dsh-scnet 0.6.7 → 0.6.8

package/README.md

@@ -4,15 +4,15 @@
 
 DSH-SCNet (`dsh-scnet` on npm) is a community-maintained DSH bundle for operating Supercomputing Network (SCNet). It packages the source [`scnet-hpc`](https://github.com/lql341/scnet-hpc) Skill, profile-aware utilities, and bounded tools for SSH, Slurm, OpenAPI files, regional resources, and Notebook discovery.
 
-Current release: **0.6.7**
+Current release: **0.6.8**
 
 <!-- scnet-release:start -->
-## 0.6.7 highlights
+## 0.6.8 highlights
 
-- Desktop hosts can inject a verified Python 3 interpreter through `DSH_SCNET_PYTHON` or
-  `SCNET_PYTHON`; local entrypoints no longer require the command name `python3`.
-- Shared shell helpers reject Python 2 and invalid configured interpreters before running
-  OpenAPI or local job-generation code.
+- The connector now exposes stable error codes and JSON-safe envelopes for authentication,
+  callback, network, scope, region, and platform failures.
+- OAuth callback sessions are one-shot and reject replay; platform keyring adapters have no
+  plaintext fallback.
 <!-- scnet-release:end -->
 
 > This is an independent community project. It is compatible with DeepSeek Harness but is not an official DeepSeek product and does not imply endorsement, partnership, or authorization by DeepSeek.

package/README_CN.md

@@ -4,14 +4,14 @@
 
 <p align="center">在 DeepSeek Harness 里操作超算互联网（SCNet）：配置 SSH、管理 Slurm 作业、查询 OpenAPI 区域和文件、检查 Notebook 资源与实例，并保留海光 DCU/DTK 诊断能力。</p>
 
-当前版本：**0.6.7**
+当前版本：**0.6.8**
 
 <!-- scnet-release:start -->
-## 0.6.7 更新
+## 0.6.8 更新
 
-- Desktop 主机可通过 `DSH_SCNET_PYTHON` 或 `SCNET_PYTHON` 注入经过校验的 Python 3
-  解释器，本地入口不再强制要求命令名为 `python3`。
-- 共享 shell 辅助函数会在运行 OpenAPI 或本地作业生成前拒绝 Python 2 和无效解释器路径。
+- connector 现在提供稳定错误码和 JSON 安全错误信封，覆盖认证、回调、网络、权限、
+  区域和平台能力失败。
+- OAuth 回调会话只允许消费一次并拒绝重放；平台 keyring 适配器不提供明文回退。
 <!-- scnet-release:end -->
 
 > 本项目是独立维护的社区项目，与 DeepSeek Harness 兼容，但不是 DeepSeek 官方产品，也不表示 DeepSeek 对本项目提供背书、合作或授权。

package/connector/credentials.mjs

@@ -0,0 +1,42 @@
+function requiredString(value, label) {
+  const normalized = String(value ?? '').trim()
+  if (!normalized) throw new TypeError(`${label} must be a non-empty string`)
+  return normalized
+}
+
+function assertBackend(backend) {
+  if (!backend || typeof backend !== 'object') {
+    throw new TypeError('credential backend is required')
+  }
+  for (const method of ['get', 'set', 'delete']) {
+    if (typeof backend[method] !== 'function') {
+      throw new TypeError(`credential backend must implement ${method}()`)
+    }
+  }
+  return backend
+}
+
+/**
+ * Adapt a platform keyring implementation without providing a plaintext fallback.
+ * The backend owns encryption, locking, and OS-specific Secret Service behavior.
+ */
+export function createCredentialStoreAdapter({ backend, namespace = 'scnet' } = {}) {
+  const store = assertBackend(backend)
+  const prefix = requiredString(namespace, 'credential namespace')
+  const keyOf = (key) => `${prefix}.${requiredString(key, 'credential key')}`
+  return Object.freeze({
+    async get(key) {
+      return store.get(keyOf(key))
+    },
+    async set(key, value) {
+      if (value === undefined) throw new TypeError('credential value must not be undefined')
+      return store.set(keyOf(key), structuredClone(value))
+    },
+    async delete(key) {
+      return store.delete(keyOf(key))
+    },
+    async clear() {
+      if (typeof store.clear === 'function') return store.clear(prefix)
+    },
+  })
+}

