coding-tool-x 3.7.10 → 3.7.11

package/src/server/services/omp-auth-gateway-client.js

@@ -0,0 +1,62 @@
+'use strict';
+
+const http = require('http');
+const https = require('https');
+
+function isPiNativeOAuthChannel(channel = {}) {
+  const transport = String(channel.transport || channel.providerConfig?.transport || '').trim();
+  return channel.authMode === 'oauth'
+    && transport === 'pi-native'
+    && Boolean(String(channel.apiKey || '').trim())
+    && Boolean(String(channel.baseUrl || '').trim());
+}
+
+function probeHealth(channel, timeoutMs) {
+  return new Promise((resolve) => {
+    let target;
+    try {
+      target = new URL('/healthz', channel.baseUrl);
+    } catch {
+      resolve(false);
+      return;
+    }
+    const transport = target.protocol === 'https:' ? https : http;
+    const request = transport.request(target, {
+      method: 'GET',
+      headers: {
+        accept: 'application/json'
+      }
+    }, (response) => {
+      response.resume();
+      response.once('end', () => {
+        resolve((response.statusCode || 0) >= 200 && (response.statusCode || 0) < 300);
+      });
+    });
+    request.setTimeout(timeoutMs, () => {
+      request.destroy(new Error('OMP auth gateway health probe timed out'));
+    });
+    request.once('error', () => resolve(false));
+    request.end();
+  });
+}
+
+async function probeOmpAuthGateways(channels = [], options = {}) {
+  const candidates = channels.filter(isPiNativeOAuthChannel);
+  const timeoutMs = Math.max(100, Number(options.timeoutMs) || 1000);
+  const results = await Promise.all(candidates.map(async (channel) => ({
+    channel,
+    healthy: await probeHealth(channel, timeoutMs)
+  })));
+  return {
+    supportedOAuthChannelIds: results
+      .filter(result => result.healthy)
+      .map(result => result.channel.id),
+    warnings: results
+      .filter(result => !result.healthy)
+      .map(result => `OMP OAuth auth gateway for channel "${result.channel.name || result.channel.id}" is unavailable; the native OMP provider remains active.`)
+  };
+}
+
+module.exports = {
+  probeOmpAuthGateways
+};

package/src/server/services/omp-channels.js

@@ -1,13 +1,12 @@
 const fs = require('fs');
 const path = require('path');
 const { execFileSync } = require('child_process');
-const { PATHS } = require('../../config/paths');
+const { PATHS, ensureStorageDirMigrated } = require('../../config/paths');
 const BaseChannelService = require('./base/base-channel-service');
 const ompConfig = require('./omp-config');
 const {
   writeManagedOmpProviders,
   removeManagedOmpProviders,
-  isManagedOmpProvidersActive,
   getLastManagedOmpSyncResult,
   readModelsConfig,
   readOmpSettingsConfig,
@@ -23,13 +22,82 @@ const {
 
 const OMP_THINKING_SUFFIX_RE = /:(minimal|low|medium|high|xhigh|off)$/;
 
