comisai 1.0.33 → 1.0.36

package/node_modules/@comis/agent/dist/model/oauth-tls-preflight.js

@@ -0,0 +1,82 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * OAuth TLS preflight for OpenAI Codex `auth.openai.com`.
+ *
+ * Issues a single 5-second `fetch` GET against the OAuth authorize endpoint
+ * and classifies failures as `tls-cert` (system CA bundle missing/broken;
+ * fixable via `apt install ca-certificates` etc.) or `network` (DNS,
+ * firewall, proxy — operator action required).
+ *
+ * Verbatim port of OpenClaw's provider-openai-codex-oauth-tls.ts minus the
+ * Homebrew prefix-resolution branch and minus the `note()` UI (caller decides
+ * how to surface the result; this module is pure).
+ *
+ * The probe URL uses the public OpenAI Codex client_id
+ * `app_EMoamEEZ73f0CkXaXp7hrann` (NOT a Comis-distinct value) to avoid
+ * fingerprinting in OpenAI logs.
+ *
+ * This module never logs — the caller is responsible for surfacing
+ * the result via Pino (daemon) or DoctorFinding (CLI). Per AGENTS.md §2.4
+ * no `@comis/infra` import.
+ *
+ * @module
+ */
+const TLS_CERT_ERROR_CODES = new Set([
+    "UNABLE_TO_GET_ISSUER_CERT_LOCALLY",
+    "UNABLE_TO_VERIFY_LEAF_SIGNATURE",
+    "CERT_HAS_EXPIRED",
+    "DEPTH_ZERO_SELF_SIGNED_CERT",
+    "SELF_SIGNED_CERT_IN_CHAIN",
+    "ERR_TLS_CERT_ALTNAME_INVALID",
+]);
+const TLS_CERT_ERROR_PATTERNS = [
+    /unable to get local issuer certificate/i,
+    /unable to verify the first certificate/i,
+    /self[- ]signed certificate/i,
+    /certificate has expired/i,
+];
+const OPENAI_AUTH_PROBE_URL = "https://auth.openai.com/oauth/authorize?response_type=code" +
+    "&client_id=app_EMoamEEZ73f0CkXaXp7hrann" +
+    "&redirect_uri=http%3A%2F%2Flocalhost%3A1455%2Fauth%2Fcallback" +
+    "&scope=openid+profile+email";
+const DEFAULT_TIMEOUT_MS = 5000;
+/**
+ * Issue a single TLS preflight GET against auth.openai.com/oauth/authorize.
+ *
+ * Resolves to {ok:true} on any HTTP response (302 included — that's the
+ * expected success path with redirect:"manual"). Resolves to {ok:false,
+ * kind, code?, message} on fetch error.
+ *
+ * Never throws.
+ */
+export async function runOAuthTlsPreflight(opts) {
+    const timeoutMs = opts?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const fetchImpl = opts?.fetchImpl ?? fetch;
+    try {
+        await fetchImpl(OPENAI_AUTH_PROBE_URL, {
+            method: "GET",
+            redirect: "manual", // a 302 IS the success signal; do not follow
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+        return { ok: true };
+    }
+    catch (error) {
+        return classifyTlsPreflightError(error);
+    }
+}
+function classifyTlsPreflightError(error) {
+    // Inline narrowing — OpenClaw's asNullableObjectRecord helper is not
+    // exported by Comis; duplicating ~3 lines is preferred over adding a
+    // shared util (AGENTS.md §2.3 rule of three not yet met).
+    const root = (error && typeof error === "object" ? error : {});
+    const cause = (root.cause && typeof root.cause === "object" ? root.cause : {});
+    const code = typeof cause.code === "string" ? cause.code : undefined;
+    const message = typeof cause.message === "string"
+        ? cause.message
+        : typeof root.message === "string"
+            ? root.message
+            : String(error);
+    const isTlsCert = (code ? TLS_CERT_ERROR_CODES.has(code) : false) ||
+        TLS_CERT_ERROR_PATTERNS.some((re) => re.test(message));
+    return { ok: false, kind: isTlsCert ? "tls-cert" : "network", code, message };
+}

package/node_modules/@comis/agent/dist/model/oauth-token-manager.d.ts

@@ -1,9 +1,24 @@
 /**
  * OAuth Token Manager: Wraps pi-ai's OAuth subsystem for Comis patterns.
