coding-tool-x 3.7.1 → 3.7.3

package/src/server/services/native-oauth-adapters.js

@@ -2,6 +2,7 @@ const fs = require('fs');
 const path = require('path');
 const os = require('os');
 const crypto = require('crypto');
+const { spawnSync } = require('child_process');
 const toml = require('toml');
 const tomlStringify = require('@iarna/toml').stringify;
 const { NATIVE_PATHS, PATHS } = require('../../config/paths');
@@ -13,7 +14,7 @@ const { syncCodexUserEnvironment } = require('./codex-env-manager');
 const nativeKeychain = require('./native-keychain');
 const { maskToken, decodeJwtPayload, removeFileIfExists, sha256 } = require('./oauth-utils');
 
-const SUPPORTED_TOOLS = ['claude', 'codex', 'gemini', 'opencode'];
+const SUPPORTED_TOOLS = ['claude', 'codex', 'gemini', 'opencode', 'omp'];
 const GEMINI_MAIN_ACCOUNT_KEY = 'main-account';
 const GEMINI_KEYCHAIN_SERVICE = 'gemini-cli-oauth';
 const CODEX_KEYCHAIN_SERVICE = 'Codex Auth';
@@ -1006,6 +1007,202 @@ function inspectOpenCodeState() {
   };
 }
 
