@modelprofile.com/authswitch 9.0.0 → 9.1.0

package/ts/classes.authoritymodels.ts

@@ -444,7 +444,10 @@ export const assertStoredAuthorityGrant: (value: unknown) => asserts value is IS
     throw new Error('Claude handoff grant has incompatible custody.');
   }
   if (value.purpose === 'openai_managed' && value.providerId !== 'openai') throw new Error('OpenAI grant provider mismatch.');
-  if (value.purpose === 'claude_container_setup' && value.owner === 'claude_native') throw new Error('Container setup grant has a native host owner.');
+  // No native tool refreshes a container setup token: the authority holds it, or nobody does.
+  if (value.purpose === 'claude_container_setup' && value.owner !== 'daemon' && value.owner !== 'none') {
+    throw new Error('Container setup grant has a native owner.');
+  }
 };
 
 export const assertStoredAuthorityBinding: (value: unknown) => asserts value is IStoredAuthorityBinding = value => {

package/ts/classes.codexmanaged.ts

@@ -1,6 +1,7 @@
 import * as plugins from './plugins.js';
 import { commitinfo } from './00_commitinfo_data.js';
 import type { AuthSwitchAuthorityBroker } from './classes.authoritybroker.js';
+import { requireVerifiedCodexServer, verifyManagedCodexContract, type IManagedCodexContract } from './codexcontract.js';
 
 export interface IAuthSwitchManagedCodexOptions {
   /** Private runtime root; only the disposable control socket lives here. */
@@ -28,15 +29,6 @@ export interface IAuthSwitchCodexInteractiveCommand {
   env: NodeJS.ProcessEnv;
 }
 
-/**
- * The one Codex release whose app-server contract managed Codex was verified against: the
- * external-token login and its refresh callback, thread/turn start and resume, `--listen` and
- * how it publishes that socket, `--strict-config`, the ephemeral credential store and
- * `--remote`. Both the CLI and the app-server it serves must report exactly this release;
- * any other is refused unverified.
- */
-export const MANAGED_CODEX_VERSION = '0.157.0';
-
 const isRecord = (value: unknown): value is Record<string, unknown> =>
   value !== null && typeof value === 'object' && !Array.isArray(value);
 const isAlive = (child: plugins.childProcess.ChildProcess): boolean => child.exitCode === null && child.signalCode === null;
@@ -162,20 +154,6 @@ export class AuthSwitchManagedCodex {
     return picked;
   }
 
-  private async requireVersion(): Promise<void> {
-    const executable = this.options.executable ?? 'codex';
-    const output = await new Promise<string>((resolve, reject) => {
-      plugins.childProcess.execFile(executable, ['--version'], { timeout: 5_000, maxBuffer: 4096,
-        windowsHide: true, env: this.environment() }, (error, stdout) => {
-        if (error) reject(new Error('Managed Codex version probe failed.'));
-        else resolve(stdout.trim());
-      });
-    });
-    if (output !== `codex-cli ${MANAGED_CODEX_VERSION}`) {
-      throw new Error(`Managed Codex requires verified codex-cli ${MANAGED_CODEX_VERSION}.`);
-    }
-  }
-
   public start(): Promise<void> {
     if (this.closed || this.startPromise) throw new Error('Managed Codex can start only once.');
     this.startPromise = this.performStart();
@@ -206,7 +184,9 @@ export class AuthSwitchManagedCodex {
       } catch (error) {
         if (!isRecord(error) || error.code !== 'ENOENT') throw error;
       }
-      await this.requireVersion();
+      // Nothing is recorded or started for a Codex that is too old or no longer offers what this uses.
+      const contract: IManagedCodexContract = await verifyManagedCodexContract({
+        executable: this.options.executable ?? 'codex', env: this.environment(), scratchDirectory: this.runDirectory });
       if (this.closed) throw new Error('Managed Codex startup was cancelled.');
       const initial = await this.options.broker.resolveAccess(this.options.bindingId,
         this.options.capability, 60_000);
@@ -258,8 +238,8 @@ export class AuthSwitchManagedCodex {
       });
       this.client = client;
       await client.connect();
-      // The executable can be replaced between the version probe and the spawn (Codex updates itself).
-      if (client.serverVersion !== MANAGED_CODEX_VERSION) throw new Error('Managed Codex app-server version changed.');
+      // The executable can be replaced between the check and the spawn (Codex updates itself).
+      requireVerifiedCodexServer(contract, client.serverVersion);
       const login: unknown = await client.request('account/login/start', {
         type: 'chatgptAuthTokens', accessToken: initial.accessToken, chatgptAccountId: initial.accountId,
       }, 5_000);

