@nema-project/nema 0.0.0-stage → 0.1.4

package/dist/direct/authCommands.d.ts

@@ -0,0 +1,54 @@
+import { type Refresher } from "./authStore.js";
+import { type SiwcEndpoints } from "./siwc.js";
+export { authByok } from "./byok.js";
+export type Out = {
+    log: (s: string) => void;
+    error: (s: string) => void;
+};
+/** Why the saved provider's model catalog could not be read. The message is the reason, never an upstream body. */
+export declare class ModelsListError extends Error {
+    readonly reason: "not_applicable" | "not_connected" | "list_failed";
+    constructor(reason: "not_applicable" | "not_connected" | "list_failed");
+}
+export declare const consoleOut: Out;
+/** Opens the system browser without a shell; the URL is printed if launching fails. */
+export declare function defaultOpenBrowser(url: string): void;
+export declare function authLogin(o: {
+    nemaHome: string;
+    out: Out;
+    openBrowser?: (url: string) => void;
+    port?: number;
+    timeoutMs?: number;
+    endpoints?: SiwcEndpoints;
+    /** Codex CLI home for authMode=compat. Defaults to $CODEX_HOME or ~/.codex. */
+    codexHome?: string;
+    signal?: AbortSignal;
+    requireTrustedAuthorizeUrl?: boolean;
+    redactCallbackErrors?: boolean;
+}): Promise<number>;
+export declare function authStatus(o: {
+    nemaHome: string;
+    out: Out;
+    codexHome?: string;
+}): number;
+export declare function authLogout(o: {
+    nemaHome: string;
+    out: Out;
+    lockTimeoutMs?: number;
+}): Promise<number>;
+export declare function authProbe(o: {
+    nemaHome: string;
+    out: Out;
+    apiBase?: string;
+    refresher?: Refresher;
+    forceRefresh?: boolean;
+    codexHome?: string;
+    signal?: AbortSignal;
+}): Promise<number>;
+/** Listed models for the saved provider. Does not send a generation request. */
+export declare function listConfiguredModels(o: {
+    nemaHome: string;
+    codexHome?: string;
+    refresher?: Refresher;
+    signal?: AbortSignal;
+}): Promise<string[]>;

package/dist/direct/authCommands.js

@@ -0,0 +1,268 @@
+// direct/authCommands.js
+import { spawn } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { browserCommand } from "../platform.js";
+import { configErrorMessage, loadConfig } from "../config.js";
+import { AuthStore, ReloginRequiredError, UNUSABLE_FILE_MESSAGE } from "./authStore.js";
+import { CodexFileTokenSource, CodexLoginError, defaultCodexHome, readCodexCliTokens } from "./codexLogin.js";
+import { jwtExp } from "./jwt.js";
+import { LockTimeoutError, withFileLock } from "./lock.js";
+import { cliVersion, siwcLogin, siwcRefresher } from "./siwc.js";
+import { BYOK_PROFILE, COMPAT_PROFILE, listModels, outputText, SIWC_PROFILE, streamResponse } from "./transport.js";
+import { ByokTokenSource } from "./byok.js";
+import { authByok } from "./byok.js";
+var ModelsListError = class extends Error {
+  reason;
+  constructor(reason) {
+    super(reason);
+    this.reason = reason;
+    this.name = "ModelsListError";
+  }
+};
+var consoleOut = { log: (s) => console.log(s), error: (s) => console.error(s) };
+var errMessage = (e) => e instanceof Error ? e.message : String(e);
+var tail4 = (s) => s ? `\u2026${s.slice(-4)}` : "\u672A\u77E5";
+var NOT_LOGGED_IN = "\u5C1A\u672A\u767B\u5F55\u76F4\u8FDE\u6A21\u5F0F\uFF0C\u8BF7\u5728\u7EC8\u7AEF\u8FD0\u884C nema auth login";
+function defaultOpenBrowser(url) {
+  const command = browserCommand(url);
+  try {
+    const child = spawn(command.bin, command.args, { stdio: "ignore", detached: true, windowsHide: true });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+}
