@nmzpy/pi-ember-stack 0.1.1 → 0.1.3

package/plugins/devin-auth/src/cloud-direct/auth.ts

@@ -0,0 +1,246 @@
+/**
+ * Mint the short-lived `user_jwt` that every chat RPC needs alongside the
+ * persistent OAuth-issued `api_key`.
+ *
+ *   POST https://server.codeium.com/exa.auth_pb.AuthService/GetUserJwt
+ *   Content-Type: application/proto             ← unary, NOT streaming
+ *   Body: GetUserJwtRequest { metadata: Metadata }
+ *   Response: GetUserJwtResponse { user_jwt: string }  (field 1)
+ *
+ * The returned JWT has a payload like:
+ *   {
+ *     "api_key": "devin-synthetic-apikey$account-…$user-…",
+ *     "auth_uid": "devin-auth-uid$…",
+ *     "email": "user@example.com",
+ *     "exp": <unix-seconds>,         ← ~24 minute TTL
+ *     "pro": true,
+ *     "teams_tier": "TEAMS_TIER_DEVIN_PRO",
+ *     ...
+ *   }
+ *
+ * The JWT is signed HS256 by the server — can't be forged client-side. We
+ * cache it and refresh shortly before `exp`.
+ */
+
+import * as crypto from 'crypto';
+import { encodeMessage, iterFields } from './wire.js';
+import { buildMetadata } from './metadata.js';
+
+const DEFAULT_HOST = 'https://server.codeium.com';
+
+/**
+ * Polyfill for `AbortSignal.any` — composes multiple signals so the result
+ * aborts when ANY input aborts. Built-in in Node ≥20.3 / Bun ≥1.0. Our
+ * `engines.node` is `>=18.0.0`, so we ship the fallback ourselves; without
+ * it the caller's cancel signal silently disappears on older runtimes
+ * (chat-cancel during a `GetUserJwt` mint would keep the network request
+ * alive for up to the full 30s timeout).
+ */
+function anySignal(signals: AbortSignal[]): AbortSignal {
+  const builtin = (AbortSignal as unknown as { any?: (s: AbortSignal[]) => AbortSignal }).any;
+  if (typeof builtin === 'function') return builtin(signals);
+  const controller = new AbortController();
+  const onAbort = (reason: unknown): void => {
+    if (!controller.signal.aborted) controller.abort(reason);
+  };
+  for (const s of signals) {
+    if (s.aborted) {
+      onAbort(s.reason);
+      break;
+    }
+    s.addEventListener('abort', () => onAbort(s.reason), { once: true });
+  }
+  return controller.signal;
+}
+
+export interface MintedUserJwt {
+  jwt: string;
+  /** Unix epoch seconds when the JWT expires. */
+  expiresAt: number;
+}
+
+export class CloudAuthError extends Error {
+  constructor(message: string, public readonly status?: number) {
+    super(message);
+    this.name = 'CloudAuthError';
+  }
+}
+
+/**
+ * Default mint timeout — 30s is generous (the endpoint responds in ~200ms
+ * in steady state) but enough headroom for slow networks. Callers can pass
+ * a tighter `signal` to override.
+ */
+const MINT_TIMEOUT_MS = 30_000;
+
+/**
+ * Mint a fresh user_jwt by calling exa.auth_pb.AuthService/GetUserJwt.
+ * `host` defaults to https://server.codeium.com — pass your tenant URL if your
+ * RegisterUser response gave a different host.
+ *
+ * Always applies an internal 30s timeout so a network stall here can't
+ * deadlock every concurrent chat request. If the caller passes a `signal`,
+ * we honor whichever fires first via AbortSignal.any.
+ */
+export async function mintUserJwt(
+  apiKey: string,
+  host: string = DEFAULT_HOST,
+  signal?: AbortSignal,
+): Promise<MintedUserJwt> {
+  const metadata = buildMetadata({
+    apiKey,
+    sessionId: crypto.randomUUID(),
+    requestId: BigInt(Date.now()),
+    triggerId: crypto.randomUUID(),
+  });
+  // GetUserJwtRequest { metadata: Metadata }   — Metadata is field 1
+  const req = encodeMessage(1, metadata);
+
+  // Compose caller signal with our internal timeout via `anySignal` — a
+  // small polyfill of `AbortSignal.any` for runtimes (Node 18 / older
+  // Bun) that lack the built-in. The previous fallback silently dropped
+  // the CALLER's signal on those runtimes, so a chat-cancel during a
+  // GetUserJwt mint would keep the network request alive for up to the
+  // full 30s timeout.
