dsh-oauth-login 0.2.4

package/src/proxy-config.ts

@@ -0,0 +1,61 @@
+/** Shared, credential-free settings for this plugin's two outbound transports. */
+
+export const PROXY_SETTINGS_PATH = '/plugins/dsh-oauth-login/network/settings'
+export const PROXY_SETTINGS_FILENAME = '.dsh-oauth-proxy.json'
+
+export interface ProxyChannelSettings {
+  /** False means direct, even when proxy environment variables are set. */
+  enabled: boolean
+  /** Empty keeps environment/system discovery; otherwise this URL wins. */
+  url: string
+}
+
+export interface ProxySettings {
+  http: ProxyChannelSettings
+  websocket: ProxyChannelSettings
+}
+
+export interface ProxySettingsSnapshot extends ProxySettings {
+  revision: number
+}
+
+export function defaultProxySettings(): ProxySettingsSnapshot {
+  return { revision: 0, http: { enabled: true, url: '' }, websocket: { enabled: true, url: '' } }
+}
+
+function object(value: unknown, keys: readonly string[], label: string): Record<string, unknown> {
+  if (typeof value !== 'object' || value === null || Array.isArray(value)
+    || Object.keys(value).some(key => !keys.includes(key))) {
+    throw new Error(`${label}: invalid settings object`)
+  }
+  return value as Record<string, unknown>
+}
+
+function channel(value: unknown, label: string): ProxyChannelSettings {
+  const raw = object(value, ['enabled', 'url'], label)
+  if (typeof raw.enabled !== 'boolean' || typeof raw.url !== 'string' || raw.url.length > 1024) {
+    throw new Error(`${label}: expected enabled and proxy URL`)
+  }
+  const text = raw.url.trim()
+  if (text === '') return { enabled: raw.enabled, url: '' }
+  let parsed: URL
+  try { parsed = new URL(text) } catch { throw new Error(`${label}: enter a valid HTTP proxy address and port`) }
+  if (!['http:', 'https:'].includes(parsed.protocol) || !parsed.hostname
+    || parsed.username || parsed.password || parsed.search || parsed.hash
+    || parsed.pathname !== '/' || parsed.port === '0') {
+    throw new Error(`${label}: use an HTTP(S) proxy without credentials, path, query or fragment`)
+  }
+  return { enabled: raw.enabled, url: parsed.origin }
+}
+
+export function parseProxySettings(value: unknown): ProxySettingsSnapshot {
+  const raw = object(value, ['revision', 'http', 'websocket'], 'Network')
+  if (typeof raw.revision !== 'number' || !Number.isSafeInteger(raw.revision) || raw.revision < 0) {
+    throw new Error('Network: invalid revision')
+  }
+  return {
+    revision: raw.revision,
+    http: channel(raw.http, 'HTTP'),
+    websocket: channel(raw.websocket, 'WebSocket'),
+  }
+}

package/src/proxy-store.ts

@@ -0,0 +1,45 @@
+/** Independent, atomic settings file; never writes the OAuth credential document. */
+
+import { mkdir, readFile } from 'node:fs/promises'
+import { dirname } from 'node:path'
+import { withFileLock, writeFileAtomic } from '@deepseek-ai/dsh-atomic-write'
+import { defaultProxySettings, parseProxySettings } from './proxy-config.ts'
+import type { ProxySettingsSnapshot } from './proxy-config.ts'
+
+export class ProxySettingsConflict extends Error {}
+
+export class ProxySettingsStore {
+  constructor(readonly filename: string) {}
+
+  async read(): Promise<ProxySettingsSnapshot> {
+    let text: string
+    try { text = await readFile(this.filename, 'utf8') } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') return defaultProxySettings()
+      throw new Error('Network settings could not be read', { cause: error })
+    }
+    let document: unknown
+    try { document = JSON.parse(text) } catch { throw new Error('Network settings file is not valid JSON') }
+    if (typeof document !== 'object' || document === null || !('version' in document)
+      || document.version !== 1 || !('settings' in document)
+      || Object.keys(document).some(key => key !== 'version' && key !== 'settings')) {
+      throw new Error('Unsupported network settings file')
+    }
+    return parseProxySettings(document.settings)
+  }
+
+  async save(value: unknown): Promise<ProxySettingsSnapshot> {
+    const input = parseProxySettings(value)
+    await mkdir(dirname(this.filename), { recursive: true, mode: 0o700 })
+    return withFileLock(this.filename, async () => {
+      const current = await this.read()
+      if (current.revision !== input.revision) {
+        throw new ProxySettingsConflict('Network settings changed. Reload them before saving.')
+      }
+      const settings = { ...input, revision: current.revision + 1 }
+      await writeFileAtomic(this.filename, `${JSON.stringify({ version: 1, settings }, null, 2)}\n`, {
+        mode: 0o600, dirMode: 0o700,
+      })
+      return settings
+    })
+  }
+}