+function loadManagedOmpModeState() {
+  ensureStorageDirMigrated();
+  try {
+    if (!fs.existsSync(PATHS.activeChannel.omp)) return null;
+    const data = JSON.parse(fs.readFileSync(PATHS.activeChannel.omp, 'utf8'));
+    return data && typeof data === 'object' && !Array.isArray(data) ? data : null;
+  } catch {
+    return null;
+  }
+}
+
+function loadManagedOmpActiveChannelId() {
+  return loadManagedOmpModeState()?.activeChannelId || null;
+}
+
+function isManagedOmpModeEnabled() {
+  ensureStorageDirMigrated();
+  return fs.existsSync(PATHS.activeChannel.omp);
+}
+
+function writeManagedOmpModeState(filePath, state) {
+  const temporaryPath = `${filePath}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+  try {
+    fs.writeFileSync(temporaryPath, JSON.stringify(state, null, 2), {
+      encoding: 'utf8',
+      mode: 0o600
+    });
+    fs.renameSync(temporaryPath, filePath);
+  } catch (error) {
+    if (fs.existsSync(temporaryPath)) fs.unlinkSync(temporaryPath);
+    throw error;
+  }
+}
+
+function enableManagedOmpMode(activeChannelId = null, gateway = null) {
+  ensureStorageDirMigrated();
+  const filePath = PATHS.activeChannel.omp;
+  const dir = path.dirname(filePath);
+  if (!fs.existsSync(dir)) {
+    fs.mkdirSync(dir, { recursive: true });
+  }
+  const nextActiveChannelId = activeChannelId || loadManagedOmpActiveChannelId();
+  const previousState = loadManagedOmpModeState();
+  const nextGateway = gateway || previousState?.gateway || null;
+  const state = {
+    version: 2,
+    activeChannelId: nextActiveChannelId || null
+  };
+  if (nextGateway) {
+    state.gateway = {
+      host: String(nextGateway.host || '127.0.0.1'),
+      port: Number(nextGateway.port),
+      secret: String(nextGateway.secret || ''),
+      supportedOAuthChannelIds: Array.isArray(nextGateway.supportedOAuthChannelIds)
+        ? [...nextGateway.supportedOAuthChannelIds]
+        : []
+    };
+  }
+  writeManagedOmpModeState(filePath, state);
+  return nextActiveChannelId || null;
+}
+
+function disableManagedOmpMode() {
+  ensureStorageDirMigrated();
+  if (fs.existsSync(PATHS.activeChannel.omp)) {
+    fs.unlinkSync(PATHS.activeChannel.omp);
+  }
+}
+
 class OmpChannelService extends BaseChannelService {
   constructor() {
     super({
       platform: 'omp',
       channelsFilePath: PATHS.channels.omp,
       defaultGatewaySource: 'openai_compatible',
-      isProxyRunning: () => isManagedOmpProvidersActive()
+      isProxyRunning: () => isManagedOmpModeEnabled()
     });
   }
 
@@ -37,10 +105,16 @@ class OmpChannelService extends BaseChannelService {
     const normalized = super._applyDefaults(channel);
     normalized.providerKey = normalized.providerKey || normalized.provider || normalized.name || normalized.id;
     normalized.providerApi = normalized.providerApi || normalized.api || normalized.wireApi || 'openai-completions';
-    normalized.authMode = normalized.authMode === 'oauth' ? 'oauth' : 'api_key';
+    normalized.authMode = ['api_key', 'oauth', 'none'].includes(normalized.authMode)
+      ? normalized.authMode
+      : 'api_key';
+    normalized.routingGroup = String(normalized.routingGroup || '').trim();
     normalized.oauthProviderId = normalized.oauthProviderId || (normalized.authMode === 'oauth' ? normalized.providerKey : '');
     if (normalized.authMode === 'oauth') {
       normalized.apiKey = normalized.apiKey || '';
+    } else if (normalized.authMode === 'none') {
+      normalized.apiKey = '';
+      normalized.oauthProviderId = '';
     }
     normalized.model = normalized.model || null;
     normalized.models = Array.isArray(normalized.models) ? normalized.models : [];
@@ -59,28 +133,46 @@ class OmpChannelService extends BaseChannelService {
   }
 
   _applyToNativeSettings(channel) {
-    writeManagedOmpProviders([channel]);
+    if (isManagedOmpModeEnabled()) {
+      const state = loadManagedOmpModeState();
+      enableManagedOmpMode(channel.id, state?.gateway || null);
+      writeManagedOmpProviders([channel], state?.gateway ? {
+        gateway: state.gateway,
+        activeChannelId: channel.id
+      } : {});
+    }
   }
 
   _onAfterCreate(_channel, allChannels) {
-    this.syncManagedOmpProviders(allChannels);
+    this.syncManagedOmpProvidersIfEnabled(allChannels);
   }
 
   _onAfterUpdate(_oldChannel, _newChannel, allChannels) {
-    this.syncManagedOmpProviders(allChannels);
+    this.syncManagedOmpProvidersIfEnabled(allChannels);
   }
 
   _onAfterDelete(_channel, allChannels) {
-    this.syncManagedOmpProviders(allChannels);
+    this.syncManagedOmpProvidersIfEnabled(allChannels);
+  }
+
+  syncManagedOmpProvidersIfEnabled(channels = this.getChannels().channels) {
+    if (!isManagedOmpModeEnabled()) {
+      return getLastManagedOmpSyncResult();
+    }
+    const state = loadManagedOmpModeState();
+    return this.syncManagedOmpProviders(channels, state?.gateway ? {
+      gateway: state.gateway,
+      activeChannelId: state.activeChannelId
+    } : {});
   }
 
