@the-open-engine/zeroshot 6.29.0 → 6.30.0

package/lib/target/target-session.js

@@ -1,163 +1,75 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LoginRequiredError = void 0;
+exports.TargetSessionManager = exports.LoginRequiredError = void 0;
 exports.targetLogin = targetLogin;
 exports.refreshAccessToken = refreshAccessToken;
 exports.getAccessTokenProvider = getAccessTokenProvider;
 exports.revokeAndCleanup = revokeAndCleanup;
-const device_flow_ts_1 = require("./device-flow.js");
-const credential_store_ts_1 = require("./credential-store.js");
-const target_registry_ts_1 = require("./target-registry.js");
-class LoginRequiredError extends Error {
-    targetName;
-    constructor(targetName) {
-        super(`Login required. Run: zeroshot target login ${targetName}`);
-        this.name = 'LoginRequiredError';
-        this.targetName = targetName;
-    }
+const target_session_manager_js_1 = require("./target-session-manager.js");
+var target_session_manager_js_2 = require("./target-session-manager.js");
+Object.defineProperty(exports, "LoginRequiredError", { enumerable: true, get: function () { return target_session_manager_js_2.LoginRequiredError; } });
+Object.defineProperty(exports, "TargetSessionManager", { enumerable: true, get: function () { return target_session_manager_js_2.TargetSessionManager; } });
+function transientSettings(targetName, target) {
+    const state = {
+        _targets: { [targetName]: target },
+    };
+    return {
+        load: () => state,
+        mutate: (mutator) => mutator(state),
+    };
 }
-exports.LoginRequiredError = LoginRequiredError;
-async function targetLogin(targetName, target, credentialStore, acquireLock, settings, deps) {
-    const { http, clock, browserOpener, stderr, discoveryEndpoints } = deps;
-    const { deviceAuthorizationEndpoint, tokenEndpoint, clientId } = discoveryEndpoints;
-    const codeResponse = await (0, device_flow_ts_1.requestDeviceCode)(deviceAuthorizationEndpoint, clientId, http);
-    stderr.write(`\nOpen this URL to authorize:\n  ${codeResponse.verification_uri}\n\nEnter code: ${codeResponse.user_code}\n\n`);
-    if (codeResponse.verification_uri_complete) {
-        try {
-            await browserOpener.open(codeResponse.verification_uri_complete);
-        }
-        catch {
-            // Browser open is best-effort
-        }
-    }
-    const tokenResponse = await (0, device_flow_ts_1.pollForToken)(tokenEndpoint, clientId, codeResponse.device_code, codeResponse.interval, codeResponse.expires_in, http, clock, undefined, { token: target.deviceToken, label: 'Zeroshot CLI' });
-    if (!tokenResponse.organization) {
-        throw new device_flow_ts_1.UnboundSessionError(codeResponse.verification_uri);
-    }
-    const serviceKey = (0, credential_store_ts_1.targetServiceKey)(target.id);
-    const release = await acquireLock();
-    try {
-        await credentialStore.set(serviceKey, credential_store_ts_1.TARGET_ACCOUNT, tokenResponse.refresh_token);
-    }
-    finally {
-        await release();
-    }
-    (0, target_registry_ts_1.updateTargetOrganization)(targetName, tokenResponse.organization, settings);
-    return { organization: tokenResponse.organization };
+function legacyManager(init) {
+    const clock = init.clock ?? init.deps.clock ?? { now: () => Date.now() };
+    return new target_session_manager_js_1.TargetSessionManager({
+        targetName: init.targetName,
+        target: init.target,
+        credentialStore: init.credentialStore,
+        acquireLock: init.acquireLock,
+        settings: init.deps.settings ?? transientSettings(init.targetName, init.target),
+        deps: {
+            http: init.deps.http,
+            clock,
+            browserOpener: { open: () => Promise.resolve() },
+            stderr: { write: () => undefined },
+            discoveryEndpoints: init.deps.discoveryEndpoints,
+        },
+    });
 }
-async function refreshAccessToken(targetName, target, credentialStore, acquireLock, deps) {
-    const { http, discoveryEndpoints } = deps;
-    const { tokenEndpoint, revocationEndpoint, clientId } = discoveryEndpoints;
-    const serviceKey = (0, credential_store_ts_1.targetServiceKey)(target.id);
-    const release = await acquireLock();
-    try {
-        const currentRefreshToken = await credentialStore.get(serviceKey, credential_store_ts_1.TARGET_ACCOUNT);
-        if (!currentRefreshToken) {
-            throw new LoginRequiredError(targetName);
-        }
-        const body = new URLSearchParams({
-            grant_type: 'refresh_token',
-            refresh_token: currentRefreshToken,
-            client_id: clientId,
-            audience: 'capsule',
-        });
-        let tokenResponse;
-        const response = await http.fetch(tokenEndpoint, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-            body: body.toString(),
-            redirect: 'error',
-        });