package/src/proxy-transport.ts

@@ -0,0 +1,220 @@
+/** Plugin-scoped HTTP/WS routing without changing process.env or provider SDKs. */
+
+import { AsyncLocalStorage } from 'node:async_hooks'
+import { isIP } from 'node:net'
+import { Agent, ProxyAgent, getGlobalDispatcher, setGlobalDispatcher } from 'undici'
+import type { Dispatcher } from 'undici'
+import { closeOpenAICodexWebSocketSessions } from '@earendil-works/pi-ai/api/openai-codex-responses'
+import { createOAuthHttpTransport, installOAuthHttpGlobals } from './http.ts'
+import type { OAuthProxyDiscoveryOptions, OAuthProxyResolution } from './http.ts'
+import type { ProxyChannelSettings, ProxySettingsSnapshot } from './proxy-config.ts'
+import { ProxySettingsStore } from './proxy-store.ts'
+
+interface RoutingScope {
+  http: Dispatcher
+  websocket: Dispatcher
+  direct: Dispatcher
+}
+
+interface RoutingState {
+  context: AsyncLocalStorage<RoutingScope>
+  dispatcher?: Dispatcher
+}
+
+const ROUTING_KEY = Symbol.for('dsh-oauth-login.scoped-proxy.v1')
+const globals = globalThis as typeof globalThis & { [ROUTING_KEY]?: RoutingState }
+const routing = globals[ROUTING_KEY] ??= { context: new AsyncLocalStorage<RoutingScope>() }
+
+function isLoopback(origin: Dispatcher.DispatchOptions['origin']): boolean {
+  if (origin === undefined) return false
+  const hostname = new URL(origin).hostname.toLowerCase().replace(/^\[|\]$/g, '')
+  return hostname === 'localhost' || hostname.endsWith('.localhost') || hostname === '::1'
+    || (isIP(hostname) === 4 && hostname.startsWith('127.'))
+}
+
+function installRouting(): void {
+  const fallback = getGlobalDispatcher()
+  if (fallback !== routing.dispatcher) {
+    routing.dispatcher = fallback.compose(dispatch => (options, handler) => {
+      const scope = routing.context.getStore()
+      if (scope === undefined) return dispatch(options, handler)
+      const websocket = typeof options.upgrade === 'string' && options.upgrade.toLowerCase() === 'websocket'
+      const selected = isLoopback(options.origin) ? scope.direct : websocket ? scope.websocket : scope.http
+      return selected.dispatch(options, handler)
+    })
+    setGlobalDispatcher(routing.dispatcher)
+  }
+  installOAuthHttpGlobals()
+}
+
+interface ReadyTransport {
+  scope: RoutingScope
+  resolution: OAuthProxyResolution
+  agents: Set<Dispatcher>
+  wsKey: string
+  active: number
+  retired: boolean
+  closing: boolean
+}
+
+interface SessionConnection {
+  key: string
+  active: number
+  resetPending: boolean
+}
+
+export class OAuthProxyTransport {
+  readonly settings: ProxySettingsStore
+  private readyPromise?: Promise<ReadyTransport>
+  private readonly generations = new Set<ReadyTransport>()
+  private readonly sessions = new Map<string, SessionConnection>()
+  private disposed = false
+
+  constructor(filename: string, private readonly discovery: OAuthProxyDiscoveryOptions = {}) {