-  syncManagedOmpProviders(channels = this.getChannels().channels) {
+  syncManagedOmpProviders(channels = this.getChannels().channels, options = {}) {
     const enabledChannels = (channels || []).filter(channel => channel.enabled !== false);
     if (enabledChannels.length === 0) {
       removeManagedOmpProviders();
       return getLastManagedOmpSyncResult();
     }
-    writeManagedOmpProviders(enabledChannels);
+    writeManagedOmpProviders(enabledChannels, options);
     return getLastManagedOmpSyncResult();
   }
 
@@ -90,7 +182,7 @@ class OmpChannelService extends BaseChannelService {
   }
 
   syncManagedProviderExtension(channels = this.getChannels().channels) {
-    return this.syncManagedOmpProviders(channels);
+    return this.syncManagedOmpProvidersIfEnabled(channels);
   }
 
   disableManagedProviderExtension() {
@@ -396,9 +488,14 @@ module.exports = {
   applyChannelToSettings: (id) => service.applyChannelToSettings(id),
   disableAllChannels: () => service.disableAllChannels(),
   getEffectiveApiKey: (channel) => channel?.apiKey || null,
-  syncManagedOmpProviders: (channels) => service.syncManagedOmpProviders(channels),
+  syncManagedOmpProviders: (channels, options) => service.syncManagedOmpProviders(channels, options),
   disableManagedOmpProviders: () => service.disableManagedOmpProviders(),
   syncManagedProviderExtension: (channels) => service.syncManagedProviderExtension(channels),
   disableManagedProviderExtension: () => service.disableManagedProviderExtension(),
+  isManagedOmpModeEnabled,
+  enableManagedOmpMode,
+  disableManagedOmpMode,
+  loadManagedOmpModeState,
+  loadManagedOmpActiveChannelId,
   syncCurrentOmpChannel
 };