-        if (!response.ok) {
-            const errorBody = (await response.json().catch(() => ({ error: 'unknown' })));
-            if (errorBody.error === 'invalid_grant') {
-                await credentialStore.delete(serviceKey, credential_store_ts_1.TARGET_ACCOUNT);
-                throw new LoginRequiredError(targetName);
-            }
-            throw new Error(`Token refresh failed (${response.status}): ${errorBody.error}`);
-        }
-        tokenResponse = (await response.json());
-        try {
-            await credentialStore.set(serviceKey, credential_store_ts_1.TARGET_ACCOUNT, tokenResponse.refresh_token);
-        }
-        catch {
-            await bestEffortRevoke(tokenResponse.refresh_token, revocationEndpoint, clientId, http);
-            await credentialStore.delete(serviceKey, credential_store_ts_1.TARGET_ACCOUNT);
-            throw new LoginRequiredError(targetName);
-        }
-        return { accessToken: tokenResponse.access_token, expiresIn: tokenResponse.expires_in };
-    }
-    finally {
-        await release();
-    }
+function targetLogin(...args) {
+    const [targetName, target, credentialStore, acquireLock, settings, deps] = args;
+    return new target_session_manager_js_1.TargetSessionManager({
+        targetName,
+        target,
+        credentialStore,
+        acquireLock,
+        settings,
+        deps,
+    }).login();
 }
-async function bestEffortRevoke(token, revocationEndpoint, clientId, http) {
-    if (!revocationEndpoint)
-        return;
-    try {
-        const body = new URLSearchParams({
-            token,
-            client_id: clientId,
-            token_type_hint: 'refresh_token',
-        });
-        await http.fetch(revocationEndpoint, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-            body: body.toString(),
-            redirect: 'error',
-        });
-    }
-    catch {
-        // Best-effort
-    }
+async function refreshAccessToken(...args) {
+    const [targetName, target, credentialStore, acquireLock, deps, clock] = args;
+    return legacyManager({
+        targetName,
+        target,
+        credentialStore,
+        acquireLock,
+        deps,
+        ...(clock === undefined ? {} : { clock }),
+    }).getAccessTokenWithLifetime('capsule');
 }
-function getAccessTokenProvider(targetName, target, credentialStore, acquireLock, deps, clock = { now: () => Date.now() }) {
-    let cachedToken = null;
-    let expiresAt = 0;
-    return {
-        async getAccessToken(_signal) {
-            if (cachedToken && clock.now() < expiresAt - 30_000) {
-                return cachedToken;
-            }
-            const result = await refreshAccessToken(targetName, target, credentialStore, acquireLock, deps);
-            cachedToken = result.accessToken;
-            expiresAt = clock.now() + result.expiresIn * 1000;
-            return result.accessToken;
-        },
-    };
+function getAccessTokenProvider(...args) {
+    const [targetName, target, credentialStore, acquireLock, deps, clock] = args;
+    return legacyManager({
+        targetName,
+        target,
+        credentialStore,
+        acquireLock,
+        deps,
+        ...(clock === undefined ? {} : { clock }),
+    }).tokenProvider('capsule');
 }
-async function revokeAndCleanup(target, credentialStore, acquireLock, deps, force) {
-    const { http, discoveryEndpoints } = deps;
-    const { revocationEndpoint, clientId } = discoveryEndpoints;
-    const serviceKey = (0, credential_store_ts_1.targetServiceKey)(target.id);
-    const release = await acquireLock();
-    try {
-        const refreshToken = await credentialStore.get(serviceKey, credential_store_ts_1.TARGET_ACCOUNT);
-        if (refreshToken && revocationEndpoint) {
-            const body = new URLSearchParams({
-                token: refreshToken,
-                client_id: clientId,
-                token_type_hint: 'refresh_token',
-            });
-            try {
-                const response = await http.fetch(revocationEndpoint, {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-                    body: body.toString(),
-                    redirect: 'error',
-                });
-                if (!response.ok && !force) {
-                    throw new Error(`Remote revocation failed (${response.status}). Use --force to remove anyway.`);
-                }
-            }
-            catch (err) {
-                if (!force)
-                    throw err;
-            }
-        }
-        await credentialStore.delete(serviceKey, credential_store_ts_1.TARGET_ACCOUNT);
-    }
-    finally {
-        await release();
-    }
+function revokeAndCleanup(...args) {
+    const [target, credentialStore, acquireLock, deps, force] = args;
+    const targetName = deps.targetName ?? target.id;
+    return legacyManager({ targetName, target, credentialStore, acquireLock, deps }).revoke(force);
 }