package/ts/codexcontract.ts

@@ -0,0 +1,200 @@
+import * as plugins from './plugins.js';
+import { AuthSwitchRefusal } from './authority-contract.js';
+
+/**
+ * What managed Codex needs from the Codex it starts, checked at every start instead of pinning one release.
+ *
+ * The floor is `@modelprofile.com/mcp-crossharness`'s: 0.156.0 is the first release that publishes the
+ * `--listen unix://` alias managed Codex connects through, and every other surface it uses is older. Above
+ * the floor nothing is assumed. Codex describes its own app-server protocol (`app-server
+ * generate-json-schema`), and that description must still offer every request managed Codex sends and the one
+ * it answers, with the fields it sends. The external-token login in particular is marked unstable upstream,
+ * so a release that drops or reshapes it is refused at start, by name, rather than failing a session later
+ * -- the refresh callback, for one, would otherwise only be missed at the first expired token.
+ */
+export const MANAGED_CODEX_MINIMUM_VERSION = plugins.crossharness.CODEX_UNIX_SOCKET_MINIMUM_VERSION;
+
+/** The verified release, exactly as `codex --version` printed it; the app-server must report the same. */
+export interface IManagedCodexContract {
+  version: string;
+}
+
+export interface IManagedCodexContractOptions {
+  executable: string;
+  env: NodeJS.ProcessEnv;
+  /** A private, existing directory; the schema is written below it and removed before this returns. */
+  scratchDirectory: string;
+}
+
+type TSchema = Record<string, unknown>;
+
+const supportInstruction = 'Managed Codex needs an authswitch release that supports this Codex, or a Codex '
+  + 'release that still offers it.';
+const maximumSchemaFileBytes = 16 * 1024 * 1024;
+
+const isRecord = (value: unknown): value is TSchema =>
+  value !== null && typeof value === 'object' && !Array.isArray(value);
+const strings = (value: unknown): string[] =>
+  Array.isArray(value) ? value.filter((item): item is string => typeof item === 'string') : [];
+
+const run = (executable: string, args: string[], env: NodeJS.ProcessEnv, timeoutMs: number): Promise<string | null> =>
+  new Promise(resolve => {
+    plugins.childProcess.execFile(executable, args, { timeout: timeoutMs, maxBuffer: 64 * 1024,
+      windowsHide: true, env }, (error, stdout) => resolve(error ? null : stdout));
+  });
+
+/** Follows local `#/definitions/<name>` references; any other reference resolves to nothing. */
+const resolve = (root: TSchema, node: unknown): TSchema | null => {
+  let current = node;
+  for (let depth = 0; depth < 8 && isRecord(current); depth++) {
+    const ref = current.$ref;
+    if (typeof ref !== 'string') return current;
+    const match = /^#\/definitions\/([^/]+)$/.exec(ref);
+    const definitions = root.definitions;
+    current = match && isRecord(definitions) ? definitions[match[1]] : undefined;
+  }
+  return null;
+};
+
+/** The schema alternatives a node offers: itself, or each member of its `oneOf`/`anyOf`. */
+const alternatives = (root: TSchema, node: unknown): TSchema[] => {
+  const resolved = resolve(root, node);
+  if (!resolved) return [];
+  const members = [...(Array.isArray(resolved.oneOf) ? resolved.oneOf : []),
+    ...(Array.isArray(resolved.anyOf) ? resolved.anyOf : [])];
+  return members.length ? members.flatMap(member => alternatives(root, member)) : [resolved];
+};
+
+/** Every string a node accepts as an enum value, through references and alternatives. */
+const enumValues = (root: TSchema, node: unknown): string[] =>
+  alternatives(root, node).flatMap(member => strings(member.enum));
+
+const acceptsNull = (root: TSchema, node: unknown): boolean => alternatives(root, node)
+  .some(member => member.type === 'null' || strings(member.type).includes('null'));
+
+/** The object alternative whose `discriminator` property is exactly `value`, or the node itself. */
+const variant = (root: TSchema, node: unknown, discriminator: string, value: string): TSchema | null =>
+  alternatives(root, node).find(member => {
+    const properties = member.properties;
+    const tag = isRecord(properties) ? resolve(root, properties[discriminator]) : null;
+    return tag !== null && strings(tag.enum).length === 1 && strings(tag.enum)[0] === value;
+  }) ?? null;
+
+/** Declares every field managed Codex sends, and requires none it does not send. */
+const acceptsFields = (object: TSchema | null, sent: readonly string[]): object is TSchema => {
+  if (!object || !isRecord(object.properties)) return false;
+  const properties = object.properties;
+  return sent.every(field => Object.hasOwn(properties, field))
+    && strings(object.required).every(field => sent.includes(field));
+};
+
+const property = (object: TSchema | null, name: string): unknown =>
+  object && isRecord(object.properties) ? object.properties[name] : undefined;
+
+const requestMethods = (root: TSchema): string[] => alternatives(root, root)
+  .flatMap(member => isRecord(member.properties) ? strings(resolve(root, member.properties.method)?.enum) : []);
+
+/**
+ * Each surface managed Codex uses, and whether a protocol description still offers it. Reads nothing but
+ * the schema files named here, so a release that moves a file fails the element that needs it.
+ */
+const elements: ReadonlyArray<{ name: string; files: string[]; offered: (schemas: TSchema[]) => boolean }> = [
+  {
+    name: 'the requests account/login/start, thread/start, thread/resume and turn/start',
+    files: ['ClientRequest.json'],
