@shawnstack/quickforge 1.7.4 → 1.7.5

package/server/ai-http-logger.mjs

@@ -3,6 +3,8 @@ import path from 'node:path'
 import { AsyncLocalStorage } from 'node:async_hooks'
 import { randomUUID } from 'node:crypto'
 import { streamSimple } from '@earendil-works/pi-ai/compat'
+import { resolveManagedCloudProvider } from './cloud/runtime.mjs'
+import { ensureCloudChatIdempotencyKey } from './cloud/chat-idempotency-store.mjs'
 import {
   DEFAULT_AI_STREAM_DEADLINE_MS,
   withDefaultAiProviderOptions,
@@ -45,14 +47,27 @@ function writeAiHttpRecord(record) {
   })
 }
 
-function headersToRecord(headers) {
+const SENSITIVE_HEADER_NAMES = new Set([
+  'authorization',
+  'proxy-authorization',
+  'x-api-key',
+  'api-key',
+  'idempotency-key',
+  'cookie',
+  'set-cookie',
+])
+
+export function sanitizeHttpHeaders(headers) {
   const result = {}
   if (!headers) return result
 
   try {
     const iterable = typeof headers.entries === 'function' ? headers.entries() : Object.entries(headers)
     for (const [key, value] of iterable) {
-      result[String(key)] = Array.isArray(value) ? value.join(', ') : String(value)
+      const name = String(key)
+      result[name] = SENSITIVE_HEADER_NAMES.has(name.toLowerCase())
+        ? '[REDACTED]'
+        : Array.isArray(value) ? value.join(', ') : String(value)
     }
   } catch {
     // ignore malformed headers
@@ -61,6 +76,10 @@ function headersToRecord(headers) {
   return result
 }
 
+function headersToRecord(headers) {
+  return sanitizeHttpHeaders(headers)
+}
+
 function isRequest(value) {
   return typeof Request !== 'undefined' && value instanceof Request
 }
@@ -253,6 +272,63 @@ function wrapStreamWithDeadline(stream, deadlineController, deadlineMs) {
   }
 }
 
+function lazyStream(streamPromise) {
+  return {
+    result: () => streamPromise.then((stream) => stream.result()),
+    [Symbol.asyncIterator]() {
+      let iteratorPromise
+      const iterator = () => {
+        iteratorPromise ||= streamPromise.then((stream) => stream[Symbol.asyncIterator]())
+        return iteratorPromise
+      }
+      return {
+        next: async () => (await iterator()).next(),
+        return: async () => {
+          const resolved = await iterator()
+          if (typeof resolved.return === 'function') return resolved.return()
+          return { value: undefined, done: true }
+        },
+      }
+    },
+  }
+}
+
+function createProviderStream(model, context, options) {
+  return aiHttpLogEnabled
+    ? aiHttpContext.run({
+        traceId: randomUUID(),
+        sessionId: options.sessionId,
+        purpose: options.metadata?.quickforgePurpose || 'chat',
+        provider: model?.provider,
+        api: model?.api,
+        model: model?.id,
+      }, () => streamSimple(model, context, options))
+    : streamSimple(model, context, options)
+}
+
+const CLIENT_MESSAGE_ID_FIELD = 'quickforgeClientMessageId'
+
+function logicalMessageIdFromContext(context) {
+  const messages = Array.isArray(context?.messages) ? context.messages : []
+  for (let index = messages.length - 1; index >= 0; index--) {
+    const message = messages[index]
+    if (message?.role !== 'user' && message?.role !== 'user-with-attachments') continue
+    const metadata = message.metadata
+    const messageId = metadata && typeof metadata === 'object' && !Array.isArray(metadata)
+      ? metadata[CLIENT_MESSAGE_ID_FIELD]
+      : undefined
+    return typeof messageId === 'string' && messageId ? messageId : undefined
+  }
+  return undefined
+}
+
+async function managedCloudIdempotencyKey(context, options) {
+  const messageId = logicalMessageIdFromContext(context)
+  return options.sessionId && messageId
+    ? ensureCloudChatIdempotencyKey(options.sessionId, messageId)
+    : randomUUID()
+}
+
 export function streamSimpleWithAiHttpLogging(model, context, options = {}) {
   const providerOptions = withDefaultAiProviderOptions(options)
   const deadlineMs = Number.isFinite(providerOptions.deadlineMs)
@@ -265,16 +341,26 @@ export function streamSimpleWithAiHttpLogging(model, context, options = {}) {
   }
   delete effectiveOptions.deadlineMs
 
