [new CodexHarness(), new OpenCodeHarness(), new ClaudeCodeHarness()],
-    private readonly coordinator?: TAuthSwitchCoordinator,
-  ) {}
+  private readonly harnesses: IAuthHarness[];
+  private readonly legacyFence: TAuthSwitchLegacyFence;
+  /**
+   * With no harnesses, the service composes this host's own and fences them with this host's authority.
+   *
+   * A host that injects its harnesses -- AGL does -- also states the fence for them: only it knows which
+   * stores they write, and a default would fence whichever host this process happens to run on.
+   */
+  constructor();
+  constructor(harnesses: IAuthHarness[], coordinator: TAuthSwitchCoordinator | undefined,
+    legacyFence: TAuthSwitchLegacyFence);
+  constructor(harnessesArg?: IAuthHarness[], private readonly coordinator?: TAuthSwitchCoordinator,
+    legacyFenceArg?: TAuthSwitchLegacyFence) {
+    this.harnesses = harnessesArg ?? [new CodexHarness(), new OpenCodeHarness(), new ClaudeCodeHarness()];
+    const legacyFence: unknown = harnessesArg === undefined ? authSwitchHostLegacyFence() : legacyFenceArg;
+    assertStatedLegacyFence(legacyFence);
+    this.legacyFence = legacyFence;
+  }
   private harness(id: string): IAuthHarness {
     const harness = this.harnesses.find(item => item.id === id);
     if (!harness) throw new Error('Unknown harness.');
     return harness;
   }
+  /**
+   * One hosted mutation: fenced, then coordinated, then -- when no supervisor carries it out -- run here.
+   *
+   * The fence is asked before the coordinator, as `AuthSwitchOperations` asks it: a refused mutation must not
+   * first have its host stop the runtimes it would restart. The local run asks again, because the answer can
+   * change while coordination waits. A refusal is reported as the outcome's problem: it is an answer the owner
+   * acts on, exactly like the credential-location mismatch `request` reports, and it wrote nothing; letting it
+   * fall into the operation's generic failure would hide the one sentence that says what to do instead.
+   */
+  private async mutate(harness: IAuthHarness,
+    coordination: IAuthSwitchCoordinationRequest): Promise<TAuthSwitchCoordinationResult> {
+    try {
+      await assertAuthSwitchMutationAllowed(this.legacyFence, harness, coordination.mutation);
+      const coordinated = this.coordinator ? await this.coordinator(coordination) : { status: 'unavailable' } as const;
+      if (coordinated.status !== 'unavailable') return coordinated;
+      return { status: 'complete',
+        outcome: await runAuthSwitchMutation(harness, coordination.mutation, this.legacyFence) };
+    } catch (error) {
+      if (error instanceof AuthSwitchRefusal) return { status: 'complete', outcome: { lines: [], problems: [error.message] } };
+      throw error;
+    }
+  }
   private snapshot(operation: IOperation): IAuthSwitchServiceOperation { return structuredClone(operation.status); }
   public async request(request: TAuthSwitchServiceRequest): Promise<IAuthSwitchServiceOperation> {
     assertAuthSwitchServiceRequest(request);
@@ -111,10 +150,8 @@ export class AuthSwitchService {
             operation.status.result = { status: 'complete', outcome: { lines: [], problems: ['AGL and authswitch use different credential locations. Use matching credential environment settings before switching.'] } };
             break;
           }
-          const harness = this.harness(request.coordination.mutation.harnessId);
-          const coordinated = this.coordinator ? await this.coordinator(request.coordination) : { status: 'unavailable' } as const;
-          operation.status.result = publicResult(coordinated.status === 'unavailable'
-            ? { status: 'complete', outcome: await runAuthSwitchMutation(harness, request.coordination.mutation) } : coordinated);
+          operation.status.result = publicResult(
+            await this.mutate(this.harness(request.coordination.mutation.harnessId), request.coordination));
           break;
         }
         case 'login': {

package/ts/classes.tui.ts

@@ -13,7 +13,9 @@ const preuseResultLine = (resultArg: TPreuseAccountResult): string => resultArg.
 
