@myagentroam/node 0.9.133 → 0.9.134

package/dist/capabilities.js

@@ -9,6 +9,7 @@ const runtimeCredentialCapability = () => ({
     apiVersion: 1,
     websocket: true,
     fastMode: true,
+    namespacedTools: true,
     httpVersions: ['1.1', '2']
 });
 const workspaceDirectTransferCapability = () => ({
@@ -52,6 +53,7 @@ export function unavailableCapabilities() {
         openCode: { available: false },
         marAgent: { available: true, version: nodeAppVersion },
         marAgentRuntimeCredentials: runtimeCredentialCapability(),
+        chatgptLogin: { apiVersion: 1, loopback: true },
         workspaceDirectTransfer: workspaceDirectTransferCapability(),
         terminalDirect: terminalDirectCapability()
     };
@@ -86,6 +88,7 @@ export function detectCapabilities(commands = {}) {
         },
         marAgent: { available: true, version: nodeAppVersion },
         marAgentRuntimeCredentials: runtimeCredentialCapability(),
+        chatgptLogin: { apiVersion: 1, loopback: true },
         workspaceDirectTransfer: workspaceDirectTransferCapability(),
         terminalDirect: terminalDirectCapability()
     };
@@ -124,6 +127,7 @@ export async function detectCapabilitiesAsync(commands = {}) {
         },
         marAgent: { available: true, version: nodeAppVersion },
         marAgentRuntimeCredentials: runtimeCredentialCapability(),
+        chatgptLogin: { apiVersion: 1, loopback: true },
         workspaceDirectTransfer: workspaceDirectTransferCapability(),
         terminalDirect: terminalDirectCapability()
     };

package/dist/connector.js

@@ -99,6 +99,7 @@ import { safeErrorCode } from './util/safe-error.js';
 import { RuntimeCredentialControlService } from './service/runtime-credential-control-service.js';
 import { MarAgentRuntimeModelFactory } from './runner/mar-agent/runtime-model-factory.js';
 import { MarAgentModelTransportTestService } from './service/mar-agent-model-transport-test-service.js';
+import { ChatgptLoginService } from './service/chatgpt-login-service.js';
 const HEARTBEAT_MS = 15_000;
 const CAPABILITY_REFRESH_MS = 60_000;
 const RETRY_MIN_MS = 500;
@@ -170,6 +171,11 @@ export class NodeConnector {
     marAgentModelTransportTests = new MarAgentModelTransportTestService({
         modelFactory: this.marAgentRuntimeModels
     });
+    chatgptLogins = new ChatgptLoginService(() => {
+        if (!this.config)
+            throw new Error('NODE_CONFIG_UNAVAILABLE');
+        return nodeDataDirectory(this.config, this.configPath);
+    });
     /** @internal Existing contract tests inject their socket through this boundary. */
     set socket(value) {
         this.controlChannel.replaceSocketForTesting(value);
@@ -1233,6 +1239,7 @@ export class NodeConnector {
             onClose: (code, reason) => {
                 this.directTransferService?.close();
                 this.runtimeCredentials.disconnected();
+                this.chatgptLogins.close();
                 this.scheduledRunAuthorization.disconnected();
                 this.mailNotificationControl.disconnected();
                 this.mailNotificationMcpServer.revokeAll();
@@ -1453,6 +1460,7 @@ export class NodeConnector {
         this.operationRouter.registerAll(this.sessionCommandService.operations());
         this.operationRouter.registerAll(this.workspaceQueueWorkbenchService.operations());
         this.operationRouter.registerAll(this.marAgentModelTransportTests.operations());
+        this.operationRouter.registerAll(this.chatgptLogins.operations());
         this.operationRouter.registerAll(new ConversationHostingEnablementService({
             config: () => this.config,
             setConfig: (config) => (this.config = config),
@@ -2009,6 +2017,7 @@ export class NodeConnector {
         const terminalDrain = this.terminalManager.shutdown();
         this.terminalChannel.stop();
         this.runtimeCredentials.close();
+        this.chatgptLogins.close();
         this.scheduledSessions.stop();
         this.scheduledRunAuthorization.close();
