@oneciel-ai/ciel-runtime 0.1.1 → 0.2.0

package/ciel_runtime_support/executable_discovery.py

@@ -0,0 +1,141 @@
+"""Cross-platform executable and runtime helper discovery."""
+
+from __future__ import annotations
+
+import importlib.util
+import os
+import shlex
+import shutil
+import site
+import sys
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Callable
+
+
+@dataclass(frozen=True, slots=True)
+class ExecutableDiscovery:
+    home: Path
+    source_file: Path
+    platform_path: Callable[[str], Path]
+    ciel_user_bin: Callable[[], Path]
+    agy_user_bin: Callable[[], Path]
+
+    @staticmethod
+    def candidates(name: str) -> list[str]:
+        if os.name == "nt" and not Path(name).suffix:
+            return [f"{name}.exe", f"{name}.cmd", f"{name}.bat", name]
+        return [name]
+
+    def extra_dirs(self) -> list[Path]:
+        directories = [self.ciel_user_bin(), self.agy_user_bin()]
+        for variable in ("UV_INSTALL_DIR", "CARGO_HOME"):
+            if root := os.environ.get(variable):
+                path = Path(root)
+                directories.append(path if path.name == "bin" else path / "bin")
+        if os.name == "nt":
+            if appdata := os.environ.get("APPDATA"):
+                directories.append(self.platform_path(appdata) / "npm")
+            if local_appdata := os.environ.get("LOCALAPPDATA"):
+                directories.append(self.platform_path(local_appdata) / "Programs" / "nodejs")
+            python_version = f"Python{sys.version_info.major}{sys.version_info.minor}"
+            for variable in ("APPDATA", "LOCALAPPDATA"):
+                if root := os.environ.get(variable):
+                    directories.append(self.platform_path(root) / "Python" / python_version / "Scripts")
+            try:
+                directories.append(self.platform_path(site.getuserbase()) / "Scripts")
+            except Exception:
+                pass
+            directories.append(self.platform_path(sys.executable).parent / "Scripts")
+        else:
+            directories.extend(
+                (
+                    self.home / ".local" / "bin",
+                    self.home / ".cargo" / "bin",
+                    self.home / ".npm-global" / "bin",
+                    self.home / ".bun" / "bin",
+                    Path(sys.executable).resolve().parent,
+                    Path("/usr/local/bin"),
+                    Path("/usr/bin"),
+                    Path("/bin"),
+                    Path("/opt/homebrew/bin"),
+                )
+            )
+        result: list[Path] = []
+        seen: set[str] = set()
+        for directory in directories:
+            key = str(directory)
+            if key and key not in seen:
+                seen.add(key)
+                result.append(directory)
+        return result
+
+    def find(self, name: str) -> str | None:
+        for candidate in self.candidates(name):
+            if found := shutil.which(candidate):
+                return found
+        for directory in self.extra_dirs():
+            for candidate in self.candidates(name):
+                path = directory / candidate
+                if path.exists():
+                    return str(path)
+        return None
+
+    def resolve(self, command: str) -> str:
+        command = str(command or "").strip()
+        if not command:
+            return command
+        pathish = Path(command).is_absolute() or os.sep in command or bool(
+            os.altsep and os.altsep in command
+        )
+        return command if pathish else self.find(command) or command
+
+    def resolve_mcp_process(
+        self,
+        command: str,
+        arguments: list[str],
+        finder: Callable[[str], str | None] | None = None,
+    ) -> tuple[str, list[str]]:
+        command = str(command or "").strip()