+    this.settings = new ProxySettingsStore(filename)
+  }
+
+  private async build(): Promise<ReadyTransport> {
+    const settings = await this.settings.read()
+    const channels = [settings.http, settings.websocket]
+    const auto = channels.some(channel => channel.enabled && channel.url === '')
+      ? await createOAuthHttpTransport(this.discovery)
+      : undefined
+    const direct = new Agent({ allowH2: false })
+    const agents = new Set<Dispatcher>([direct, ...(auto === undefined ? [] : [auto.dispatcher])])
+    const select = (channel: ProxyChannelSettings): Dispatcher => {
+      if (!channel.enabled) return direct
+      if (channel.url === '') {
+        if (auto === undefined) throw new Error('Automatic proxy transport is unavailable')
+        return auto.dispatcher
+      }
+      const proxy = new ProxyAgent({ uri: channel.url, allowH2: false })
+      agents.add(proxy)
+      return proxy
+    }
+    const ready: ReadyTransport = {
+      scope: { direct, http: select(settings.http), websocket: select(settings.websocket) },
+      // Preserve the legacy initialize() result as HTTP-route metadata. The
+      // separately configured WS route is never reported as an HTTP proxy.
+      resolution: !settings.http.enabled ? { source: 'direct' }
+        : settings.http.url !== '' ? { source: 'explicit', proxyUrl: settings.http.url }
+        : auto?.resolution ?? { source: 'direct' },
+      agents,
+      // Refresh auto-discovered connections after a settings save as well.
+      wsKey: JSON.stringify(settings.websocket) + (settings.websocket.enabled && !settings.websocket.url ? `:${settings.revision}` : ''),
+      active: 0, retired: false, closing: false,
+    }
+    if (this.disposed) {
+      await Promise.allSettled([...agents].map(agent => agent.destroy()))
+      throw new Error('OAuth proxy transport disposed')
+    }
+    this.generations.add(ready)
+    installRouting()
+    return ready
+  }
+
+  private ready(): Promise<ReadyTransport> {
+    if (this.disposed) return Promise.reject(new Error('OAuth proxy transport disposed'))
+    if (this.readyPromise === undefined) {
+      const pending = this.build()
+      this.readyPromise = pending
+      void pending.catch(() => { if (this.readyPromise === pending) this.readyPromise = undefined })
+    }
+    return this.readyPromise
+  }
+
+  async initialize(): Promise<OAuthProxyResolution> {
+    return (await this.ready()).resolution
+  }
+
+  private async acquire(): Promise<ReadyTransport> {
+    while (true) {
+      const ready = await this.ready()
+      if (ready.retired) continue
+      ready.active++
+      return ready
+    }
+  }
+
+  async save(value: unknown): Promise<ProxySettingsSnapshot> {
+    if (this.disposed) throw new Error('OAuth proxy transport disposed')
+    const saved = await this.settings.save(value)
