@symerian/symi 3.0.17 → 3.0.19

package/extensions/pipeline/src/pipeline-tool.ts

@@ -1,266 +0,0 @@
-import { spawn } from "node:child_process";
-import path from "node:path";
-import { Type } from "@sinclair/typebox";
-import type { SymiPluginApi } from "../../../src/plugins/types.js";
-import { resolveWindowsPipelineSpawn } from "./windows-spawn.js";
-
-type PipelineEnvelope =
-  | {
-      ok: true;
-      status: "ok" | "needs_approval" | "cancelled";
-      output: unknown[];
-      requiresApproval: null | {
-        type: "approval_request";
-        prompt: string;
-        items: unknown[];
-        resumeToken?: string;
-      };
-    }
-  | {
-      ok: false;
-      error: { type?: string; message: string };
-    };
-
-function normalizeForCwdSandbox(p: string): string {
-  const normalized = path.normalize(p);
-  return process.platform === "win32" ? normalized.toLowerCase() : normalized;
-}
-
-function resolveCwd(cwdRaw: unknown): string {
-  if (typeof cwdRaw !== "string" || !cwdRaw.trim()) {
-    return process.cwd();
-  }
-  const cwd = cwdRaw.trim();
-  if (path.isAbsolute(cwd)) {
-    throw new Error("cwd must be a relative path");
-  }
-  const base = process.cwd();
-  const resolved = path.resolve(base, cwd);
-
-  const rel = path.relative(normalizeForCwdSandbox(base), normalizeForCwdSandbox(resolved));
-  if (rel === "" || rel === ".") {
-    return resolved;
-  }
-  if (rel.startsWith("..") || path.isAbsolute(rel)) {
-    throw new Error("cwd must stay within the gateway working directory");
-  }
-  return resolved;
-}
-
-async function runPipelineSubprocessOnce(params: {
-  execPath: string;
-  argv: string[];
-  cwd: string;
-  timeoutMs: number;
-  maxStdoutBytes: number;
-}) {
-  const { execPath, argv, cwd } = params;
-  const timeoutMs = Math.max(200, params.timeoutMs);
-  const maxStdoutBytes = Math.max(1024, params.maxStdoutBytes);
-
-  const env = { ...process.env, LOBSTER_MODE: "tool" } as Record<string, string | undefined>;
-  const nodeOptions = env.NODE_OPTIONS ?? "";
-  if (nodeOptions.includes("--inspect")) {
-    delete env.NODE_OPTIONS;
-  }
-  const spawnTarget =
-    process.platform === "win32"
-      ? resolveWindowsPipelineSpawn(execPath, argv, env)
-      : { command: execPath, argv };
-
-  return await new Promise<{ stdout: string }>((resolve, reject) => {
-    const child = spawn(spawnTarget.command, spawnTarget.argv, {
-      cwd,
-      stdio: ["ignore", "pipe", "pipe"],
-      env,
-      windowsHide: spawnTarget.windowsHide,
-    });
-
-    let stdout = "";
-    let stdoutBytes = 0;
-    let stderr = "";
-    let settled = false;
-
-    const settle = (
-      result: { ok: true; value: { stdout: string } } | { ok: false; error: Error },
-    ) => {
-      if (settled) {
-        return;
-      }
-      settled = true;
-      clearTimeout(timer);
-      if (result.ok) {
-        resolve(result.value);
-      } else {
-        reject(result.error);
-      }
-    };
-
-    const failAndTerminate = (message: string) => {
-      try {
-        child.kill("SIGKILL");
-      } finally {
-        settle({ ok: false, error: new Error(message) });
-      }
-    };
-
-    child.stdout?.setEncoding("utf8");
-    child.stderr?.setEncoding("utf8");
-