 /** Owns account-management actions; terminal rendering and interaction belong to smartconsole. */
 export class AuthSwitchTui {
-  constructor(private readonly harnesses: readonly IAuthHarness[], private readonly out: plugins.smartconsole.SmartConsole, private readonly operations = new AuthSwitchOperations()) {}
+  /** The guide is reached through `AuthSwitchCli`, and mutates through that command line's own operations and fence. */
+  constructor(private readonly harnesses: readonly IAuthHarness[], private readonly out: plugins.smartconsole.SmartConsole,
+    private readonly operations: AuthSwitchOperations) {}
 
   public async run(preferredArg?: IAuthHarness): Promise<number> {
     let harness = preferredArg ?? this.harnesses[0];

package/ts/codexcontract.ts

@@ -0,0 +1,200 @@
+import * as plugins from './plugins.js';
+import { AuthSwitchRefusal } from './authority-contract.js';
+
+/**
+ * What managed Codex needs from the Codex it starts, checked at every start instead of pinning one release.
+ *
+ * The floor is `@modelprofile.com/mcp-crossharness`'s: 0.156.0 is the first release that publishes the
+ * `--listen unix://` alias managed Codex connects through, and every other surface it uses is older. Above
+ * the floor nothing is assumed. Codex describes its own app-server protocol (`app-server
+ * generate-json-schema`), and that description must still offer every request managed Codex sends and the one
+ * it answers, with the fields it sends. The external-token login in particular is marked unstable upstream,
+ * so a release that drops or reshapes it is refused at start, by name, rather than failing a session later
+ * -- the refresh callback, for one, would otherwise only be missed at the first expired token.
+ */
+export const MANAGED_CODEX_MINIMUM_VERSION = plugins.crossharness.CODEX_UNIX_SOCKET_MINIMUM_VERSION;
+
+/** The verified release, exactly as `codex --version` printed it; the app-server must report the same. */
+export interface IManagedCodexContract {
+  version: string;
+}
+
+export interface IManagedCodexContractOptions {
+  executable: string;
+  env: NodeJS.ProcessEnv;
+  /** A private, existing directory; the schema is written below it and removed before this returns. */
+  scratchDirectory: string;
+}
+
+type TSchema = Record<string, unknown>;
+
+const supportInstruction = 'Managed Codex needs an authswitch release that supports this Codex, or a Codex '
+  + 'release that still offers it.';
+const maximumSchemaFileBytes = 16 * 1024 * 1024;
+
+const isRecord = (value: unknown): value is TSchema =>
+  value !== null && typeof value === 'object' && !Array.isArray(value);
+const strings = (value: unknown): string[] =>
+  Array.isArray(value) ? value.filter((item): item is string => typeof item === 'string') : [];
+
+const run = (executable: string, args: string[], env: NodeJS.ProcessEnv, timeoutMs: number): Promise<string | null> =>
+  new Promise(resolve => {
+    plugins.childProcess.execFile(executable, args, { timeout: timeoutMs, maxBuffer: 64 * 1024,
+      windowsHide: true, env }, (error, stdout) => resolve(error ? null : stdout));
+  });
+
+/** Follows local `#/definitions/<name>` references; any other reference resolves to nothing. */
+const resolve = (root: TSchema, node: unknown): TSchema | null => {
+  let current = node;
+  for (let depth = 0; depth < 8 && isRecord(current); depth++) {
+    const ref = current.$ref;
+    if (typeof ref !== 'string') return current;
+    const match = /^#\/definitions\/([^/]+)$/.exec(ref);
+    const definitions = root.definitions;
+    current = match && isRecord(definitions) ? definitions[match[1]] : undefined;
+  }
+  return null;
+};
+
+/** The schema alternatives a node offers: itself, or each member of its `oneOf`/`anyOf`. */
+const alternatives = (root: TSchema, node: unknown): TSchema[] => {
+  const resolved = resolve(root, node);
+  if (!resolved) return [];
+  const members = [...(Array.isArray(resolved.oneOf) ? resolved.oneOf : []),
+    ...(Array.isArray(resolved.anyOf) ? resolved.anyOf : [])];
+  return members.length ? members.flatMap(member => alternatives(root, member)) : [resolved];
+};
+
+/** Every string a node accepts as an enum value, through references and alternatives. */
+const enumValues = (root: TSchema, node: unknown): string[] =>
+  alternatives(root, node).flatMap(member => strings(member.enum));
+
+const acceptsNull = (root: TSchema, node: unknown): boolean => alternatives(root, node)
+  .some(member => member.type === 'null' || strings(member.type).includes('null'));
+
+/** The object alternative whose `discriminator` property is exactly `value`, or the node itself. */
+const variant = (root: TSchema, node: unknown, discriminator: string, value: string): TSchema | null =>
+  alternatives(root, node).find(member => {
+    const properties = member.properties;
+    const tag = isRecord(properties) ? resolve(root, properties[discriminator]) : null;
+    return tag !== null && strings(tag.enum).length === 1 && strings(tag.enum)[0] === value;
+  }) ?? null;
+
+/** Declares every field managed Codex sends, and requires none it does not send. */
+const acceptsFields = (object: TSchema | null, sent: readonly string[]): object is TSchema => {
+  if (!object || !isRecord(object.properties)) return false;
+  const properties = object.properties;
+  return sent.every(field => Object.hasOwn(properties, field))
+    && strings(object.required).every(field => sent.includes(field));
+};
+
+const property = (object: TSchema | null, name: string): unknown =>
+  object && isRecord(object.properties) ? object.properties[name] : undefined;
+
+const requestMethods = (root: TSchema): string[] => alternatives(root, root)
+  .flatMap(member => isRecord(member.properties) ? strings(resolve(root, member.properties.method)?.enum) : []);
+
+/**
+ * Each surface managed Codex uses, and whether a protocol description still offers it. Reads nothing but
