@the-open-engine/zeroshot 6.29.0 → 6.30.0

package/src/target/target-session.ts

@@ -1,253 +1,132 @@
-import type { TargetCredentialStore } from './credential-store.ts';
-import type { TargetRecord, SettingsPort } from './target-registry.ts';
+import type { TargetCredentialStore } from './credential-store.js';
+import type { Clock } from './device-flow.js';
 import {
-  requestDeviceCode,
-  pollForToken,
-  UnboundSessionError,
-  type HttpTransport,
-  type Clock,
-  type TokenResponse,
-} from './device-flow.ts';
-import { targetServiceKey, TARGET_ACCOUNT } from './credential-store.ts';
-import { updateTargetOrganization } from './target-registry.ts';
+  TargetSessionManager,
+  type TargetSessionDeps,
+} from './target-session-manager.js';
+import type { SettingsPort, TargetRecord } from './target-registry.js';
+
+export {
+  LoginRequiredError,
+  TargetSessionManager,
+  type BrowserOpener,
+  type TargetSessionDeps,
+  type TargetSessionManagerInit,
+} from './target-session-manager.js';
 
-export class LoginRequiredError extends Error {
-  readonly targetName: string;
-  constructor(targetName: string) {
-    super(`Login required. Run: zeroshot target login ${targetName}`);
-    this.name = 'LoginRequiredError';
-    this.targetName = targetName;
-  }
-}
-
-export interface BrowserOpener {
-  open(url: string): Promise<void>;
+export interface TargetAccessTokenProvider {
+  getAccessToken(signal?: AbortSignal): Promise<string>;
 }
 
-export interface TargetSessionDeps {
-  readonly http: HttpTransport;
-  readonly clock: Clock;
-  readonly browserOpener: BrowserOpener;
-  readonly stderr: { write(s: string): void };
-  readonly discoveryEndpoints: {
-    readonly deviceAuthorizationEndpoint: string;
-    readonly tokenEndpoint: string;
-    readonly revocationEndpoint?: string;
-    readonly clientId: string;
-    readonly capsuleApiBaseUrl: string;
-  };
-}
+type LegacySessionDeps = Pick<TargetSessionDeps, 'http' | 'discoveryEndpoints'> & {
+  readonly settings?: SettingsPort;
+  readonly targetName?: string;
+  readonly clock?: Clock;
+};
 
-export async function targetLogin(
+type TargetLoginArgs = readonly [
   targetName: string,
   target: TargetRecord,
   credentialStore: TargetCredentialStore,
   acquireLock: () => Promise<() => Promise<void>>,
   settings: SettingsPort,
-  deps: TargetSessionDeps
-): Promise<{ organization: { id: string; name: string } }> {
-  const { http, clock, browserOpener, stderr, discoveryEndpoints } = deps;
-  const { deviceAuthorizationEndpoint, tokenEndpoint, clientId } = discoveryEndpoints;
-
-  const codeResponse = await requestDeviceCode(deviceAuthorizationEndpoint, clientId, http);
-
-  stderr.write(
-    `\nOpen this URL to authorize:\n  ${codeResponse.verification_uri}\n\nEnter code: ${codeResponse.user_code}\n\n`
-  );
-
-  if (codeResponse.verification_uri_complete) {
-    try {
-      await browserOpener.open(codeResponse.verification_uri_complete);
-    } catch {
-      // Browser open is best-effort
-    }
-  }
-
-  const tokenResponse = await pollForToken(
-    tokenEndpoint,
-    clientId,
-    codeResponse.device_code,
-    codeResponse.interval,
-    codeResponse.expires_in,
-    http,
-    clock,
-    undefined,
-    { token: target.deviceToken, label: 'Zeroshot CLI' }
-  );
-
-  if (!tokenResponse.organization) {
-    throw new UnboundSessionError(codeResponse.verification_uri);
-  }
+  deps: TargetSessionDeps,
+];
 
