@walkhi/code-relax 0.1.0-beta.82 → 0.1.0-beta.83

package/dist/build-platform.json

@@ -1 +1 @@
-{"layout":"npm-platform-packages","version":"0.1.0-beta.82"}
+{"layout":"npm-platform-packages","version":"0.1.0-beta.83"}

package/dist/shared/server-requests.cjs

@@ -115,6 +115,38 @@
     } catch { return null; }
   }
   function elicitationResult(action, content = null) { return { action, content: action === 'accept' ? content : null, _meta: null }; }
+  function browserAuth(request) {
+    const p = request.params || {}, meta = p._meta || {};
+    if (request.method !== elicitation || p.mode !== 'form' || meta.codex_approval_kind !== 'browser_auth'
+      || p.requestedSchema?.type !== 'object' || !p.requestedSchema.properties || Object.keys(p.requestedSchema.properties).length
+      || !/^[A-Za-z0-9_-]{32,128}$/.test(meta.browser_auth_challenge_id || '')
+      || !Array.isArray(meta.fields) || !meta.fields.length || meta.fields.length > 6
+      || meta.options != null && (!Array.isArray(meta.options) || meta.options.length)
+      || meta.qrCode || meta.qrCodePayload || meta.qrCodeUrl || meta.webauthn != null) return null;
+    try {
+      const origin = new URL(meta.origin);
+      if (!['https:', 'http:'].includes(origin.protocol) || origin.origin !== meta.origin) return null;
+    } catch { return null; }
+    const ids = new Set();
+    for (const field of meta.fields) {
+      if (!field || typeof field.id !== 'string' || !/^[A-Za-z0-9_-]{1,48}$/.test(field.id) || ['__proto__', 'constructor', 'prototype'].includes(field.id)
+        || ids.has(field.id) || typeof field.label !== 'string' || typeof field.required !== 'boolean'
+        || !['email', 'number', 'password', 'search', 'tel', 'text', 'url'].includes(field.type)) return null;
+      ids.add(field.id);
+    }
+    return { origin: meta.origin, challengeId: meta.browser_auth_challenge_id, fields: meta.fields,
+      accountUsername: typeof meta.account_username === 'string' ? meta.account_username : null };
+  }
+  function validateBrowserAuthFields(auth, fields) {
+    if (!auth || !fields || typeof fields !== 'object' || Array.isArray(fields)
+      || !Object.keys(fields).length || Object.keys(fields).some(id => !auth.fields.some(field => field.id === id))) throw new Error('安全登录字段无效');
+    for (const field of auth.fields) {
+      const entry = fields[field.id];
+      if (entry === undefined && !field.required) continue;
+      if (!entry || Object.keys(entry).length !== 1 || typeof entry.value !== 'string'
+        || !entry.value.length) throw new Error('请填写有效的安全登录信息');
+    }
+  }
   function fieldOptions(field) {
     const schema = field.type === 'array' ? field.items : field;
     if (Array.isArray(schema?.enum)) return schema.enum.map((value, index) => ({ value, label: schema.enumNames?.[index] || value }));
@@ -191,6 +223,10 @@
   }
   function validate(request, result) {
     if (request.method === elicitation && equal(result, elicitationResult('cancel'))) return;
+    if (browserAuth(request)) {
+      if (!['decline', 'cancel'].some(action => equal(result, { action }))) throw new Error('安全登录必须通过专用输入入口提交');
+      return;
+    }
     if (externalAction(request)) {
       if (!['accept', 'decline'].some(action => equal(result, elicitationResult(action)))) throw new Error('外部操作结果无效');
       return;
@@ -307,5 +343,5 @@
       return { submitted: true };
     }
   }
-  return { Store, decisions, validate, command, file, input, elicitation, permissions, externalAction, elicitationResult, formSchema, fieldOptions, validateForm, permissionResult, blocksComposer, browserAccess, browserAction, browserActionResult, computerAppAccess, computerAppResult, mcpToolApproval, mcpToolResult, confirmation, confirmationResult };
+  return { Store, decisions, validate, command, file, input, elicitation, permissions, externalAction, elicitationResult, formSchema, fieldOptions, validateForm, permissionResult, blocksComposer, browserAccess, browserAction, browserActionResult, browserAuth, validateBrowserAuthFields, computerAppAccess, computerAppResult, mcpToolApproval, mcpToolResult, confirmation, confirmationResult };
 });

package/dist/src/browser-auth-operations.mjs

@@ -0,0 +1,26 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { createHash, randomUUID } from 'node:crypto';
+
+// Only submission markers are durable. Credentials never enter this store.
+export class BrowserAuthOperations {
+  constructor(stateRoot) { this.directory = path.join(stateRoot, 'browser-auth-operations'); }
+  file(key) { return path.join(this.directory, createHash('sha256').update(JSON.stringify(key)).digest('hex') + '.json'); }
+  async read(key) {
+    try { return JSON.parse(await fs.readFile(this.file(key), 'utf8')).status; }
+    catch (error) { if (error.code === 'ENOENT') return null; throw error; }
+  }
+  async claim(key) {
+    await fs.mkdir(this.directory, { recursive: true });
+    let handle;
+    try { handle = await fs.open(this.file(key), 'wx'); }
+    catch (error) { if (error.code === 'EEXIST') throw new Error('此安全登录已提交或结果待核对，请勿重复提交'); throw error; }
+    try { await handle.writeFile(JSON.stringify({ status: 'unknown' })); await handle.sync(); }
+    finally { await handle.close(); }
+  }
+  async complete(key, status) {
+    const file = this.file(key), temporary = file + '.' + randomUUID() + '.tmp';
+    await fs.writeFile(temporary, JSON.stringify({ status }));
+    await fs.rename(temporary, file);
+  }
+}