package/lib/target/token-response.cjs

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseTokenResponse = parseTokenResponse;
+const MAX_TOKEN_BYTES = 16 * 1024;
+const TOKEN_RESPONSE_FIELDS = [
+    'access_token',
+    'refresh_token',
+    'token_type',
+    'expires_in',
+    'refresh_expires_in',
+    'scope',
+];
+function boundedString(value, maxBytes) {
+    return typeof value === 'string' && value.length > 0 &&
+        new TextEncoder().encode(value).byteLength <= maxBytes;
+}
+function tokenFieldsValid(token) {
+    const fields = Object.keys(token);
+    return fields.length === TOKEN_RESPONSE_FIELDS.length &&
+        fields.every((key) => TOKEN_RESPONSE_FIELDS.includes(key));
+}
+function tokenLifetimesValid(token) {
+    return Number.isSafeInteger(token.expires_in) &&
+        token.expires_in > 0 &&
+        token.expires_in <= 86_400 &&
+        Number.isSafeInteger(token.refresh_expires_in) &&
+        token.refresh_expires_in > 0 &&
+        token.refresh_expires_in <= 31_536_000;
+}
+function tokenStringsValid(token) {
+    return boundedString(token.access_token, MAX_TOKEN_BYTES) &&
+        boundedString(token.refresh_token, MAX_TOKEN_BYTES) &&
+        token.token_type === 'Bearer' &&
+        boundedString(token.scope, 512) &&
+        !/[\u0000-\u001f\u007f]/.test(token.scope);
+}
+function parseTokenResponse(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error('Token response is malformed');
+    }
+    const token = value;
+    if (!tokenFieldsValid(token) || !tokenLifetimesValid(token) || !tokenStringsValid(token)) {
+        throw new Error('Token response is malformed');
+    }
+    return Object.freeze({
+        access_token: token.access_token,
+        refresh_token: token.refresh_token,
+        token_type: 'Bearer',
+        expires_in: token.expires_in,
+    });
+}

package/lib/target/token-response.d.cts

@@ -0,0 +1,7 @@
+export interface TokenResponse {
+    readonly access_token: string;
+    readonly refresh_token: string;
+    readonly token_type: 'Bearer';
+    readonly expires_in: number;
+}
+export declare function parseTokenResponse(value: unknown): TokenResponse;

package/lib/target/token-response.d.mts

@@ -0,0 +1,7 @@
+export interface TokenResponse {
+    readonly access_token: string;
+    readonly refresh_token: string;
+    readonly token_type: 'Bearer';
+    readonly expires_in: number;
+}
+export declare function parseTokenResponse(value: unknown): TokenResponse;

package/lib/target/token-response.d.ts

@@ -0,0 +1,7 @@
+export interface TokenResponse {
+    readonly access_token: string;
+    readonly refresh_token: string;
+    readonly token_type: 'Bearer';
+    readonly expires_in: number;
+}
+export declare function parseTokenResponse(value: unknown): TokenResponse;