+        find = finder or self.find
+        pathish = Path(command).is_absolute() or os.sep in command or bool(
+            os.altsep and os.altsep in command
+        )
+        resolved = command if pathish else find(command) or command
+        if resolved == command and Path(command).name.lower() in ("uvx", "uvx.exe", "uvx.cmd", "uvx.bat"):
+            if uv := find("uv"):
+                return uv, ["tool", "run", *arguments]
+            if importlib.util.find_spec("uv") is not None:
+                return sys.executable, ["-m", "uv", "tool", "run", *arguments]
+        return resolved, arguments
+
+    @staticmethod
+    def shell_command(arguments: list[str]) -> str:
+        if os.name == "nt":
+            normalized: list[str] = []
+            for argument in arguments:
+                path_like = "\\" in argument and (
+                    (len(argument) >= 2 and argument[1] == ":")
+                    or argument.startswith("\\\\")
+                    or argument.endswith((".py", ".exe", ".cmd", ".bat", ".ps1"))
+                )
+                normalized.append(shlex.quote(argument.replace("\\", "/") if path_like else argument))
+            return " ".join(normalized)
+        return " ".join(shlex.quote(argument) for argument in arguments)
+
+    def find_tool_guard(
+        self,
+        finder: Callable[[str], str | None] | None = None,
+    ) -> Path | None:
+        candidates = [
+            self.source_file.resolve().with_name("ciel-runtime-tool-guard.py"),
+            self.ciel_user_bin() / "ciel-runtime-tool-guard.py",
+            self.ciel_user_bin() / "ciel-runtime-tool-guard",
+            self.home / ".local" / "bin" / "ciel-runtime-tool-guard.py",
+            self.home / ".local" / "bin" / "ciel-runtime-tool-guard",
+        ]
+        find = finder or self.find
+        for name in ("ciel-runtime-tool-guard", "ciel-runtime-tool-guard.py"):
+            if found := find(name):
+                candidates.append(Path(found))
+        return next((path for path in candidates if path.exists()), None)

package/ciel_runtime_support/github_copilot_oauth.py

@@ -0,0 +1,335 @@
+"""GitHub Device OAuth and short-lived Copilot token management."""
+
+from __future__ import annotations
+
+import json
+import os
+import time
+import urllib.error
+import urllib.parse
+import urllib.request
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any, Callable, Mapping
+
+
+DEFAULT_GITHUB_COPILOT_CLIENT_ID = "Iv1.b507a08c87ecfe98"
+GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code"
+GITHUB_ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token"
+GITHUB_USER_URL = "https://api.github.com/user"
+GITHUB_COPILOT_TOKEN_URL = "https://api.github.com/copilot_internal/v2/token"
+GITHUB_API_VERSION = "2022-11-28"
+COPILOT_API_VERSION = "2025-04-01"
+COPILOT_VSCODE_VERSION = "1.110.0"
+COPILOT_CHAT_VERSION = "0.38.0"
+COPILOT_USER_AGENT = f"GitHubCopilotChat/{COPILOT_CHAT_VERSION}"
+
+
+@dataclass(frozen=True, slots=True)
+class GitHubCopilotOAuthCredentials:
+    github_access_token: str = ""
+    copilot_token: str = ""
+    copilot_token_expires_at: int = 0
+    github_login: str = ""
+
+    @classmethod
+    def from_mapping(
+        cls, value: Mapping[str, Any] | None
+    ) -> GitHubCopilotOAuthCredentials:
+        value = value or {}
+        try:
+            expires_at = int(value.get("copilot_token_expires_at") or 0)
+        except (TypeError, ValueError):
+            expires_at = 0
+        return cls(
+            github_access_token=str(value.get("github_access_token") or ""),
+            copilot_token=str(value.get("copilot_token") or ""),
+            copilot_token_expires_at=expires_at,
+            github_login=str(value.get("github_login") or ""),
+        )
+
+    def as_mapping(self) -> dict[str, Any]:
