indusagi-coding-agent 0.1.37 → 0.1.39

package/dist/core/auth-storage.js

@@ -1,174 +1,200 @@
-/**
- * Credential storage for API keys and OAuth tokens.
- * Handles loading, saving, and refreshing credentials from auth.json.
- *
- * MULTI-ACCOUNT SUPPORT: Each provider can have multiple named accounts.
- *
- * Uses file locking to prevent race conditions when multiple indusagi instances
- * try to refresh tokens simultaneously.
- */
 import { getEnvApiKey, getOAuthApiKey, getOAuthProvider, getOAuthProviders, } from "indusagi/ai";
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "fs";
 import { dirname, join } from "path";
 import lockfile from "proper-lockfile";
 import { getAgentDir } from "../config.js";
-/**
- * Credential storage backed by a JSON file.
- * Supports multiple accounts per provider.
- */
-export class AuthStorage {
-    constructor(authPath = join(getAgentDir(), "auth.json")) {
-        this.authPath = authPath;
-        this.data = {};
-        this.runtimeOverrides = new Map(); // provider -> accountId -> apiKey
-        this.defaultAccounts = new Map(); // provider -> default accountId
-        this.reload();
+function resolveAuthPath(input) {
+    if (!input) {
+        return join(getAgentDir(), "auth.json");
+    }
+    if (input.endsWith(".json")) {
+        return input;
+    }
+    try {
+        if (existsSync(input) && statSync(input).isDirectory()) {
+            return join(input, "auth.json");
+        }
+    }
+    catch {
+        // Fall through to path join below.
+    }
+    return join(input, "auth.json");
+}
+function cloneCredential(credential) {
+    return { ...credential };
+}
+function cloneStorageData(data) {
+    const cloned = {};
+    for (const [provider, accounts] of Object.entries(data)) {
+        cloned[provider] = {};
+        for (const [accountId, credential] of Object.entries(accounts)) {
+            cloned[provider][accountId] = cloneCredential(credential);
+        }
+    }
+    return cloned;
+}
+function ensureStorageFile(filePath) {
+    const storageDir = dirname(filePath);
+    if (!existsSync(storageDir)) {
+        mkdirSync(storageDir, { recursive: true, mode: 0o700 });
     }
-    /**
-     * Migrate from legacy single-account format to multi-account format
-     */
-    migrateLegacyData(legacyData) {
-        const migrated = {};
-        for (const [provider, credential] of Object.entries(legacyData)) {
-            // Create default account for legacy credential
-            const accountId = "default";
-            const accountName = "Default";
-            if (!migrated[provider]) {
-                migrated[provider] = {};
+    if (!existsSync(filePath)) {
+        writeFileSync(filePath, "{}", "utf-8");
+        chmodSync(filePath, 0o600);
+    }
+}
+function isLegacyFormat(data) {
+    if (!data || typeof data !== "object") {
+        return false;
+    }
+    for (const [key, value] of Object.entries(data)) {
+        if (key.startsWith("_")) {
+            continue;
+        }
+        if (value && typeof value === "object" && "type" in value) {
+            return true;
+        }
+    }
+    return false;
+}
+function migrateLegacyData(legacyData) {
+    const migrated = {};
+    for (const [provider, credential] of Object.entries(legacyData)) {
+        migrated[provider] = {
+            default: {
+                ...credential,
+                accountId: "default",
+                accountName: credential.accountName || "Default",
+            },
+        };
+    }
+    return migrated;
+}
+function normalizeAuthData(raw) {
+    if (!raw || typeof raw !== "object") {
+        return { data: {}, defaults: new Map(), migrated: false };
+    }
+    const payload = raw;
+    if (isLegacyFormat(payload)) {
+        return {
+            data: migrateLegacyData(payload),
+            defaults: new Map(),
+            migrated: true,
+        };
+    }
+    const data = {};
+    for (const [provider, accounts] of Object.entries(payload)) {
+        if (provider.startsWith("_")) {
+            continue;
+        }
+        if (!accounts || typeof accounts !== "object") {
+            continue;
+        }
+        data[provider] = {};
+        for (const [accountId, credential] of Object.entries(accounts)) {
+            if (!credential || typeof credential !== "object") {
+                continue;
             }
-            migrated[provider][accountId] = {
+            data[provider][accountId] = {
                 ...credential,
                 accountId,
-                accountName,
+                accountName: credential.accountName || accountId,
             };
         }
-        return migrated;
     }
-    /**
-     * Set a runtime API key override (not persisted to disk).
-     * Used for CLI --api-key flag.