+  const timeoutSignal = AbortSignal.timeout(MINT_TIMEOUT_MS);
+  const combinedSignal: AbortSignal = signal
+    ? anySignal([signal, timeoutSignal])
+    : timeoutSignal;
+
+  const resp = await fetch(`${host.replace(/\/$/, '')}/exa.auth_pb.AuthService/GetUserJwt`, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/proto',
+      'Connect-Protocol-Version': '1',
+    },
+    body: req,
+    signal: combinedSignal,
+  });
+  const buf = Buffer.from(await resp.arrayBuffer());
+
+  if (!resp.ok) {
+    const text = buf.toString('utf8');
+    throw new CloudAuthError(`GetUserJwt HTTP ${resp.status}: ${text.slice(0, 400)}`, resp.status);
+  }
+
+  // Response is GetUserJwtResponse { user_jwt: string } where user_jwt is
+  // field 1, length-delimited. Decode the field properly instead of
+  // regex-scanning the whole buffer — the previous regex would pick up
+  // any JWT-shaped substring in the response (trace IDs, signature
+  // headers, any cached token inadvertently logged) and could even land
+  // on a non-user_jwt if Cognition ever embeds another JWT in a sibling
+  // field.
+  let jwt: string | null = null;
+  for (const f of iterFields(buf)) {
+    if (f.num === 1 && f.wire === 2 && Buffer.isBuffer(f.value)) {
+      const s = (f.value as Buffer).toString('utf8');
+      // Sanity-check the shape — defensive: if the cloud ever moves user_jwt
+      // out from field 1 we want a clean error, not silently wrong creds.
+      // base64url with OPTIONAL `=` padding on each segment. Most modern
+      // JWTs omit the `=`, but the spec allows it and a future server-side
+      // change could re-introduce it; either way it's still a valid token.
+      if (/^eyJ[A-Za-z0-9_-]{10,}={0,2}\.[A-Za-z0-9_-]+={0,2}\.[A-Za-z0-9_-]+={0,2}$/.test(s)) {
+        jwt = s;
+        break;
+      }
+    }
+  }
+  if (!jwt) {
+    throw new CloudAuthError(
+      `GetUserJwt 200 but no field-1 JWT found (${buf.length} bytes): ${buf.toString('utf8').slice(0, 200)}`,
+    );
+  }
+
+  // Decode the payload to get the expiry.
+  let expiresAt = Math.floor(Date.now() / 1000) + 600;   // fallback: 10 min
+  try {
+    const parts = jwt.split('.');
+    const pad = (s: string) => s + '='.repeat((4 - (s.length % 4)) % 4);
+    const payload = JSON.parse(
+      Buffer.from(pad(parts[1]).replace(/-/g, '+').replace(/_/g, '/'), 'base64').toString('utf8'),
+    );
+    if (typeof payload.exp === 'number') expiresAt = payload.exp;
+  } catch { /* fall back to default */ }
+
+  return { jwt, expiresAt };
+}
+
+// ----------------------------------------------------------------------------
+// In-memory cache — refresh ~60s before expiry
+// ----------------------------------------------------------------------------
+
+interface CacheEntry {
+  jwt: string;
+  expiresAt: number;
+  apiKey: string;
+  host: string;
+}
+
+/**
+ * Cache is keyed by (apiKey, host). A single shared `cache` slot only holds
+ * the MOST RECENTLY USED entry — common case is one account at a time, so
+ * a single slot is enough. inFlight is a per-key map so a JWT mint for
+ * account A doesn't get returned to a concurrent request for account B.
+ *
+ * Previously `inFlight` was a singleton — if account A's mint was in flight
+ * and a request for account B arrived, B got A's JWT. That's the M1
+ * "concurrent requests after account switch get wrong JWT" bug.
