farming-code 2.2.7 → 2.2.11

package/backend/auth.js

@@ -1,5 +1,6 @@
 const crypto = require('crypto');
 const fs = require('fs');
+const { FarmingNetPassVerifier, PASS_QUERY_PARAM } = require('./farming-net-pass');
 const { createPoeticToken, generatePoeticToken, getPoeticTokenEntropyBits } = require('./haiku-token');
 const storageLayout = require('./storage-layout');
 
@@ -24,6 +25,21 @@ function decodeCookieToken(token) {
   }
 }
 
+function normalizeCookieName(value) {
+  const cookieName = String(value || '').trim();
+  return /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(cookieName) ? cookieName : 'farming_token';
+}
+
+function normalizeCookiePath(value) {
+  const cookiePath = String(value || '/').trim();
+  if (!cookiePath.startsWith('/') || /[;\r\n]/.test(cookiePath)) return '/';
+  return cookiePath;
+}
+
+function escapeRegExp(value) {
+  return String(value).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
 function readExistingTokenFile(tokenFile) {
   try {
     const token = fs.readFileSync(tokenFile, 'utf8').trim();
@@ -35,12 +51,17 @@ function readExistingTokenFile(tokenFile) {
 
 class TokenAuth {
   constructor(options = {}) {
-    this.disabled = options.disabled === true || isTruthyEnv(process.env.FARMING_DISABLE_AUTH);
+    const authEnv = options.env || process.env;
+    this.disabled = options.disabled === true || isTruthyEnv(authEnv.FARMING_DISABLE_AUTH);
     this.basePath = normalizeBasePath(options.basePath || '/');
     this.authStatusPath = this.basePath ? `${this.basePath}/api/auth/status` : '/api/auth/status';
+    this.cookieName = normalizeCookieName(options.cookieName);
+    this.cookiePath = normalizeCookiePath(options.cookiePath);
+    this.redirectQueryToken = options.redirectQueryToken === true;
     this.tokenFile = '';
     this.token = '';
     this.tokenInfo = null;
+    this.farmingNetPassVerifier = null;
 
     if (this.disabled) {
       return;
@@ -51,7 +72,15 @@ class TokenAuth {
       fs.mkdirSync(farmingDir, { recursive: true });
     }
     this.tokenFile = storageLayout.sessionTokenFile(farmingDir);
-    const configuredToken = String(options.token || process.env.FARMING_TOKEN || '').trim();
+    if (options.farmingNetPassVerifier !== false) {
+      this.farmingNetPassVerifier = options.farmingNetPassVerifier || new FarmingNetPassVerifier({
+        trustFile: options.farmingNetTrustFile || storageLayout.farmingNetTrustFile(farmingDir),
+      });
+    }
+    const configuredTokenSource = Object.prototype.hasOwnProperty.call(options, 'token')
+      ? options.token
+      : authEnv.FARMING_TOKEN;
+    const configuredToken = String(configuredTokenSource || '').trim();
     const existingToken = configuredToken ? '' : readExistingTokenFile(this.tokenFile);
     if (configuredToken) {
       this.token = configuredToken;
@@ -70,7 +99,7 @@ class TokenAuth {
         entropyBits: 0,
       };
     } else {
-      this.tokenInfo = createPoeticToken({ locale: options.tokenLocale, env: options.env, timeZone: options.timeZone });
+      this.tokenInfo = createPoeticToken({ locale: options.tokenLocale, env: authEnv, timeZone: options.timeZone });
       this.token = this.tokenInfo.token;
     }
     this.saveTokenFile();
@@ -97,6 +126,10 @@ class TokenAuth {
     return this.tokenInfo;
   }
 
+  getCookieName() {
+    return this.cookieName;
+  }
+
   verify(token) {
     if (this.disabled) return true;
     if (!token || !this.token) return false;
@@ -115,13 +148,32 @@ class TokenAuth {
     const queryToken = url.searchParams.get('token');
     if (queryToken) return queryToken;
 