-  const serviceKey = targetServiceKey(target.id);
-  const release = await acquireLock();
-  try {
-    await credentialStore.set(serviceKey, TARGET_ACCOUNT, tokenResponse.refresh_token);
-  } finally {
-    await release();
-  }
-
-  updateTargetOrganization(targetName, tokenResponse.organization, settings);
-
-  return { organization: tokenResponse.organization };
-}
-
-export async function refreshAccessToken(
+type RefreshAccessArgs = readonly [
   targetName: string,
   target: TargetRecord,
   credentialStore: TargetCredentialStore,
   acquireLock: () => Promise<() => Promise<void>>,
-  deps: Pick<TargetSessionDeps, 'http' | 'discoveryEndpoints'>
-): Promise<{ accessToken: string; expiresIn: number }> {
-  const { http, discoveryEndpoints } = deps;
-  const { tokenEndpoint, revocationEndpoint, clientId } = discoveryEndpoints;
-  const serviceKey = targetServiceKey(target.id);
+  deps: LegacySessionDeps,
+  clock?: Clock,
+];
 
-  const release = await acquireLock();
-  try {
-    const currentRefreshToken = await credentialStore.get(serviceKey, TARGET_ACCOUNT);
-    if (!currentRefreshToken) {
-      throw new LoginRequiredError(targetName);
-    }
-
-    const body = new URLSearchParams({
-      grant_type: 'refresh_token',
-      refresh_token: currentRefreshToken,
-      client_id: clientId,
-      audience: 'capsule',
-    });
-
-    let tokenResponse: TokenResponse;
-    const response = await http.fetch(tokenEndpoint, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-      body: body.toString(),
-      redirect: 'error',
-    });
-
-    if (!response.ok) {
-      const errorBody = (await response.json().catch(() => ({ error: 'unknown' }))) as {
-        error: string;
-      };
-      if (errorBody.error === 'invalid_grant') {
-        await credentialStore.delete(serviceKey, TARGET_ACCOUNT);
-        throw new LoginRequiredError(targetName);
-      }
-      throw new Error(`Token refresh failed (${response.status}): ${errorBody.error}`);
-    }
-
-    tokenResponse = (await response.json()) as TokenResponse;
-
-    try {
-      await credentialStore.set(serviceKey, TARGET_ACCOUNT, tokenResponse.refresh_token);
-    } catch {
-      await bestEffortRevoke(tokenResponse.refresh_token, revocationEndpoint, clientId, http);
-      await credentialStore.delete(serviceKey, TARGET_ACCOUNT);
-      throw new LoginRequiredError(targetName);
-    }
+type RevokeArgs = readonly [
+  target: TargetRecord,
+  credentialStore: TargetCredentialStore,
+  acquireLock: () => Promise<() => Promise<void>>,
+  deps: LegacySessionDeps,
+  force: boolean,
+];
 
-    return { accessToken: tokenResponse.access_token, expiresIn: tokenResponse.expires_in };
-  } finally {
-    await release();
-  }
+type LegacyManagerInit = {
+  readonly targetName: string;
+  readonly target: TargetRecord;
+  readonly credentialStore: TargetCredentialStore;
+  readonly acquireLock: () => Promise<() => Promise<void>>;
+  readonly deps: LegacySessionDeps;
+  readonly clock?: Clock;
+};
+
+function transientSettings(targetName: string, target: TargetRecord): SettingsPort {
+  const state: { _targets: Record<string, TargetRecord> } = {
+    _targets: { [targetName]: target },
+  };
+  return {
+    load: () => state,
+    mutate: (mutator) => mutator(state),
+  };
 }
 
-async function bestEffortRevoke(
-  token: string,
-  revocationEndpoint: string | undefined,
-  clientId: string,
-  http: HttpTransport
-): Promise<void> {
-  if (!revocationEndpoint) return;
-  try {
-    const body = new URLSearchParams({
-      token,
-      client_id: clientId,
-      token_type_hint: 'refresh_token',
-    });
-    await http.fetch(revocationEndpoint, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-      body: body.toString(),
-      redirect: 'error',
-    });
-  } catch {
-    // Best-effort
-  }
+function legacyManager(init: LegacyManagerInit): TargetSessionManager {
+  const clock = init.clock ?? init.deps.clock ?? { now: () => Date.now() };
+  return new TargetSessionManager({
+    targetName: init.targetName,
+    target: init.target,
+    credentialStore: init.credentialStore,
+    acquireLock: init.acquireLock,
+    settings: init.deps.settings ?? transientSettings(init.targetName, init.target),
+    deps: {
+      http: init.deps.http,
+      clock,
+      browserOpener: { open: () => Promise.resolve() },
+      stderr: { write: () => undefined },
+      discoveryEndpoints: init.deps.discoveryEndpoints,
+    },
+  });
 }
 