+function resolveOmpRuntime() {
+  try {
+    const ompConfig = require('./omp-config');
+    const runtime = ompConfig.resolveOmpRuntime(process.env, {});
+    return runtime && runtime.runtime === 'omp' && runtime.installed ? runtime : null;
+  } catch {
+    return null;
+  }
+}
+
+function runOmpCommand(args = [], options = {}) {
+  const runtime = options.runtime || resolveOmpRuntime();
+  if (!runtime) {
+    return { ok: false, status: 127, stdout: '', stderr: 'OMP CLI not installed' };
+  }
+
+  const result = spawnSync(runtime.command, args, {
+    encoding: 'utf8',
+    env: {
+      ...process.env,
+      ...(options.env || {})
+    },
+    timeout: options.timeout || 10000
+  });
+  const status = result?.status === undefined || result?.status === null ? 0 : result.status;
+  return {
+    ok: !result?.error && status === 0,
+    status,
+    stdout: String(result?.stdout || ''),
+    stderr: String(result?.stderr || ''),
+    error: result?.error || null,
+    command: runtime.command
+  };
+}
+
+function getOmpAuthSnapshot(options = {}) {
+  try {
+    const { getOmpAuthProviderSnapshot } = require('./omp-auth-providers');
+    return getOmpAuthProviderSnapshot({
+      accountCheck: true,
+      includeStatus: false,
+      ...options
+    });
+  } catch {
+    return null;
+  }
+}
+
+function readAllOmpNativeOAuth() {
+  const snapshot = getOmpAuthSnapshot({ forceRefresh: true });
+  if (!snapshot?.available || !Array.isArray(snapshot.providers)) {
+    return [];
+  }
+
+  return snapshot.providers
+    .filter(provider => provider?.loggedIn || Number(provider?.accountCount || 0) > 0)
+    .flatMap((provider) => {
+      const accounts = Array.isArray(provider.accounts) && provider.accounts.length > 0
+        ? provider.accounts
+        : [{ index: 1, identity: '' }];
+      return accounts.map((account) => ({
+        providerId: provider.id,
+        accountId: String(account.index || '').trim(),
+        accountEmail: String(account.identity || '').trim(),
+        storage: 'auth-broker',
+        primaryToken: ''
+      }));
+    });
+}
+
+function readOmpNativeOAuth() {
+  return readAllOmpNativeOAuth()[0] || null;
+}
+
+function clearOmpOAuth() {
+  const credentials = readAllOmpNativeOAuth();
+  const providerIds = [...new Set(credentials.map(item => item.providerId).filter(Boolean))];
+  providerIds.forEach((providerId) => {
+    runOmpCommand(['auth-broker', 'logout', providerId], { timeout: 10000 });
+  });
+  try {
+    require('./omp-auth-providers').clearOmpAuthProviderCache();
+  } catch {
+    // cache invalidation is best-effort
+  }
+}
+
+function disableOmpOAuthCredential(credential = {}) {
+  const providerId = String(credential.providerId || '').trim();
+  if (!providerId) {
+    clearOmpOAuth();
+    return;
+  }
+  runOmpCommand(['auth-broker', 'logout', providerId], { timeout: 10000 });
+  try {
+    require('./omp-auth-providers').clearOmpAuthProviderCache();
+  } catch {
+    // cache invalidation is best-effort
+  }
+}
+
+function buildOmpImportPayload(credential = {}) {
+  if (credential.importPayload && typeof credential.importPayload === 'object') {
+    return credential.importPayload;
+  }
+
+  const access = String(credential.accessToken || credential.primaryToken || '').trim();
+  if (!access) {
+    return null;
+  }
+
+  return {
+    provider: credential.providerId,
+    credential_type: credential.credentialType || 'oauth',
+    identity_key: credential.identityKey || credential.accountId || credential.accountEmail || undefined,
+    data: {
+      access,
+      refresh: credential.refreshToken || '',
+      expires: credential.expiresAt || null,
+      accountId: credential.accountId || undefined,
+      accountEmail: credential.accountEmail || undefined
+    }
+  };
+}
+
+function hasOmpNativeCredential(providerId) {
+  return readAllOmpNativeOAuth().some((entry) => (
+    !providerId || entry.providerId === providerId
+  ));
+}
+
+function applyOmpOAuth(credential = {}) {
+  const providerId = String(credential.providerId || '').trim();
+  if (!providerId) {
+    throw new Error('OMP OAuth credential requires providerId');
+  }
+
+  const payload = buildOmpImportPayload(credential);
+  if (!payload) {
+    if (hasOmpNativeCredential(providerId)) {
+      return { storage: 'auth-broker-existing' };
+    }
+    throw new Error('OMP OAuth credential requires an import payload or access token');
+  }
+
+  const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'ctx-omp-oauth-'));
+  const tempPath = path.join(tempDir, `${providerId}.json`);
+  try {
+    fs.writeFileSync(tempPath, JSON.stringify(payload, null, 2), 'utf8');
+    ensureFileMode(tempPath);
+    const result = runOmpCommand(['auth-broker', 'import', tempPath, '--provider', providerId], { timeout: 15000 });
+    if (!result.ok) {
+      const detail = result.stderr.trim() || result.stdout.trim() || result.error?.message || `exit code ${result.status}`;
+      throw new Error(`OMP auth-broker import failed: ${detail}`);
+    }
+    try {
+      require('./omp-auth-providers').clearOmpAuthProviderCache();
+    } catch {
+      // cache invalidation is best-effort
+    }
+    return { storage: 'auth-broker' };
+  } finally {
+    try {
+      removeFileIfExists(tempPath);
+      fs.rmSync(tempDir, { recursive: true, force: true });
+    } catch {
+      // ignore cleanup failures
+    }
+  }
+}
+
+function inspectOmpState() {
+  const { getOmpProxyStatus } = require('../omp-proxy-server');
+  const { isManagedOmpProvidersActive } = require('./omp-settings-manager');
+  const proxyStatus = getOmpProxyStatus();
+  const nativeCredentials = readAllOmpNativeOAuth();
+
+  let channelConfigured = false;
+  try {
+    channelConfigured = Boolean(isManagedOmpProvidersActive());
+  } catch {
+    channelConfigured = false;
+  }
+
+  return {
+    tool: 'omp',
+    mode: proxyStatus.running || channelConfigured
+      ? 'proxy'
+      : (nativeCredentials.length > 0 ? 'oauth' : 'idle'),
+    proxyRunning: Boolean(proxyStatus.running || channelConfigured),
+    oauthPresent: nativeCredentials.length > 0,
+    channelConfigured,
+    nativeCredential: nativeCredentials[0] ? buildNativeSummary(nativeCredentials[0]) : null
+  };
+}
+
 function inspectTool(tool) {
   switch (tool) {
     case 'claude':
@@ -1016,6 +1213,8 @@ function inspectTool(tool) {
       return inspectGeminiState();
     case 'opencode':
       return inspectOpenCodeState();
+    case 'omp':
+      return inspectOmpState();
     default:
       throw new Error(`Unsupported OAuth tool: ${tool}`);
   }
@@ -1031,6 +1230,8 @@ function readNativeOAuth(tool) {
       return readGeminiNativeOAuth();
     case 'opencode':
       return readOpenCodeNativeOAuth();
+    case 'omp':
+      return readOmpNativeOAuth();
     default:
       throw new Error(`Unsupported OAuth tool: ${tool}`);
   }
@@ -1052,6 +1253,8 @@ function readAllNativeOAuth(tool) {
     }
     case 'opencode':
       return readAllOpenCodeNativeOAuth();
+    case 'omp':
+      return readAllOmpNativeOAuth();
     default:
       throw new Error(`Unsupported OAuth tool: ${tool}`);
   }
@@ -1071,6 +1274,9 @@ function clearNativeOAuth(tool) {
     case 'opencode':
       clearOpenCodeOAuth();
       return;
+    case 'omp':
+      clearOmpOAuth();
+      return;
     default:
       throw new Error(`Unsupported OAuth tool: ${tool}`);
   }
@@ -1090,6 +1296,9 @@ function disableNativeOAuthCredential(tool, credential = {}) {
     case 'opencode':
       disableOpenCodeOAuthCredential(credential);
       return;
+    case 'omp':
+      disableOmpOAuthCredential(credential);
+      return;
     default:
       throw new Error(`Unsupported OAuth tool: ${tool}`);
   }
@@ -1105,6 +1314,8 @@ function applyOAuthCredential(tool, credential) {
       return applyGeminiOAuth(credential);
     case 'opencode':
       return applyOpenCodeOAuth(credential);
+    case 'omp':
+      return applyOmpOAuth(credential);
     default:
       throw new Error(`Unsupported OAuth tool: ${tool}`);
   }