         this.mailNotificationControl.close();

package/dist/node-execution-environment.js

@@ -1,5 +1,5 @@
 import { existsSync } from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
+import { basename, dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 /** Environment for processes started by this Node, not for the Node service itself. */
 export function nodeExecutionEnvironment(provided = {}, inherited = process.env, options = {}) {
@@ -8,8 +8,21 @@ export function nodeExecutionEnvironment(provided = {}, inherited = process.env,
     environment['MAR_NODE_CONTEXT'] = '1';
     const platform = options.platform ?? process.platform;
     const packageRoot = options.packageRoot ?? resolve(dirname(fileURLToPath(import.meta.url)), '..');
-    const cliBin = join(packageRoot, 'node_modules', '.bin');
-    if (!existsSync(join(cliBin, platform === 'win32' ? 'marnodes.cmd' : 'marnodes')))
+    const cliBins = [join(packageRoot, 'node_modules', '.bin')];
+    const nodeModules = resolve(packageRoot, '..', '..');
+    if (basename(packageRoot) === 'node' &&
+        basename(dirname(packageRoot)) === '@myagentroam' &&
+        basename(nodeModules) === 'node_modules') {
+        // npm prefix installs and pnpm's virtual store place shims beside scoped packages.
+        cliBins.push(join(nodeModules, '.bin'));
+        const prefix = dirname(nodeModules);
+        if (platform === 'win32')
+            cliBins.push(prefix);
+        else if (basename(prefix) === 'lib')
+            cliBins.push(resolve(prefix, '..', 'bin'));
+    }
+    const cliBin = cliBins.find((bin) => existsSync(join(bin, platform === 'win32' ? 'marnodes.cmd' : 'marnodes')));
+    if (cliBin === undefined)
         return environment;
     const separator = platform === 'win32' ? ';' : ':';
     const existingKeys = Object.keys(environment).filter((key) => key.toLowerCase() === 'path');

package/dist/runner/mar-agent/runtime-model-factory.js

@@ -22,6 +22,7 @@ class PendingCredentialResolution {
     }
 }
 const CREDENTIAL_REFRESH_WINDOW_MS = 60_000;
+const CREDENTIAL_REFRESH_RETRY_MS = 30_000;
 export class MarAgentRuntimeModelFactory {
     control;
     now;
@@ -73,6 +74,7 @@ export class MarAgentRuntimeModelFactory {
                     ...(configuration.responsesEncoding === undefined
                         ? {}
                         : { responsesEncoding: configuration.responsesEncoding }),
+                    responsesToolNamespace: configuration.responsesToolNamespace,
                     responsesPreviousResponseId: configuration.responsesPreviousResponseId,
                     enabled: configuration.enabled
                 };
@@ -229,12 +231,12 @@ class ServerRuntimeCredentialProvider {
             if (this.state.pending !== pending)
                 return;
             delete this.state.pending;
-            scheduleRefresh(this.state, this.now);
+            scheduleRefresh(this.state, this.now, CREDENTIAL_REFRESH_RETRY_MS);
         }, () => {
             if (this.state.pending !== pending)
                 return;
             delete this.state.pending;
-            scheduleRefresh(this.state, this.now, false);
+            scheduleRefresh(this.state, this.now, CREDENTIAL_REFRESH_RETRY_MS);
         });
         return pending;
     }
@@ -296,20 +298,23 @@ function sameRuntimeCredentialTicket(first, second) {
         first.allowedModelIds.length === second.allowedModelIds.length &&
         first.allowedModelIds.every((modelId, index) => modelId === second.allowedModelIds[index]));
 }
-function scheduleRefresh(state, now, includeDue = true) {
+function scheduleRefresh(state, now, minimumDelayMs = 0) {
     clearRefreshTimer(state);
     if (state.released || state.pending !== undefined || state.providers.size === 0)
         return;
+    const timestamp = now();
+    if (state.ticket.expiresAt <= timestamp)
+        return;
     const expiresAt = Math.min(state.ticket.expiresAt, state.credential?.expiresAt ?? Number.POSITIVE_INFINITY);
