create-workframe 0.1.17 → 0.1.20

package/workframe-api/package.json

@@ -4,9 +4,9 @@
   "private": true,
   "type": "module",
   "scripts": {
-    "dev": "python3 server.py",
-    "start": "python3 server.py",
-    "typecheck": "python -m py_compile server.py zk_auth.py email_sender.py profile_config_yaml.py route_registry.py domain/entities.py domain/__init__.py && python test_public_routes.py && python test_route_registry.py && python test_billing_provider.py && python test_model_surface_consistency.py && python test_profile_model_yaml.py && python test_domain_entities.py",
-    "build": "python3 -m py_compile server.py zk_auth.py email_sender.py"
+    "dev": "node scripts/run-python.mjs server.py",
+    "start": "node scripts/run-python.mjs server.py",
+    "typecheck": "node scripts/run-python.mjs -m py_compile server.py zk_auth.py email_sender.py profile_config_yaml.py route_registry.py domain/entities.py domain/__init__.py && node scripts/run-python.mjs test_public_routes.py && node scripts/run-python.mjs test_route_registry.py && node scripts/run-python.mjs test_billing_provider.py && node scripts/run-python.mjs test_model_surface_consistency.py && node scripts/run-python.mjs test_profile_model_yaml.py && node scripts/run-python.mjs test_domain_entities.py",
+    "build": "node scripts/run-python.mjs -m py_compile server.py zk_auth.py email_sender.py"
   }
 }

package/workframe-api/profile_gateway.py

@@ -31,7 +31,13 @@ def _srv():
 def _reload_runtime_profile_gateway(profile: str, *, wait_healthy: bool = True) -> None:
     """Reload Hermes after config.yaml change — gateway restart before stop+start."""
     prof = _srv().resolve_hermes_profile(profile)
-    if not _srv()._is_runtime_profile_slug(prof) or prof == _srv()._primary_profile():
+    if prof == _srv()._primary_profile():
+        _srv()._invalidate_profile_health_cache(prof)
+        _srv()._restart_stack_gateway()
+        if wait_healthy:
+            _wait_profile_api_healthy(prof, attempts=120, delay=0.5)
+        return
+    if not _srv()._is_runtime_profile_slug(prof):
         return
     with _srv()._gateway_lifecycle_lock:
         if _profile_api_healthy(prof, timeout=0.5, use_cache=False):
@@ -59,8 +65,7 @@ def _schedule_gateway_reload(profile: str) -> None:
 
     def _run() -> None:
         try:
-            with _srv()._gateway_lifecycle_lock:
-                _reload_runtime_profile_gateway(prof, wait_healthy=False)
+            _reload_runtime_profile_gateway(prof, wait_healthy=False)
         except Exception as exc:  # noqa: BLE001
             print(f"[workframe-api] gateway reload failed for {prof}: {exc}")
 
@@ -363,15 +368,18 @@ def _profile_api_healthy(profile: str, timeout: float = 1.5, *, use_cache: bool
     return ok
 
 
-def _wait_profile_api_healthy(profile: str, attempts: int = 60, delay: float = 0.5) -> bool:
+def _wait_profile_api_healthy(profile: str, attempts: int = 120, delay: float = 0.5) -> bool:
     try:
         prof = _srv().resolve_hermes_profile(profile)
     except ValueError:
         return False
-    if _profile_api_healthy(prof):
+    # A compose-managed primary gateway can take ~40 seconds to restart. Do
+    # not let the short-lived negative health cache consume the polling window
+    # or the first post-install room turn can fail just before it comes up.
+    if _profile_api_healthy(prof, use_cache=False):
         return True
     for _ in range(attempts):
-        if _profile_api_healthy(prof):
+        if _profile_api_healthy(prof, use_cache=False):
             return True
         time.sleep(delay)
     return False

package/workframe-api/provider_bindings.py

@@ -45,6 +45,30 @@ def _user_provider_bindings(user_id: str) -> dict[str, dict[str, Any]]:
     return by_provider
 