-    child.stdout?.on("data", (chunk) => {
-      const str = String(chunk);
-      stdoutBytes += Buffer.byteLength(str, "utf8");
-      if (stdoutBytes > maxStdoutBytes) {
-        failAndTerminate("pipeline output exceeded maxStdoutBytes");
-        return;
-      }
-      stdout += str;
-    });
-
-    child.stderr?.on("data", (chunk) => {
-      stderr += String(chunk);
-    });
-
-    const timer = setTimeout(() => {
-      failAndTerminate("pipeline subprocess timed out");
-    }, timeoutMs);
-
-    child.once("error", (err) => {
-      settle({ ok: false, error: err });
-    });
-
-    child.once("exit", (code) => {
-      if (code !== 0) {
-        settle({
-          ok: false,
-          error: new Error(`pipeline failed (${code ?? "?"}): ${stderr.trim() || stdout.trim()}`),
-        });
-        return;
-      }
-      settle({ ok: true, value: { stdout } });
-    });
-  });
-}
-
-function parseEnvelope(stdout: string): PipelineEnvelope {
-  const trimmed = stdout.trim();
-
-  const tryParse = (input: string) => {
-    try {
-      return JSON.parse(input) as unknown;
-    } catch {
-      return undefined;
-    }
-  };
-
-  let parsed: unknown = tryParse(trimmed);
-
-  // Some environments can leak extra stdout (e.g. warnings/logs) before the
-  // final JSON envelope. Be tolerant and parse the last JSON-looking suffix.
-  if (parsed === undefined) {
-    const suffixMatch = trimmed.match(/({[\s\S]*}|\[[\s\S]*])\s*$/);
-    if (suffixMatch?.[1]) {
-      parsed = tryParse(suffixMatch[1]);
-    }
-  }
-
-  if (parsed === undefined) {
-    throw new Error("pipeline returned invalid JSON");
-  }
-
-  if (!parsed || typeof parsed !== "object") {
-    throw new Error("pipeline returned invalid JSON envelope");
-  }
-
-  const ok = (parsed as { ok?: unknown }).ok;
-  if (ok === true || ok === false) {
-    return parsed as PipelineEnvelope;
-  }
-
-  throw new Error("pipeline returned invalid JSON envelope");
-}
-
-function buildPipelineArgv(action: string, params: Record<string, unknown>): string[] {
-  if (action === "run") {
-    const pipeline = typeof params.pipeline === "string" ? params.pipeline : "";
-    if (!pipeline.trim()) {
-      throw new Error("pipeline required");
-    }
-    const argv = ["run", "--mode", "tool", pipeline];
-    const argsJson = typeof params.argsJson === "string" ? params.argsJson : "";
-    if (argsJson.trim()) {
-      argv.push("--args-json", argsJson);
-    }
-    return argv;
-  }
-  if (action === "resume") {
-    const token = typeof params.token === "string" ? params.token : "";
-    if (!token.trim()) {
-      throw new Error("token required");
-    }
-    const approve = params.approve;
-    if (typeof approve !== "boolean") {
-      throw new Error("approve required");
-    }
-    return ["resume", "--token", token, "--approve", approve ? "yes" : "no"];
-  }
-  throw new Error(`Unknown action: ${action}`);
-}
-
-export function createPipelineTool(api: SymiPluginApi) {
-  return {
-    name: "pipeline",
-    label: "Pipeline Workflow",
-    description:
-      "Run pipelines as a local-first workflow runtime (typed JSON envelope + resumable approvals).",
-    parameters: Type.Object({
-      // NOTE: Prefer string enums in tool schemas; some providers reject unions/anyOf.