+    const previous = this.readyPromise
+    this.readyPromise = undefined
+    void previous?.then(ready => {
+      ready.retired = true
+      this.release(ready, false)
+    }, () => undefined)
+    return saved
+  }
+
+  private release(ready: ReadyTransport, decrement = true): void {
+    if (decrement) ready.active--
+    if (ready.retired && ready.active === 0 && !ready.closing) {
+      ready.closing = true
+      void Promise.allSettled([...ready.agents].map(agent => agent.close())).then(() => {
+        this.generations.delete(ready)
+      })
+    }
+  }
+
+  async run<T>(operation: () => Promise<T>): Promise<T> {
+    const ready = await this.acquire()
+    try {
+      installRouting()
+      return await routing.context.run(ready.scope, operation)
+    } finally { this.release(ready) }
+  }
+
+  private beginSession(sessionId: string | undefined, ready: ReadyTransport): (() => void) | undefined {
+    if (sessionId === undefined) return undefined
+    let record = this.sessions.get(sessionId)
+    if (record === undefined) {
+      record = { key: ready.wsKey, active: 0, resetPending: false }
+      this.sessions.set(sessionId, record)
+    }
+    if (record.key !== ready.wsKey) record.resetPending = true
+    if (record.resetPending && record.active === 0) {
+      // Public Pi API: retire the old connection, without clearing its SSE
+      // fallback latch or changing any retry budget. Never interrupt active work.
+      closeOpenAICodexWebSocketSessions(sessionId)
+      record.key = ready.wsKey
+      record.resetPending = false
+    }
+    record.active++
+    return () => { record.active-- }
+  }
+
+  async * iterate<T>(source: AsyncIterable<T>, codexSessionId?: string): AsyncIterable<T> {
+    const ready = await this.acquire()
+    let endSession: (() => void) | undefined
+    let iterator: AsyncIterator<T> | undefined
+    try {
+      installRouting()
+      endSession = this.beginSession(codexSessionId, ready)
+      iterator = routing.context.run(ready.scope, () => source[Symbol.asyncIterator]())
+      while (true) {
+        const current = iterator
+        const item = await routing.context.run(ready.scope, () => current.next())
+        if (item.done) return
+        yield item.value
+      }
+    } finally {
+      try {
+        await routing.context.run(ready.scope, () => iterator?.return?.())
+      } finally {
+        endSession?.()
+        this.release(ready)
+      }
+    }
+  }
+
+  async dispose(): Promise<void> {
+    this.disposed = true
+    await this.readyPromise?.catch(() => undefined)
+    for (const sessionId of this.sessions.keys()) closeOpenAICodexWebSocketSessions(sessionId)
+    this.sessions.clear()
+    await Promise.allSettled([...this.generations].flatMap(ready => [...ready.agents].map(agent => agent.destroy())))
+    this.generations.clear()
+  }
+}