-  const stream = aiHttpLogEnabled
-    ? aiHttpContext.run({
-        traceId: randomUUID(),
-        sessionId: effectiveOptions.sessionId,
-        purpose: effectiveOptions.metadata?.quickforgePurpose || 'chat',
-        provider: model?.provider,
-        api: model?.api,
-        model: model?.id,
-      }, () => streamSimple(model, context, effectiveOptions))
-    : streamSimple(model, context, effectiveOptions)
+  const managedCloud = model?.provider === 'quickforge-cloud' && model?.quickforgeModelSource === 'cloud'
+  const stream = managedCloud
+    ? lazyStream(Promise.all([
+        resolveManagedCloudProvider(model, effectiveOptions.signal),
+        managedCloudIdempotencyKey(context, effectiveOptions),
+      ]).then(([resolved, idempotencyKey]) => createProviderStream(
+        {
+          ...resolved.model,
+          headers: {
+            ...(resolved.model.headers || {}),
+            'Idempotency-Key': idempotencyKey,
+          },
+        },
+        context,
+        {
+          ...effectiveOptions,
+          apiKey: resolved.apiKey,
+        },
+      )))
+    : createProviderStream(model, context, effectiveOptions)
 
   return wrapStreamWithDeadline(stream, deadlineController, deadlineMs)
 }

package/server/cloud/chat-idempotency-store.mjs

@@ -0,0 +1,96 @@
+import { createHash, randomUUID } from 'node:crypto'
+import { promises as fs } from 'node:fs'
+import path from 'node:path'
+import { ensureStorage, storageDir } from '../storage.mjs'
+
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
+const MESSAGE_ID_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/
+
+function digest(value) {
+  return createHash('sha256').update(value).digest('hex')
+}
+
+function assertIdentifier(value, label, pattern) {
+  const normalized = typeof value === 'string' ? value.trim() : ''
+  if (!pattern.test(normalized)) throw new Error(`Invalid ${label}.`)
+  return normalized
+}
+
+export function createCloudChatIdempotencyStore({
+  directory = path.join(storageDir, 'security', 'cloud-chat-idempotency'),
+  ensureBaseStorage = ensureStorage,
+} = {}) {
+  function entryPath(sessionId, messageId) {
+    return path.join(directory, digest(sessionId), `${digest(messageId)}.json`)
+  }
+
+  async function ensureDirectory(file) {
+    await ensureBaseStorage()
+    await fs.mkdir(path.dirname(file), { recursive: true, mode: 0o700 })
+  }
+
+  async function readEntry(file, sessionId, messageId) {
+    try {
+      const raw = await fs.readFile(file, 'utf8')
+      const entry = raw.trim() ? JSON.parse(raw) : null
+      if (entry?.sessionId !== sessionId || entry?.messageId !== messageId || !UUID_PATTERN.test(entry?.idempotencyKey || '')) {
+        throw new Error('Invalid QuickForge Cloud chat idempotency record.')
+      }
+      return entry
+    } catch (error) {
+      if (error?.code === 'ENOENT') return null
+      throw error
+    }
+  }
+
+  async function ensure(sessionIdInput, messageIdInput) {
+    const sessionId = assertIdentifier(sessionIdInput, 'session ID', /^.{1,512}$/)
+    const messageId = assertIdentifier(messageIdInput, 'logical message ID', MESSAGE_ID_PATTERN)
+    const file = entryPath(sessionId, messageId)
+    await ensureDirectory(file)
+
+    const existing = await readEntry(file, sessionId, messageId)
+    if (existing) return existing.idempotencyKey
+
+    const entry = {
+      schemaVersion: 1,
+      sessionId,
+      messageId,
+      idempotencyKey: randomUUID(),
+      createdAt: new Date().toISOString(),
+    }
+
+    const temporary = `${file}.${process.pid}.${randomUUID()}.tmp`
+    await fs.writeFile(temporary, `${JSON.stringify(entry, null, 2)}\n`, { encoding: 'utf8', flag: 'wx', mode: 0o600 })
+    try { await fs.chmod(temporary, 0o600) } catch { /* best effort on Windows */ }
+    try {
+      await fs.link(temporary, file)
+      try { await fs.chmod(file, 0o600) } catch { /* best effort on Windows */ }
+      return entry.idempotencyKey
+    } catch (error) {
+      if (error?.code !== 'EEXIST') throw error
+      const concurrent = await readEntry(file, sessionId, messageId)
+      if (!concurrent) throw error
+      return concurrent.idempotencyKey
+    } finally {
+      await fs.rm(temporary, { force: true })
+    }
+  }
+
+  async function removeSession(sessionIdInput) {
+    const sessionId = assertIdentifier(sessionIdInput, 'session ID', /^.{1,512}$/)
+    await fs.rm(path.join(directory, digest(sessionId)), { recursive: true, force: true })
+  }
+
+  return { directory, ensure, removeSession }
+}
+
+const defaultStore = createCloudChatIdempotencyStore()
+
+export function ensureCloudChatIdempotencyKey(sessionId, messageId) {
+  return defaultStore.ensure(sessionId, messageId)
+}
+
+export function deleteCloudChatIdempotencySession(sessionId) {
+  return defaultStore.removeSession(sessionId)
+}