-    const delay = expiresAt - now() - CREDENTIAL_REFRESH_WINDOW_MS;
-    if (!includeDue && delay <= 0)
+    const delay = Math.max(minimumDelayMs, expiresAt - timestamp - CREDENTIAL_REFRESH_WINDOW_MS, 0);
+    if (timestamp + delay > state.ticket.expiresAt)
         return;
     const timer = setTimeout(() => {
         if (state.refreshTimer === timer)
             delete state.refreshTimer;
         const provider = state.providers.values().next().value;
         provider?.refreshAutomatically();
-    }, Math.max(0, delay));
+    }, delay);
     timer.unref();
     state.refreshTimer = timer;
 }

package/dist/service/chatgpt-login-service.js

@@ -0,0 +1,345 @@
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
+import { createServer } from 'node:http';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { requestHttp } from '@myagentroam/agent/host/network';
+import { CHATGPT_ISSUER, CHATGPT_RESOURCE, CHATGPT_TOKEN_ENDPOINT, CHATGPT_JWKS_ENDPOINT, CHATGPT_REQUESTED_SCOPE, chatgptLoginStartSchema, chatgptTokenResponseSchema, verifyChatgptIdentity } from '@myagentroam/protocol';
+const TTL_MS = 10 * 60_000;
+/** Temporary, loopback-only OAuth provider. Only the Server may consume token results. */
+export class ChatgptLoginService {
+    dataDirectory;
+    request;
+    attempts = new Map();
+    starting = new Map();
+    hostIdFlight;
+    constructor(dataDirectory, request = (url, init, proxy, signal) => requestHttp(url, { request: init, httpVersion: '1.1', ...(proxy ? { socks5Url: proxy } : {}) }, signal ?? AbortSignal.timeout(30_000), 30_000)) {
+        this.dataDirectory = dataDirectory;
+        this.request = request;
+    }
+    operations() {
+        return {
+            'chatgpt.login.start': (raw) => this.start(raw),
+            'chatgpt.login.status': (raw) => this.status(raw),
+            'chatgpt.login.ack': (raw) => this.remove(raw),
+            'chatgpt.login.cancel': (raw) => this.remove(raw)
+        };
+    }
+    async start(raw) {
+        const { data, userId, session } = this.context(raw);
+        const parsed = chatgptLoginStartSchema.safeParse(data);
+        if (!parsed.success)
+            throw new Error('CHATGPT_LOGIN_INPUT_INVALID');
+        const input = parsed.data;
+        if (this.attempts.has(input.attemptId))
+            return this.status(raw);
+        const existing = this.starting.get(input.attemptId);
+        if (existing) {
+            if (existing.userId !== userId || existing.session !== session)
+                throw new Error('CHATGPT_LOGIN_FORBIDDEN');
+            await existing.flight;
+            return this.status(raw);
+        }
+        if (this.attempts.size + this.starting.size >= 64)
+            throw new Error('CHATGPT_LOGIN_LIMIT_REACHED');
+        if (input.socks5Url !== undefined && new URL(input.socks5Url).protocol !== 'socks5:')
+            throw new Error('CHATGPT_LOGIN_INPUT_INVALID');
+        const pending = { userId, session, cancelled: false };
+        this.starting.set(input.attemptId, pending);
+        pending.flight = this.openAttempt(input, pending);
+        try {
+            await pending.flight;
+            return this.status(raw);
+        }
+        finally {
+            if (this.starting.get(input.attemptId) === pending)
+                this.starting.delete(input.attemptId);
+        }
+    }
+    async openAttempt(input, pending) {
+        const hostId = await this.hostId();
+        if (pending.cancelled)
+            throw new Error('CHATGPT_LOGIN_CANCELLED');
+        const server = createServer((req, res) => {
+            void this.handle(input.attemptId, req, res).catch(() => {
+                if (!res.headersSent)
+                    res.writeHead(500);
+                res.end('Login failed.');
+            });
+        });
+        server.maxHeadersCount = 32;
+        server.headersTimeout = 10_000;
+        server.requestTimeout = 10_000;
+        await new Promise((resolve, reject) => {