-export interface TargetAccessTokenProvider {
-  getAccessToken(signal?: AbortSignal): Promise<string>;
+export function targetLogin(...args: TargetLoginArgs): Promise<{ organization: { id: string } }> {
+  const [targetName, target, credentialStore, acquireLock, settings, deps] = args;
+  return new TargetSessionManager({
+    targetName,
+    target,
+    credentialStore,
+    acquireLock,
+    settings,
+    deps,
+  }).login();
 }
 
-export function getAccessTokenProvider(
-  targetName: string,
-  target: TargetRecord,
-  credentialStore: TargetCredentialStore,
-  acquireLock: () => Promise<() => Promise<void>>,
-  deps: Pick<TargetSessionDeps, 'http' | 'discoveryEndpoints'>,
-  clock: Clock = { now: () => Date.now() }
-): TargetAccessTokenProvider {
-  let cachedToken: string | null = null;
-  let expiresAt = 0;
-
-  return {
-    async getAccessToken(_signal?: AbortSignal): Promise<string> {
-      if (cachedToken && clock.now() < expiresAt - 30_000) {
-        return cachedToken;
-      }
-      const result = await refreshAccessToken(
-        targetName,
-        target,
-        credentialStore,
-        acquireLock,
-        deps
-      );
-      cachedToken = result.accessToken;
-      expiresAt = clock.now() + result.expiresIn * 1000;
-      return result.accessToken;
-    },
-  };
+export async function refreshAccessToken(
+  ...args: RefreshAccessArgs
+): Promise<{ accessToken: string; expiresIn: number }> {
+  const [targetName, target, credentialStore, acquireLock, deps, clock] = args;
+  return legacyManager({
+    targetName,
+    target,
+    credentialStore,
+    acquireLock,
+    deps,
+    ...(clock === undefined ? {} : { clock }),
+  }).getAccessTokenWithLifetime('capsule');
 }
 
-export async function revokeAndCleanup(
-  target: TargetRecord,
-  credentialStore: TargetCredentialStore,
-  acquireLock: () => Promise<() => Promise<void>>,
-  deps: Pick<TargetSessionDeps, 'http' | 'discoveryEndpoints'>,
-  force: boolean
-): Promise<void> {
-  const { http, discoveryEndpoints } = deps;
-  const { revocationEndpoint, clientId } = discoveryEndpoints;
-  const serviceKey = targetServiceKey(target.id);
+export function getAccessTokenProvider(...args: RefreshAccessArgs): TargetAccessTokenProvider {
+  const [targetName, target, credentialStore, acquireLock, deps, clock] = args;
+  return legacyManager({
+    targetName,
+    target,
+    credentialStore,
+    acquireLock,
+    deps,
+    ...(clock === undefined ? {} : { clock }),
+  }).tokenProvider('capsule');
+}
 
-  const release = await acquireLock();
-  try {
-    const refreshToken = await credentialStore.get(serviceKey, TARGET_ACCOUNT);
-    if (refreshToken && revocationEndpoint) {
-      const body = new URLSearchParams({
-        token: refreshToken,
-        client_id: clientId,
-        token_type_hint: 'refresh_token',
-      });
-      try {
-        const response = await http.fetch(revocationEndpoint, {
-          method: 'POST',
-          headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-          body: body.toString(),
-          redirect: 'error',
-        });
-        if (!response.ok && !force) {
-          throw new Error(
-            `Remote revocation failed (${response.status}). Use --force to remove anyway.`
-          );
-        }
-      } catch (err) {
-        if (!force) throw err;
-      }
-    }
-    await credentialStore.delete(serviceKey, TARGET_ACCOUNT);
-  } finally {
-    await release();
-  }
+export function revokeAndCleanup(...args: RevokeArgs): Promise<void> {
+  const [target, credentialStore, acquireLock, deps, force] = args;
+  const targetName = deps.targetName ?? target.id;
+  return legacyManager({ targetName, target, credentialStore, acquireLock, deps }).revoke(force);
 }