+ */
+let cache: CacheEntry | null = null;
+const inFlight = new Map<string, Promise<MintedUserJwt>>();
+/**
+ * Monotonic epoch counter. Incremented on every `clearCachedUserJwt()`
+ * call so an in-flight mint that started BEFORE the clear can't
+ * repopulate the cache after-the-fact. Without this, a logout that
+ * happened concurrently with a mint would silently get its just-
+ * invalidated JWT cached and served for the next ~24 minutes.
+ */
+let cacheEpoch = 0;
+
+function flightKey(apiKey: string, host: string): string {
+  return `${host}\x1f${apiKey}`;
+}
+
+/**
+ * Get a cached user_jwt or mint a new one. Refreshes when the cached JWT is
+ * within 60s of expiry. Multiple concurrent callers for the SAME (apiKey, host)
+ * share the same in-flight mint; concurrent callers for DIFFERENT keys each
+ * get their own mint.
+ */
+export async function getCachedUserJwt(apiKey: string, host: string = DEFAULT_HOST, signal?: AbortSignal): Promise<string> {
+  const now = Math.floor(Date.now() / 1000);
+  if (cache && cache.apiKey === apiKey && cache.host === host && cache.expiresAt > now + 60) {
+    return cache.jwt;
+  }
+  const key = flightKey(apiKey, host);
+  const existing = inFlight.get(key);
+  if (existing) return (await existing).jwt;
+  const promise = mintUserJwt(apiKey, host, signal);
+  inFlight.set(key, promise);
+  // Snapshot the epoch BEFORE awaiting the mint. If clearCachedUserJwt()
+  // fires while we're awaiting (logout-during-mint), the epoch changes
+  // and we won't repopulate the cache with the just-invalidated JWT.
+  const epochAtStart = cacheEpoch;
+  try {
+    const minted = await promise;
+    if (cacheEpoch === epochAtStart) {
+      cache = { jwt: minted.jwt, expiresAt: minted.expiresAt, apiKey, host };
+    }
+    return minted.jwt;
+  } finally {
+    inFlight.delete(key);
+  }
+}
+
+/**
+ * Drop the in-memory JWT cache. Call after credential changes (logout,
+ * account switch) so long-running opencode processes don't keep using a
+ * JWT minted from a now-invalid api_key. Also bumps the cache epoch so
+ * any in-flight mint racing with this clear can't repopulate cache
+ * with the stale JWT after-the-fact.
+ */
+export function clearCachedUserJwt(): void {
+  cache = null;
+  inFlight.clear();
+  cacheEpoch++;
+}

package/plugins/devin-auth/src/cloud-direct/catalog.ts

@@ -0,0 +1,246 @@
+/**
+ * Per-account model catalog from Cognition's `GetCascadeModelConfigs`.
+ *
+ * Why this exists — issue #14:
+ *   The cloud's `GetChatMessage` returns a single Connect-streaming EOS frame
+ *   containing `{"error":{"code":"permission_denied","message":"an internal
+ *   error occurred (trace ID: <hex>)"}}` whenever the caller's account tier
+ *   does not include the requested `model_uid`. Reproduced byte-identical on a
+ *   `TEAMS_TIER_DEVIN_FREE` account for every Anthropic/Gemini/Premium UID
+ *   (only `swe-1-6-slow` streamed a real reply). The user-facing message is
+ *   indistinguishable from a transient server fault — issue #14's reporter
+ *   spent multiple sessions guessing.
+ *
+ *   The pre-flight here checks the per-account catalog (`disabled` flag on
+ *   `ClientModelConfig` field #4) BEFORE we spend a roundtrip on a request
+ *   the cloud will refuse. When the lookup fails (network, auth, schema
+ *   drift) we silently fall back to the chat path so a transient catalog
+ *   outage can't take chat down with it.
+ *
+ * Schema (verified against the bundled `extension.js`,
+ * `exa.codeium_common_pb.ClientModelConfig`):
+ *
+ *   GetCascadeModelConfigsResponse {
+ *     #1 client_model_configs: repeated ClientModelConfig
+ *   }
+ *   ClientModelConfig {
+ *     #1  label                string
+ *     #4  disabled             bool   ← the gate this module reads
+ *     #22 model_uid            string ← what `GetChatMessage` accepts
+ *   }
+ *
+ *   Disabled semantics: TRUE means "this UID exists in the catalog but the
+ *   caller's account/tier cannot run inference against it." BYOK models
+ *   surface as `disabled: false` so users with their own provider keys still
+ *   pass through — the only way they fail at chat time is a missing key,
+ *   which surfaces with a different message.