+            server.once('error', reject);
+            server.listen(0, '127.0.0.1', () => {
+                server.removeListener('error', reject);
+                resolve();
+            });
+        });
+        const address = server.address();
+        if (pending.cancelled) {
+            server.close();
+            server.closeAllConnections();
+            throw new Error('CHATGPT_LOGIN_CANCELLED');
+        }
+        if (address === null || typeof address === 'string') {
+            server.close();
+            throw new Error('CHATGPT_LISTENER_FAILED');
+        }
+        const attempt = {
+            id: input.attemptId,
+            userId: pending.userId,
+            session: pending.session,
+            nonce: input.nonce,
+            state: randomBytes(32).toString('base64url'),
+            entry: randomBytes(32).toString('base64url'),
+            verifier: randomBytes(48).toString('base64url'),
+            clientId: input.clientId,
+            subject: input.subject,
+            proxy: input.socks5Url,
+            hostId,
+            server,
+            expiresAt: Date.now() + TTL_MS,
+            redirectUri: `http://127.0.0.1:${address.port}/auth/callback`,
+            abort: new AbortController(),
+            started: false,
+            exchanging: false,
+            timer: setTimeout(() => this.clear(input.attemptId), TTL_MS)
+        };
+        attempt.timer.unref();
+        this.attempts.set(attempt.id, attempt);
+    }
+    status(raw) {
+        const attempt = this.owned(raw);
+        if (attempt.result !== undefined)
+            return { status: 'SUCCEEDED', result: attempt.result };
+        if (attempt.error !== undefined)
+            return { status: 'FAILED', code: attempt.error };
+        return {
+            status: 'PENDING',
+            verificationUri: attempt.redirectUri.replace('/auth/callback', `/auth/start?ticket=${attempt.entry}`),
+            expiresAt: attempt.expiresAt
+        };
+    }
+    async remove(raw) {
+        const { data, userId, session } = this.context(raw);
+        const id = data['attemptId'];
+        const pending = typeof id === 'string' ? this.starting.get(id) : undefined;
+        if (pending) {
+            if (pending.userId !== userId || pending.session !== session)
+                throw new Error('CHATGPT_LOGIN_FORBIDDEN');
+            pending.cancelled = true;
+            await pending.flight?.catch(() => undefined);
+            return { cleared: true };
+        }
+        const attempt = this.owned(raw);
+        this.clear(attempt.id);
+        return { cleared: true };
+    }
+    close() {
+        for (const pending of this.starting.values())
+            pending.cancelled = true;
+        this.starting.clear();
+        for (const id of this.attempts.keys())
+            this.clear(id);
+    }
+    clear(id) {
+        const attempt = this.attempts.get(id);
+        if (!attempt)
+            return;
+        this.attempts.delete(id);
+        clearTimeout(attempt.timer);
+        attempt.abort.abort();
+        attempt.server.close();
+        attempt.server.closeAllConnections();
+        attempt.result = undefined;
+        attempt.verifier = '';
+        attempt.entry = '';
+    }
+    context(raw) {
+        if (raw === null || typeof raw !== 'object' || Array.isArray(raw))
+            throw new Error('CHATGPT_LOGIN_INPUT_INVALID');
+        const data = { ...raw };
+        const userId = data['__requestUserId'], session = data['__workspaceWatchSessionHash'];
+        delete data['__requestUserId'];
+        delete data['__workspaceWatchSessionHash'];
+        if (!Number.isSafeInteger(userId) ||
+            userId < 1 ||
+            typeof session !== 'string' ||
+            session.length < 1)
+            throw new Error('CHATGPT_LOGIN_FORBIDDEN');
+        return { data, userId: userId, session };
+    }
+    owned(raw) {
+        const { data, userId, session } = this.context(raw);
+        const id = data['attemptId'];