 
+def _workspace_provider_bindings(workspace_id: str) -> dict[str, dict[str, Any]]:
+    """Return the active, newest shared credential for each workspace provider."""
+    by_provider: dict[str, dict[str, Any]] = {}
+    try:
+        conn = sqlite3.connect(str(_srv()._workframe_db_path()), timeout=3.0)
+        conn.row_factory = sqlite3.Row
+        rows = conn.execute(
+            """SELECT id, provider, credential_type, credential_ref, label, is_active, updated_at
+               FROM credential_bindings
+               WHERE workspace_id = ? AND user_id IS NULL
+                 AND deleted_at IS NULL AND is_active = 1
+               ORDER BY updated_at DESC, created_at DESC""",
+            (workspace_id,),
+        ).fetchall()
+        conn.close()
+    except sqlite3.Error:
+        rows = []
+    for row in rows:
+        provider = str(row["provider"] or "").lower()
+        if provider and provider not in by_provider:
+            by_provider[provider] = dict(row)
+    return by_provider
+
+
 _DEVICE_OAUTH_PROVIDER_IDS: frozenset[str] = frozenset({"codex", "nous"})
 _oauth_device_lock = threading.Lock()
 _oauth_device_sessions: dict[str, dict[str, Any]] = {}
@@ -146,15 +170,16 @@ def _sync_oauth_llm_to_profile(profile: str, user_id: str, provider: str) -> boo
         return False
     prof = _srv().resolve_hermes_profile(profile)
     auth = _load_profile_auth_json(prof)
-    if _extract_oauth_block_from_auth(auth, hermes_auth_id):
-        # ponytail: steady-state turns — skip user auth read when profile already has oauth
-        return False
     user_auth = _load_user_hermes_auth(user_id)
     if not isinstance(user_auth, dict):
         return False
     auth_path = _srv()._profile_dir(prof) / "auth.json"
+    before = json.dumps(auth, sort_keys=True, separators=(",", ":"))
     if not _merge_oauth_auth_into_profile(auth, user_auth, hermes_auth_id):
         return False
+    after = json.dumps(auth, sort_keys=True, separators=(",", ":"))
+    if after == before:
+        return False
     auth["version"] = 1
     auth["updated_at"] = _srv()._utc_now()
     auth_path.parent.mkdir(parents=True, exist_ok=True)
@@ -238,21 +263,47 @@ def _user_provider_connected(user_id: str, spec: dict[str, Any]) -> bool:
     return _srv()._provider_connected_for_user(user_id, spec, bindings, env_keys)
 
 
-def list_user_providers(user_id: str, workspace_id: str = "") -> dict[str, Any]:
+def list_user_providers(
+    user_id: str,
+    workspace_id: str = "",
+    credential_scope: str = "effective",
+) -> dict[str, Any]:
+    scope = str(credential_scope or "effective").strip().lower()
+    if scope not in {"effective", "user", "workspace"}:
+        scope = "effective"
     bindings = _user_provider_bindings(user_id)
     workspace = str(workspace_id or "").strip()
+    workspace_bindings = _workspace_provider_bindings(workspace) if workspace else {}
+    workspace_mode = bool(workspace and _srv()._workspace_credential_mode(None, workspace) == "workspace")
     providers: list[dict[str, Any]] = []
     for spec in _srv().PROVIDER_CONNECT_CATALOG:
         provider_id = str(spec["id"])
         env_var = str(spec.get("env_var") or "")
         binding = bindings.get(provider_id)
-        connected = _user_provider_connected(user_id, spec)
-        source: str | None = "user" if connected else None
-        if not connected and workspace and str(spec.get("category") or "") == "llm":
-            resolved = _srv()._resolve_credential("", workspace, provider_id)
-            if resolved and _srv()._credential_secret(resolved, user_id):
-                connected = True
-                source = "workspace"
+        workspace_binding = workspace_bindings.get(provider_id)
+        connected = False
+        source: str | None = None
+        selected_binding: dict[str, Any] | None = None
+        if scope == "workspace":
+            selected_binding = workspace_binding
+            if selected_binding:
+                connected = bool(_srv()._credential_secret(selected_binding, user_id))
+                source = "workspace" if connected else None
+        else:
+            connected = _user_provider_connected(user_id, spec)
+            source = "user" if connected else None
+            selected_binding = binding if connected else None
+            if (
+                scope == "effective"
+                and not connected
+                and workspace_mode
+                and str(spec.get("category") or "") == "llm"
+                and workspace_binding
+            ):
+                connected = bool(_srv()._credential_secret(workspace_binding, user_id))
+                if connected:
+                    source = "workspace"
+                    selected_binding = workspace_binding
         oauth_configured = None
         if str(spec.get("connect_mode") or "") == "oauth":
             oauth_name = str(spec.get("oauth_provider") or provider_id)
@@ -264,13 +315,18 @@ def list_user_providers(user_id: str, workspace_id: str = "") -> dict[str, Any]:
             **spec,
             "connected": connected,
             "source": source,
-            "credential_id": str(binding["id"]) if binding else None,
-            "credential_ref": str(binding["credential_ref"]) if binding else (f"env:{env_var}" if env_var and connected else None),
+            "credential_id": str(selected_binding["id"]) if selected_binding else None,
+            "credential_ref": str(selected_binding["credential_ref"]) if selected_binding else (f"env:{env_var}" if env_var and connected else None),
             "profile_home": str(_srv()._user_hermes_home(user_id)),
             "oauth_configured": oauth_configured,
             "user_only": bool(spec.get("user_only")),
         })
-    return {"ok": True, "providers": providers, "profile_home": str(_srv()._user_hermes_home(user_id))}
+    return {
+        "ok": True,
+        "credential_scope": scope,
+        "providers": providers,
+        "profile_home": str(_srv()._user_hermes_home(user_id)),
+    }
 