+    offered: ([client]) => ['account/login/start', 'thread/start', 'thread/resume', 'turn/start']
+      .every(method => requestMethods(client).includes(method)),
+  },
+  {
+    name: 'the external ChatGPT token login (account/login/start chatgptAuthTokens)',
+    files: ['v2/LoginAccountParams.json', 'v2/LoginAccountResponse.json'],
+    offered: ([params, response]) =>
+      acceptsFields(variant(params, params, 'type', 'chatgptAuthTokens'), ['type', 'accessToken', 'chatgptAccountId'])
+      && variant(response, response, 'type', 'chatgptAuthTokens') !== null,
+  },
+  {
+    name: 'the token refresh callback (account/chatgptAuthTokens/refresh)',
+    files: ['ServerRequest.json', 'ChatgptAuthTokensRefreshParams.json', 'ChatgptAuthTokensRefreshResponse.json'],
+    offered: ([server, params, response]) => requestMethods(server).includes('account/chatgptAuthTokens/refresh')
+      && enumValues(params, property(params, 'reason')).includes('unauthorized')
+      && acceptsFields(response, ['accessToken', 'chatgptAccountId', 'chatgptPlanType'])
+      && acceptsNull(response, property(response, 'chatgptPlanType')),
+  },
+  {
+    name: 'thread/start and thread/resume with a working directory, approval policy and model',
+    files: ['v2/ThreadStartParams.json', 'v2/ThreadResumeParams.json'],
+    offered: ([start, resume]) => acceptsFields(start, ['cwd', 'approvalPolicy', 'model'])
+      && acceptsFields(resume, ['threadId', 'cwd', 'approvalPolicy', 'model'])
+      && [start, resume].every(schema => ['never', 'on-request']
+        .every(policy => enumValues(schema, property(schema, 'approvalPolicy')).includes(policy))),
+  },
+  {
+    name: 'turn/start with text input, approval policy and model',
+    files: ['v2/TurnStartParams.json'],
+    offered: ([turn]) => {
+      if (!acceptsFields(turn, ['threadId', 'input', 'approvalPolicy', 'model'])) return false;
+      const input = resolve(turn, property(turn, 'input'));
+      return acceptsFields(variant(turn, input?.items, 'type', 'text'), ['type', 'text', 'text_elements'])
+        && ['never', 'on-request']
+          .every(policy => enumValues(turn, property(turn, 'approvalPolicy')).includes(policy));
+    },
+  },
+];
+
+const readSchema = async (directory: string, relative: string): Promise<TSchema | null> => {
+  try {
+    const file = plugins.path.join(directory, ...relative.split('/'));
+    const stat = await plugins.fs.promises.lstat(file);
+    if (!stat.isFile() || stat.size > maximumSchemaFileBytes) return null;
+    const value: unknown = JSON.parse(await plugins.fs.promises.readFile(file, 'utf8'));
+    return isRecord(value) ? value : null;
+  } catch { return null; }
+};
+
+const refuse = (instruction: string): never => { throw new AuthSwitchRefusal('codex_unsupported', instruction); };
+
+/**
+ * Proves, before anything is recorded or started, that `executable` is a Codex managed Codex can run: its
+ * version is the floor or newer, and its own protocol description offers every surface managed Codex uses.
+ * Every refusal is `codex_unsupported` and names the version or the missing surface.
+ */
+export const verifyManagedCodexContract = async (options: IManagedCodexContractOptions): Promise<IManagedCodexContract> => {
+  const printed = await run(options.executable, ['--version'], options.env, 5_000);
+  const version = /^codex-cli (\S+)$/.exec(printed?.trim() ?? '')?.[1] ?? null;
+  try {
+    plugins.crossharness.requireCodexVersion(version, MANAGED_CODEX_MINIMUM_VERSION);
+  } catch (error) {
+    if (!(error instanceof plugins.crossharness.CodexVersionUnsupportedError)) throw error;
+    refuse(error.reason === 'unreadable'
+      ? `This Codex did not report a readable version. Install Codex ${MANAGED_CODEX_MINIMUM_VERSION} or newer.`
+      : `Codex ${version} is older than ${MANAGED_CODEX_MINIMUM_VERSION}, the first release managed Codex runs. `
+        + 'Update Codex, then start managed Codex again.');
+  }
+  const verified = version!;
+  const directory = await plugins.fs.promises.mkdtemp(plugins.path.join(options.scratchDirectory, 'schema-'));
+  try {
+    if (await run(options.executable, ['app-server', 'generate-json-schema', '--out', directory],
+      options.env, 30_000) === null) {
+      refuse(`Codex ${verified} did not describe its app-server protocol, so managed Codex cannot check it. `
+        + supportInstruction);
+    }
+    for (const element of elements) {
+      const schemas = await Promise.all(element.files.map(file => readSchema(directory, file)));
+      if (schemas.some(schema => schema === null) || !element.offered(schemas as TSchema[])) {
+        refuse(`Codex ${verified} does not offer ${element.name}. ${supportInstruction}`);
+      }
+    }
+  } finally {
+    await plugins.fs.promises.rm(directory, { recursive: true, force: true });
+  }
+  return { version: verified };
+};
+
+/** The app-server a start connected to must be the release that was verified; Codex can replace itself. */
+export const requireVerifiedCodexServer = (contract: IManagedCodexContract, serverVersion: string | undefined): void => {
+  if (serverVersion === contract.version) return;
+  const reported = serverVersion !== undefined && plugins.crossharness.parseCodexVersion(serverVersion)
+    ? `Codex ${serverVersion}` : 'an unreadable version';
+  refuse(`The Codex app-server reports ${reported}, not the checked Codex ${contract.version}; Codex was `
+    + 'replaced while managed Codex started. Start managed Codex again.');
+};