+    return this.extractCookieToken(req);
+  }
+
+  extractCookieToken(req) {
     const cookies = req.headers.cookie || '';
-    const match = cookies.match(/(?:^|;\s*)farming_token=([^;]+)/);
+    const match = cookies.match(new RegExp(`(?:^|;\\s*)${escapeRegExp(this.cookieName)}=([^;]+)`));
     if (match) return decodeCookieToken(match[1]);
 
     return null;
   }
 
+  setAuthenticatedCookie(res) {
+    res.setHeader('Set-Cookie',
+      `${this.cookieName}=${encodeCookieToken(this.token)}; Path=${this.cookiePath}; HttpOnly; SameSite=Lax`);
+  }
+
+  redirectWithoutQueryParameter(res, url, parameter) {
+    url.searchParams.delete(parameter);
+    const search = url.searchParams.toString();
+    res.writeHead(302, {
+      'Cache-Control': 'no-store',
+      Location: `${url.pathname}${search ? `?${search}` : ''}`,
+    });
+    res.end();
+  }
+
   middleware() {
     return (req, res, next) => {
       if (this.disabled) return next();
@@ -133,13 +185,34 @@ class TokenAuth {
         return next();
       }
 
+      const method = String(req.method || 'GET').toUpperCase();
+      if (['GET', 'HEAD'].includes(method) && url.searchParams.has(PASS_QUERY_PARAM)) {
+        const pass = url.searchParams.get(PASS_QUERY_PARAM);
+        const passResult = this.farmingNetPassVerifier
+          ? this.farmingNetPassVerifier.verify(pass)
+          : { valid: false };
+        if (passResult.valid) {
+          this.setAuthenticatedCookie(res);
+          this.redirectWithoutQueryParameter(res, url, PASS_QUERY_PARAM);
+          return;
+        }
+        const cookieToken = this.extractCookieToken(req);
+        if (cookieToken && this.verify(cookieToken)) {
+          this.redirectWithoutQueryParameter(res, url, PASS_QUERY_PARAM);
+          return;
+        }
+      }
+
       const token = this.extractToken(req);
 
       // URL has token query param -> validate, set cookie, redirect
       if (url.searchParams.has('token')) {
         if (token && this.verify(token)) {
-          res.setHeader('Set-Cookie',
-            `farming_token=${encodeCookieToken(this.token)}; Path=/; HttpOnly; SameSite=Lax`);
+          this.setAuthenticatedCookie(res);
+          if (this.redirectQueryToken && ['GET', 'HEAD'].includes(method)) {
+            this.redirectWithoutQueryParameter(res, url, 'token');
+            return;
+          }
           return next();
         }
       }

package/backend/codex-models.js

@@ -1,69 +1,24 @@
 const { execFile } = require('child_process');
 