package/src/target/token-response.ts

@@ -0,0 +1,62 @@
+const MAX_TOKEN_BYTES = 16 * 1024;
+const TOKEN_RESPONSE_FIELDS = [
+  'access_token',
+  'refresh_token',
+  'token_type',
+  'expires_in',
+  'refresh_expires_in',
+  'scope',
+] as const;
+
+export interface TokenResponse {
+  readonly access_token: string;
+  readonly refresh_token: string;
+  readonly token_type: 'Bearer';
+  readonly expires_in: number;
+}
+
+function boundedString(value: unknown, maxBytes: number): value is string {
+  return typeof value === 'string' && value.length > 0 &&
+    new TextEncoder().encode(value).byteLength <= maxBytes;
+}
+
+function tokenFieldsValid(token: Record<string, unknown>): boolean {
+  const fields = Object.keys(token);
+  return fields.length === TOKEN_RESPONSE_FIELDS.length &&
+    fields.every((key) => TOKEN_RESPONSE_FIELDS.includes(
+      key as (typeof TOKEN_RESPONSE_FIELDS)[number],
+    ));
+}
+
+function tokenLifetimesValid(token: Record<string, unknown>): boolean {
+  return Number.isSafeInteger(token.expires_in) &&
+    (token.expires_in as number) > 0 &&
+    (token.expires_in as number) <= 86_400 &&
+    Number.isSafeInteger(token.refresh_expires_in) &&
+    (token.refresh_expires_in as number) > 0 &&
+    (token.refresh_expires_in as number) <= 31_536_000;
+}
+
+function tokenStringsValid(token: Record<string, unknown>): boolean {
+  return boundedString(token.access_token, MAX_TOKEN_BYTES) &&
+    boundedString(token.refresh_token, MAX_TOKEN_BYTES) &&
+    token.token_type === 'Bearer' &&
+    boundedString(token.scope, 512) &&
+    !/[\u0000-\u001f\u007f]/.test(token.scope);
+}
+
+export function parseTokenResponse(value: unknown): TokenResponse {
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+    throw new Error('Token response is malformed');
+  }
+  const token = value as Record<string, unknown>;
+  if (!tokenFieldsValid(token) || !tokenLifetimesValid(token) || !tokenStringsValid(token)) {
+    throw new Error('Token response is malformed');
+  }
+  return Object.freeze({
+    access_token: token.access_token,
+    refresh_token: token.refresh_token,
+    token_type: 'Bearer',
+    expires_in: token.expires_in,
+  }) as TokenResponse;
+}

package/docker/zeroshot-oecp/Cargo.toml

@@ -1,12 +0,0 @@
-[package]
-name = "zeroshot-oecp-server"
-version = "0.1.0"
-edition.workspace = true
-rust-version.workspace = true
-license.workspace = true
-repository.workspace = true
-publish = false
-
-[dependencies]
-tokio.workspace = true
-zeroshot-engine = { package = "zeroshot-rust", path = "../../zeroshot-rust" }