 
 def disconnect_user_credential(user_id: str, credential_id: str) -> dict[str, Any]:
@@ -303,6 +359,11 @@ def disconnect_user_credential(user_id: str, credential_id: str) -> dict[str, An
         conn.close()
     except sqlite3.Error as exc:
         return {"ok": False, "error": f"db_error: {exc}"}
+    _srv()._revoke_runtime_llm_leases(
+        payer_user_id=user_id,
+        provider=str(row["provider"]),
+        credential_binding_id=credential_id,
+    )
     return {"ok": True, "credential_id": credential_id, "provider": str(row["provider"])}
 
 
@@ -439,14 +500,14 @@ def _device_oauth_error_from_log(log_text: str) -> str | None:
     if not clean:
         return None
     lowered = clean.lower()
-    auth_err = re.search(r"AuthError:\s*(.+)", clean)
-    if auth_err:
-        return auth_err.group(1).strip()[:500]
     if "rate-limit" in lowered or "rate limiting" in lowered or "http 429" in lowered or re.search(r"\b429\b", lowered):
         return (
             "OpenAI is rate-limiting Codex login requests (HTTP 429). "
             "Wait a minute and try again."
         )
+    auth_err = re.search(r"AuthError:\s*(.+)", clean)
+    if auth_err:
+        return auth_err.group(1).strip()[:500]
     if any(token in lowered for token in ("login timed out", "login cancelled", "oauth_start_failed")):
         lines = [line.strip() for line in clean.splitlines() if line.strip()]
         return (lines[-1] if lines else "OAuth failed")[:500]
@@ -492,6 +553,11 @@ def _sync_user_oauth_provider_to_runtime_profiles(user_id: str, hermes_auth_id:
 def _finalize_hermes_device_oauth(user_id: str, provider_id: str, spec: dict[str, Any]) -> None:
     hermes_auth_id = _hermes_auth_id_for_spec(spec)
     _sync_user_oauth_provider_to_runtime_profiles(user_id, hermes_auth_id)
+    # The picker caches connected providers for one minute. OAuth material is
+    # stored outside credential_bindings, so the ordinary secret-save
+    # invalidation path never runs; clear it before selecting/bootstraping the
+    # new provider or the completed Codex connection remains invisible.
+    _srv()._invalidate_user_llm_picker_cache(user_id)
     _srv()._bootstrap_model_after_llm_connect(user_id, "", provider_id)
 
 
@@ -508,6 +574,24 @@ def _device_oauth_session_patch(session_id: str, patch: dict[str, Any]) -> None:
             row.update(patch)
 