package/server/cloud/client.mjs

@@ -0,0 +1,102 @@
+import { cloudEndpoint } from './config.mjs'
+
+export class CloudApiError extends Error {
+  constructor(message, { status = 0, code = 'cloud_request_failed', retryable = false, details } = {}) {
+    super(message)
+    this.name = 'CloudApiError'
+    this.status = status
+    this.code = code
+    this.retryable = retryable
+    this.details = details
+  }
+}
+
+async function parseError(response) {
+  let payload
+  try { payload = await response.json() } catch { payload = undefined }
+  const error = payload?.error
+  const structured = error && typeof error === 'object' ? error : undefined
+  const oauthCode = typeof error === 'string' ? error : undefined
+  return new CloudApiError(
+    structured?.message || payload?.error_description || `QuickForge Cloud request failed (${response.status}).`,
+    {
+      status: response.status,
+      code: structured?.code || payload?.code || oauthCode || 'cloud_request_failed',
+      retryable: Boolean(structured?.retryable || payload?.retryable),
+      details: structured?.details || payload?.details,
+    },
+  )
+}
+
+function timeoutSignal(timeoutMs, outerSignal) {
+  const timeout = AbortSignal.timeout(timeoutMs)
+  return outerSignal ? AbortSignal.any([outerSignal, timeout]) : timeout
+}
+
+export class CloudClient {
+  constructor({ baseUrl, timeoutMs = 10_000, fetchImpl = fetch } = {}) {
+    if (!(baseUrl instanceof URL)) throw new Error('CloudClient requires a configured base URL.')
+    this.baseUrl = baseUrl
+    this.timeoutMs = timeoutMs
+    this.fetch = fetchImpl
+  }
+
+  async request(pathname, { method = 'GET', token, body, headers, signal, raw = false, timeout = true } = {}) {
+    const requestHeaders = { Accept: 'application/json', ...headers }
+    if (body !== undefined) requestHeaders['Content-Type'] = 'application/json'
+    if (token) requestHeaders.Authorization = `Bearer ${token}`
+    const response = await this.fetch(cloudEndpoint(this.baseUrl, pathname), {
+      method,
+      headers: requestHeaders,
+      body: body === undefined ? undefined : JSON.stringify(body),
+      signal: timeout ? timeoutSignal(this.timeoutMs, signal) : signal,
+      redirect: 'error',
+    })
+    if (!response.ok) throw await parseError(response)
+    if (raw) return response
+    if (response.status === 204) return undefined
+    return response.json()
+  }
+
+  health(signal) { return this.request('healthz', { signal }) }
+  ready(signal) { return this.request('readyz', { signal }) }
+  registerGuest(input, idempotencyKey, signal) {
+    return this.request('v1/guest/installations', {
+      method: 'POST', body: input, headers: { 'Idempotency-Key': idempotencyKey }, signal,
+    })
+  }
+  refresh(refreshToken, signal) {
+    return this.request('oauth/token', {
+      method: 'POST', body: { grantType: 'refresh_token', refreshToken }, signal,
+    })
+  }
+  authorizeDevice(token, installationId, clientId = 'quickforge-desktop', signal) {
+    return this.request('oauth/device_authorization', {
+      method: 'POST', token, body: { installationId, clientId }, signal,