package/docker/zeroshot-oecp/Dockerfile

@@ -1,65 +0,0 @@
-# syntax=docker/dockerfile:1
-
-# The server and the existing Node worker ship together because OECP is the
-# in-capsule process boundary. Capsule allocation and termination remain owned
-# by Zero Cloud's control plane and capsule agent.
-FROM rust@sha256:14b9b5f47dcc6644d0f0c1b35a2c2c5d0124f67159aaee28a348627523459b55 AS rust-builder
-# Security package revisions intentionally follow the pinned Alpine release repositories.
-# hadolint ignore=DL3018
-RUN apk add --no-cache musl-dev
-WORKDIR /build
-COPY Cargo.toml Cargo.lock rust-toolchain.toml ./
-COPY crates ./crates
-COPY zeroshot-rust ./zeroshot-rust
-COPY docker/zeroshot-oecp ./docker/zeroshot-oecp
-# musl does not expose renameat2 through libc, although the Linux syscall is
-# available. Keep the portable source API on glibc and use the syscall binding
-# only for this musl image build.
-RUN sed -i 's/libc::renameat2(/libc::syscall(libc::SYS_renameat2,/' \
-        zeroshot-rust/src/workspace_lease/types.rs \
-    && grep -Fq 'libc::syscall(libc::SYS_renameat2,' \
-        zeroshot-rust/src/workspace_lease/types.rs
-RUN rustup component add --toolchain 1.97.0 rustfmt clippy \
-    && cargo +1.97.0 build --locked --release -p zeroshot-oecp-server \
-    && rustup default 1.97.0 \
-    && rustup toolchain uninstall 1.96.0 1.96.1
-
-FROM node@sha256:c2cc26d8f991c2db236ad51a61efee843c482372d6d22570787309d511694110 AS node-builder
-ARG CODEX_VERSION=0.146.0
-# Security package revisions intentionally follow the pinned Alpine release repositories.
-# hadolint ignore=DL3018
-RUN apk add --no-cache build-base python3
-WORKDIR /opt/zeroshot
-COPY package.json package-lock.json ./
-RUN npm ci --omit=dev --ignore-scripts --no-audit --no-fund \
-    && npm rebuild better-sqlite3 node-pty \
-    && npm install --global --no-audit --no-fund "@openai/codex@${CODEX_VERSION}"
-COPY . .
-
-FROM node@sha256:c2cc26d8f991c2db236ad51a61efee843c482372d6d22570787309d511694110 AS runtime
-ARG ZEROSHOT_MIN_DISK_GB=10
-ENV ZEROSHOT_MIN_DISK_GB=${ZEROSHOT_MIN_DISK_GB}
-# Security package revisions intentionally follow the pinned Alpine release repositories.
-# hadolint ignore=DL3018
-RUN apk add --no-cache bash build-base ca-certificates git github-cli openssl python3 tini \
-    && install -d -m 1777 /tmp \
-    && install -d -m 0750 -o node -g node /workspace
-COPY --from=node-builder --chown=node:node /opt/zeroshot /opt/zeroshot
-COPY --from=node-builder /usr/local/lib/node_modules/@openai /usr/local/lib/node_modules/@openai
-COPY --from=rust-builder --chown=node:node /usr/local/cargo/bin /usr/local/cargo/bin
-COPY --from=rust-builder --chown=node:node /usr/local/rustup /usr/local/rustup
-COPY --from=rust-builder /build/target/release/zeroshot-oecp-server /usr/local/bin/zeroshot-oecp-server
-RUN ln -s /opt/zeroshot/bin/zeroshot-cluster-worker.js /usr/local/bin/zeroshot-cluster-worker \
-    && ln -s /opt/zeroshot/cli/index.js /usr/local/bin/zeroshot \
-    && ln -s /usr/local/lib/node_modules/@openai/codex/bin/codex.js /usr/local/bin/codex \
-    && for command in cargo cargo-clippy cargo-fmt clippy-driver rustc rustdoc rustfmt rustup; do \
-        ln -s "/usr/local/cargo/bin/${command}" "/usr/local/bin/${command}"; \
-    done
-ENV RUSTUP_HOME=/usr/local/rustup
-ENV PATH=/usr/local/cargo/bin:${PATH}
-# The official Node image defines this stable application user.
-# hadolint ignore=DL3066
-USER node
-WORKDIR /workspace
-EXPOSE 8083 8084
-ENTRYPOINT ["/sbin/tini", "--", "/usr/local/bin/zeroshot-oecp-server"]