+        const attempt = typeof id === 'string' ? this.attempts.get(id) : undefined;
+        if (!attempt ||
+            attempt.userId !== userId ||
+            attempt.session !== session ||
+            Date.now() >= attempt.expiresAt)
+            throw new Error('CHATGPT_LOGIN_NOT_FOUND');
+        return attempt;
+    }
+    hostId() {
+        this.hostIdFlight ??= this.loadHostId().catch((error) => {
+            this.hostIdFlight = undefined;
+            throw error;
+        });
+        return this.hostIdFlight;
+    }
+    async loadHostId() {
+        const directory = this.dataDirectory(), path = join(directory, 'chatgpt-host-id');
+        await mkdir(directory, { recursive: true, mode: 0o700 });
+        try {
+            await writeFile(path, `urn:uuid:${randomUUID()}`, { flag: 'wx', mode: 0o600 });
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw new Error('CHATGPT_HOST_ID_FAILED');
+        }
+        const id = await readFile(path, 'utf8');
+        if (!/^urn:uuid:[0-9a-f-]{36}$/u.test(id))
+            throw new Error('CHATGPT_HOST_ID_INVALID');
+        return id;
+    }
+    async json(url, init, attempt) {
+        const response = await this.request(url, { ...init, redirect: 'error' }, attempt.proxy, AbortSignal.any([attempt.abort.signal, AbortSignal.timeout(30_000)]));
+        if (!response.ok) {
+            await response.body?.cancel();
+            throw new Error('CHATGPT_TOKEN_EXCHANGE_FAILED');
+        }
+        const reader = response.body?.getReader();
+        if (!reader)
+            throw new Error('CHATGPT_TOKEN_RESPONSE_INVALID');
+        let length = 0;
+        const chunks = [];
+        try {
+            for (;;) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                length += value.length;
+                if (length > 524_288)
+                    throw new Error('CHATGPT_TOKEN_RESPONSE_INVALID');
+                chunks.push(value);
+            }
+            const bytes = new Uint8Array(length);
+            let offset = 0;
+            for (const chunk of chunks) {
+                bytes.set(chunk, offset);
+                offset += chunk.length;
+            }
+            return JSON.parse(new TextDecoder().decode(bytes));
+        }
+        finally {
+            await reader.cancel().catch(() => undefined);
+        }
+    }
+    async handle(id, req, res) {
+        res.setHeader('cache-control', 'no-store');
+        res.setHeader('referrer-policy', 'no-referrer');
+        res.setHeader('content-security-policy', "default-src 'none'; frame-ancestors 'none'");
+        const attempt = this.attempts.get(id);
+        if (!attempt ||
+            req.method !== 'GET' ||
+            !req.url ||
+            req.url.length > 16_384 ||
+            req.headers.host !== new URL(attempt.redirectUri).host ||
+            Date.now() >= attempt.expiresAt) {
+            res.writeHead(400);
+            res.end('Invalid login request.');
+            return;
+        }
+        const url = new URL(req.url, attempt.redirectUri);
+        if (url.pathname === '/auth/start' &&
+            !attempt.started &&
+            url.searchParams.getAll('ticket').length === 1 &&
+            url.searchParams.get('ticket') === attempt.entry) {
+            attempt.started = true;
+            attempt.entry = '';
+            const authorize = new URL(`${CHATGPT_ISSUER}/api/accounts/authorize`);
+            authorize.search = new URLSearchParams({
+                response_type: 'code',
+                client_id: attempt.clientId ?? 'dynamic_agent_client',
+                ext_agent_host_id: attempt.hostId,
+                scope: CHATGPT_REQUESTED_SCOPE,
+                resource: CHATGPT_RESOURCE,
+                redirect_uri: attempt.redirectUri,
+                state: attempt.state,
+                nonce: attempt.nonce,
+                code_challenge_method: 'S256',
+                code_challenge: createHash('sha256').update(attempt.verifier).digest('base64url'),