  *
- * Provides automatic token refresh via pi-ai's getOAuthApiKey(), credential
- * storage via in-memory cache (bootstrapped from SecretManager), and
- * observability via TypedEventBus auth:token_rotated events.
+ * Architecture:
+ * - Reads + writes credentials through OAuthCredentialStorePort (no in-memory map
+ *   as source of truth; refreshed credentials persist to disk and survive restart).
+ * - Per-profile-ID file lock via withExecutionLock from @comis/scheduler — concurrent
+ *   refresh attempts from multiple processes serialize; different profiles refresh
+ *   in parallel.
+ * - 30s timeout wrapper around pi-ai's getOAuthApiKey to prevent indefinite hang
+ *   when auth.openai.com is unreachable.
+ * - Real-refresh detection via newCredentials.refresh !== profile.refresh — the
+ *   original !!newCredentials check was a no-op since pi-ai always returns truthy
+ *   newCredentials.
+ * - Log events with submodule: "oauth-token-manager".
+ * - Event-bus events: auth:token_rotated (extended with profileId),
+ *   auth:profile_bootstrapped, auth:refresh_failed.
+ * - Env-var bootstrap: empty store + valid OAUTH_<PROVIDER> env writes profile
+ *   to store, decodes JWT identity, emits auth:profile_bootstrapped.
+ * - Env-var conflict: stored profile + different env-var refresh → WARN once
+ *   per (provider, process) with hint=env-override-ignored.
  *
  * Supported OAuth providers (via pi-ai built-in):
  * - Anthropic (Claude Pro/Max)
@@ -16,45 +31,100 @@
  */
 import type { Result } from "@comis/shared";
 import type { SecretManager } from "@comis/core";
-import { TypedEventBus } from "@comis/core";
+import { TypedEventBus, type OAuthCredentialStorePort } from "@comis/core";
+import type { ComisLogger } from "@comis/infra";
 import type { OAuthCredentials } from "@mariozechner/pi-ai";
-/** Error codes returned by OAuthTokenManager operations. */
+/**
+ * Error codes returned by OAuthTokenManager operations.
+ *
+ * Extended with `errorKind`, `profileId`, `hint` (all optional) so CLI
+ * consumers can pattern-match on `errorKind === "refresh_token_reused"`
+ * without breaking existing consumers that only read `code` + `message` +
+ * `providerId`.
+ */
 export interface OAuthError {
-    code: "NO_PROVIDER" | "NO_CREDENTIALS" | "REFRESH_FAILED" | "STORE_FAILED";
+    code: "NO_PROVIDER" | "NO_CREDENTIALS" | "REFRESH_FAILED" | "STORE_FAILED" | "PROFILE_NOT_FOUND";
     message: string;
     providerId: string;
+    /** Free-form classification (e.g. "refresh_token_reused", "invalid_grant", "timeout"). */
+    errorKind?: string;
+    /** Profile that failed (mirrors auth:refresh_failed event payload field). */
+    profileId?: string;
+    /** Operator action recommendation; mirrors the WARN log `hint` field. */
+    hint?: string;
 }
 /** Dependencies injected into the OAuth token manager factory. */
 export interface OAuthTokenManagerDeps {
-    /** SecretManager for bootstrapping credentials on first access. */
+    /** SecretManager for env-var bootstrap and conflict detection. */
     secretManager: SecretManager;
-    /** EventBus for emitting auth:token_rotated events. */
+    /** EventBus for emitting auth events (3 typed events: token_rotated, profile_bootstrapped, refresh_failed). */
     eventBus: TypedEventBus;
+    /** Credential store for persistent refresh — REQUIRED. */
+    credentialStore: OAuthCredentialStorePort;
+    /** Logger for log events — REQUIRED. */
+    logger: ComisLogger;
+    /** Data directory for lock-file path resolution — REQUIRED. */
+    dataDir: string;
     /** Prefix for SecretManager key names (default: "OAUTH_"). */
     keyPrefix?: string;
+    /**
+     * Absolute path to auth-profiles.json. When set, the manager registers a
+     * chokidar watcher on this path and invalidates its in-memory cache when
+     * the file changes externally (e.g. CLI auth login). When undefined
+     * (encrypted-store mode), no watcher is registered.