-     */
-    setRuntimeApiKey(provider, apiKey, accountId = "default") {
-        if (!this.runtimeOverrides.has(provider)) {
-            this.runtimeOverrides.set(provider, new Map());
+    return {
+        data,
+        defaults: new Map(Object.entries(payload._defaults ?? {})),
+        migrated: false,
+    };
+}
+function getConfiguredDefaultAccount(provider, defaults) {
+    const envKey = `INDUSAGI_DEFAULT_ACCOUNT_${provider.replace(/-/g, "_").toUpperCase()}`;
+    return process.env[envKey] || defaults.get(provider);
+}
+function selectAccountId(provider, requestedAccountId, defaults) {
+    return requestedAccountId || getConfiguredDefaultAccount(provider, defaults) || "default";
+}
+function collectOAuthCredentials(accounts) {
+    const result = {};
+    for (const [accountId, credential] of Object.entries(accounts ?? {})) {
+        if (credential.type === "oauth") {
+            result[accountId] = credential;
         }
-        this.runtimeOverrides.get(provider).set(accountId, apiKey);
     }
-    /**
-     * Remove a runtime API key override.
-     */
+    return result;
+}
+export class AuthStorage {
+    constructor(authPathOrAgentDir) {
+        this.data = {};
+        this.runtimeOverrides = new Map();
+        this.defaultAccounts = new Map();
+        this.authPath = resolveAuthPath(authPathOrAgentDir);
+        this.reload();
+    }
+    setRuntimeApiKey(provider, apiKey, accountId = "default") {
+        const providerOverrides = this.runtimeOverrides.get(provider) ?? new Map();
+        providerOverrides.set(accountId, apiKey);
+        this.runtimeOverrides.set(provider, providerOverrides);
+    }
     removeRuntimeApiKey(provider, accountId) {
-        if (accountId) {
-            this.runtimeOverrides.get(provider)?.delete(accountId);
-        }
-        else {
+        if (!accountId) {
             this.runtimeOverrides.delete(provider);
+            return;
         }
+        this.runtimeOverrides.get(provider)?.delete(accountId);
     }
-    /**
-     * Set default account for a provider
-     */
     setDefaultAccount(provider, accountId) {
         this.defaultAccounts.set(provider, accountId);
     }
-    /**
-     * Get default account for a provider
-     */
     getDefaultAccount(provider) {
-        // Check env var first
-        const envDefault = process.env[`INDUSAGI_DEFAULT_ACCOUNT_${provider.replace(/-/g, '_').toUpperCase()}`];
-        if (envDefault)
-            return envDefault;
-        // Then check saved default
-        return this.defaultAccounts.get(provider);
-    }
-    /**
-     * Set a fallback resolver for API keys not found in auth.json or env vars.
-     * Used for custom provider keys from models.json.
-     */
+        return getConfiguredDefaultAccount(provider, this.defaultAccounts);
+    }
     setFallbackResolver(resolver) {
         this.fallbackResolver = resolver;
     }
-    /**
-     * Reload credentials from disk.
-     */
     reload() {
         if (!existsSync(this.authPath)) {
             this.data = {};
+            this.defaultAccounts = new Map();
             return;
         }
         try {
             const raw = JSON.parse(readFileSync(this.authPath, "utf-8"));
-            // Detect legacy format and migrate
-            if (this.isLegacyFormat(raw)) {
-                this.data = this.migrateLegacyData(raw);
-                this.save(); // Save in new format
-            }
-            else {
-                this.data = raw;
-            }
-            // Load default accounts
-            if (raw._defaults) {
-                this.defaultAccounts = new Map(Object.entries(raw._defaults));
+            const normalized = normalizeAuthData(raw);
+            this.data = normalized.data;
+            this.defaultAccounts = normalized.defaults;
+            if (normalized.migrated) {
+                this.save();
             }
         }
         catch {
             this.data = {};
+            this.defaultAccounts = new Map();
         }
     }
-    /**
-     * Check if data is in legacy format (single account per provider)
-     */
-    isLegacyFormat(data) {
-        if (!data || typeof data !== "object")
-            return false;
-        for (const [key, value] of Object.entries(data)) {
-            if (key.startsWith("_"))
-                continue; // Skip metadata
-            // If value has 'type' field directly, it's legacy format
-            if (value && typeof value === "object" && value.type) {
-                return true;
-            }
-        }
-        return false;
-    }
-    /**
-     * Save credentials to disk.
-     */
-    save() {
-        const dir = dirname(this.authPath);
-        if (!existsSync(dir)) {
-            mkdirSync(dir, { recursive: true, mode: 0o700 });
-        }
-        // Include defaults in saved data
-        const dataToSave = {
-            ...this.data,
+    persistAuthData() {
+        ensureStorageFile(this.authPath);
+        const payload = {
+            ...cloneStorageData(this.data),
             _defaults: Object.fromEntries(this.defaultAccounts),
         };
-        writeFileSync(this.authPath, JSON.stringify(dataToSave, null, 2), "utf-8");
+        writeFileSync(this.authPath, JSON.stringify(payload, null, 2), "utf-8");
         chmodSync(this.authPath, 0o600);
     }
-    /**
-     * Get credential for a provider and account.
-     */
+    save() {
+        this.persistAuthData();
+    }
     get(provider, accountId = "default") {
-        return this.data[provider]?.[accountId];
+        const credential = this.data[provider]?.[accountId];
+        return credential ? cloneCredential(credential) : undefined;
     }
-    /**
-     * Get all accounts for a provider.
