conductor-oss 0.2.4 → 0.2.6

package/web/.next/standalone/packages/web/src/lib/modelAccess.ts

@@ -0,0 +1,40 @@
+import {
+  getDefaultModelAccessPreferences,
+  type ModelAccessPreferences,
+} from "@conductor-oss/core/types";
+
+const CLAUDE_ACCESS = ["pro", "max", "api"] as const;
+const CODEX_ACCESS = ["chatgpt", "api"] as const;
+const GEMINI_ACCESS = ["oauth", "api"] as const;
+const QWEN_ACCESS = ["oauth", "api"] as const;
+
+function toObject(value: unknown): Record<string, unknown> {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return {};
+  }
+  return { ...(value as Record<string, unknown>) };
+}
+
+function selectValue<T extends string>(
+  value: unknown,
+  supported: readonly T[],
+  fallback: T,
+): T {
+  return typeof value === "string" && supported.includes(value as T)
+    ? value as T
+    : fallback;
+}
+
+export function normalizeModelAccessPreferences(
+  value: unknown,
+): Required<ModelAccessPreferences> {
+  const root = toObject(value);
+  const defaults = getDefaultModelAccessPreferences();
+
+  return {
+    claudeCode: selectValue(root["claudeCode"], CLAUDE_ACCESS, defaults.claudeCode),
+    codex: selectValue(root["codex"], CODEX_ACCESS, defaults.codex),
+    gemini: selectValue(root["gemini"], GEMINI_ACCESS, defaults.gemini),
+    qwenCode: selectValue(root["qwenCode"], QWEN_ACCESS, defaults.qwenCode),
+  };
+}

package/web/.next/standalone/packages/web/src/lib/projectConfigSync.ts

@@ -1,7 +1,12 @@
 import { join, resolve } from "node:path";
-import { writeFile } from "node:fs/promises";
+import { stat, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
-import { buildConductorYaml, type ScaffoldProjectConfig } from "@conductor-oss/core";
+import {
+  buildConductorYaml,
+  resolveConfiguredProjectPath,
+  type ScaffoldProjectConfig,
+} from "@conductor-oss/core";
+import { normalizeModelAccessPreferences } from "@/lib/modelAccess";
 
 type MutableConfig = Record<string, unknown>;
 
@@ -25,6 +30,14 @@ function expandHome(value: string): string {
   return resolve(value);
 }
 
+async function isDirectory(path: string): Promise<boolean> {
+  try {
+    return (await stat(path)).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
 function normalizePreferences(value: unknown) {
   const root = toObject(value);
   const notifications = toObject(root["notifications"]);
@@ -36,6 +49,7 @@ function normalizePreferences(value: unknown) {
     remoteSshHost: asNonEmptyString(root["remoteSshHost"]),
     remoteSshUser: asNonEmptyString(root["remoteSshUser"]),
     markdownEditor: asNonEmptyString(root["markdownEditor"]) ?? "obsidian",
+    modelAccess: normalizeModelAccessPreferences(root["modelAccess"]),
     notifications: {
       soundEnabled: notifications["soundEnabled"] !== false,
       soundFile: notifications["soundFile"] === null
@@ -45,14 +59,18 @@ function normalizePreferences(value: unknown) {
   };
 }
 
-function buildProjectScaffold(projectId: string, project: Record<string, unknown>): ScaffoldProjectConfig {
+function buildProjectScaffold(
+  projectId: string,
+  project: Record<string, unknown>,
+  projectPath: string,
+): ScaffoldProjectConfig {
   const agentConfig = toObject(project["agentConfig"]);
 
   return {
     projectId,
     displayName: asNonEmptyString(project["name"]) ?? projectId,
     repo: asNonEmptyString(project["repo"]) ?? `local-${projectId}`,
-    path: expandHome(asNonEmptyString(project["path"]) ?? projectId),
+    path: projectPath,
     agent: asNonEmptyString(project["agent"]) ?? "claude-code",
     defaultBranch: asNonEmptyString(project["defaultBranch"]) ?? "main",
     defaultWorkingDirectory: asNonEmptyString(project["defaultWorkingDirectory"]),
@@ -66,11 +84,43 @@ function buildProjectScaffold(projectId: string, project: Record<string, unknown
   };
 }
 