package/src/redact.ts

@@ -0,0 +1,22 @@
+import type { PiLoginProvider } from './catalog.ts'
+
+/** Remove token-like strings from an external OAuth diagnostic. */
+export function safeMessage(error: unknown): string {
+  return (error instanceof Error ? error.message : String(error))
+    .replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/gu, '[redacted token]')
+    .replace(/(\b(?:code|token|refresh_token|access_token|api[_-]?key|key)=)[^&\s]+/giu, '$1[redacted]')
+    .slice(0, 1000)
+}
+
+/** Only this provider's official HTTPS hosts may be opened for login. */
+export function isSafeAuthUrl(raw: string, provider: PiLoginProvider): boolean {
+  try {
+    const url = new URL(raw)
+    if (url.protocol !== 'https:') return false
+    const host = url.hostname.toLowerCase()
+    if (provider.allowedHosts.includes(host)) return true
+    return provider.allowedSuffixes.some(suffix => host.endsWith(suffix))
+  } catch {
+    return false
+  }
+}

package/src/responses-tap.ts

@@ -0,0 +1,97 @@
+/** Peek Responses SSE for hosted image_generation_call items pi-ai ignores. */
+
+import { currentHostedCapture } from './hosted-capture.ts'
+import { collectHostedImagesFromEvent } from './hosted-images.ts'
+
+const TAPPED = Symbol('dsh-oauth-hosted-tap')
+
+type TappableFetch = typeof fetch & { [TAPPED]?: true }
+type FetchInput = Parameters<typeof fetch>[0]
+type FetchInit = Parameters<typeof fetch>[1]
+
+function requestUrl(input: FetchInput): string {
+  if (typeof input === 'string') return input
+  if (input instanceof URL) return input.href
+  return input.url
+}
+
+function requestMethod(input: FetchInput, init?: FetchInit): string {
+  if (init?.method !== undefined) return init.method.toUpperCase()
+  if (typeof input !== 'string' && !(input instanceof URL) && input.method.length > 0) {
+    return input.method.toUpperCase()
+  }
+  return 'GET'
+}
+
+export function isResponsesRequest(input: FetchInput, init?: FetchInit): boolean {
+  if (requestMethod(input, init) !== 'POST') return false
+  try {
+    const path = new URL(requestUrl(input)).pathname
+    return path === '/responses' || path.endsWith('/responses')
+  } catch {
+    return false
+  }
+}
+
+function parseSseBlock(block: string): unknown {
+  const data = block
+    .split(/\r?\n/)
+    .filter(line => line.startsWith('data:'))
+    .map(line => line.slice(5).trimStart())
+    .join('\n')
+    .trim()
+  if (data.length === 0 || data === '[DONE]') return undefined
+  try {
+    return JSON.parse(data) as unknown
+  } catch {
+    return undefined
+  }
+}
+
+export function consumeResponsesSseText(text: string, onEvent: (event: unknown) => void): string {
+  const parts = text.split(/\r?\n\r?\n/)
+  const rest = parts.pop() ?? ''
+  for (const block of parts) {
+    const event = parseSseBlock(block)
+    if (event !== undefined) onEvent(event)
+  }
+  return rest
+}
+
+function peekResponsesBody(body: ReadableStream<Uint8Array>, onEvent: (event: unknown) => void): ReadableStream<Uint8Array> {
+  const decoder = new TextDecoder()
+  let buffer = ''
+  return body.pipeThrough(new TransformStream<Uint8Array, Uint8Array>({
+    transform(chunk, controller) {
+      controller.enqueue(chunk)
+      buffer = consumeResponsesSseText(buffer + decoder.decode(chunk, { stream: true }), onEvent)
+    },
+    flush(controller) {
+      if (buffer.length === 0) return
+      const event = parseSseBlock(buffer)
+      if (event !== undefined) onEvent(event)
+      void controller
+    },
+  }))
+}
+
+export function tapResponsesResponse(response: Response, onEvent: (event: unknown) => void): Response {
+  if (response.body === null) return response
+  return new Response(peekResponsesBody(response.body, onEvent), response)
+}
+
+export function wrapFetchForHostedOutput(fetchImpl: typeof fetch): typeof fetch {
+  return async (input, init) => {
+    const capture = currentHostedCapture()
+    if (capture === undefined || !isResponsesRequest(input, init)) return await fetchImpl(input, init)
+    const response = await fetchImpl(input, init)
+    return tapResponsesResponse(response, event => collectHostedImagesFromEvent(event, capture.images))
+  }
+}
+
+export function installHostedOutputFetch(): void {
+  const current = globalThis.fetch as TappableFetch
+  if (current[TAPPED] === true) return
+  const next = Object.assign(wrapFetchForHostedOutput(current), { [TAPPED]: true as const })
+  globalThis.fetch = next
+}