package/src/server/services/omp-gateway-routing.js

@@ -0,0 +1,295 @@
+'use strict';
+
+const crypto = require('crypto');
+
+const MANAGED_PREFIX = 'ctx-';
+const SUPPORTED_PROVIDER_APIS = new Set([
+  'openai-completions',
+  'openai-responses',
+  'openai-codex-responses',
+  'azure-openai-responses',
+  'anthropic-messages',
+  'google-generative-ai',
+  'google-gemini-cli',
+  'google-vertex'
+]);
+
+function normalizeText(value) {
+  return String(value || '').trim();
+}
+
+function normalizeProviderId(value) {
+  return normalizeText(value)
+    .toLowerCase()
+    .replace(/[^a-z0-9._-]+/g, '-')
+    .replace(/^-+|-+$/g, '') || 'provider';
+}
+
+function getProviderKey(channel = {}) {
+  return normalizeText(channel.providerKey || channel.provider || channel.name || channel.id);
+}
+
+function getProviderApi(channel = {}) {
+  return normalizeText(channel.providerApi || channel.api || channel.wireApi || 'openai-completions');
+}
+
+function getRoutingGroup(channel = {}) {
+  return normalizeText(channel.routingGroup) || normalizeText(channel.id);
+}
+
+function stableToken(secret, namespace, value, length = 24) {
+  return crypto
+    .createHmac('sha256', String(secret || ''))
+    .update(`${namespace}\0${value}`)
+    .digest('hex')
+    .slice(0, length);
+}
+
+function stablePublicId(namespace, value, length = 8) {
+  return crypto
+    .createHash('sha256')
+    .update(`${namespace}\0${value}`)
+    .digest('hex')
+    .slice(0, length);
+}
+
+function normalizeRedirects(channel = {}) {
+  const redirects = Array.isArray(channel.modelRedirects) ? channel.modelRedirects : [];
+  return JSON.stringify(redirects);
+}
+
+function canonicalize(value) {
+  if (Array.isArray(value)) return value.map(canonicalize);
+  if (value && typeof value === 'object') {
+    return Object.fromEntries(
+      Object.keys(value).sort().map(key => [key, canonicalize(value[key])])
+    );
+  }
+  return value;
+}
+
+function getModelCapabilityMap(channel = {}) {
+  const result = new Map();
+  const add = (raw) => {
+    const model = typeof raw === 'string' ? { id: raw } : raw;
+    const id = normalizeText(model?.id || model?.name);
+    if (!id || result.has(id)) return;
+    const capability = { ...(model || {}) };
+    delete capability.id;
+    delete capability.name;
+    delete capability.baseUrl;
+    delete capability.headers;
+    result.set(id, JSON.stringify(canonicalize(capability)));
+  };
+  (Array.isArray(channel.models) ? channel.models : []).forEach(add);
+  (Array.isArray(channel.allowedModels) ? channel.allowedModels : []).forEach(add);
+  add(channel.model);
+  return result;
+}
+
+function getGroupKey(channel = {}) {
+  return [
+    getProviderKey(channel),
+    getProviderApi(channel),
+    getRoutingGroup(channel)
+  ].join('\0');
+}
+
+function assertCompatibleGroup(channels = []) {
+  if (channels.length <= 1) return;
+  const first = channels[0];
+  const expectedApi = getProviderApi(first);
+  const expectedProvider = getProviderKey(first);
+  const expectedRedirects = normalizeRedirects(first);
+  const expectedAuthMode = normalizeText(first.authMode) || 'api_key';
+  const expectedCapabilities = getModelCapabilityMap(first);
+
+  channels.slice(1).forEach((channel) => {
+    if (getProviderKey(channel) !== expectedProvider) {
+      throw new Error(`OMP routing group "${getRoutingGroup(first)}" mixes providerKey values`);
+    }
+    if (getProviderApi(channel) !== expectedApi) {
+      throw new Error(`OMP routing group "${getRoutingGroup(first)}" mixes providerApi values`);
+    }
+    if (normalizeRedirects(channel) !== expectedRedirects) {
+      throw new Error(`OMP routing group "${getRoutingGroup(first)}" has inconsistent modelRedirects`);
+    }
+    if ((normalizeText(channel.authMode) || 'api_key') !== expectedAuthMode) {
+      throw new Error(`OMP routing group "${getRoutingGroup(first)}" mixes authMode values`);
+    }
+    const actualCapabilities = getModelCapabilityMap(channel);
+    expectedCapabilities.forEach((capability, modelId) => {
+      if (actualCapabilities.has(modelId) && actualCapabilities.get(modelId) !== capability) {
+        throw new Error(
+          `OMP routing group "${getRoutingGroup(first)}" has incompatible capability metadata for model "${modelId}"`
+        );
+      }
+    });
+  });
+}
+
+function sanitizeProviderConfig(channel = {}) {
+  const source = channel.providerConfig && typeof channel.providerConfig === 'object'
+    && !Array.isArray(channel.providerConfig)
+    ? channel.providerConfig
+    : {};
+  const next = { ...source };
+  for (const key of ['baseUrl', 'base_url', 'apiKey', 'api_key', 'headers', 'auth']) {
+    delete next[key];
+  }
+  return next;
+}
+
+function sanitizeModels(channel = {}) {
+  return (Array.isArray(channel.models) ? channel.models : []).map((model) => {
+    if (!model || typeof model !== 'object' || Array.isArray(model)) return model;
+    const next = { ...model };
+    delete next.baseUrl;
+    delete next.headers;
+    return next;
+  });
+}
+
+function mergeGroupField(channels = [], field) {