+        return {
+            "github_access_token": self.github_access_token,
+            "copilot_token": self.copilot_token,
+            "copilot_token_expires_at": self.copilot_token_expires_at,
+            "github_login": self.github_login,
+        }
+
+    def copilot_token_is_fresh(
+        self, now: float, refresh_lead_seconds: int = 300
+    ) -> bool:
+        return bool(
+            self.copilot_token
+            and self.copilot_token_expires_at > int(now) + refresh_lead_seconds
+        )
+
+
+@dataclass(frozen=True, slots=True)
+class GitHubCopilotOAuthRepository:
+    path: Path
+
+    def load(self) -> GitHubCopilotOAuthCredentials:
+        try:
+            value = json.loads(self.path.read_text(encoding="utf-8"))
+        except (FileNotFoundError, json.JSONDecodeError, OSError):
+            return GitHubCopilotOAuthCredentials()
+        return GitHubCopilotOAuthCredentials.from_mapping(
+            value if isinstance(value, dict) else {}
+        )
+
+    def save(self, credentials: GitHubCopilotOAuthCredentials) -> None:
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        temporary = self.path.with_suffix(self.path.suffix + ".tmp")
+        temporary.write_text(
+            json.dumps(credentials.as_mapping(), ensure_ascii=False),
+            encoding="utf-8",
+        )
+        os.chmod(temporary, 0o600)
+        temporary.replace(self.path)
+        os.chmod(self.path, 0o600)
+
+    def clear(self) -> bool:
+        if not self.path.exists():
+            return False
+        self.path.unlink()
+        return True
+
+
+@dataclass(frozen=True, slots=True)
+class GitHubCopilotOAuthHttp:
+    urlopen: Callable[..., Any] = urllib.request.urlopen
+    timeout_seconds: float = 30.0
+
+    def post_form(self, url: str, values: Mapping[str, Any]) -> dict[str, Any]:
+        request = urllib.request.Request(
+            url,
+            data=urllib.parse.urlencode(values).encode("utf-8"),
+            headers={
+                "Accept": "application/json",
+                "Content-Type": "application/x-www-form-urlencoded",
+            },
+            method="POST",
+        )
+        return self._json(request)
+
+    def get_json(
+        self, url: str, headers: Mapping[str, str]
+    ) -> dict[str, Any]:
+        return self._json(
+            urllib.request.Request(url, headers=dict(headers), method="GET")
+        )
+
+    def _json(self, request: urllib.request.Request) -> dict[str, Any]:
+        try:
+            with self.urlopen(request, timeout=self.timeout_seconds) as response:
+                raw = response.read().decode("utf-8", errors="replace")
+        except urllib.error.HTTPError as exc:
+            raw = exc.read().decode("utf-8", errors="replace")
+            raise RuntimeError(
+                f"GitHub OAuth HTTP {exc.code}: {raw[:500]}"
+            ) from exc
+        value = json.loads(raw)
+        if not isinstance(value, dict):
+            raise RuntimeError("GitHub OAuth returned a non-object response.")
+        return value
+
+
+@dataclass(frozen=True, slots=True)
+class GitHubCopilotOAuthClient:
+    http: GitHubCopilotOAuthHttp
+    client_id: str = DEFAULT_GITHUB_COPILOT_CLIENT_ID
+    sleep: Callable[[float], None] = time.sleep
+    now: Callable[[], float] = time.time
+
+    def request_device_code(self) -> dict[str, Any]:
+        response = self.http.post_form(
+            GITHUB_DEVICE_CODE_URL,
+            {"client_id": self.client_id, "scope": "read:user"},
+        )
+        self._raise_oauth_error(response)
+        for field in ("device_code", "user_code", "verification_uri"):
+            if not str(response.get(field) or "").strip():
+                raise RuntimeError(
+                    f"GitHub device authorization omitted {field}."