package/ts/ts_migration/0004_container_setup_owner.ts

@@ -0,0 +1,19 @@
+import * as plugins from '../plugins.js';
+
+/**
+ * Refuses a store holding a Claude container setup grant that a native tool would own.
+ *
+ * Until 9.1.0 the grant record allowed a container setup grant to be owned by `legacy_native`. No release
+ * ever wrote one: the importer creates only Claude host, OpenCode and managed OpenAI grants, and no route
+ * creates a container setup grant at all. 9.1.0 narrows the record to what the authority means by it -- the
+ * authority holds that token, or nobody does -- so a row outside that would fail every read of its account.
+ * Such a row was never written by this package, and nothing about it can be repaired by guessing, so the
+ * store is refused before the first write and left exactly as it was.
+ */
+export const refuseNativeContainerSetupOwners = async (db: plugins.nosqldb.SmartdataDb): Promise<void> => {
+  const grants = db.mongoDb.collection('authswitch_authority_grants');
+  if (await grants.findOne({ purpose: 'claude_container_setup', owner: { $nin: ['daemon', 'none'] } })) {
+    throw new Error('Authswitch authority store holds a Claude container setup login owned by a native tool, '
+      + 'which no release could have recorded; set the store aside and sign in to each account again.');
+  }
+};

package/ts/ts_migration/index.ts

@@ -2,6 +2,7 @@ import * as plugins from '../plugins.js';
 import { migrateAuthorityMeta } from './0001_authority_meta.js';
 import { removeAuthorityBackupRecords } from './0002_remove_backup_records.js';
 import { addClaudeHandoffProofFailure } from './0003_claude_handoff_proof.js';
+import { refuseNativeContainerSetupOwners } from './0004_container_setup_owner.js';
 
 /**
  * Runs on every start of an existing store, in this fixed order. Each module recognises the published shapes it
@@ -11,4 +12,5 @@ export const runAuthorityMigrations = async (db: plugins.nosqldb.SmartdataDb): P
   await migrateAuthorityMeta(db);
   await removeAuthorityBackupRecords(db);
   await addClaudeHandoffProofFailure(db);
+  await refuseNativeContainerSetupOwners(db);
 };