+ *
+ * Cache: per (apiServerUrl, apiKey) for {@link CATALOG_TTL_MS}. Cognition
+ * doesn't bump catalog entries mid-session in normal operation, so a 10-min
+ * TTL trades one extra roundtrip per ~10 min for clear errors on every chat.
+ */
+
+import * as crypto from 'crypto';
+import { buildMetadata } from './metadata.js';
+import { getCachedUserJwt } from './auth.js';
+import { encodeMessage, iterFields } from './wire.js';
+
+/** 10 minutes — see header. */
+const CATALOG_TTL_MS = 10 * 60 * 1000;
+
+/** Catalog endpoint inactivity timeout. Cognition responds in <500ms steady-state. */
+const CATALOG_FETCH_TIMEOUT_MS = 10_000;
+
+export interface ModelCatalogEntry {
+  /** Cloud-side `model_uid` (e.g. `claude-opus-4-7-medium`). */
+  modelUid: string;
+  /** Human label (e.g. `Claude Opus 4.7 Medium`) — used in error messages. */
+  label: string;
+  /** True when the caller's account tier cannot use this UID for chat. */
+  disabled: boolean;
+}
+
+export interface CacheEntry {
+  /** Lookup keyed by `model_uid`. */
+  byUid: Map<string, ModelCatalogEntry>;
+  fetchedAt: number;
+  /** Cache key components, captured for invalidation/log purposes. */
+  apiKey: string;
+  host: string;
+}
+
+let cached: CacheEntry | null = null;
+let inFlight: Promise<CacheEntry> | null = null;
+let inFlightKey: string | null = null;
+
+function flightKey(apiKey: string, host: string): string {
+  return `${host}\x1f${apiKey}`;
+}
+
+/**
+ * Fetch the cascade model catalog for `(apiKey, host)` and parse the
+ * subset of `ClientModelConfig` we care about into a UID-keyed map.
+ *
+ * Throws on transport/auth failure so the caller can decide whether to fall
+ * back to "skip pre-flight". Does NOT throw on an unexpected response body —
+ * a malformed catalog returns an empty map, treated the same as "model not
+ * listed" by the chat pre-flight.
+ */
+async function fetchCatalog(apiKey: string, host: string, signal?: AbortSignal): Promise<CacheEntry> {
+  const userJwt = await getCachedUserJwt(apiKey, host, signal);
+
+  const metadata = buildMetadata({
+    apiKey,
+    userJwt,
+    sessionId: crypto.randomUUID(),
+    requestId: BigInt(Date.now()),
+    triggerId: crypto.randomUUID(),
+  });
+  // GetCascadeModelConfigsRequest { metadata: Metadata }  — Metadata is #1.
+  const reqBody = encodeMessage(1, metadata);
+
+  // Internal 10s timeout so a stalled catalog endpoint can't deadlock chat.
+  // The caller's signal still takes precedence — when they cancel, we cancel.