+async function authLogin(o) {
+  let authMode;
+  try {
+    ({ authMode } = loadConfig(o.nemaHome));
+  } catch (e) {
+    o.out.error(configErrorMessage(e));
+    return 1;
+  }
+  if (authMode === "compat")
+    return confirmCodexLogin(o);
+  const open = o.openBrowser ?? defaultOpenBrowser;
+  try {
+    const auth = await siwcLogin({
+      nemaHome: o.nemaHome,
+      port: o.port,
+      timeoutMs: o.timeoutMs,
+      endpoints: o.endpoints,
+      signal: o.signal,
+      requireTrustedAuthorizeUrl: o.requireTrustedAuthorizeUrl,
+      redactCallbackErrors: o.redactCallbackErrors,
+      openBrowser: (url) => {
+        o.out.log(`\u8BF7\u5728\u6D4F\u89C8\u5668\u4E2D\u5B8C\u6210\u300CSign in with ChatGPT\u300D\u767B\u5F55\u3002\u82E5\u6D4F\u89C8\u5668\u6CA1\u6709\u81EA\u52A8\u6253\u5F00\uFF0C\u8BF7\u8BBF\u95EE\uFF1A
+${url}`);
+        try {
+          open(url);
+        } catch {
+        }
+      }
+    });
+    o.out.log(`\u767B\u5F55\u6210\u529F\uFF1A\u6A21\u5F0F siwc\uFF0C\u8D26\u53F7 ${tail4(auth.accountId)}\uFF0Cclient id ${auth.clientId}`);
+    return 0;
+  } catch (e) {
+    o.out.error(`\u767B\u5F55\u5931\u8D25\uFF1A${errMessage(e)}`);
+    return 1;
+  }
+}
+function confirmCodexLogin(o) {
+  try {
+    const t = readCodexCliTokens(o.codexHome ?? defaultCodexHome());
+    const exp = t.exp === null ? "\u672A\u77E5" : new Date(t.exp * 1e3).toISOString();
+    o.out.log(`\u5DF2\u4F7F\u7528 Codex \u767B\u5F55\uFF1A\u8D26\u53F7 ${tail4(t.accountId)}\uFF0Caccess token \u5230\u671F ${exp}\u3002Nema \u53EA\u8BFB\u53D6\u8BE5\u6587\u4EF6\uFF0C\u4E0D\u4F1A\u5237\u65B0\u6216\u6539\u5199\u5B83\u3002`);
+    return 0;
+  } catch (e) {
+    o.out.error(e instanceof CodexLoginError ? e.message : `\u767B\u5F55\u5931\u8D25\uFF1A${errMessage(e)}`);
+    return 1;
+  }
+}
+function authStatus(o) {
+  let authMode;
+  try {
+    ({ authMode } = loadConfig(o.nemaHome));
+  } catch (e) {
+    o.out.error(configErrorMessage(e));
+    return 1;
+  }
+  if (authMode === "compat")
+    return confirmCodexLogin(o) === 0 ? 0 : 1;
+  const { auth, reason } = new AuthStore(o.nemaHome, siwcRefresher).inspect();
+  if (!auth) {
+    o.out.log(reason === "unusable" ? UNUSABLE_FILE_MESSAGE : NOT_LOGGED_IN);
+    return 1;
+  }
+  o.out.log(`\u6A21\u5F0F\uFF1A${auth.mode}`);
+  o.out.log(`\u8D26\u53F7\uFF1A${tail4(auth.accountId)}`);
+  o.out.log(`client id\uFF1A${auth.clientId}`);
+  if (auth.tokens.refresh_token === "") {
+    o.out.log("\u4EE4\u724C\uFF1A\u5DF2\u5931\u6548\uFF0C\u9700\u8981\u91CD\u65B0\u767B\u5F55\uFF08nema auth login\uFF09");
+  } else {
+    const exp = jwtExp(auth.tokens.access_token);
+    o.out.log(`access token \u8FC7\u671F\u65F6\u95F4\uFF1A${exp === null ? "\u672A\u77E5" : new Date(exp * 1e3).toISOString()}`);
+  }
+  o.out.log(`\u4E0A\u6B21\u5237\u65B0\uFF1A${auth.lastRefresh}`);
+  if (auth.lastAuthError) {
+    const e = auth.lastAuthError;
+    o.out.log(`\u6700\u8FD1\u4E00\u6B21\u8BA4\u8BC1\u9519\u8BEF\uFF1A${e.code}\uFF08${e.message}\uFF09\u4E8E ${e.at}`);
+  }
+  return 0;
+}
+async function authLogout(o) {
+  const store = new AuthStore(o.nemaHome, siwcRefresher);
+  if (!existsSync(o.nemaHome)) {
+    o.out.log("\u5F53\u524D\u6CA1\u6709\u76F4\u8FDE\u767B\u5F55\u3002");
+    return 0;
+  }
+  try {
+    await withFileLock(path.join(o.nemaHome, "auth.lock"), async () => store.clear(), { timeoutMs: o.lockTimeoutMs ?? 15e3 });
+  } catch (e) {
+    if (e instanceof LockTimeoutError) {
+      o.out.error("\u7B49\u5F85\u51ED\u8BC1\u9501\u8D85\u65F6\uFF08\u53EF\u80FD\u6709\u5176\u4ED6 nema \u8FDB\u7A0B\u6B63\u5728\u5237\u65B0\u767B\u5F55\uFF09\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5 nema auth logout");