+ * the schema files named here, so a release that moves a file fails the element that needs it.
+ */
+const elements: ReadonlyArray<{ name: string; files: string[]; offered: (schemas: TSchema[]) => boolean }> = [
+  {
+    name: 'the requests account/login/start, thread/start, thread/resume and turn/start',
+    files: ['ClientRequest.json'],
+    offered: ([client]) => ['account/login/start', 'thread/start', 'thread/resume', 'turn/start']
+      .every(method => requestMethods(client).includes(method)),
+  },
+  {
+    name: 'the external ChatGPT token login (account/login/start chatgptAuthTokens)',
+    files: ['v2/LoginAccountParams.json', 'v2/LoginAccountResponse.json'],
+    offered: ([params, response]) =>
+      acceptsFields(variant(params, params, 'type', 'chatgptAuthTokens'), ['type', 'accessToken', 'chatgptAccountId'])
+      && variant(response, response, 'type', 'chatgptAuthTokens') !== null,
+  },
+  {
+    name: 'the token refresh callback (account/chatgptAuthTokens/refresh)',
+    files: ['ServerRequest.json', 'ChatgptAuthTokensRefreshParams.json', 'ChatgptAuthTokensRefreshResponse.json'],
+    offered: ([server, params, response]) => requestMethods(server).includes('account/chatgptAuthTokens/refresh')
+      && enumValues(params, property(params, 'reason')).includes('unauthorized')
+      && acceptsFields(response, ['accessToken', 'chatgptAccountId', 'chatgptPlanType'])
+      && acceptsNull(response, property(response, 'chatgptPlanType')),
+  },
+  {
+    name: 'thread/start and thread/resume with a working directory, approval policy and model',
+    files: ['v2/ThreadStartParams.json', 'v2/ThreadResumeParams.json'],
+    offered: ([start, resume]) => acceptsFields(start, ['cwd', 'approvalPolicy', 'model'])
+      && acceptsFields(resume, ['threadId', 'cwd', 'approvalPolicy', 'model'])
+      && [start, resume].every(schema => ['never', 'on-request']
+        .every(policy => enumValues(schema, property(schema, 'approvalPolicy')).includes(policy))),
+  },
+  {
+    name: 'turn/start with text input, approval policy and model',
+    files: ['v2/TurnStartParams.json'],
+    offered: ([turn]) => {
+      if (!acceptsFields(turn, ['threadId', 'input', 'approvalPolicy', 'model'])) return false;
+      const input = resolve(turn, property(turn, 'input'));
+      return acceptsFields(variant(turn, input?.items, 'type', 'text'), ['type', 'text', 'text_elements'])
+        && ['never', 'on-request']
+          .every(policy => enumValues(turn, property(turn, 'approvalPolicy')).includes(policy));
+    },
+  },
+];
+
+const readSchema = async (directory: string, relative: string): Promise<TSchema | null> => {
+  try {
+    const file = plugins.path.join(directory, ...relative.split('/'));
+    const stat = await plugins.fs.promises.lstat(file);
+    if (!stat.isFile() || stat.size > maximumSchemaFileBytes) return null;
+    const value: unknown = JSON.parse(await plugins.fs.promises.readFile(file, 'utf8'));
+    return isRecord(value) ? value : null;
+  } catch { return null; }
+};
+
+const refuse = (instruction: string): never => { throw new AuthSwitchRefusal('codex_unsupported', instruction); };
+
+/**
+ * Proves, before anything is recorded or started, that `executable` is a Codex managed Codex can run: its
+ * version is the floor or newer, and its own protocol description offers every surface managed Codex uses.
+ * Every refusal is `codex_unsupported` and names the version or the missing surface.
+ */
+export const verifyManagedCodexContract = async (options: IManagedCodexContractOptions): Promise<IManagedCodexContract> => {
+  const printed = await run(options.executable, ['--version'], options.env, 5_000);
+  const version = /^codex-cli (\S+)$/.exec(printed?.trim() ?? '')?.[1] ?? null;
+  try {
+    plugins.crossharness.requireCodexVersion(version, MANAGED_CODEX_MINIMUM_VERSION);
+  } catch (error) {
+    if (!(error instanceof plugins.crossharness.CodexVersionUnsupportedError)) throw error;
+    refuse(error.reason === 'unreadable'
+      ? `This Codex did not report a readable version. Install Codex ${MANAGED_CODEX_MINIMUM_VERSION} or newer.`
+      : `Codex ${version} is older than ${MANAGED_CODEX_MINIMUM_VERSION}, the first release managed Codex runs. `
+        + 'Update Codex, then start managed Codex again.');
+  }
+  const verified = version!;
+  const directory = await plugins.fs.promises.mkdtemp(plugins.path.join(options.scratchDirectory, 'schema-'));
+  try {
+    if (await run(options.executable, ['app-server', 'generate-json-schema', '--out', directory],
+      options.env, 30_000) === null) {
+      refuse(`Codex ${verified} did not describe its app-server protocol, so managed Codex cannot check it. `
+        + supportInstruction);
+    }
+    for (const element of elements) {
+      const schemas = await Promise.all(element.files.map(file => readSchema(directory, file)));
+      if (schemas.some(schema => schema === null) || !element.offered(schemas as TSchema[])) {
+        refuse(`Codex ${verified} does not offer ${element.name}. ${supportInstruction}`);
+      }
+    }
+  } finally {
+    await plugins.fs.promises.rm(directory, { recursive: true, force: true });
+  }
+  return { version: verified };
+};
+
+/** The app-server a start connected to must be the release that was verified; Codex can replace itself. */
+export const requireVerifiedCodexServer = (contract: IManagedCodexContract, serverVersion: string | undefined): void => {
+  if (serverVersion === contract.version) return;
+  const reported = serverVersion !== undefined && plugins.crossharness.parseCodexVersion(serverVersion)
+    ? `Codex ${serverVersion}` : 'an unreadable version';
+  refuse(`The Codex app-server reports ${reported}, not the checked Codex ${contract.version}; Codex was `
+    + 'replaced while managed Codex started. Start managed Codex again.');
+};