+    })
+  }
+  exchangeDeviceCode(deviceCode, clientId = 'quickforge-desktop', signal) {
+    return this.request('oauth/token', {
+      method: 'POST',
+      body: {
+        grantType: 'urn:ietf:params:oauth:grant-type:device_code',
+        deviceCode,
+        clientId,
+      },
+      signal,
+    })
+  }
+  me(token, signal) { return this.request('v1/me', { token, signal }) }
+  models(token, signal) { return this.request('v1/models', { token, signal }) }
+  usage(token, signal) { return this.request('v1/usage', { token, signal }) }
+  installations(token, signal) { return this.request('v1/installations', { token, signal }) }
+  revokeInstallation(token, installationId, signal) {
+    return this.request(`v1/installations/${encodeURIComponent(installationId)}`, { method: 'DELETE', token, signal })
+  }
+  chat(token, payload, idempotencyKey, signal) {
+    return this.request('v1/chat/completions', {
+      method: 'POST', token, body: payload,
+      headers: { 'Idempotency-Key': idempotencyKey }, signal, raw: true, timeout: false,
+    })
+  }
+}

package/server/cloud/config.mjs

@@ -0,0 +1,53 @@
+import net from 'node:net'
+
+const DEFAULT_TIMEOUT_MS = 10_000
+
+function isLoopbackHost(hostname) {
+  const host = String(hostname || '').toLowerCase()
+  if (host === 'localhost' || host.endsWith('.localhost')) return true
+  const ip = net.isIP(host)
+  if (ip === 4) return host.startsWith('127.')
+  if (ip === 6) return host === '::1' || host === '0:0:0:0:0:0:0:1'
+  return false
+}
+
+export function parseCloudBaseUrl(value, _options = {}) {
+  const raw = typeof value === 'string' ? value.trim() : ''
+  if (!raw) return undefined
+
+  let url
+  try {
+    url = new URL(raw)
+  } catch {
+    throw new Error('QUICKFORGE_CLOUD_URL must be a valid URL.')
+  }
+
+  if (url.username || url.password || url.search || url.hash) {
+    throw new Error('QUICKFORGE_CLOUD_URL must not contain credentials, query parameters, or fragments.')
+  }
+  if (url.protocol !== 'https:') {
+    if (!(url.protocol === 'http:' && isLoopbackHost(url.hostname))) {
+      throw new Error('QUICKFORGE_CLOUD_URL must use HTTPS. HTTP is allowed only for loopback addresses.')
+    }
+  }
+  if (url.pathname.includes('..')) throw new Error('QUICKFORGE_CLOUD_URL contains an unsafe path.')
+  url.pathname = `${url.pathname.replace(/\/+$/, '')}/`
+  return url
+}
+
+export function cloudEndpoint(baseUrl, pathname) {
+  if (!(baseUrl instanceof URL)) throw new Error('QuickForge Cloud is not configured.')
+  const relative = String(pathname || '').replace(/^\/+/, '')
+  if (!relative || relative.split('/').includes('..')) throw new Error('Invalid QuickForge Cloud endpoint.')
+  return new URL(relative, baseUrl)
+}
+
+export function readCloudConfig(env = process.env) {
+  const baseUrl = parseCloudBaseUrl(env.QUICKFORGE_CLOUD_URL)
+  const timeoutValue = Number(env.QUICKFORGE_CLOUD_TIMEOUT_MS || DEFAULT_TIMEOUT_MS)
+  return {
+    enabled: Boolean(baseUrl),
+    baseUrl,
+    timeoutMs: Number.isFinite(timeoutValue) ? Math.min(60_000, Math.max(1_000, timeoutValue)) : DEFAULT_TIMEOUT_MS,
+  }
+}