+      return 1;
+    }
+    throw e;
+  }
+  o.out.log("\u5DF2\u9000\u51FA\u76F4\u8FDE\u767B\u5F55\uFF08\u5DF2\u5220\u9664 auth.json\uFF09\u3002");
+  return 0;
+}
+var PROBE_PROMPT = "\u53EA\u56DE\u590D ok";
+var PROBE_INSTRUCTIONS = "You are a connectivity probe. Reply with exactly what the user asks.";
+var PROBE_TIMEOUT_MS = 6e4;
+async function authProbe(o) {
+  let authMode;
+  try {
+    ({ authMode } = loadConfig(o.nemaHome));
+  } catch (e) {
+    o.out.error(configErrorMessage(e));
+    return 1;
+  }
+  if (authMode === "compat") {
+    const source = new CodexFileTokenSource(o.codexHome ?? defaultCodexHome());
+    try {
+      await source.getAccessToken({ signal: o.signal });
+    } catch (e) {
+      o.out.error(e instanceof CodexLoginError ? e.message : errMessage(e));
+      return 1;
+    }
+    if (o.forceRefresh)
+      o.out.log("\u5DF2\u91CD\u65B0\u8BFB\u53D6 Codex \u767B\u5F55\uFF08Nema \u4E0D\u5237\u65B0\u8BE5\u51ED\u8BC1\uFF09");
+    const profile2 = o.apiBase ? { ...COMPAT_PROFILE, baseUrl: o.apiBase } : COMPAT_PROFILE;
+    return runProbe(o, source, profile2, o.signal);
+  }
+  const config = loadConfig(o.nemaHome);
+  if (config.authMode === "byok") {
+    const profile2 = { ...BYOK_PROFILE, baseUrl: config.byokBaseUrl ?? BYOK_PROFILE.baseUrl };
+    return runProbe(o, new ByokTokenSource(o.nemaHome), profile2, o.signal);
+  }
+  const store = new AuthStore(o.nemaHome, o.refresher ?? siwcRefresher);
+  const { auth, reason } = store.inspect();
+  if (!auth || auth.tokens.refresh_token === "") {
+    o.out.error(reason === "unusable" ? UNUSABLE_FILE_MESSAGE : NOT_LOGGED_IN);
+    return 1;
+  }
+  if (auth.mode !== "siwc") {
+    o.out.error("\u5F53\u524D\u767B\u5F55\u4E0D\u662F siwc \u6A21\u5F0F\uFF1Bcompat \u6A21\u5F0F\u8BF7\u628A authMode \u8BBE\u4E3A compat\u3002");
+    return 1;
+  }
+  const profile = o.apiBase ? { ...SIWC_PROFILE, baseUrl: o.apiBase } : SIWC_PROFILE;
+  if (o.forceRefresh) {
+    const before = auth.lastRefresh;
+    const { auth: current } = await store.getAccessToken({ force: true, signal: o.signal });
+    o.out.log(current.lastRefresh !== before ? `\u5DF2\u5F3A\u5236\u5237\u65B0\u4EE4\u724C\uFF08${current.lastRefresh}\uFF09` : "\u4EE4\u724C\u672A\u5237\u65B0");
+  }
+  return runProbe(o, store, profile, o.signal);
+}
+async function runProbe(o, source, profile, ownerSignal) {
+  try {
+    const ctx = { auth: source, profile, version: cliVersion(), signal: ownerSignal ? AbortSignal.any([ownerSignal, AbortSignal.timeout(PROBE_TIMEOUT_MS)]) : AbortSignal.timeout(PROBE_TIMEOUT_MS) };
+    const models = await listModels(ctx);
+    o.out.log(`\u53EF\u7528\u6A21\u578B\uFF08${models.length}\uFF09\uFF1A${models.join(", ") || "\u65E0"}`);
+    if (models.length === 0) {
+      o.out.error("\u63A2\u9488\u5931\u8D25\uFF1A\u6A21\u578B\u5217\u8868\u4E3A\u7A7A");
+      return 1;
+    }
+    const { model: configured } = loadConfig(o.nemaHome);
+    const model = configured && models.includes(configured) ? configured : models[0];
+    let streamed = "";
+    const r = await streamResponse({
+      model,
+      instructions: PROBE_INSTRUCTIONS,
+      input: [{ type: "message", role: "user", content: [{ type: "input_text", text: PROBE_PROMPT }] }],
+      tools: [],
+      reasoning: { effort: "low", summary: "auto" },
+      sessionId: randomUUID()
+    }, { ...ctx, onTextDelta: (t) => streamed += t });
+    o.out.log(`\u6A21\u578B\uFF1A${model}`);
+    if (r.status !== "completed") {