+                )
+        return response
+
+    def poll_access_token(
+        self,
+        device: Mapping[str, Any],
+        on_pending: Callable[[int], None] | None = None,
+    ) -> str:
+        device_code = str(device.get("device_code") or "")
+        interval = max(1, int(device.get("interval") or 5))
+        expires_in = max(interval, int(device.get("expires_in") or 900))
+        deadline = self.now() + expires_in
+        attempt = 0
+        while self.now() < deadline:
+            self.sleep(interval)
+            attempt += 1
+            response = self.http.post_form(
+                GITHUB_ACCESS_TOKEN_URL,
+                {
+                    "client_id": self.client_id,
+                    "device_code": device_code,
+                    "grant_type": (
+                        "urn:ietf:params:oauth:grant-type:device_code"
+                    ),
+                },
+            )
+            access_token = str(response.get("access_token") or "").strip()
+            if access_token:
+                return access_token
+            error = str(response.get("error") or "").strip()
+            if error == "authorization_pending":
+                if on_pending is not None:
+                    on_pending(attempt)
+                continue
+            if error == "slow_down":
+                interval += 5
+                continue
+            self._raise_oauth_error(response)
+        raise RuntimeError("GitHub device authorization expired.")
+
+    def exchange_copilot_token(
+        self, github_access_token: str
+    ) -> tuple[str, int]:
+        response = self.http.get_json(
+            GITHUB_COPILOT_TOKEN_URL,
+            {
+                "Authorization": f"token {github_access_token}",
+                "Accept": "application/json",
+                "User-Agent": COPILOT_USER_AGENT,
+                "Editor-Version": f"vscode/{COPILOT_VSCODE_VERSION}",
+                "Editor-Plugin-Version": (
+                    f"copilot-chat/{COPILOT_CHAT_VERSION}"
+                ),
+                "X-GitHub-Api-Version": COPILOT_API_VERSION,
+            },
+        )
+        token = str(response.get("token") or "").strip()
+        try:
+            expires_at = int(response.get("expires_at") or 0)
+        except (TypeError, ValueError):
+            expires_at = 0
+        if not token or not expires_at:
+            raise RuntimeError(
+                "GitHub did not return a usable Copilot token. "
+                "Confirm that this account has Copilot access."
+            )
+        return token, expires_at
+
+    def github_login(self, github_access_token: str) -> str:
+        response = self.http.get_json(
+            GITHUB_USER_URL,
+            {
+                "Authorization": f"Bearer {github_access_token}",
+                "Accept": "application/json",
+                "User-Agent": COPILOT_USER_AGENT,
+                "X-GitHub-Api-Version": GITHUB_API_VERSION,
+            },
+        )
+        return str(response.get("login") or "").strip()
+
+    @staticmethod
+    def _raise_oauth_error(response: Mapping[str, Any]) -> None:
+        error = str(response.get("error") or "").strip()
+        if not error:
+            return
+        detail = str(response.get("error_description") or error)
+        raise RuntimeError(f"GitHub OAuth failed: {detail}")
+
+
+@dataclass(frozen=True, slots=True)
+class GitHubCopilotOAuthService:
+    repository: GitHubCopilotOAuthRepository
+    client: GitHubCopilotOAuthClient
+    now: Callable[[], float] = time.time
+
+    def current_token(self) -> str:
+        credentials = self.repository.load()
+        if credentials.copilot_token_is_fresh(self.now()):
+            return credentials.copilot_token
+        if not credentials.github_access_token:
+            return ""
+        token, expires_at = self.client.exchange_copilot_token(
+            credentials.github_access_token
+        )
+        refreshed = GitHubCopilotOAuthCredentials(
+            github_access_token=credentials.github_access_token,
+            copilot_token=token,
+            copilot_token_expires_at=expires_at,
+            github_login=credentials.github_login,
+        )
+        self.repository.save(refreshed)
+        return token
+
+    def force_refresh(self) -> str:
+        credentials = self.repository.load()
+        if not credentials.github_access_token:
+            return ""
+        token, expires_at = self.client.exchange_copilot_token(