package/server/cloud/credential-store.mjs

@@ -0,0 +1,193 @@
+import { generateKeyPair } from 'node:crypto'
+import { promises as fs } from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { promisify } from 'node:util'
+import { createRandomToken } from '../utils/password-auth.mjs'
+import { ensureStorage, storageDir } from '../storage.mjs'
+
+const generateKeyPairAsync = promisify(generateKeyPair)
+const SCHEMA_VERSION = 1
+const ACCOUNT_FIELDS = ['id', 'email', 'plan']
+
+function publicAccount(value) {
+  if (!value || typeof value !== 'object') return undefined
+  const account = {}
+  for (const field of ACCOUNT_FIELDS) {
+    const candidate = value[field]
+    if (typeof candidate === 'string' && candidate) account[field] = candidate
+  }
+  return Object.keys(account).length ? account : undefined
+}
+
+function publicPendingDeviceFlow(value) {
+  if (!value || typeof value !== 'object') return undefined
+  const expiresAt = Number(value.expiresAt)
+  if (!Number.isFinite(expiresAt)) return undefined
+  return {
+    userCode: String(value.userCode || ''),
+    verificationUri: String(value.verificationUri || ''),
+    verificationUriComplete: String(value.verificationUriComplete || ''),
+    expiresAt,
+    interval: Math.max(1, Number(value.interval) || 5),
+    status: String(value.status || 'pending'),
+  }
+}
+
+function platformName(platform = process.platform) {
+  if (platform === 'win32') return 'windows'
+  if (platform === 'darwin') return 'macos'
+  return 'linux'
+}
+
+function defaultRecord({ installationName, platform, clientVersion } = {}) {
+  return {
+    schemaVersion: SCHEMA_VERSION,
+    mode: 'local',
+    installationName: installationName || os.hostname() || 'QuickForge',
+    platform: platformName(platform),
+    clientVersion: clientVersion || 'unknown',
+    updatedAt: new Date().toISOString(),
+  }
+}
+
+function normalizeRecord(value, defaults) {
+  const input = value && typeof value === 'object' ? value : {}
+  const base = defaultRecord(defaults)
+  return {
+    ...base,
+    ...input,
+    schemaVersion: SCHEMA_VERSION,
+    mode: ['local', 'guest', 'account'].includes(input.mode) ? input.mode : 'local',
+    installationName: String(input.installationName || base.installationName).slice(0, 120),
+    platform: ['windows', 'macos', 'linux'].includes(input.platform) ? input.platform : base.platform,
+    clientVersion: String(input.clientVersion || base.clientVersion).slice(0, 80),
+  }
+}
+
+function publicRecord(record) {
+  return {
+    configured: true,
+    mode: record.mode,
+    installationId: record.installationId,
+    installationName: record.installationName,
+    platform: record.platform,
+    clientVersion: record.clientVersion,
+    hasInstallationKey: Boolean(record.publicKey && record.privateKeyPkcs8),
+    hasSession: Boolean(record.refreshToken),
+    account: publicAccount(record.account),
+    pendingDeviceFlow: publicPendingDeviceFlow(record.pendingDeviceFlow),
+    updatedAt: record.updatedAt,
+  }
+}
+
+async function generateInstallationKeyPair() {
+  const { publicKey, privateKey } = await generateKeyPairAsync('ed25519')
+  const publicJwk = publicKey.export({ format: 'jwk' })
+  return {
+    publicKey: publicJwk.x,
+    privateKeyPkcs8: privateKey.export({ format: 'der', type: 'pkcs8' }).toString('base64url'),
+  }
+}
+
+export function createCloudCredentialStore({