+      o.out.error(`\u63A2\u9488\u5931\u8D25\uFF1A\u54CD\u5E94\u4E0D\u5B8C\u6574\uFF08${r.incompleteReason ?? "incomplete"}\uFF09`);
+      return 1;
+    }
+    o.out.log(`\u7ED3\u679C\uFF1A${(outputText(r.items) || streamed).trim()}`);
+    return 0;
+  } catch (e) {
+    if (e instanceof ReloginRequiredError) {
+      o.out.error(e.message);
+      return 1;
+    }
+    o.out.error(`\u63A2\u9488\u5931\u8D25\uFF1A${errMessage(e)}`);
+    return 1;
+  }
+}
+async function listConfiguredModels(o) {
+  let config;
+  try {
+    config = loadConfig(o.nemaHome);
+  } catch {
+    throw new ModelsListError("list_failed");
+  }
+  if (config.adapter === "claude-code")
+    throw new ModelsListError("not_applicable");
+  const signal = o.signal ? AbortSignal.any([o.signal, AbortSignal.timeout(2e4)]) : AbortSignal.timeout(2e4);
+  let source;
+  let profile;
+  try {
+    if (config.authMode === "compat") {
+      source = new CodexFileTokenSource(o.codexHome ?? defaultCodexHome());
+      await source.getAccessToken({ signal });
+      profile = COMPAT_PROFILE;
+    } else if (config.authMode === "byok") {
+      source = new ByokTokenSource(o.nemaHome);
+      await source.getAccessToken({ signal });
+      profile = { ...BYOK_PROFILE, baseUrl: config.byokBaseUrl ?? BYOK_PROFILE.baseUrl };
+    } else {
+      const store = new AuthStore(o.nemaHome, o.refresher ?? siwcRefresher);
+      const { auth } = store.inspect();
+      if (!auth || auth.tokens.refresh_token === "" || auth.mode !== "siwc")
+        throw new ModelsListError("not_connected");
+      await store.getAccessToken({ signal });
+      source = store;
+      profile = SIWC_PROFILE;
+    }
+  } catch (error) {
+    if (error instanceof ModelsListError)
+      throw error;
+    throw new ModelsListError("not_connected");
+  }
+  try {
+    return await listModels({ auth: source, profile, version: cliVersion(), signal });
+  } catch {
+    throw new ModelsListError("list_failed");
+  }
+}
+export {
+  ModelsListError,
+  authByok,
+  authLogin,
+  authLogout,
+  authProbe,
+  authStatus,
+  consoleOut,
+  defaultOpenBrowser,
+  listConfiguredModels
+};

package/dist/direct/authStore.d.ts

@@ -0,0 +1,120 @@
+import { type LockOptions } from "./lock.js";
+export declare const REFRESH_SKEW_MS = 120000;
+export declare const TERMINAL_CODES: readonly ["invalid_grant", "invalid_client", "invalid_token", "refresh_token_reused", "refresh_token_expired", "refresh_token_invalidated"];
+export declare const RELOGIN_MESSAGE = "\u76F4\u8FDE\u767B\u5F55\u5DF2\u5931\u6548\uFF0C\u8BF7\u5728\u7EC8\u7AEF\u8FD0\u884C nema auth login";
+/** The file exists but cannot be trusted or parsed (wrong permissions, symlink, not ours, corrupt). */
+export declare const UNUSABLE_FILE_MESSAGE = "\u51ED\u8BC1\u6587\u4EF6\u4E0D\u53EF\u7528\uFF08\u6743\u9650/\u7B26\u53F7\u94FE\u63A5/\u635F\u574F\uFF09\uFF0C\u8BF7\u91CD\u65B0\u8FD0\u884C nema auth login";
+export type StoredAuth = {
+    version: 1;
+    mode: "siwc" | "compat" | "byok";
+    clientId: string;
+    tokens: {
+        access_token: string;
+        refresh_token: string;
+        id_token?: string;
+    };
+    accountId?: string;
+    lastRefresh: string;
+    lastAuthError?: {
+        code: string;
+        message: string;
+        at: string;
+    };
+};
+export type RefreshResult = {
+    access_token: string;
+    refresh_token?: string;
+    id_token?: string;
+};
+/**
+ * Exchanges `auth.tokens.refresh_token`; throws RefreshError on an HTTP error response. `signal` aborts when
+ * AuthStore gives up waiting (refresh deadline), so the refresher should pass it to its HTTP request.