+            credentials.github_access_token
+        )
+        self.repository.save(
+            GitHubCopilotOAuthCredentials(
+                github_access_token=credentials.github_access_token,
+                copilot_token=token,
+                copilot_token_expires_at=expires_at,
+                github_login=credentials.github_login,
+            )
+        )
+        return token
+
+    def login(
+        self,
+        show_device: Callable[[str, str], None],
+        on_pending: Callable[[int], None] | None = None,
+    ) -> GitHubCopilotOAuthCredentials:
+        device = self.client.request_device_code()
+        show_device(
+            str(device["verification_uri"]),
+            str(device["user_code"]),
+        )
+        access_token = self.client.poll_access_token(device, on_pending)
+        copilot_token, expires_at = self.client.exchange_copilot_token(
+            access_token
+        )
+        login = self.client.github_login(access_token)
+        credentials = GitHubCopilotOAuthCredentials(
+            github_access_token=access_token,
+            copilot_token=copilot_token,
+            copilot_token_expires_at=expires_at,
+            github_login=login,
+        )
+        self.repository.save(credentials)
+        return credentials
+
+    def status(self) -> tuple[bool, str, int]:
+        credentials = self.repository.load()
+        return (
+            bool(credentials.github_access_token),
+            credentials.github_login,
+            credentials.copilot_token_expires_at,
+        )
+
+    def logout(self) -> bool:
+        return self.repository.clear()
+
+
+__all__ = [
+    "COPILOT_API_VERSION",
+    "COPILOT_CHAT_VERSION",
+    "COPILOT_USER_AGENT",
+    "COPILOT_VSCODE_VERSION",
+    "DEFAULT_GITHUB_COPILOT_CLIENT_ID",
+    "GITHUB_ACCESS_TOKEN_URL",
+    "GITHUB_COPILOT_TOKEN_URL",
+    "GITHUB_DEVICE_CODE_URL",
+    "GitHubCopilotOAuthClient",
+    "GitHubCopilotOAuthCredentials",
+    "GitHubCopilotOAuthHttp",
+    "GitHubCopilotOAuthRepository",
+    "GitHubCopilotOAuthService",
+]

package/ciel_runtime_support/github_copilot_oauth_runtime.py

@@ -0,0 +1,213 @@
+"""Runtime application service for the GitHub Copilot OAuth provider."""
+
+from __future__ import annotations
+
+import os
+import time
+import urllib.error
+import urllib.request
+import webbrowser
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any, Callable, Mapping
+
+from .github_copilot_oauth import (
+    DEFAULT_GITHUB_COPILOT_CLIENT_ID,
+    GitHubCopilotOAuthClient,
+    GitHubCopilotOAuthHttp,
+    GitHubCopilotOAuthRepository,
+    GitHubCopilotOAuthService,
+)
+
+
+@dataclass(frozen=True, slots=True)
+class GitHubCopilotOAuthRuntimePorts:
+    clear_model_cache: Callable[[], None]
+    log: Callable[[str, str], Any]
+    provider_headers: Callable[[str, dict[str, Any]], dict[str, str]]
+    network_open: Callable[..., Any]
+
+
+class GitHubCopilotOAuthRuntime:
+    provider = "github-copilot-oauth"
+
+    def __init__(
+        self,
+        config_dir: Path,
+        ports: GitHubCopilotOAuthRuntimePorts,
+        environ: Mapping[str, str] | None = None,
+    ) -> None:
+        self._path = config_dir / "github-copilot-oauth.json"
+        self._ports = ports
+        self._environ = os.environ if environ is None else environ
+
+    def service(self) -> GitHubCopilotOAuthService:
+        client_id = str(
+            self._environ.get("CIEL_RUNTIME_GITHUB_COPILOT_CLIENT_ID")
+            or DEFAULT_GITHUB_COPILOT_CLIENT_ID
+        ).strip()
+        return GitHubCopilotOAuthService(
+            repository=GitHubCopilotOAuthRepository(self._path),
+            client=GitHubCopilotOAuthClient(
+                http=GitHubCopilotOAuthHttp(),
+                client_id=client_id,
+            ),
+        )
+
+    def token(self) -> str:
+        try:
+            return self.service().current_token()
+        except Exception as exc:
+            self._ports.log(
+                "WARN",
+                "github_copilot_oauth_token_unavailable "
+                f"error={type(exc).__name__}: {exc}",
+            )
+            return ""
+
+    def force_refresh(self) -> str:
+        try:
+            return self.service().force_refresh()
+        except Exception as exc:
+            self._ports.log(
+                "WARN",
+                "github_copilot_oauth_force_refresh_failed "
+                f"error={type(exc).__name__}: {exc}",