package/src/session.ts

@@ -0,0 +1,104 @@
+/** Shared OAuth store + catalog for the host plugin and CLI. */
+
+import { dirname, join } from 'node:path'
+import { createModels } from '@earendil-works/pi-ai'
+import type { MutableModels } from '@earendil-works/pi-ai'
+import { PI_LOGIN_PROVIDERS, piLoginProvider } from './catalog.ts'
+import type { PiLoginProvider } from './catalog.ts'
+import type { OAuthProxyDiscoveryOptions, OAuthProxyResolution } from './http.ts'
+import { PROXY_SETTINGS_FILENAME } from './proxy-config.ts'
+import { OAuthProxyTransport } from './proxy-transport.ts'
+import {
+  grantNeedsRefresh,
+  markRefreshAttempt,
+  refreshAttemptKey,
+  refreshGrant,
+  refreshOnCooldown,
+} from './oauth-refresh.ts'
+import { DEFAULT_NATIVE_TOOL_POLICY } from './native-tools.ts'
+import type { NativeToolPolicy } from './native-tools.ts'
+import { allCatalogProviders, harnessModels, harnessProvider } from './provider.ts'
+import { PiLoginCredentialStore } from './store.ts'
+import { OPENROUTER_CACHE_FILENAME, OpenRouterCatalog } from './openrouter-catalog.ts'
+import type { OpenRouterCatalogOptions } from './openrouter-catalog.ts'
+
+export class PiLoginSession {
+  readonly store: PiLoginCredentialStore
+  readonly models: MutableModels
+  readonly native: NativeToolPolicy
+  readonly openRouter: OpenRouterCatalog
+  readonly proxy: OAuthProxyTransport
+
+  constructor(
+    store: PiLoginCredentialStore = new PiLoginCredentialStore(),
+    native: NativeToolPolicy = DEFAULT_NATIVE_TOOL_POLICY,
+    catalogOptions: Partial<Pick<OpenRouterCatalogOptions, 'fetch' | 'now' | 'filename'>> = {},
+    proxyDiscovery: OAuthProxyDiscoveryOptions = {},
+  ) {
+    this.store = store
+    this.native = native
+    this.proxy = new OAuthProxyTransport(join(dirname(store.filename), PROXY_SETTINGS_FILENAME), proxyDiscovery)
+    this.models = createModels({ credentials: store })
+    for (const provider of allCatalogProviders()) this.models.setProvider(provider)
+    this.openRouter = new OpenRouterCatalog({
+      filename: join(dirname(store.filename), OPENROUTER_CACHE_FILENAME),
+      isAuthenticated: async () => (await store.list()).some(item => item.providerId === 'openrouter'),
+      beforeFetch: () => this.ensureTransport(),
+      fetch: (input, init) => this.proxy.run(() => fetch(input, init)),
+      initiallyProtectedIds: harnessModels(this.spec('openrouter'))
+        .filter(model => model.cost.input === 0 && model.cost.output === 0)
+        .map(model => model.id),
+      ...catalogOptions,
+    })
+  }
+
+  ensureTransport(): Promise<OAuthProxyResolution> {
+    return this.proxy.initialize()
+  }
+
+  spec(id: string): PiLoginProvider {
+    const spec = piLoginProvider(id)
+    if (spec === undefined) throw new Error(`dsh-oauth-login: unknown provider "${id}"`)
+    return spec
+  }
+
+  provider(id: string) {
+    return harnessProvider(this.spec(id), this.native, this.openRouter)
+  }
+
+  visibleModels(id: string) {
+    return this.provider(id).getModels()
+  }
+
+  /**
+   * Harness routes that currently hold a stored OAuth grant.
+   * Model pickers should only advertise these — logging out must drop the route.
+   */
+  async authenticatedRoutes(): Promise<string[]> {
+    const signedIn = new Set((await this.store.list()).map(item => item.providerId))
+    return PI_LOGIN_PROVIDERS
+      .filter(provider => signedIn.has(provider.id))
+      .map(provider => provider.route)
+  }
+
+  async logout(id: string): Promise<void> {
+    await this.store.delete(id)
+    if (id === 'openrouter') this.openRouter.disconnect()
+  }
+
+  /**
+   * Renew access tokens that are expired or close to expiry.
+   * Failures stay in the store; the next poll or chat retries.
+   */
+  async refreshStoredGrants(now = Date.now()): Promise<void> {
+    await this.ensureTransport()
+    for (const { providerId } of await this.store.list()) {
+      const credential = await this.store.read(providerId)
+      if (credential?.type !== 'oauth' || !grantNeedsRefresh(credential.expires, now)) continue
+      const key = refreshAttemptKey(this.store.filename, providerId)
+      if (refreshOnCooldown(key, now)) continue
+      markRefreshAttempt(key, now)
+      await this.proxy.run(() => refreshGrant(id => this.models.getAuth(id), providerId))
+    }
+  }
+}