package/src/server/services/network-access.js

@@ -72,6 +72,10 @@ function createRemoteMutationGuard(options = {}) {
   };
 }
 
+function isRemoteMutationAllowedByEnv(env = process.env) {
+  return String(env.CC_TOOL_ALLOW_REMOTE_WRITE || '').toLowerCase() !== 'false';
+}
+
 function createRemoteRouteGuard(options = {}) {
   const enabled = options.enabled === true;
   const allowRemoteAccess = options.allowRemoteAccess === true;
@@ -113,6 +117,7 @@ module.exports = {
   isLoopbackRequest,
   isSameOriginRequest,
   createRemoteMutationGuard,
+  isRemoteMutationAllowedByEnv,
   createRemoteRouteGuard,
   createSameOriginGuard
 };

package/src/server/services/oauth-credentials-service.js

@@ -240,6 +240,70 @@ function parseOpenCodeImport(rawText) {
   };
 }
 
+function pickOmpCredentialEntry(parsed) {
+  if (Array.isArray(parsed)) {
+    return parsed.find(item => item && typeof item === 'object') || null;
+  }
+  if (!parsed || typeof parsed !== 'object') {
+    return null;
+  }
+  if (parsed.provider || parsed.providerId || parsed.provider_id || parsed.providerKey || parsed.credential_type || parsed.data) {
+    return parsed;
+  }
+  const entry = Object.entries(parsed).find(([, value]) => value && typeof value === 'object');
+  return entry ? { provider: entry[0], ...entry[1] } : parsed;
+}
+
+function parseOmpImport(rawText) {
+  const parsed = tryParseJson(rawText);
+  if (!parsed || typeof parsed !== 'object') {
+    throw new Error('OMP OAuth 仅支持 JSON 导入。');
+  }
+
+  const entry = pickOmpCredentialEntry(parsed);
+  if (!entry || typeof entry !== 'object') {
+    throw new Error('OMP OAuth 导入缺少 provider。');
+  }
+
+  const data = entry.data && typeof entry.data === 'object' ? entry.data : entry;
+  const providerId = safeString(
+    entry.providerId
+    || entry.provider_id
+    || entry.providerKey
+    || entry.provider
+    || data.providerId
+    || data.provider
+  );
+  if (!providerId) {
+    throw new Error('OMP OAuth 导入缺少 providerId。');
+  }
+
+  const accessToken = safeString(
+    data.accessToken
+    || data.access_token
+    || data.access
+    || data.token
+    || data.authToken
+  );
+  const credentialType = safeString(entry.credentialType || entry.credential_type || data.type || 'oauth') || 'oauth';
+  if (credentialType === 'oauth' && !accessToken && !entry.data) {
+    throw new Error('OMP OAuth 导入缺少 access/accessToken。');
+  }
+
+  return {
+    providerId,
+    credentialType,
+    accessToken,
+    refreshToken: safeString(data.refreshToken || data.refresh_token || data.refresh),
+    expiresAt: safeNumber(data.expiresAt || data.expiry_date || data.expiryDate || data.expires),
+    accountId: safeString(data.accountId || data.account_id || entry.accountId || entry.account_id),
+    accountEmail: safeString(data.accountEmail || data.email || entry.accountEmail || entry.email),
+    identityKey: safeString(entry.identityKey || entry.identity_key || data.identityKey || data.identity_key),
+    importPayload: parsed,
+    primaryToken: accessToken
+  };
+}
+
 function parseCredentialInput(tool, rawText) {
   switch (tool) {
     case 'claude':
@@ -250,6 +314,8 @@ function parseCredentialInput(tool, rawText) {
       return parseGeminiImport(rawText);
     case 'opencode':
       return parseOpenCodeImport(rawText);
+    case 'omp':
+      return parseOmpImport(rawText);
     default:
       throw new Error(`Unsupported OAuth tool: ${tool}`);
   }
@@ -261,7 +327,7 @@ function buildCredentialName(tool, metadata, providedName = '') {
     return explicit;
   }
 