-const FALLBACK_MODELS = [
-  {
-    slug: 'gpt-5.5',
-    display_name: 'GPT-5.5',
-    description: 'Frontier model for complex coding, research, and real-world work.',
-    default_reasoning_level: 'medium',
-    supported_reasoning_levels: [
-      { effort: 'low', description: 'Fast responses with lighter reasoning' },
-      { effort: 'medium', description: 'Balances speed and reasoning depth for everyday tasks' },
-      { effort: 'high', description: 'Greater reasoning depth for complex problems' },
-      { effort: 'xhigh', description: 'Extra high reasoning depth for complex problems' },
-    ],
-    service_tiers: [
-      { id: 'priority', name: 'Fast', description: '1.5x speed, increased usage' },
-    ],
-    visibility: 'list',
-  },
-  {
-    slug: 'gpt-5.4',
-    display_name: 'GPT-5.4',
-    description: 'Strong model for everyday coding.',
-    default_reasoning_level: 'medium',
-    supported_reasoning_levels: [
-      { effort: 'low', description: 'Fast responses with lighter reasoning' },
-      { effort: 'medium', description: 'Balances speed and reasoning depth for everyday tasks' },
-      { effort: 'high', description: 'Greater reasoning depth for complex problems' },
-      { effort: 'xhigh', description: 'Extra high reasoning depth for complex problems' },
-    ],
-    service_tiers: [
-      { id: 'priority', name: 'Fast', description: '1.5x speed, increased usage' },
-    ],
-    visibility: 'list',
-  },
-  {
-    slug: 'gpt-5.4-mini',
-    display_name: 'GPT-5.4 Mini',
-    description: 'Small, fast, and cost-efficient model for simpler coding tasks.',
-    default_reasoning_level: 'medium',
-    supported_reasoning_levels: [
-      { effort: 'low', description: 'Fast responses with lighter reasoning' },
-      { effort: 'medium', description: 'Balances speed and reasoning depth for everyday tasks' },
-      { effort: 'high', description: 'Greater reasoning depth for complex problems' },
-    ],
-    visibility: 'list',
-  },
-  {
-    slug: 'gpt-5.3-codex-spark',
-    display_name: 'GPT-5.3 Codex Spark',
-    description: 'Ultra-fast coding model.',
-    default_reasoning_level: 'medium',
-    supported_reasoning_levels: [
-      { effort: 'low', description: 'Fast responses with lighter reasoning' },
-      { effort: 'medium', description: 'Balances speed and reasoning depth for everyday tasks' },
-    ],
-    visibility: 'list',
-  },
-];
+const DEFAULT_CODEX_MODELS_TIMEOUT_MS = 15_000;
+
+class CodexModelCatalogError extends Error {
+  constructor(code, message, cause = null) {
+    super(message);
+    this.name = 'CodexModelCatalogError';
+    this.code = code;
+    if (cause) this.cause = cause;
+  }
+}
 
 const EFFORT_LABELS = {
+  minimal: 'Minimal',
   low: 'Low',
   medium: 'Medium',
   high: 'High',
   xhigh: 'Extra High',
   max: 'Max',
+  ultra: 'Ultra',
 };
 
 const DEFAULT_SERVICE_TIER = {
@@ -182,46 +137,88 @@ function buildModelOptions(models, source = 'codex') {
 
 function listCodexModelOptions(options = {}) {
   const codexBin = options.codexBin || process.env.FARMING_CODEX_BIN || 'codex';
-  const timeout = options.timeout || 3000;
-
-  return new Promise((resolve) => {
-    const fallback = () => resolve({
-      models: buildModelOptions(FALLBACK_MODELS, 'fallback'),
-      catalog: buildModelCatalog(FALLBACK_MODELS, 'fallback'),
-      source: 'fallback',
-    });
+  const timeout = Number.isFinite(options.timeout)
+    ? Math.max(1, options.timeout)
+    : DEFAULT_CODEX_MODELS_TIMEOUT_MS;
+  const runExecFile = options.execFile || execFile;
 