 
+def _reusable_device_oauth_session(user_id: str, provider_id: str) -> tuple[str, dict[str, Any]] | None:
+    """Reuse one live device flow instead of rate-limiting the upstream provider."""
+    now = time.time()
+    with _oauth_device_lock:
+        candidates = [
+            (session_id, dict(row))
+            for session_id, row in _oauth_device_sessions.items()
+            if isinstance(row, dict)
+            and row.get("user_id") == user_id
+            and row.get("provider_id") == provider_id
+            and row.get("status") == "pending"
+            and now - float(row.get("started_at") or 0.0) < 16 * 60
+        ]
+    if not candidates:
+        return None
+    return max(candidates, key=lambda item: float(item[1].get("started_at") or 0.0))
+
+
 def _spawn_hermes_device_oauth(user_id: str, hermes_auth_id: str, log_container: str) -> tuple[int, str]:
     """Start long-running `hermes auth add` detached in gateway (survives exec return)."""
     home = _srv()._hermes_user_home_container(user_id)
@@ -544,6 +628,23 @@ def _spawn_hermes_device_oauth(user_id: str, hermes_auth_id: str, log_container:
 
 def _start_device_oauth(user_id: str, provider_id: str, spec: dict[str, Any]) -> dict[str, Any]:
     hermes_auth_id = _hermes_auth_id_for_spec(spec)
+    reusable = _reusable_device_oauth_session(user_id, provider_id)
+    if reusable:
+        reusable_id, _ = reusable
+        current = device_oauth_status(user_id, provider_id, reusable_id)
+        if current.get("status") != "error":
+            return {
+                "ok": True,
+                "provider": provider_id,
+                "hermes_auth_id": hermes_auth_id,
+                "flow": "device_code",
+                "session_id": reusable_id,
+                "status": current.get("status") or "pending",
+                "verification_uri": current.get("verification_uri"),
+                "user_code": current.get("user_code"),
+                "message": current.get("message"),
+                "reused": True,
+            }
     session_id = secrets.token_urlsafe(16)
     log_name = f".oauth-{session_id}.log"
     home = _srv()._hermes_user_home_container(user_id)