+  filePath = path.join(storageDir, 'security', 'cloud-identity.json'),
+  ensureBaseStorage = ensureStorage,
+  installationName,
+  platform,
+  clientVersion,
+} = {}) {
+  let queue = Promise.resolve()
+  const defaults = { installationName, platform, clientVersion }
+
+  async function ensureDirectory() {
+    await ensureBaseStorage()
+    await fs.mkdir(path.dirname(filePath), { recursive: true, mode: 0o700 })
+  }
+
+  async function read() {
+    await ensureDirectory()
+    try {
+      const raw = await fs.readFile(filePath, 'utf8')
+      return normalizeRecord(raw.trim() ? JSON.parse(raw) : {}, defaults)
+    } catch (error) {
+      if (error?.code === 'ENOENT') return defaultRecord(defaults)
+      throw error
+    }
+  }
+
+  async function writeNow(record) {
+    await ensureDirectory()
+    const normalized = normalizeRecord({ ...record, updatedAt: new Date().toISOString() }, defaults)
+    const temporary = `${filePath}.${process.pid}.${createRandomToken(8)}.tmp`
+    await fs.writeFile(temporary, `${JSON.stringify(normalized, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 })
+    try { await fs.chmod(temporary, 0o600) } catch { /* best effort on Windows */ }
+    try {
+      await fs.rename(temporary, filePath)
+    } catch (error) {
+      if (!['EEXIST', 'EPERM'].includes(error?.code)) throw error
+      await fs.rm(filePath, { force: true })
+      await fs.rename(temporary, filePath)
+    }
+    try { await fs.chmod(filePath, 0o600) } catch { /* best effort on Windows */ }
+    return normalized
+  }
+
+  function update(mutator) {
+    const next = queue.catch(() => undefined).then(async () => {
+      const current = await read()
+      const result = await mutator({ ...current })
+      return writeNow(result || current)
+    })
+    queue = next
+    return next
+  }
+
+  async function ensureInstallation() {
+    const current = await read()
+    if (current.publicKey && current.privateKeyPkcs8) return current
+    return update(async (record) => ({ ...record, ...(await generateInstallationKeyPair()) }))
+  }
+
+  async function rotateInstallation() {
+    const keyPair = await generateInstallationKeyPair()
+    return update((record) => ({
+      ...record,
+      ...keyPair,
+      mode: 'local',
+      installationId: undefined,
+      refreshToken: undefined,
+      sessionCloudUrl: undefined,
+      pendingRegistrationKey: undefined,
+      pendingRegistrationHash: undefined,
+      pendingDeviceFlow: undefined,
+      account: undefined,
+      rotateInstallationBeforeRegistration: undefined,
+    }))
+  }
+
+  return {
+    filePath,
+    read,
+    update,
+    ensureInstallation,
+    rotateInstallation,
+    async readPublic() { return publicRecord(await read()) },
+    async clearSession({ rotateInstallationBeforeRegistration = false } = {}) {
+      return update((record) => ({
+        ...record,
+        mode: 'local',
+        installationId: undefined,
+        refreshToken: undefined,
+        sessionCloudUrl: undefined,
+        pendingRegistrationKey: undefined,
+        pendingRegistrationHash: undefined,
+        pendingDeviceFlow: undefined,
+        account: undefined,
+        rotateInstallationBeforeRegistration: rotateInstallationBeforeRegistration || undefined,
+      }))
+    },
+  }
+}
+
+export { publicRecord as publicCloudCredentialRecord }