+export async function normalizeRootProjectPaths(rootConfig: MutableConfig): Promise<void> {
+  const projects = toObject(rootConfig["projects"]);
+
+  for (const [projectId, rawProject] of Object.entries(projects)) {
+    const project = toObject(rawProject);
+    const rawProjectPath = asNonEmptyString(project["path"]);
+    if (!rawProjectPath) {
+      continue;
+    }
+
+    const resolvedProjectPath = resolveConfiguredProjectPath(
+      rawProjectPath,
+      asNonEmptyString(project["repo"]),
+    );
+
+    if (!await isDirectory(resolvedProjectPath)) {
+      continue;
+    }
+
+    projects[projectId] = {
+      ...project,
+      path: resolvedProjectPath,
+    };
+  }
+
+  rootConfig["projects"] = projects;
+}
+
 export async function syncProjectLocalConfig(rootConfig: MutableConfig, projectId: string): Promise<void> {
   const projects = toObject(rootConfig["projects"]);
   const project = toObject(projects[projectId]);
-  const projectPath = asNonEmptyString(project["path"]);
-  if (!projectPath) {
+  const rawProjectPath = asNonEmptyString(project["path"]);
+  if (!rawProjectPath) {
+    return;
+  }
+  const projectPath = resolveConfiguredProjectPath(rawProjectPath, asNonEmptyString(project["repo"]));
+  if (!await isDirectory(projectPath)) {
     return;
   }
 
@@ -78,13 +128,13 @@ export async function syncProjectLocalConfig(rootConfig: MutableConfig, projectI
     port: typeof rootConfig["port"] === "number" ? rootConfig["port"] : 4747,
     dashboardUrl: asNonEmptyString(rootConfig["dashboardUrl"]),
     preferences: normalizePreferences(rootConfig["preferences"]),
-    projects: [buildProjectScaffold(projectId, project)],
+    projects: [buildProjectScaffold(projectId, project, projectPath)],
   });
-
-  await writeFile(join(expandHome(projectPath), "conductor.yaml"), yaml, "utf8");
+  await writeFile(join(projectPath, "conductor.yaml"), yaml, "utf8");
 }
 
 export async function syncAllProjectLocalConfigs(rootConfig: MutableConfig): Promise<void> {
+  await normalizeRootProjectPaths(rootConfig);
   const projects = toObject(rootConfig["projects"]);
   for (const projectId of Object.keys(projects)) {
     await syncProjectLocalConfig(rootConfig, projectId);

package/web/.next/standalone/packages/web/src/lib/remoteAuth.ts

@@ -0,0 +1,104 @@
+const BUILTIN_REMOTE_ACCESS_TOKEN_ENV = "CONDUCTOR_REMOTE_ACCESS_TOKEN";
+const BUILTIN_REMOTE_SESSION_SECRET_ENV = "CONDUCTOR_REMOTE_SESSION_SECRET";
+
+export const BUILTIN_REMOTE_SESSION_COOKIE = "conductor_session";
+export const BUILTIN_REMOTE_SESSION_TTL_SECONDS = 60 * 60 * 24 * 7;
+
+function getAccessToken(): string | null {
+  const token = process.env[BUILTIN_REMOTE_ACCESS_TOKEN_ENV]?.trim();
+  return token && token.length > 0 ? token : null;
+}
+
+function getSessionSecret(): string | null {
+  const secret = process.env[BUILTIN_REMOTE_SESSION_SECRET_ENV]?.trim();
+  return secret && secret.length > 0 ? secret : null;
+}
+
+function toHex(bytes: Uint8Array): string {
+  return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+
+function constantTimeEqual(left: string, right: string): boolean {
+  if (left.length !== right.length) return false;
+  let mismatch = 0;
+  for (let index = 0; index < left.length; index += 1) {
+    mismatch |= left.charCodeAt(index) ^ right.charCodeAt(index);
+  }
+  return mismatch === 0;
+}
+
+async function signPayload(payload: string, secret: string): Promise<string> {
+  const encoder = new TextEncoder();
+  const key = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"],
+  );
+  const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(payload));
+  return toHex(new Uint8Array(signature));
+}
+
+export function isBuiltinRemoteAuthEnabled(): boolean {
+  return Boolean(getAccessToken() && getSessionSecret());
+}
+
+export function sanitizeRedirectTarget(value: string | null | undefined): string {
+  if (!value) return "/";
+  const trimmed = value.trim();
+  if (!trimmed.startsWith("/") || trimmed.startsWith("//")) return "/";
+  return trimmed;
+}
+
+export function isValidBuiltinAccessToken(candidate: string | null | undefined): boolean {
+  const configured = getAccessToken();
+  if (!configured || !candidate) return false;
+  return constantTimeEqual(configured, candidate.trim());
+}
+
+export async function createBuiltinRemoteSessionValue(): Promise<string> {
+  const secret = getSessionSecret();
+  if (!secret) {
+    throw new Error("Built-in remote session secret is not configured");
+  }
+
+  const expiresAt = Date.now() + BUILTIN_REMOTE_SESSION_TTL_SECONDS * 1000;
+  const payload = String(expiresAt);
+  const signature = await signPayload(payload, secret);
+  return `${payload}.${signature}`;
+}
+
+export async function verifyBuiltinRemoteSession(value: string | null | undefined): Promise<boolean> {
+  const secret = getSessionSecret();
+  if (!secret || !value) return false;
+
+  const separator = value.indexOf(".");
+  if (separator <= 0 || separator === value.length - 1) return false;
+
+  const payload = value.slice(0, separator);
+  const signature = value.slice(separator + 1);
+  const expiresAt = Number.parseInt(payload, 10);
+  if (!Number.isFinite(expiresAt) || expiresAt <= Date.now()) {
+    return false;
+  }
+
+  const expected = await signPayload(payload, secret);
+  return constantTimeEqual(expected, signature);
+}
+
+export function getBuiltinRemoteSessionCookieOptions(isSecure: boolean): {
+  httpOnly: true;
+  maxAge: number;
+  path: string;
+  sameSite: "lax";
+  secure: boolean;
+} {
+  return {
+    httpOnly: true,
+    sameSite: "lax",
+    secure: isSecure,
+    path: "/",
+    maxAge: BUILTIN_REMOTE_SESSION_TTL_SECONDS,
+  };
+}