package/workframe-api/provider_bootstrap.py

@@ -213,57 +213,85 @@ def _reconcile_profile_llm_for_user(
     *,
     prefer_provider: str = "",
 ) -> bool:
-    """Point proxy + MVP model at a provider the acting user can bill."""
+    """Repair routing for the agent-owned model without changing that model.
+
+    Credentials authorize execution; they never silently select a different
+    provider and create DM/room model drift.
+    """
     user = str(user_id or "").strip()
     if not user:
         return False
     prof = _srv().resolve_hermes_profile(profile)
     block = _srv()._read_model_block(prof)
-    model = str(block.get("default") or "").strip()
-    if model:
-        cfg = str(block.get("provider") or "").strip().lower()
-        quick_billing = _srv()._billing_provider_id_from_hermes_config(cfg)
-        # Direct oauth routing only — custom proxy may still need rebilling to user's provider.
-        if quick_billing and cfg != "custom" and _srv()._profile_routing_matches_billing(
-            prof, quick_billing, block=block,
-        ):
-            return False
-    connected = _srv()._user_llm_providers_for_picker(user)
-    current_model = model
-    prefer = str(prefer_provider or "").strip().lower()
-    model_billing = (
-        _srv()._resolve_billing_provider_for_model(current_model, connected, prefer=prefer)
-        if current_model
+    current_model = str(block.get("default") or "").strip()
+    cfg = str(block.get("provider") or "").strip().lower()
+    configured_billing = (
+        _srv()._billing_provider_from_block(
+            str(block.get("base_url") or ""),
+            cfg,
+            cfg,
+        )
+        if (cfg or block.get("base_url"))
         else ""
     )
-    if model_billing and _srv()._user_can_use_llm(user, workspace_id, model_billing):
-        billing = model_billing
+    connected = _srv()._user_llm_providers_for_picker(user)
+    prefer = str(prefer_provider or "").strip().lower()
+    if configured_billing and current_model:
+        billing = configured_billing
     elif prefer and _srv()._user_can_use_llm(user, workspace_id, prefer):
         billing = prefer
     else:
-        billing = _srv()._llm_billing_provider(prof, user_id=user, workspace_id=workspace_id)
-        if not _srv()._user_can_use_llm(user, workspace_id, billing):
-            connected_sorted = sorted(connected)
-            if not connected_sorted:
-                return False
-            billing = connected_sorted[0]
-    if _srv()._profile_routing_matches_billing(prof, billing):
-        return False
-    if _srv()._oauth_llm_provider_spec(billing) and _srv()._user_can_use_llm(user, workspace_id, billing):
-        current = str(_srv()._read_model_from_config(prof)[1] or "").strip()
-        if not _srv()._resolve_billing_provider_for_model(current, {billing}, prefer=billing):
-            current = str((_srv().PROVIDER_MVP_MODELS.get(billing) or {}).get("primary") or "")
-        _srv()._apply_model_for_billing_provider(prof, billing, current, user_id=user)
-        if _srv()._is_runtime_profile_slug(prof):
+        connected_sorted = sorted(connected)
+        if not connected_sorted:
+            return False
+        billing = connected_sorted[0]
+
+    if not current_model:
+        current_model = str(
+            (_srv().PROVIDER_MVP_MODELS.get(billing) or {}).get("primary") or ""
+        ).strip()
+        if not current_model:
+            return False
+
+    if _srv()._oauth_llm_provider_spec(billing):
+        if _srv()._profile_routing_matches_billing(prof, billing, block=block):
+            auth_changed = bool(
+                _srv()._user_can_use_llm(user, workspace_id, billing)
+                and _srv()._sync_oauth_llm_to_profile(prof, user, billing)
+            )
+            if auth_changed:
+                _srv()._reload_runtime_profile_gateway(prof, wait_healthy=True)
+            return auth_changed
+        changed = _srv()._apply_model_for_billing_provider(
+            prof,
+            billing,
+            current_model,
+            user_id=user if _srv()._user_can_use_llm(user, workspace_id, billing) else "",
+        )
+        if changed:
             _srv()._reload_runtime_profile_gateway(prof, wait_healthy=True)
-        return True
-    if _srv()._user_can_use_llm(user, workspace_id, billing) and _srv()._profile_llm_proxy_matches_billing(prof, billing):
+        return changed
+
+    if _srv()._profile_routing_matches_billing(prof, billing, block=block):
+        if not _srv()._profile_llm_proxy_ready(prof, billing):
+            before = _srv()._parse_model_block_from_disk(prof)
+            _srv()._ensure_profile_llm_proxy(prof, billing)
+            changed = before != _srv()._parse_model_block_from_disk(prof)
+            if changed:
+                _srv()._reload_runtime_profile_gateway(prof, wait_healthy=True)
+            return changed
         return False
-    changed = _srv()._apply_mvp_model_for_provider(prof, billing)
-    block = _srv()._read_model_block(prof)
-    if _srv()._is_runtime_profile_slug(prof) or str(block.get("provider") or "").strip().lower() == "custom":
+
+    # API-key providers are vault-backed. Repair transport to the internal
+    # proxy while preserving the exact agent-selected model id.
+    changed = _srv()._apply_model_for_billing_provider(
+        prof,
+        billing,
+        current_model,
+        user_id=user,
+    )
+    if changed:
         _srv()._ensure_profile_llm_proxy(prof, billing)
-    if changed and _srv()._is_runtime_profile_slug(prof):
         _srv()._reload_runtime_profile_gateway(prof, wait_healthy=True)
     return changed
 
@@ -340,6 +368,14 @@ def _bootstrap_profile_providers(profile: str, user_id: str = "", workspace_id:
 
     provider, model_name = _srv()._read_model_from_config(prof)
     llm_provider = _srv()._llm_billing_provider(prof, provider or "")
+    # ChatGPT-account Codex rejects the historical gpt-5.4-medium default.
+    # Migrate generated profiles during ordinary bootstrap so existing installs
+    # converge without requiring users to delete their agent/session data.
+    if llm_provider == "codex" and str(model_name or "").strip() == "gpt-5.4-medium":
+        ok_model, _ = _srv()._set_profile_model(prof, "gpt-5.4-mini")
+        changed = ok_model or changed
+        model_name = "gpt-5.4-mini"
+
     if not str(model_name or "").strip():
         changed = _srv()._apply_mvp_model_for_provider(prof, llm_provider) or changed
         if _srv()._is_runtime_profile_slug(prof):