package/connector/errors.mjs

@@ -0,0 +1,58 @@
+const ERROR_CODES = [
+  'AUTHENTICATION_REQUIRED',
+  'AUTHENTICATION_FAILED',
+  'SCOPE_INSUFFICIENT',
+  'NETWORK_TIMEOUT',
+  'REGION_UNAVAILABLE',
+  'PLATFORM_UNSUPPORTED',
+  'CALLBACK_REPLAY',
+  'CALLBACK_MISMATCH',
+  'CONFIGURATION_REQUIRED',
+  'INTERNAL_ERROR',
+]
+
+export const CONNECTOR_ERROR_CODES = Object.freeze(ERROR_CODES)
+
+function requiredString(value, label) {
+  const normalized = String(value ?? '').trim()
+  if (!normalized) throw new TypeError(`${label} must be a non-empty string`)
+  return normalized
+}
+
+export class ConnectorError extends Error {
+  constructor(code, message, { operation, retryable = false } = {}) {
+    if (!CONNECTOR_ERROR_CODES.includes(code)) {
+      throw new RangeError(`unsupported connector error code: ${code}`)
+    }
+    super(requiredString(message, 'error message'))
+    this.name = 'ConnectorError'
+    this.code = code
+    this.operation = operation === undefined ? undefined : requiredString(operation, 'operation')
+    this.retryable = Boolean(retryable)
+  }
+
+  toJSON() {
+    return {
+      ok: false,
+      error_code: this.code,
+      error: this.message,
+      ...(this.operation ? { operation: this.operation } : {}),
+      retryable: this.retryable,
+    }
+  }
+}
+
+export function connectorError(code, message, options) {
+  return new ConnectorError(code, message, options)
+}
+
+export function errorEnvelope(error, { operation } = {}) {
+  if (error instanceof ConnectorError) {
+    return error.toJSON()
+  }
+  return new ConnectorError(
+    'INTERNAL_ERROR',
+    error instanceof Error ? error.message : String(error || 'unknown connector error'),
+    { operation },
+  ).toJSON()
+}

package/connector/index.mjs

@@ -8,10 +8,22 @@ export {
   getOperationDefinition,
 } from './contract.mjs'
 
+export {
+  CONNECTOR_ERROR_CODES,
+  ConnectorError,
+  connectorError,
+  errorEnvelope,
+} from './errors.mjs'
+
+export {
+  createCredentialStoreAdapter,
+} from './credentials.mjs'
+
 export {
   MemoryCredentialStore,
   TokenLifecycle,
   createAuthorizationRequest,
+  createAuthorizationSession,
   createCodeVerifier,
   createPkceChallenge,
   createRefreshTokenRequest,

package/connector/oauth2.mjs

@@ -1,4 +1,5 @@
 import { createHash, randomBytes, randomUUID } from 'node:crypto'
+import { ConnectorError } from './errors.mjs'
 
 const LOOPBACK_HOSTS = new Set(['127.0.0.1', '[::1]', 'localhost'])
 
@@ -130,6 +131,33 @@ export function validateAuthorizationCallback(callbackUrl, request) {
   })
 }
 
+export function createAuthorizationSession(options = {}) {
+  const request = createAuthorizationRequest(options)
+  let consumed = false
+  return Object.freeze({
+    request,
+    get consumed() {
+      return consumed
+    },
+    consumeCallback(callbackUrl) {
+      if (consumed) {
+        throw new ConnectorError(
+          'CALLBACK_REPLAY',
+          'OAuth authorization callback has already been consumed',
+          { operation: 'login' },
+        )
+      }
+      consumed = true
+      try {
+        return validateAuthorizationCallback(callbackUrl, request)
+      } catch (error) {
+        if (error instanceof ConnectorError) throw error
+        throw new ConnectorError('CALLBACK_MISMATCH', error.message, { operation: 'login' })
+      }
+    },
+  })
+}
+
 export function createTokenExchangeRequest({
   tokenEndpoint,
   clientId,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-scnet",
-  "version": "0.6.7",
+  "version": "0.6.8",
   "description": "Community DeepSeek Harness bundle for SCNet SSH and OpenAPI jobs, files, Notebook resources, Slurm diagnostics, and Hygon DCU/DTK guidance.",
   "type": "module",
   "main": "./index.mjs",

package/skills/scnet-hpc/VERSION

@@ -1 +1 @@
-0.6.7
+0.6.8