-      action: Type.Unsafe<"run" | "resume">({ type: "string", enum: ["run", "resume"] }),
-      pipeline: Type.Optional(Type.String()),
-      argsJson: Type.Optional(Type.String()),
-      token: Type.Optional(Type.String()),
-      approve: Type.Optional(Type.Boolean()),
-      cwd: Type.Optional(
-        Type.String({
-          description:
-            "Relative working directory (optional). Must stay within the gateway working directory.",
-        }),
-      ),
-      timeoutMs: Type.Optional(Type.Number()),
-      maxStdoutBytes: Type.Optional(Type.Number()),
-    }),
-    async execute(_id: string, params: Record<string, unknown>) {
-      const action = typeof params.action === "string" ? params.action.trim() : "";
-      if (!action) {
-        throw new Error("action required");
-      }
-
-      const execPath = "lobster";
-      const cwd = resolveCwd(params.cwd);
-      const timeoutMs = typeof params.timeoutMs === "number" ? params.timeoutMs : 20_000;
-      const maxStdoutBytes =
-        typeof params.maxStdoutBytes === "number" ? params.maxStdoutBytes : 512_000;
-
-      const argv = buildPipelineArgv(action, params);
-
-      if (api.runtime?.version && api.logger?.debug) {
-        api.logger.debug(`pipeline plugin runtime=${api.runtime.version}`);
-      }
-
-      const { stdout } = await runPipelineSubprocessOnce({
-        execPath,
-        argv,
-        cwd,
-        timeoutMs,
-        maxStdoutBytes,
-      });
-
-      const envelope = parseEnvelope(stdout);
-
-      return {
-        content: [{ type: "text", text: JSON.stringify(envelope, null, 2) }],
-        details: envelope,
-      };
-    },
-  };
-}

package/extensions/pipeline/src/windows-spawn.test.ts

@@ -1,148 +0,0 @@
-import fs from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { afterEach, beforeEach, describe, expect, it } from "vitest";
-import { resolveWindowsPipelineSpawn } from "./windows-spawn.js";
-
-function setProcessPlatform(platform: NodeJS.Platform) {
-  Object.defineProperty(process, "platform", {
-    value: platform,
-    configurable: true,
-  });
-}
-
-describe("resolveWindowsPipelineSpawn", () => {
-  let tempDir = "";
-  const originalPlatform = Object.getOwnPropertyDescriptor(process, "platform");
-  const originalPath = process.env.PATH;
-  const originalPathAlt = process.env.Path;
-  const originalPathExt = process.env.PATHEXT;
-  const originalPathExtAlt = process.env.Pathext;
-
-  beforeEach(async () => {
-    tempDir = await fs.mkdtemp(path.join(os.tmpdir(), "symi-pipeline-win-spawn-"));
-    setProcessPlatform("win32");
-  });
-
-  afterEach(async () => {
-    if (originalPlatform) {
-      Object.defineProperty(process, "platform", originalPlatform);
-    }
-    if (originalPath === undefined) {
-      delete process.env.PATH;
-    } else {
-      process.env.PATH = originalPath;
-    }
-    if (originalPathAlt === undefined) {
-      delete process.env.Path;
-    } else {
-      process.env.Path = originalPathAlt;
-    }
-    if (originalPathExt === undefined) {
-      delete process.env.PATHEXT;
-    } else {
-      process.env.PATHEXT = originalPathExt;
-    }
-    if (originalPathExtAlt === undefined) {
-      delete process.env.Pathext;
-    } else {
-      process.env.Pathext = originalPathExtAlt;
-    }
-    if (tempDir) {
-      await fs.rm(tempDir, { recursive: true, force: true });
-      tempDir = "";
-    }
-  });
-
-  it("unwraps cmd shim with %dp0% token", async () => {
-    const scriptPath = path.join(tempDir, "shim-dist", "lobster-cli.cjs");
-    const shimPath = path.join(tempDir, "shim", "lobster.cmd");