package/web/.next/standalone/packages/web/src/proxy.ts

@@ -1,4 +1,12 @@
 import { NextResponse, type NextFetchEvent, type NextRequest } from "next/server";
+import { isLoopbackHost } from "./lib/accessControl";
+import { verifyTrustedEdgeIdentity } from "./lib/edgeAuth";
+import {
+  BUILTIN_REMOTE_SESSION_COOKIE,
+  isBuiltinRemoteAuthEnabled,
+  sanitizeRedirectTarget,
+  verifyBuiltinRemoteSession,
+} from "./lib/remoteAuth";
 
 const clerkConfigured = Boolean(
   process.env.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY && process.env.CLERK_SECRET_KEY,
@@ -8,7 +16,63 @@ export default async function proxy(
   req: NextRequest,
   event: NextFetchEvent,
 ): Promise<NextResponse> {
+  const trustedEdgeIdentity = await verifyTrustedEdgeIdentity(req.headers, null);
+  if (trustedEdgeIdentity?.ok) {
+    return NextResponse.next();
+  }
+
+  if (isBuiltinRemoteAuthEnabled()) {
+    const pathname = req.nextUrl.pathname;
+    const isBuiltinPublicRoute =
+      pathname.startsWith("/unlock") ||
+      pathname.startsWith("/auth/grant") ||
+      pathname.startsWith("/api/auth/session");
+
+    if (isBuiltinPublicRoute) {
+      return NextResponse.next();
+    }
+
+    const session = req.cookies.get(BUILTIN_REMOTE_SESSION_COOKIE)?.value ?? null;
+    const hasValidSession = await verifyBuiltinRemoteSession(session);
+    if (hasValidSession) {
+      return NextResponse.next();
+    }
+
+    if (pathname.startsWith("/api/")) {
+      return NextResponse.json(
+        {
+          error: "Access denied",
+          reason: "Remote sign-in required",
+        },
+        { status: 403 },
+      );
+    }
+
+    const redirectUrl = req.nextUrl.clone();
+    redirectUrl.pathname = "/unlock";
+    const nextPath = sanitizeRedirectTarget(`${pathname}${req.nextUrl.search}`);
+    if (nextPath !== "/") {
+      redirectUrl.searchParams.set("next", nextPath);
+    }
+    return NextResponse.redirect(redirectUrl);
+  }
+
   if (!clerkConfigured) {
+    if (!isLoopbackHost(req.nextUrl.hostname)) {
+      if (!req.nextUrl.pathname.startsWith("/api/")) {
+        const redirectUrl = req.nextUrl.clone();
+        redirectUrl.pathname = "/unlock";
+        redirectUrl.searchParams.set("error", "unavailable");
+        return NextResponse.redirect(redirectUrl);
+      }
+      return NextResponse.json(
+        {
+          error: "Access denied",
+          reason: "Authentication is required for non-local dashboard access",
+        },
+        { status: 403 },
+      );
+    }
     return NextResponse.next();
   }