+ */
+export type Refresher = (auth: StoredAuth, signal?: AbortSignal) => Promise<RefreshResult>;
+export declare const REFRESH_TIMEOUT_MS = 20000;
+export type AuthStoreOptions = {
+    refreshTimeoutMs?: number;
+    lock?: LockOptions;
+};
+type StatLike = {
+    isFile(): boolean;
+    mode: number;
+    uid: number;
+};
+/** A credential file is trusted only if it is a regular file, mode 0600, and (where uids exist) owned by us. */
+export declare function isTrustedAuthStat(st: StatLike, uid?: number | null, platform?: NodeJS.Platform): boolean;
+export declare class RefreshError extends Error {
+    readonly status: number;
+    readonly code?: string;
+    readonly retryAfterS?: number;
+    constructor(status: number, opts?: {
+        code?: string;
+        retryAfterS?: number;
+        message?: string;
+    });
+}
+export declare class ReloginRequiredError extends Error {
+    readonly code?: string | undefined;
+    constructor(code?: string | undefined, options?: ErrorOptions);
+}
+export declare class AuthRateLimitedError extends Error {
+    readonly retryAfterS?: number | undefined;
+    constructor(retryAfterS?: number | undefined, options?: ErrorOptions);
+}
+export declare class TransientAuthError extends Error {
+    constructor(message: string, options?: ErrorOptions);
+}
+type AuthResult = {
+    accessToken: string;
+    auth: StoredAuth;
+};
+export declare class AuthStore {
+    private readonly nemaHome;
+    private readonly refresher;
+    private readonly now;
+    private readonly opts;
+    private readonly file;
+    private readonly lockPath;
+    constructor(nemaHome: string, refresher: Refresher, now?: () => number, opts?: AuthStoreOptions);
+    /** The stored login, or null if missing, a symlink, not a regular file, not 0600, not ours, or malformed. */
+    read(): StoredAuth | null;
+    /** Like read(), but says why there is no login: "missing" (no file) or "unusable" (present but untrusted/corrupt). */
+    inspect(): {
+        auth: StoredAuth | null;
+        reason?: "missing" | "unusable";
+    };
+    /**
+     * Records an auth problem in the file WITHOUT clearing the tokens (used when the model API rejects a token
+     * that refreshing could not fix). Best effort: only if the file still holds the same refresh token.
+     */
+    recordAuthError(reason: {
+        code: string;
+        message: string;
+    }, forAuth: StoredAuth): Promise<void>;
+    /** Atomic write (exclusive 0600 temp file + fsync + rename) under a 0700 directory. */
+    save(auth: StoredAuth): void;
+    /** Without a reason: log out (delete the file). With a reason: drop the tokens and record lastAuthError. */
+    clear(reason?: {
+        code: string;
+        message: string;
+    }): void;
+    /**
+     * A valid access token, refreshing under auth.lock when it is within 120 s of expiry or when forced.
+     * Pass the token the server just rejected as `rejectedAccessToken` with `force`: if a peer has already
+     * replaced it on disk, that token is returned without a refresh POST.
+     */
+    getAccessToken(opts?: {
+        force?: boolean;
+        rejectedAccessToken?: string;
+        signal?: AbortSignal;
+    }): Promise<AuthResult>;
+    private expiring;
+    private usableWithoutRefresh;
+    private cleared;
+    private refreshLocked;
+    private callRefresher;
+    private refreshWith;
+    private onRefreshFailure;
+    private overwriteInPlace;
+}
+export {};