-    await fs.mkdir(path.dirname(scriptPath), { recursive: true });
-    await fs.mkdir(path.dirname(shimPath), { recursive: true });
-    await fs.writeFile(scriptPath, "module.exports = {};\n", "utf8");
-    await fs.writeFile(
-      shimPath,
-      `@echo off\r\n"%dp0%\\..\\shim-dist\\lobster-cli.cjs" %*\r\n`,
-      "utf8",
-    );
-
-    const target = resolveWindowsPipelineSpawn(shimPath, ["run", "noop"], process.env);
-    expect(target.command).toBe(process.execPath);
-    expect(target.argv).toEqual([scriptPath, "run", "noop"]);
-    expect(target.windowsHide).toBe(true);
-  });
-
-  it("unwraps cmd shim with %~dp0% token", async () => {
-    const scriptPath = path.join(tempDir, "shim-dist", "lobster-cli.cjs");
-    const shimPath = path.join(tempDir, "shim", "lobster.cmd");
-    await fs.mkdir(path.dirname(scriptPath), { recursive: true });
-    await fs.mkdir(path.dirname(shimPath), { recursive: true });
-    await fs.writeFile(scriptPath, "module.exports = {};\n", "utf8");
-    await fs.writeFile(
-      shimPath,
-      `@echo off\r\n"%~dp0%\\..\\shim-dist\\lobster-cli.cjs" %*\r\n`,
-      "utf8",
-    );
-
-    const target = resolveWindowsPipelineSpawn(shimPath, ["run", "noop"], process.env);
-    expect(target.command).toBe(process.execPath);
-    expect(target.argv).toEqual([scriptPath, "run", "noop"]);
-    expect(target.windowsHide).toBe(true);
-  });
-
-  it("ignores node.exe shim entries and picks pipeline script", async () => {
-    const shimDir = path.join(tempDir, "shim-with-node");
-    const scriptPath = path.join(tempDir, "shim-dist-node", "lobster-cli.cjs");
-    const shimPath = path.join(shimDir, "lobster.cmd");
-    await fs.mkdir(path.dirname(scriptPath), { recursive: true });
-    await fs.mkdir(shimDir, { recursive: true });
-    await fs.writeFile(path.join(shimDir, "node.exe"), "", "utf8");
-    await fs.writeFile(scriptPath, "module.exports = {};\n", "utf8");
-    await fs.writeFile(
-      shimPath,
-      `@echo off\r\n"%~dp0%\\node.exe" "%~dp0%\\..\\shim-dist-node\\lobster-cli.cjs" %*\r\n`,
-      "utf8",
-    );
-
-    const target = resolveWindowsPipelineSpawn(shimPath, ["run", "noop"], process.env);
-    expect(target.command).toBe(process.execPath);
-    expect(target.argv).toEqual([scriptPath, "run", "noop"]);
-    expect(target.windowsHide).toBe(true);
-  });
-
-  it("resolves pipeline .cmd from PATH and unwraps npm layout shim", async () => {
-    const binDir = path.join(tempDir, "node_modules", ".bin");
-    const packageDir = path.join(tempDir, "node_modules", "lobster");
-    const scriptPath = path.join(packageDir, "dist", "cli.js");
-    const shimPath = path.join(binDir, "lobster.cmd");
-    await fs.mkdir(path.dirname(scriptPath), { recursive: true });
-    await fs.mkdir(binDir, { recursive: true });
-    await fs.writeFile(shimPath, "@echo off\r\n", "utf8");
-    await fs.writeFile(
-      path.join(packageDir, "package.json"),
-      JSON.stringify({ name: "lobster", version: "0.0.0", bin: { lobster: "dist/cli.js" } }),
-      "utf8",
-    );
-    await fs.writeFile(scriptPath, "module.exports = {};\n", "utf8");
-
-    const env = {
-      ...process.env,
-      PATH: `${binDir};${process.env.PATH ?? ""}`,
-      PATHEXT: ".CMD;.EXE",
-    };
-    const target = resolveWindowsPipelineSpawn("lobster", ["run", "noop"], env);
-    expect(target.command).toBe(process.execPath);
-    expect(target.argv).toEqual([scriptPath, "run", "noop"]);
-    expect(target.windowsHide).toBe(true);
-  });
-
-  it("fails fast when wrapper cannot be resolved without shell execution", async () => {