+  const ac = new AbortController();
+  const timer = setTimeout(
+    () => ac.abort(new Error(`catalog: fetch timeout (${CATALOG_FETCH_TIMEOUT_MS}ms)`)),
+    CATALOG_FETCH_TIMEOUT_MS,
+  );
+  const cleanupOnAbort = signal
+    ? (() => {
+        if (signal.aborted) ac.abort(signal.reason);
+        const fwd = (): void => ac.abort(signal.reason);
+        signal.addEventListener('abort', fwd, { once: true });
+        return () => signal.removeEventListener('abort', fwd);
+      })()
+    : (): void => { /* no caller signal */ };
+
+  let resp: Response;
+  try {
+    resp = await fetch(`${host}/exa.api_server_pb.ApiServerService/GetCascadeModelConfigs`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/proto', 'Connect-Protocol-Version': '1' },
+      body: reqBody,
+      signal: ac.signal,
+    });
+  } finally {
+    clearTimeout(timer);
+    cleanupOnAbort();
+  }
+
+  if (!resp.ok) {
+    const text = await resp.text();
+    throw new Error(`GetCascadeModelConfigs HTTP ${resp.status}: ${text.slice(0, 200)}`);
+  }
+  const buf = Buffer.from(await resp.arrayBuffer());
+
+  // GetCascadeModelConfigsResponse #1 (repeated ClientModelConfig)
+  const byUid = new Map<string, ModelCatalogEntry>();
+  for (const f of iterFields(buf)) {
+    if (f.num !== 1 || f.wire !== 2 || !Buffer.isBuffer(f.value)) continue;
+    let label = '';
+    let modelUid = '';
+    let disabled = false;
+    for (const sf of iterFields(f.value as Buffer)) {
+      if (sf.num === 1 && sf.wire === 2 && Buffer.isBuffer(sf.value)) {
+        label = (sf.value as Buffer).toString('utf8');
+      } else if (sf.num === 4 && sf.wire === 0) {
+        // #4 = disabled (bool, varint 0/1)
+        disabled = sf.value === 1n;
+      } else if (sf.num === 22 && sf.wire === 2 && Buffer.isBuffer(sf.value)) {
+        modelUid = (sf.value as Buffer).toString('utf8');
+      }
+    }
+    if (modelUid.length > 0) {
+      byUid.set(modelUid, { modelUid, label: label || modelUid, disabled });
+    }
+  }
+
+  return { byUid, fetchedAt: Date.now(), apiKey, host };
+}
+
+/**
+ * Get the cached catalog for `(apiKey, host)`, fetching when missing or stale.
+ *
+ * Concurrent callers for the SAME (apiKey, host) share one in-flight fetch
+ * (no thundering herd on startup). Concurrent callers for DIFFERENT keys
+ * serialise the in-flight slot but only one of them holds it at a time —
+ * good enough for opencode's single-account-at-a-time usage pattern.
+ *
+ * Returns `null` on fetch failure (network, transient 5xx, auth issue). The
+ * caller treats `null` as "skip pre-flight and let the chat path surface the
+ * server-side error itself."
+ */
+export async function getCachedCatalog(
+  apiKey: string,
+  host: string,
+  signal?: AbortSignal,
+): Promise<CacheEntry | null> {
+  if (cached && cached.apiKey === apiKey && cached.host === host) {
+    if (Date.now() - cached.fetchedAt < CATALOG_TTL_MS) {
+      return cached;
+    }
+  }
+
+  const key = flightKey(apiKey, host);
+  if (inFlight && inFlightKey === key) {
+    try {
+      return await inFlight;
+    } catch {
+      return null;
+    }
+  }
+
+  const promise = fetchCatalog(apiKey, host, signal);
+  inFlight = promise;
+  inFlightKey = key;
+  try {
+    const result = await promise;
+    cached = result;
+    return result;
+  } catch {
+    return null;
+  } finally {
+    if (inFlight === promise) {
+      inFlight = null;
+      inFlightKey = null;
+    }
+  }
+}
+
+/**
+ * Drop the cached catalog. Call after logout/account switch so a fresh
+ * sign-in doesn't see a previous account's allow-list.
+ */
+export function clearCachedCatalog(): void {
+  cached = null;
+  inFlight = null;
+  inFlightKey = null;
+}
+
+/**
+ * Tier-disabled error — thrown by the chat pre-flight when the catalog lists
+ * a model as `disabled: true` for this account. The message names the model
+ * and points at the plan page, replacing Cognition's opaque
+ * "an internal error occurred" trailer.
+ */
+export class ModelNotAvailableError extends Error {
+  constructor(
+    public readonly modelUid: string,
+    public readonly label: string,
+    public readonly reason: 'disabled' | 'not_listed',
+  ) {
+    super(
+      reason === 'disabled'
+        ? `Model "${label}" (uid=${modelUid}) is not enabled for your Cognition account. ` +
+          `The Cognition catalog returned it with disabled=true — meaning your current plan/tier ` +
+          `does not include this model. ` +
+          `Check the model picker on https://codeium.com/account, or pick a different model. ` +
+          `(This message replaces Cognition's "an internal error occurred" — same root cause.)`
+        : `Model uid "${modelUid}" is not listed in the Cognition catalog for your account. ` +
+          `Either the UID has been retired upstream or your account/region doesn't serve it. ` +
+          `Run \`curl http://127.0.0.1:42100/v1/models\` to see the canonical names your plan accepts.`,
+    );
+    this.name = 'ModelNotAvailableError';
+  }
+}