+  const seen = new Set();
+  const result = [];
+  channels.forEach((channel) => {
+    const values = Array.isArray(channel?.[field]) ? channel[field] : [];
+    values.forEach((value) => {
+      const id = normalizeText(typeof value === 'string' ? value : (value?.id || value?.name));
+      if (!id || seen.has(id.toLowerCase())) return;
+      seen.add(id.toLowerCase());
+      result.push(value);
+    });
+  });
+  return result;
+}
+
+function buildManagedBaseUrl(host, port, routeToken) {
+  return `http://${host}:${port}/omp/${routeToken}`;
+}
+
+function prepareManagedOmpChannels(channels = [], gateway = {}) {
+  const host = normalizeText(gateway.host) || '127.0.0.1';
+  const port = Number(gateway.port);
+  const secret = normalizeText(gateway.secret);
+  if (!Number.isInteger(port) || port <= 0) {
+    throw new Error('OMP gateway port is required before managed providers can be generated');
+  }
+  if (!secret) {
+    throw new Error('OMP gateway secret is required before managed providers can be generated');
+  }
+
+  const enabled = channels.filter(channel => channel && channel.enabled !== false && channel.baseUrl);
+  const groups = new Map();
+  enabled.forEach((channel) => {
+    const key = getGroupKey(channel);
+    if (!groups.has(key)) groups.set(key, []);
+    groups.get(key).push(channel);
+  });
+
+  const providerCounts = new Map();
+  groups.forEach((groupChannels) => {
+    const providerId = normalizeProviderId(getProviderKey(groupChannels[0]));
+    providerCounts.set(providerId, (providerCounts.get(providerId) || 0) + 1);
+  });
+
+  const routes = [];
+  const managedChannels = [];
+  const unsupportedChannels = [];
+
+  groups.forEach((groupChannels, groupKey) => {
+    assertCompatibleGroup(groupChannels);
+    const template = groupChannels[0];
+    if (!SUPPORTED_PROVIDER_APIS.has(getProviderApi(template))) {
+      groupChannels.forEach(channel => unsupportedChannels.push({
+        id: channel.id,
+        name: channel.name,
+        reason: 'unsupported-provider-api'
+      }));
+      return;
+    }
+    const authMode = normalizeText(template.authMode) || 'api_key';
+    const transport = normalizeText(template.transport || template.providerConfig?.transport);
+    const supportedOAuthIds = Array.isArray(gateway.supportedOAuthChannelIds)
+      ? new Set(gateway.supportedOAuthChannelIds)
+      : null;
+    const oauthGatewayUnavailable = authMode === 'oauth' && (
+      !normalizeText(template.apiKey)
+      || transport !== 'pi-native'
+      || (supportedOAuthIds && groupChannels.some(channel => !supportedOAuthIds.has(channel.id)))
+    );
+    if (oauthGatewayUnavailable) {
+      groupChannels.forEach(channel => unsupportedChannels.push({
+        id: channel.id,
+        name: channel.name,
+        reason: 'oauth-auth-gateway-unavailable'
+      }));
+      return;
+    }
+
+    const providerId = normalizeProviderId(getProviderKey(template));
+    const routeToken = stableToken(secret, 'route', groupKey);
+    const capability = `ctx_${stableToken(secret, 'capability', groupKey, 40)}`;
+    const multipleGroups = providerCounts.get(providerId) > 1;
+    const managedProviderId = multipleGroups
+      ? `${MANAGED_PREFIX}${providerId}-${stablePublicId('provider', groupKey)}`
+      : `${MANAGED_PREFIX}${providerId}`;
+    const routingGroup = getRoutingGroup(template);
+    const mergedModels = sanitizeModels({
+      models: mergeGroupField(groupChannels, 'models')
+    });
+    const mergedAllowedModels = mergeGroupField(groupChannels, 'allowedModels');
+
+    const route = {
+      token: routeToken,
+      capability,
+      routingGroup,
+      providerKey: getProviderKey(template),
+      providerApi: getProviderApi(template),
+      managedProviderId,
+      channelIds: groupChannels.map(channel => channel.id),
+      authMode
+    };
+    routes.push(route);
+
+    managedChannels.push({
+      ...template,
+      id: `omp-route-${routeToken}`,
+      managedProviderId,
+      originalProviderId: getProviderKey(template),
+      routingGroup,
+      baseUrl: buildManagedBaseUrl(host, port, routeToken),
+      apiKey: authMode === 'none' ? '' : capability,
+      authMode,
+      providerConfig: sanitizeProviderConfig(template),
+      headers: undefined,
+      auth: authMode === 'none' ? 'none' : undefined,
+      models: mergedModels,
+      allowedModels: mergedAllowedModels,
+      _ompGatewayRoute: route
+    });
+  });
+
+  return { routes, managedChannels, unsupportedChannels };
+}
+
+function resolveOmpGatewayRoute(pathname, channels, gateway) {
+  const match = String(pathname || '').match(/^\/omp\/([a-f0-9]{24})(\/.*|$)/);
+  if (!match) return null;
+  const prepared = prepareManagedOmpChannels(channels, gateway);
+  const route = prepared.routes.find(item => item.token === match[1]);
+  if (!route) return null;
+  return {
+    ...route,
+    upstreamPath: match[2] || '/'
+  };
+}
+
+module.exports = {
+  prepareManagedOmpChannels,
+  resolveOmpGatewayRoute,
+  getRoutingGroup,
+  getProviderKey,
+  getProviderApi
+};