package/lib/target/token-response.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseTokenResponse = parseTokenResponse;
+const MAX_TOKEN_BYTES = 16 * 1024;
+const TOKEN_RESPONSE_FIELDS = [
+    'access_token',
+    'refresh_token',
+    'token_type',
+    'expires_in',
+    'refresh_expires_in',
+    'scope',
+];
+function boundedString(value, maxBytes) {
+    return typeof value === 'string' && value.length > 0 &&
+        new TextEncoder().encode(value).byteLength <= maxBytes;
+}
+function tokenFieldsValid(token) {
+    const fields = Object.keys(token);
+    return fields.length === TOKEN_RESPONSE_FIELDS.length &&
+        fields.every((key) => TOKEN_RESPONSE_FIELDS.includes(key));
+}
+function tokenLifetimesValid(token) {
+    return Number.isSafeInteger(token.expires_in) &&
+        token.expires_in > 0 &&
+        token.expires_in <= 86_400 &&
+        Number.isSafeInteger(token.refresh_expires_in) &&
+        token.refresh_expires_in > 0 &&
+        token.refresh_expires_in <= 31_536_000;
+}
+function tokenStringsValid(token) {
+    return boundedString(token.access_token, MAX_TOKEN_BYTES) &&
+        boundedString(token.refresh_token, MAX_TOKEN_BYTES) &&
+        token.token_type === 'Bearer' &&
+        boundedString(token.scope, 512) &&
+        !/[\u0000-\u001f\u007f]/.test(token.scope);
+}
+function parseTokenResponse(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error('Token response is malformed');
+    }
+    const token = value;
+    if (!tokenFieldsValid(token) || !tokenLifetimesValid(token) || !tokenStringsValid(token)) {
+        throw new Error('Token response is malformed');
+    }
+    return Object.freeze({
+        access_token: token.access_token,
+        refresh_token: token.refresh_token,
+        token_type: 'Bearer',
+        expires_in: token.expires_in,
+    });
+}