-  if (tool === 'opencode' && safeString(metadata.providerId)) {
+  if ((tool === 'opencode' || tool === 'omp') && safeString(metadata.providerId)) {
     const accountLabel = safeString(metadata.accountId || metadata.accountEmail);
     return accountLabel
       ? `${tool} - ${metadata.providerId} - ${accountLabel}`
@@ -386,6 +452,19 @@ function extractSecrets(tool, metadata) {
         enterpriseUrl: metadata.enterpriseUrl || '',
         primaryToken: metadata.primaryToken || metadata.accessToken || ''
       };
+    case 'omp':
+      return {
+        providerId: metadata.providerId || '',
+        credentialType: metadata.credentialType || 'oauth',
+        accessToken: metadata.accessToken || '',
+        refreshToken: metadata.refreshToken || '',
+        expiresAt: metadata.expiresAt || null,
+        accountId: metadata.accountId || '',
+        accountEmail: metadata.accountEmail || '',
+        identityKey: metadata.identityKey || '',
+        importPayload: metadata.importPayload || null,
+        primaryToken: metadata.primaryToken || metadata.accessToken || ''
+      };
     default:
       return { primaryToken: metadata.primaryToken || metadata.accessToken || '' };
   }
@@ -395,7 +474,7 @@ function stableFingerprintValue(tool, metadata) {
   // 优先使用稳定标识符，避免 access token 轮换导致重复记录
   const stableId = metadata.accountEmail
     || metadata.accountId
-    || (tool === 'opencode' ? metadata.providerId : '')
+    || ((tool === 'opencode' || tool === 'omp') ? metadata.providerId : '')
     || metadata.refreshToken
     || metadata.primaryToken
     || metadata.accessToken
@@ -559,6 +638,11 @@ function cleanupManagedArtifacts(tool) {
 
   if (tool === 'opencode') {
     opencodeSettingsManager.deleteBackup?.();
+    return;
+  }
+
+  if (tool === 'omp') {
+    return;
   }
 }
 
@@ -597,6 +681,14 @@ async function stopProxyIfRunning(tool) {
       }
       return false;
     }
+    case 'omp': {
+      const { stopOmpProxyServer, getOmpProxyStatus } = require('../omp-proxy-server');
+      if (getOmpProxyStatus().running) {
+        await stopOmpProxyServer();
+        return true;
+      }
+      return false;
+    }
     default:
       throw new Error(`Unsupported OAuth tool: ${tool}`);
   }
@@ -625,6 +717,11 @@ function disableAllChannelsForTool(tool) {
         disableAllChannels();
         break;
       }
+      case 'omp': {
+        const { disableAllChannels } = require('./omp-channels');
+        disableAllChannels();
+        break;
+      }
     }
   } catch (err) {
     console.warn(`[OAuth] Failed to disable channels for ${tool}:`, err.message);
@@ -635,7 +732,7 @@ async function applyStoredCredential(tool, credentialId) {
   const entry = findStoredCredential(tool, credentialId);
   const proxyStopped = await stopProxyIfRunning(tool);
   cleanupManagedArtifacts(tool);
-  if (tool !== 'opencode') {
+  if (tool !== 'opencode' && tool !== 'omp') {
     disableAllChannelsForTool(tool);
   }
   applyOAuthCredential(tool, entry.secrets);
@@ -818,6 +915,16 @@ async function fetchCredentialUsage(tool, credentialId) {
         return await fetchCodexUsage(accessToken);
       }
     }
+    case 'omp': {
+      const providerId = entry.providerId || secrets.providerId || '';
+      if (providerId.includes('claude') || providerId.includes('anthropic')) {
+        return await fetchClaudeUsage(accessToken);
+      } else if (providerId.includes('gemini') || providerId.includes('google')) {
+        return await fetchGeminiUsage(accessToken);
+      } else {
+        return await fetchCodexUsage(accessToken);
+      }
+    }
     default:
       return { error: `不支持的工具: ${tool}` };
   }