+                ...(attempt.clientId ? {} : { agent_name_hint: 'MyAgentRoam' })
+            }).toString();
+            res.writeHead(302, { location: authorize.href });
+            res.end();
+            return;
+        }
+        if (url.pathname !== '/auth/callback' ||
+            !attempt.started ||
+            attempt.exchanging ||
+            attempt.result ||
+            attempt.error ||
+            url.searchParams.getAll('state').length !== 1 ||
+            url.searchParams.get('state') !== attempt.state) {
+            res.writeHead(400);
+            res.end('Invalid login callback.');
+            return;
+        }
+        attempt.exchanging = true;
+        try {
+            if (url.searchParams.has('error'))
+                throw new Error('CHATGPT_AUTHORIZATION_DENIED');
+            const callbackClient = url.searchParams.get('client_id');
+            const clientId = callbackClient ?? attempt.clientId;
+            const code = url.searchParams.get('code');
+            if (!clientId ||
+                clientId === 'dynamic_agent_client' ||
+                clientId.length > 512 ||
+                !code ||
+                code.length > 8192 ||
+                url.searchParams.getAll('code').length !== 1 ||
+                url.searchParams.getAll('client_id').length > 1 ||
+                (attempt.clientId && clientId !== attempt.clientId))
+                throw new Error('CHATGPT_CALLBACK_INVALID');
+            const raw = await this.json(CHATGPT_TOKEN_ENDPOINT, {
+                method: 'POST',
+                headers: { 'content-type': 'application/x-www-form-urlencoded' },
+                body: new URLSearchParams({
+                    grant_type: 'authorization_code',
+                    client_id: clientId,
+                    code,
+                    code_verifier: attempt.verifier,
+                    redirect_uri: attempt.redirectUri,
+                    resource: CHATGPT_RESOURCE
+                }).toString()
+            }, attempt);
+            const parsed = chatgptTokenResponseSchema.safeParse(raw);
+            if (!parsed.success || !parsed.data.id_token)
+                throw new Error('CHATGPT_TOKEN_RESPONSE_INVALID');
+            const jwks = await this.json(CHATGPT_JWKS_ENDPOINT, { method: 'GET' }, attempt);
+            await verifyChatgptIdentity(parsed.data.id_token, jwks, {
+                clientId,
+                nonce: attempt.nonce,
+                subject: attempt.subject
+            });
+            if (this.attempts.get(id) !== attempt || attempt.abort.signal.aborted)
+                throw new Error('CHATGPT_LOGIN_CANCELLED');
+            attempt.result = { attemptId: id, clientId, hostId: attempt.hostId, tokens: parsed.data };
+            res.end('Login completed. Return to MyAgentRoam to save the credential.');
+        }
+        catch (error) {
+            attempt.error =
+                error instanceof Error && /^CHATGPT_[A-Z0-9_]+$/u.test(error.message)
+                    ? error.message
+                    : 'CHATGPT_LOGIN_FAILED';
+            res.writeHead(400);
+            res.end('Login failed. Return to MyAgentRoam to retry.');
+        }
+        finally {
+            attempt.verifier = '';
+            attempt.server.close();
+        }
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@myagentroam/node",
-  "version": "0.9.133",
+  "version": "0.9.134",
   "description": "MyAgentRoam Node runtime CLI.",
   "license": "Apache-2.0 AND GPL-2.0-or-later",
   "type": "module",
@@ -34,10 +34,10 @@
     "npm": "11.12.1",
     "ws": "^8.21.3",
     "zod": "4.4.3",
-    "@myagentroam/marmgr": "0.9.116",
-    "@myagentroam/agent": "0.9.133",
-    "@myagentroam/protocol": "0.9.133",
-    "@myagentroam/code-navigation": "0.9.129"
+    "@myagentroam/marmgr": "0.9.117",
+    "@myagentroam/agent": "0.9.134",
+    "@myagentroam/code-navigation": "0.9.129",
+    "@myagentroam/protocol": "0.9.134"
   },
   "devDependencies": {
     "@types/ws": "^8.18.1"