conductor-oss 0.2.15 → 0.2.16

package/web/.next/standalone/packages/web/src/lib/remoteAuth.ts

@@ -0,0 +1,104 @@
+const BUILTIN_REMOTE_ACCESS_TOKEN_ENV = "CONDUCTOR_REMOTE_ACCESS_TOKEN";
+const BUILTIN_REMOTE_SESSION_SECRET_ENV = "CONDUCTOR_REMOTE_SESSION_SECRET";
+
+export const BUILTIN_REMOTE_SESSION_COOKIE = "conductor_session";
+export const BUILTIN_REMOTE_SESSION_TTL_SECONDS = 60 * 60 * 24 * 7;
+
+function getAccessToken(): string | null {
+  const token = process.env[BUILTIN_REMOTE_ACCESS_TOKEN_ENV]?.trim();
+  return token && token.length > 0 ? token : null;
+}
+
+function getSessionSecret(): string | null {
+  const secret = process.env[BUILTIN_REMOTE_SESSION_SECRET_ENV]?.trim();
+  return secret && secret.length > 0 ? secret : null;
+}
+
+function toHex(bytes: Uint8Array): string {
+  return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+
+function constantTimeEqual(left: string, right: string): boolean {
+  if (left.length !== right.length) return false;
+  let mismatch = 0;
+  for (let index = 0; index < left.length; index += 1) {
+    mismatch |= left.charCodeAt(index) ^ right.charCodeAt(index);
+  }
+  return mismatch === 0;
+}
+
+async function signPayload(payload: string, secret: string): Promise<string> {
+  const encoder = new TextEncoder();
+  const key = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"],
+  );
+  const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(payload));
+  return toHex(new Uint8Array(signature));
+}
+
+export function isBuiltinRemoteAuthEnabled(): boolean {
+  return Boolean(getAccessToken() && getSessionSecret());
+}
+
+export function sanitizeRedirectTarget(value: string | null | undefined): string {
+  if (!value) return "/";
+  const trimmed = value.trim();
+  if (!trimmed.startsWith("/") || trimmed.startsWith("//")) return "/";
+  return trimmed;
+}
+
+export function isValidBuiltinAccessToken(candidate: string | null | undefined): boolean {
+  const configured = getAccessToken();
+  if (!configured || !candidate) return false;
+  return constantTimeEqual(configured, candidate.trim());
+}
+
+export async function createBuiltinRemoteSessionValue(): Promise<string> {
+  const secret = getSessionSecret();
+  if (!secret) {
+    throw new Error("Built-in remote session secret is not configured");
+  }
+
+  const expiresAt = Date.now() + BUILTIN_REMOTE_SESSION_TTL_SECONDS * 1000;
+  const payload = String(expiresAt);
+  const signature = await signPayload(payload, secret);
+  return `${payload}.${signature}`;
+}
+
+export async function verifyBuiltinRemoteSession(value: string | null | undefined): Promise<boolean> {
+  const secret = getSessionSecret();
+  if (!secret || !value) return false;
+
+  const separator = value.indexOf(".");
+  if (separator <= 0 || separator === value.length - 1) return false;
+
+  const payload = value.slice(0, separator);
+  const signature = value.slice(separator + 1);
+  const expiresAt = Number.parseInt(payload, 10);
+  if (!Number.isFinite(expiresAt) || expiresAt <= Date.now()) {
+    return false;
+  }
+
+  const expected = await signPayload(payload, secret);
+  return constantTimeEqual(expected, signature);
+}
+
+export function getBuiltinRemoteSessionCookieOptions(isSecure: boolean): {
+  httpOnly: true;
+  maxAge: number;
+  path: string;
+  sameSite: "lax";
+  secure: boolean;
+} {
+  return {
+    httpOnly: true,
+    sameSite: "lax",
+    secure: isSecure,
+    path: "/",
+    maxAge: BUILTIN_REMOTE_SESSION_TTL_SECONDS,
+  };
+}

package/web/.next/standalone/packages/web/src/lib/runtimeAgentModels.test.ts

@@ -0,0 +1,78 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { parseCodexRuntimeModelCatalog } from "./runtimeAgentModels";
+
+test("parseCodexRuntimeModelCatalog keeps visible Codex models in priority order", () => {
+  const catalog = parseCodexRuntimeModelCatalog({
+    models: [
+      {
+        slug: "gpt-5.2-codex",
+        display_name: "gpt-5.2-codex",
+        description: "Older coding model",
+        default_reasoning_level: "medium",
+        supported_reasoning_levels: [
+          { effort: "low", description: "Fast responses with lighter reasoning" },
+          { effort: "medium", description: "Balanced speed and depth" },
+        ],
+        visibility: "list",
+        supported_in_api: true,
+        priority: 3,
+      },
+      {
+        slug: "gpt-5.4",
+        display_name: "gpt-5.4",
+        description: "Latest frontier agentic coding model.",
+        default_reasoning_level: "high",
+        supported_reasoning_levels: [
+          { effort: "low", description: "Fast responses with lighter reasoning" },
+          { effort: "medium", description: "Balanced speed and depth" },
+          { effort: "high", description: "Deeper reasoning" },
+          { effort: "xhigh", description: "Maximum depth" },
+        ],
+        visibility: "list",
+        supported_in_api: true,
+        priority: 0,
+      },
+      {
+        slug: "gpt-5.3-codex-spark",
+        display_name: "GPT-5.3-Codex-Spark",
+        description: "Ultra-fast coding model.",
+        default_reasoning_level: "medium",
+        supported_reasoning_levels: [
+          { effort: "low", description: "Fast responses with lighter reasoning" },
+          { effort: "medium", description: "Balanced speed and depth" },
+          { effort: "high", description: "Deeper reasoning" },
+        ],
+        visibility: "list",
+        supported_in_api: false,
+        priority: 2,
+      },
+      {
+        slug: "gpt-5.1-codex",
+        display_name: "gpt-5.1-codex",
+        description: "Hidden legacy model",
+        visibility: "hide",
+        supported_in_api: true,
+        priority: 8,
+      },
+    ],
+  }, "gpt-5.4");
+
+  assert.ok(catalog);
+  assert.deepEqual(
+    catalog.modelsByAccess.chatgpt?.map((model) => model.id),
+    ["gpt-5.4", "gpt-5.3-codex-spark", "gpt-5.2-codex"],
+  );
+  assert.deepEqual(
+    catalog.modelsByAccess.api?.map((model) => model.id),
+    ["gpt-5.4", "gpt-5.2-codex"],
+  );
+  assert.equal(catalog.defaultModelByAccess.chatgpt, "gpt-5.4");
+  assert.equal(catalog.defaultModelByAccess.api, "gpt-5.4");
+  assert.equal(catalog.defaultReasoningByAccess?.chatgpt, "high");
+  assert.equal(catalog.defaultReasoningByAccess?.api, "high");
+  assert.deepEqual(
+    catalog.reasoningOptionsByModel?.["gpt-5.4"]?.map((option) => option.id),
+    ["low", "medium", "high", "xhigh"],
+  );
+});