-    const badShimPath = path.join(tempDir, "bad-shim", "lobster.cmd");
-    await fs.mkdir(path.dirname(badShimPath), { recursive: true });
-    await fs.writeFile(badShimPath, "@echo off\r\nREM no entrypoint\r\n", "utf8");
-
-    expect(() => resolveWindowsPipelineSpawn(badShimPath, ["run", "noop"], process.env)).toThrow(
-      /without shell execution/,
-    );
-  });
-});

package/extensions/pipeline/src/windows-spawn.ts

@@ -1,193 +0,0 @@
-import fs from "node:fs";
-import path from "node:path";
-
-type SpawnTarget = {
-  command: string;
-  argv: string[];
-  windowsHide?: boolean;
-};
-
-function isFilePath(value: string): boolean {
-  try {
-    const stat = fs.statSync(value);
-    return stat.isFile();
-  } catch {
-    return false;
-  }
-}
-
-function resolveWindowsExecutablePath(execPath: string, env: NodeJS.ProcessEnv): string {
-  if (execPath.includes("/") || execPath.includes("\\") || path.isAbsolute(execPath)) {
-    return execPath;
-  }
-
-  const pathValue = env.PATH ?? env.Path ?? process.env.PATH ?? process.env.Path ?? "";
-  const pathEntries = pathValue
-    .split(";")
-    .map((entry) => entry.trim())
-    .filter(Boolean);
-
-  const hasExtension = path.extname(execPath).length > 0;
-  const pathExtRaw =
-    env.PATHEXT ??
-    env.Pathext ??
-    process.env.PATHEXT ??
-    process.env.Pathext ??
-    ".EXE;.CMD;.BAT;.COM";
-  const pathExt = hasExtension
-    ? [""]
-    : pathExtRaw
-        .split(";")
-        .map((ext) => ext.trim())
-        .filter(Boolean)
-        .map((ext) => (ext.startsWith(".") ? ext : `.${ext}`));
-
-  for (const dir of pathEntries) {
-    for (const ext of pathExt) {
-      for (const candidateExt of [ext, ext.toLowerCase(), ext.toUpperCase()]) {
-        const candidate = path.join(dir, `${execPath}${candidateExt}`);
-        if (isFilePath(candidate)) {
-          return candidate;
-        }
-      }
-    }
-  }
-
-  return execPath;
-}
-
-function resolveBinEntry(binField: string | Record<string, string> | undefined): string | null {
-  if (typeof binField === "string") {
-    const trimmed = binField.trim();
-    return trimmed || null;
-  }
-  if (!binField || typeof binField !== "object") {
-    return null;
-  }
-
-  const preferred = binField.lobster;
-  if (typeof preferred === "string" && preferred.trim()) {
-    return preferred.trim();
-  }
-
-  for (const value of Object.values(binField)) {
-    if (typeof value === "string" && value.trim()) {
-      return value.trim();
-    }
-  }
-  return null;
-}
-
-function resolvePipelineScriptFromPackageJson(wrapperPath: string): string | null {
-  const wrapperDir = path.dirname(wrapperPath);
-  const packageDirs = [
-    // Local install: <repo>/node_modules/.bin/lobster.cmd -> ../lobster
-    path.resolve(wrapperDir, "..", "lobster"),
-    // Global npm install: <npm-prefix>/lobster.cmd -> ./node_modules/lobster
-    path.resolve(wrapperDir, "node_modules", "lobster"),
-  ];
-
-  for (const packageDir of packageDirs) {
-    const packageJsonPath = path.join(packageDir, "package.json");
-    if (!isFilePath(packageJsonPath)) {
-      continue;
-    }
-
-    try {
-      const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, "utf8")) as {
-        bin?: string | Record<string, string>;
-      };
-      const scriptRel = resolveBinEntry(packageJson.bin);
-      if (!scriptRel) {
-        continue;
-      }
-      const scriptPath = path.resolve(packageDir, scriptRel);
-      if (isFilePath(scriptPath)) {
-        return scriptPath;
-      }
-    } catch {
-      // Ignore malformed package metadata; caller will throw a guided error.