package/lib/target/token-response.mjs

@@ -0,0 +1,48 @@
+const MAX_TOKEN_BYTES = 16 * 1024;
+const TOKEN_RESPONSE_FIELDS = [
+    'access_token',
+    'refresh_token',
+    'token_type',
+    'expires_in',
+    'refresh_expires_in',
+    'scope',
+];
+function boundedString(value, maxBytes) {
+    return typeof value === 'string' && value.length > 0 &&
+        new TextEncoder().encode(value).byteLength <= maxBytes;
+}
+function tokenFieldsValid(token) {
+    const fields = Object.keys(token);
+    return fields.length === TOKEN_RESPONSE_FIELDS.length &&
+        fields.every((key) => TOKEN_RESPONSE_FIELDS.includes(key));
+}
+function tokenLifetimesValid(token) {
+    return Number.isSafeInteger(token.expires_in) &&
+        token.expires_in > 0 &&
+        token.expires_in <= 86_400 &&
+        Number.isSafeInteger(token.refresh_expires_in) &&
+        token.refresh_expires_in > 0 &&
+        token.refresh_expires_in <= 31_536_000;
+}
+function tokenStringsValid(token) {
+    return boundedString(token.access_token, MAX_TOKEN_BYTES) &&
+        boundedString(token.refresh_token, MAX_TOKEN_BYTES) &&
+        token.token_type === 'Bearer' &&
+        boundedString(token.scope, 512) &&
+        !/[\u0000-\u001f\u007f]/.test(token.scope);
+}
+export function parseTokenResponse(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error('Token response is malformed');
+    }
+    const token = value;
+    if (!tokenFieldsValid(token) || !tokenLifetimesValid(token) || !tokenStringsValid(token)) {
+        throw new Error('Token response is malformed');
+    }
+    return Object.freeze({
+        access_token: token.access_token,
+        refresh_token: token.refresh_token,
+        token_type: 'Bearer',
+        expires_in: token.expires_in,
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@the-open-engine/zeroshot",
-  "version": "6.29.0",
+  "version": "6.30.0",
   "description": "Multi-agent orchestration engine for Claude, Codex, and Gemini",
   "main": "src/orchestrator.js",
   "bin": {
@@ -44,20 +44,20 @@
     "typecheck:agent-cli-provider": "tsc --project tsconfig.agent-cli-provider.json",
     "typecheck:hosted-target": "tsc --project tsconfig.hosted-target.json",
     "typecheck:hosted-session": "tsc --project tsconfig.hosted-session.json",
-    "test:hosted-target": "node --test tests/hosted-target/*.test.ts",
+    "test:hosted-target": "npm run build:cluster && node --test tests/hosted-target/*.test.ts",
     "test:target": "npm run build:agent-cli-provider && npm run build:target && node --test tests/target/*.test.ts",
     "typecheck:target": "tsc --project tsconfig.target.json",
     "typecheck:cluster": "tsc --project tsconfig.cluster.json",
     "lint:agent-cli-provider": "eslint \"src/agent-cli-provider/**/*.ts\" \"tests/agent-cli-provider/**/*.ts\"",
     "build:agent-cli-provider": "tsc --project tsconfig.agent-cli-provider.build.json",
     "build:target": "tsc --project tsconfig.target.build.json",
-    "build:cluster": "npm run protocol:generate && tsc --project tsconfig.cluster.cjs.json && tsc --project tsconfig.cluster.esm.json && tsc --project tsconfig.hosted-session.cjs.json && tsc --project tsconfig.hosted-session.esm.json && node scripts/build-cluster.js",
+    "build:cluster": "npm run protocol:generate && tsc --project tsconfig.cluster.cjs.json && tsc --project tsconfig.cluster.esm.json && tsc --project tsconfig.hosted-target.cjs.json && tsc --project tsconfig.hosted-target.esm.json && tsc --project tsconfig.hosted-session.cjs.json && tsc --project tsconfig.hosted-session.esm.json && node scripts/build-cluster.js",
     "test:agent-cli-provider": "node --test tests/agent-cli-provider/*.test.js",
     "test:omp": "npm run build:agent-cli-provider && node --test tests/agent-cli-provider/omp-*.test.js && node tests/run-tests.js tests/omp-rpc-watcher.test.js tests/omp-isolation-capability.test.js tests/omp-docker-auth.test.js tests/omp-docker-fresh-only.test.js",
     "test:providers:live": "npm run build:agent-cli-provider && node scripts/live-provider-smoke.js",
     "check:agent-cli-provider": "npm run check:agent-cli-provider:ci",
     "check:agent-cli-provider:ci": "npm run typecheck:agent-cli-provider && npm run lint:agent-cli-provider && npm run build:agent-cli-provider && npm run test:agent-cli-provider",
-    "test:cluster-client": "npm run build:cluster && node --test tests/cluster/client.test.js tests/cluster/parity.test.js tests/cluster/architecture.test.js tests/cluster/verifier-regressions.test.js tests/cluster/request-validation.test.js tests/hosted-session/coordinator.test.js",
+    "test:cluster-client": "npm run build:cluster && node --test tests/cluster/client.test.js tests/cluster/client-lifecycle.test.js tests/cluster/parity.test.js tests/cluster/architecture.test.js tests/cluster/verifier-regressions.test.js tests/cluster/request-validation.test.js tests/hosted-session/coordinator.test.js tests/hosted-session/coordinator-cancellation.test.js",
     "test:cluster-package": "npm run build:agent-cli-provider && npm run build:cluster && npm run build:target && node --test tests/cluster/package.test.js",
     "dev:link": "npm link",
     "opcore:status": "opcore status --repo . --json",
@@ -77,6 +77,7 @@
     "protocol:generate": "node scripts/generate-cluster-types.js",
     "protocol:check": "cargo run -p openengine-cluster-testkit --bin generate-cluster-protocol -- --check && node scripts/generate-cluster-types.js --check",
     "rust:distribution:check": "node scripts/rust-distribution.js check-repository",
+    "hosted-oecp:image:check": "node scripts/hosted-oecp-image.js check",
     "rust:check": "cargo fmt --all -- --check && cargo clippy --workspace --all-targets -- -D warnings && cargo test --workspace",
     "deadcode": "ts-prune --skip node_modules",
     "deadcode:files": "unimported",
@@ -157,16 +158,22 @@
   "files": [
     "src/",
     "lib/",
-    "!src/target/register-hosted-commands.ts",
-    "!lib/target/register-hosted-commands.js",
-    "!lib/target/register-hosted-commands.d.ts",
     "bin/",
     "cli/",
     "task-lib/",
     "cluster-templates/",
     "cluster-hooks/",
     "docker/",
+    "!docker/zeroshot-oecp/",
     "scripts/",
+    "!scripts/hosted-oecp-image.js",
+    "!scripts/hosted-oecp-image-commands.js",
+    "!scripts/hosted-oecp-image-smoke.js",
+    "!scripts/hosted-oecp-manifest.js",
+    "!scripts/hosted-oecp-smoke-capability.js",
+    "!scripts/hosted-oecp-smoke-client.js",
+    "!scripts/hosted-oecp-smoke-codex.mjs",
+    "!scripts/hosted-oecp-smoke-fixture.js",
     "protocol/openengine-cluster/v1/worker.schema.json",
     "docs/openengine-cluster-protocol/v1/legacy-worker.md",
     "README.md",