+            )
+            return ""
+
+    def open(
+        self,
+        request: urllib.request.Request,
+        timeout: float,
+        provider: str | None,
+        config: dict[str, Any] | None,
+    ) -> Any:
+        try:
+            return self._ports.network_open(
+                request, timeout, provider, config, self._ports.log
+            )
+        except urllib.error.HTTPError as exc:
+            if (
+                provider != self.provider
+                or exc.code not in (401, 403)
+                or config is None
+            ):
+                raise
+            if not self.force_refresh():
+                raise
+            headers = dict(request.header_items())
+            headers.update(self._ports.provider_headers(provider, config))
+            retry = urllib.request.Request(
+                request.full_url,
+                data=request.data,
+                headers=headers,
+                method=request.get_method(),
+            )
+            self._ports.log(
+                "INFO",
+                "github_copilot_oauth_token_refreshed_after_auth_error "
+                f"status={exc.code}",
+            )
+            return self._ports.network_open(
+                retry, timeout, provider, config, self._ports.log
+            )
+
+    def action(self, action: str) -> list[str]:
+        service = self.service()
+        action = str(action or "status").strip().lower()
+        if action == "logout":
+            removed = service.logout()
+            self._ports.clear_model_cache()
+            return [
+                "GitHub Copilot OAuth credentials cleared."
+                if removed
+                else "GitHub Copilot OAuth credentials were not stored."
+            ]
+        if action == "status":
+            connected, login, expires_at = service.status()
+            if not connected:
+                return [
+                    "GitHub Copilot OAuth: not connected. "
+                    "Run: ciel-runtimectl copilot-oauth login"
+                ]
+            account = f" ({login})" if login else ""
+            expiry = (
+                time.strftime(
+                    "%Y-%m-%d %H:%M:%S %Z",
+                    time.localtime(expires_at),
+                )
+                if expires_at
+                else "unknown"
+            )
+            return [
+                f"GitHub Copilot OAuth: connected{account}; "
+                f"Copilot token expires {expiry}."
+            ]
+        credentials = service.login(
+            self._show_device,
+            on_pending=lambda attempt: (
+                print("Waiting for GitHub authorization...", flush=True)
+                if attempt % 6 == 0
+                else None
+            ),
+        )
+        self._ports.clear_model_cache()
+        account = (
+            f" as {credentials.github_login}"
+            if credentials.github_login
+            else ""
+        )
+        return [
+            f"GitHub Copilot OAuth connected{account}. "
+            "Select provider: ciel-runtimectl provider github-copilot-oauth"
+        ]
+
+    def panel_rows(
+        self, provider: str
+    ) -> tuple[list[str], list[str]] | None:
+        if provider != self.provider:
+            return None
+        connected, login, _expires_at = self.service().status()
+        status = (
+            f"Connected as {login}"
+            if connected and login
+            else "Connected"
+            if connected
+            else "Not connected"
+        )
+        return (
+            [
+                f"OAuth status: {status}",
+                "Login with GitHub Device Code",
+                "Refresh OAuth status",
+                "Logout and clear OAuth credentials",
+                "Back",
+            ],
+            [
+                "oauth-status",
+                "oauth-login",
+                "oauth-status",
+                "oauth-logout",
+                "back",
+            ],
+        )
+
+    @staticmethod
+    def _show_device(verification_uri: str, user_code: str) -> None:
+        print(
+            "GitHub Copilot OAuth device login\n"
+            f" Open: {verification_uri}\n"
+            f" Code: {user_code}",
+            flush=True,
+        )
+        try:
+            webbrowser.open(verification_uri)
+        except Exception:
+            pass
+
+
+__all__ = [
+    "GitHubCopilotOAuthRuntime",
+    "GitHubCopilotOAuthRuntimePorts",
+]