package/ts/ts_migration/0004_container_setup_owner.ts

@@ -0,0 +1,19 @@
+import * as plugins from '../plugins.js';
+
+/**
+ * Refuses a store holding a Claude container setup grant that a native tool would own.
+ *
+ * Until 9.1.0 the grant record allowed a container setup grant to be owned by `legacy_native`. No release
+ * ever wrote one: the importer creates only Claude host, OpenCode and managed OpenAI grants, and no route
+ * creates a container setup grant at all. 9.1.0 narrows the record to what the authority means by it -- the
+ * authority holds that token, or nobody does -- so a row outside that would fail every read of its account.
+ * Such a row was never written by this package, and nothing about it can be repaired by guessing, so the
+ * store is refused before the first write and left exactly as it was.
+ */
+export const refuseNativeContainerSetupOwners = async (db: plugins.nosqldb.SmartdataDb): Promise<void> => {
+  const grants = db.mongoDb.collection('authswitch_authority_grants');
+  if (await grants.findOne({ purpose: 'claude_container_setup', owner: { $nin: ['daemon', 'none'] } })) {
+    throw new Error('Authswitch authority store holds a Claude container setup login owned by a native tool, '
+      + 'which no release could have recorded; set the store aside and sign in to each account again.');
+  }
+};

package/ts/ts_migration/index.ts

@@ -2,6 +2,7 @@ import * as plugins from '../plugins.js';
 import { migrateAuthorityMeta } from './0001_authority_meta.js';
 import { removeAuthorityBackupRecords } from './0002_remove_backup_records.js';
 import { addClaudeHandoffProofFailure } from './0003_claude_handoff_proof.js';
+import { refuseNativeContainerSetupOwners } from './0004_container_setup_owner.js';
 
 /**
  * Runs on every start of an existing store, in this fixed order. Each module recognises the published shapes it
@@ -11,4 +12,5 @@ export const runAuthorityMigrations = async (db: plugins.nosqldb.SmartdataDb): P
   await migrateAuthorityMeta(db);
   await removeAuthorityBackupRecords(db);
   await addClaudeHandoffProofFailure(db);
+  await refuseNativeContainerSetupOwners(db);
 };

package/ts/ts_migration/legacysources/authswitchstores.ts

@@ -175,7 +175,10 @@ export const readAuthSwitchStores = (locations: ILegacySourceLocations): ILegacy
   try { entries = plugins.fs.readdirSync(locations.authSwitchHome, { withFileTypes: true }); }
   catch (error) {
     if ((error as NodeJS.ErrnoException).code === 'ENOENT') return { sources, problems };
-    return { sources, problems: [`${locations.authSwitchHome} could not be listed`] };
+    // The store is named by what it is, never by where it is: this report goes to a CLI and to a backend,
+    // and the location of a credential store is not something either of them may be told. Everything
+    // below names an entry inside the store instead, which is what the owner needs to find it.
+    return { sources, problems: ['the authswitch store could not be listed'] };
   }
   for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
     const path = plugins.path.join(locations.authSwitchHome, entry.name);