+  return new Promise((resolve, reject) => {
     try {
-      execFile(codexBin, ['debug', 'models'], {
+      runExecFile(codexBin, ['debug', 'models'], {
         timeout,
         maxBuffer: 20 * 1024 * 1024,
-      }, (error, stdout) => {
-        if (!error && stdout) {
-          try {
-            const models = catalogModelsFromJson(stdout);
-            const modelOptions = buildModelOptions(models, 'codex');
-            if (modelOptions.length > 0) {
-              resolve({
-                models: modelOptions,
-                catalog: buildModelCatalog(models, 'codex'),
-                source: 'codex',
-              });
-              return;
-            }
-          } catch {
-            // fall through to fallback catalog
+      }, (error, stdout, stderr) => {
+        if (error) {
+          const timedOut = error.code === 'ETIMEDOUT' || error.killed === true;
+          if (timedOut) {
+            reject(new CodexModelCatalogError(
+              'CODEX_MODELS_TIMEOUT',
+              `Codex model catalog timed out after ${timeout}ms`,
+              error
+            ));
+            return;
           }
+
+          const detail = String(stderr || error.message || '').trim().split(/\r?\n/, 1)[0];
+          reject(new CodexModelCatalogError(
+            'CODEX_MODELS_COMMAND_FAILED',
+            detail
+              ? `Codex model catalog command failed: ${detail}`
+              : 'Codex model catalog command failed',
+            error
+          ));
+          return;
+        }
+
+        if (!String(stdout || '').trim()) {
+          reject(new CodexModelCatalogError(
+            'CODEX_MODELS_EMPTY_OUTPUT',
+            'Codex model catalog command returned no output'
+          ));
+          return;
+        }
+
+        let models;
+        try {
+          models = catalogModelsFromJson(stdout);
+        } catch (error) {
+          reject(new CodexModelCatalogError(
+            'CODEX_MODELS_INVALID_JSON',
+            'Codex model catalog returned invalid JSON',
+            error
+          ));
+          return;
+        }
+
+        const modelOptions = buildModelOptions(models, 'codex');
+        const catalog = buildModelCatalog(models, 'codex');
+        if (modelOptions.length === 0 || catalog.length === 0) {
+          reject(new CodexModelCatalogError(
+            'CODEX_MODELS_EMPTY_CATALOG',
+            'Codex model catalog did not contain any visible models'
+          ));
+          return;
         }
 
-        fallback();
+        resolve({
+          models: modelOptions,
+          catalog,
+          source: 'codex',
+        });
       });
-    } catch {
-      fallback();
+    } catch (error) {
+      reject(new CodexModelCatalogError(
+        'CODEX_MODELS_COMMAND_FAILED',
+        `Failed to start Codex model catalog command: ${error.message || error}`,
+        error
+      ));
     }
   });
 }
 
 module.exports = {
+  CodexModelCatalogError,
+  DEFAULT_CODEX_MODELS_TIMEOUT_MS,
   buildModelCatalog,
   buildModelOptions,
   catalogModelsFromJson,

package/backend/codex-session-archive.js

@@ -0,0 +1,45 @@
+const { execFile } = require('child_process');
+const os = require('os');
+const { promisify } = require('util');
+const { resolveCompatibleCodexExecutable } = require('./executable-discovery');
+
+const execFileAsync = promisify(execFile);
+
+async function unarchiveCodexSession(sessionId, session = {}, options = {}) {
+  const resolveExecutable = options.resolveCompatibleCodexExecutable || resolveCompatibleCodexExecutable;
+  const runExecFile = options.execFileAsync || execFileAsync;
+  const processEnv = options.processEnv || process.env;
+  const codexResolution = resolveExecutable(session.cliVersion || '', processEnv.PATH || '');
+  if (!codexResolution.compatible) {
+    return {
+      error: codexResolution.error || 'Codex CLI is not compatible with this session',
+      status: 400,
+    };
+  }
+
+  try {
+    await runExecFile(codexResolution.path || 'codex', ['unarchive', sessionId], {
+      cwd: session.cwd || session.workspace || os.homedir(),
+      env: session.providerHomePath
+        ? { ...processEnv, CODEX_HOME: session.providerHomePath }
+        : processEnv,
+      timeout: 30_000,
+      maxBuffer: 1024 * 1024,
+    });
+    return { unarchived: true };
+  } catch (error) {
+    const message = [
+      error && error.stdout ? String(error.stdout).trim() : '',
+      error && error.stderr ? String(error.stderr).trim() : '',
+      error && error.message ? String(error.message).trim() : '',
+    ].filter(Boolean).join('\n') || 'failed to unarchive Codex session';
+    return {
+      error: message,
+      status: 409,
+    };
+  }
+}
+
+module.exports = {
+  unarchiveCodexSession,
+};