package/docker/zeroshot-oecp/src/main.rs

@@ -1,32 +0,0 @@
-use std::{error::Error, net::SocketAddr, sync::Arc};
-
-use tokio::net::TcpListener;
-use zeroshot_engine::hosted_oecp::{serve, HostedBackend, OECP_PORT};
-
-#[tokio::main]
-async fn main() -> Result<(), Box<dyn Error>> {
-    if std::env::args().nth(1).as_deref() == Some("--healthcheck") {
-        println!("zeroshot OECP server ready");
-        return Ok(());
-    }
-    let backend = Arc::new(HostedBackend::new());
-    let listener = TcpListener::bind(SocketAddr::from(([127, 0, 0, 1], OECP_PORT))).await?;
-    serve(listener, backend, shutdown_signal()).await?;
-    Ok(())
-}
-
-#[cfg(unix)]
-async fn shutdown_signal() {
-    use tokio::signal::unix::{signal, SignalKind};
-
-    let mut terminate = signal(SignalKind::terminate()).expect("SIGTERM handler must install");
-    tokio::select! {
-        _ = tokio::signal::ctrl_c() => {}
-        _ = terminate.recv() => {}
-    }
-}
-
-#[cfg(not(unix))]
-async fn shutdown_signal() {
-    let _result = tokio::signal::ctrl_c().await;
-}

package/lib/target/bounded-json.d.ts

@@ -1,6 +0,0 @@
-interface BoundedJsonErrors {
-    readonly tooLarge: () => Error;
-    readonly invalid: () => Error;
-}
-export declare function readBoundedJson(response: Response, maxBytes: number, errors: BoundedJsonErrors): Promise<unknown>;
-export {};

package/lib/target/bounded-json.js

@@ -1,43 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.readBoundedJson = readBoundedJson;
-async function readBoundedJson(response, maxBytes, errors) {
-    const declared = response.headers.get('content-length');
-    if (declared !== null && Number(declared) > maxBytes)
-        throw errors.tooLarge();
-    const reader = response.body?.getReader();
-    if (!reader) {
-        const bytes = new Uint8Array(await response.arrayBuffer());
-        if (bytes.byteLength > maxBytes)
-            throw errors.tooLarge();
-        return parseJson(bytes, errors);
-    }
-    const chunks = [];
-    let total = 0;
-    for (;;) {
-        const { done, value } = await reader.read();
-        if (done)
-            break;
-        total += value.byteLength;
-        if (total > maxBytes) {
-            await reader.cancel();
-            throw errors.tooLarge();
-        }
-        chunks.push(value);
-    }
-    const bytes = new Uint8Array(total);
-    let offset = 0;
-    for (const chunk of chunks) {
-        bytes.set(chunk, offset);
-        offset += chunk.byteLength;
-    }
-    return parseJson(bytes, errors);
-}
-function parseJson(bytes, errors) {
-    try {
-        return JSON.parse(new TextDecoder().decode(bytes));
-    }
-    catch {
-        throw errors.invalid();
-    }
-}

package/lib/target/hosted-run/client.d.ts

@@ -1,26 +0,0 @@
-import { type TargetAccessTokenProvider } from '../target-session.ts';
-import type { HostedRunDependencies, HostedRunIntent } from './contracts.ts';
-export declare const UUID: RegExp;
-export declare const TERMINAL_STATES: Set<string>;
-export interface HostedContext {
-    readonly targetName: string;
-    readonly organization: string;
-    readonly client: RunIntentClient;
-}
-export declare class HostedRunHttpError extends Error {
-    readonly status: number;
-    readonly code: string | null;
-    constructor(status: number, message: string, code?: string | null);
-}
-export declare class RunIntentClient {
-    private readonly baseUrl;
-    private readonly organization;
-    private readonly tokenProvider;
-    private readonly fetch;
-    constructor(baseUrl: string, organization: string, tokenProvider: TargetAccessTokenProvider, fetchImplementation: typeof globalThis.fetch);
-    submit(body: Record<string, unknown>, submissionKey: string): Promise<HostedRunIntent>;
-    get(intentId: string): Promise<HostedRunIntent>;
-    cancel(intentId: string): Promise<HostedRunIntent>;
-    private request;
-}
-export declare function context(targetName: string, deps: HostedRunDependencies): Promise<HostedContext>;