+     */
+    watchPath?: string;
+    /**
+     * Getter for the agent's oauthProfiles map (Record<provider, profileId>).
+     * Called fresh on every getApiKey() invocation (no caching). Fallback when callers
+     * do not pass agentContext directly (e.g., env-var bootstrap path).
+     *
+     * The fresh-on-every-call contract is required: agents_manage update mutates
+     * the in-memory PerAgentConfig in place; the getter re-reads through that
+     * parent reference so the resolver observes the new value without restart.
+     */
+    getAgentOauthProfiles?: () => Record<string, string> | undefined;
 }
 /** OAuth token manager interface for credential lifecycle. */
 export interface OAuthTokenManager {
     /**
      * Get a valid API key for an OAuth provider. Auto-refreshes if token is
-     * expired or near-expiry. Returns err() if no credentials stored or
-     * refresh fails.
+     * expired or near-expiry. Dual-surface signature with optional agentContext
+     * for per-agent profile preference; the resolver chain (agent-config →
+     * lastGood → first available) hard-fails on configured-but-missing.
+     *
+     * @param providerId - OAuth provider id (e.g., "openai-codex")
+     * @param agentContext - Optional agent context for per-agent profile preference.
+     *   When set, agentContext.oauthProfiles[providerId] is consulted as the
+     *   primary resolver source. Falls back to deps.getAgentOauthProfiles?.()
+     *   when not provided.
      */
-    getApiKey(providerId: string): Promise<Result<string, OAuthError>>;
-    /** Check if credentials for a provider exist (in cache or SecretManager). */
+    getApiKey(providerId: string, agentContext?: {
+        oauthProfiles?: Record<string, string>;
+    }): Promise<Result<string, OAuthError>>;
+    /** Check if credentials for a provider exist (in cache, store, or env-var). */
     hasCredentials(providerId: string): boolean;
     /** Store credentials for a provider (e.g., after a login flow completes). */
     storeCredentials(providerId: string, creds: OAuthCredentials): void;
     /** Get the list of pi-ai built-in OAuth provider IDs. */
     getSupportedProviders(): string[];
+    /**
+     * Close the file watcher and clear the debounce timer.
+     * No-op when watchPath was undefined at construction. Idempotent.
+     */
+    dispose(): Promise<void>;
 }
 /**
  * Create an OAuth token manager wrapping pi-ai's OAuth subsystem.
  *
- * Credentials are bootstrapped from SecretManager (read-only) on first
- * access and cached in-memory. Refreshed credentials are stored in the
- * cache (not written back to SecretManager, which is immutable).
+ * Architecture:
+ *   1. Resolve candidate profileId (env-var seed JWT > stored list > env-bootstrap sentinel).
+ *   2. Acquire per-profile lock via withExecutionLock.
+ *   3. Inside lock: TOCTOU re-read profile, run pi-ai with 30s timeout.
+ *   4. Detect real refresh by comparing newCredentials.refresh !== profile.refresh.
+ *   5. If refreshed, persist via credentialStore.set, then emit auth:token_rotated.
+ *   6. Release lock.
  *
- * @param deps - SecretManager, EventBus, and optional key prefix
+ * @param deps - SecretManager, EventBus, CredentialStore, Logger, dataDir, optional keyPrefix
  */
 export declare function createOAuthTokenManager(deps: OAuthTokenManagerDeps): OAuthTokenManager;