-    }
-  }
-
-  return null;
-}
-
-function resolvePipelineScriptFromCmdShim(wrapperPath: string): string | null {
-  if (!isFilePath(wrapperPath)) {
-    return null;
-  }
-
-  try {
-    const content = fs.readFileSync(wrapperPath, "utf8");
-    const candidates: string[] = [];
-    const extractRelativeFromToken = (token: string): string | null => {
-      const match = token.match(/%~?dp0%\s*[\\/]*(.*)$/i);
-      if (!match) {
-        return null;
-      }
-      const relative = match[1];
-      if (!relative) {
-        return null;
-      }
-      return relative;
-    };
-
-    const matches = content.matchAll(/"([^"\r\n]*)"/g);
-    for (const match of matches) {
-      const token = match[1] ?? "";
-      const relative = extractRelativeFromToken(token);
-      if (!relative) {
-        continue;
-      }
-
-      const normalizedRelative = relative
-        .trim()
-        .replace(/[\\/]+/g, path.sep)
-        .replace(/^[\\/]+/, "");
-      const candidate = path.resolve(path.dirname(wrapperPath), normalizedRelative);
-      if (isFilePath(candidate)) {
-        candidates.push(candidate);
-      }
-    }
-
-    const nonNode = candidates.find((candidate) => {
-      const base = path.basename(candidate).toLowerCase();
-      return base !== "node.exe" && base !== "node";
-    });
-    if (nonNode) {
-      return nonNode;
-    }
-  } catch {
-    // Ignore unreadable shims; caller will throw a guided error.
-  }
-
-  return null;
-}
-
-export function resolveWindowsPipelineSpawn(
-  execPath: string,
-  argv: string[],
-  env: NodeJS.ProcessEnv,
-): SpawnTarget {
-  const resolvedExecPath = resolveWindowsExecutablePath(execPath, env);
-  const ext = path.extname(resolvedExecPath).toLowerCase();
-  if (ext !== ".cmd" && ext !== ".bat") {
-    return { command: resolvedExecPath, argv };
-  }
-
-  const scriptPath =
-    resolvePipelineScriptFromCmdShim(resolvedExecPath) ??
-    resolvePipelineScriptFromPackageJson(resolvedExecPath);
-  if (!scriptPath) {
-    throw new Error(
-      `${path.basename(resolvedExecPath)} wrapper resolved, but no Node entrypoint could be resolved without shell execution. Ensure the pipeline runtime is installed and runnable on PATH (prefer lobster.exe).`,
-    );
-  }
-
-  const entryExt = path.extname(scriptPath).toLowerCase();
-  if (entryExt === ".exe") {
-    return { command: scriptPath, argv, windowsHide: true };
-  }
-  return { command: process.execPath, argv: [scriptPath, ...argv], windowsHide: true };
-}

package/extensions/pipeline/symi.plugin.json

@@ -1,10 +0,0 @@
-{
-  "id": "pipeline",
-  "name": "Pipeline",
-  "description": "Typed workflow tool with resumable approvals.",
-  "configSchema": {
-    "type": "object",
-    "additionalProperties": false,
-    "properties": {}
-  }
-}

package/extensions/qwen-portal-auth/README.md

@@ -1,24 +0,0 @@
-# Qwen OAuth (Symi plugin)
-
-OAuth provider plugin for **Qwen** (free-tier OAuth).
-
-## Enable
-
-Bundled plugins are disabled by default. Enable this one:
-
-```bash
-symi plugins enable qwen-portal-auth
-```
-
-Restart the Gateway after enabling.
-
-## Authenticate
-
-```bash
-symi models auth login --provider qwen-portal --set-default
-```
-
-## Notes
-
-- Qwen OAuth uses a device-code login flow.
-- Tokens auto-refresh; re-run login if refresh fails or access is revoked.