-     */
     getAccounts(provider) {
-        const providerData = this.data[provider];
-        if (!providerData)
-            return [];
-        return Object.entries(providerData).map(([accountId, credential]) => ({
+        return Object.entries(this.data[provider] ?? {}).map(([accountId, credential]) => ({
             accountId,
-            credential,
+            credential: cloneCredential(credential),
         }));
     }
-    /**
-     * Set credential for a provider and account.
-     */
     set(provider, accountId, credential) {
         if (!this.data[provider]) {
             this.data[provider] = {};
@@ -178,171 +204,110 @@ export class AuthStorage {
             accountId,
             accountName: credential.accountName || accountId,
         };
-        // If this is the first account, set it as default
         if (Object.keys(this.data[provider]).length === 1) {
-            this.setDefaultAccount(provider, accountId);
+            this.defaultAccounts.set(provider, accountId);
         }
         this.save();
     }
-    /**
-     * Remove credential for a provider and account.
-     */
     remove(provider, accountId) {
-        if (accountId) {
-            delete this.data[provider]?.[accountId];
-            // If we removed the default, pick a new one
-            if (this.getDefaultAccount(provider) === accountId) {
-                const remaining = this.getAccounts(provider);
-                if (remaining.length > 0) {
-                    this.setDefaultAccount(provider, remaining[0].accountId);
-                }
-                else {
-                    this.defaultAccounts.delete(provider);
-                }
+        if (!accountId) {
+            delete this.data[provider];
+            this.defaultAccounts.delete(provider);
+            this.save();
+            return;
+        }
+        delete this.data[provider]?.[accountId];
+        if (this.getDefaultAccount(provider) === accountId) {
+            const remainingAccounts = Object.keys(this.data[provider] ?? {});
+            if (remainingAccounts.length > 0) {
+                this.defaultAccounts.set(provider, remainingAccounts[0]);
+            }
+            else {
+                this.defaultAccounts.delete(provider);
             }
         }
-        else {
+        if (this.data[provider] && Object.keys(this.data[provider]).length === 0) {
             delete this.data[provider];
-            this.defaultAccounts.delete(provider);
         }
         this.save();
     }
-    /**
-     * List all providers with credentials.
-     */
     list() {
         return Object.keys(this.data);
     }
-    /**
-     * Check if credentials exist for a provider in auth.json.
-     */
     has(provider, accountId) {
         if (accountId) {
-            return accountId in (this.data[provider] || {});
+            return accountId in (this.data[provider] ?? {});
         }
-        return provider in this.data && Object.keys(this.data[provider]).length > 0;
+        return Object.keys(this.data[provider] ?? {}).length > 0;
     }
-    /**
-     * Check if any form of auth is configured for a provider.
-     * Unlike getApiKey(), this doesn't refresh OAuth tokens.
-     */
     hasAuth(provider, accountId) {
-        // Check runtime override
-        if (accountId) {
-            if (this.runtimeOverrides.get(provider)?.has(accountId))
-                return true;
-        }
-        else {
-            if (this.runtimeOverrides.get(provider)?.size)
-                return true;
+        const targetAccount = selectAccountId(provider, accountId, this.defaultAccounts);
+        if (this.runtimeOverrides.get(provider)?.has(targetAccount)) {
+            return true;
         }
-        // Check saved credentials
         if (accountId) {
-            if (this.has(provider, accountId))
-                return true;
-        }
-        else {
-            if (this.has(provider))
+            if (this.has(provider, targetAccount))
                 return true;
         }
-        // Check env var
-        if (getEnvApiKey(provider))
+        else if (this.has(provider)) {
             return true;
-        // Check fallback
-        if (this.fallbackResolver?.(provider))
+        }
+        if (getEnvApiKey(provider)) {
             return true;
-        return false;
+        }
+        return !!this.fallbackResolver?.(provider);
     }
-    /**
-     * Get all credentials (for passing to getOAuthApiKey).
-     */
     getAll() {
-        return { ...this.data };
+        return cloneStorageData(this.data);
     }
-    /**
-     * Login to an OAuth provider.
-     */
     async login(providerId, callbacks, accountId = "default", accountName) {
         const provider = getOAuthProvider(providerId);
         if (!provider) {
             throw new Error(`Unknown OAuth provider: ${providerId}`);
         }
         const credentials = await provider.login(callbacks);
-        const oauthCred = {
+        this.set(providerId, accountId, {
             type: "oauth",
             accountId,
             accountName: accountName || accountId,
             ...credentials,
-        };
-        this.set(providerId, accountId, oauthCred);
+        });
     }
-    /**
-     * Logout from a provider.
-     */
     logout(provider, accountId) {
         this.remove(provider, accountId);
     }
-    /**
-     * Refresh OAuth token with file locking to prevent race conditions.
-     */
     async refreshOAuthTokenWithLock(providerId, accountId) {
         const provider = getOAuthProvider(providerId);
         if (!provider) {
             return null;
         }
-        // Ensure auth file exists for locking
-        if (!existsSync(this.authPath)) {
-            const dir = dirname(this.authPath);
-            if (!existsSync(dir)) {
-                mkdirSync(dir, { recursive: true, mode: 0o700 });
-            }
-            writeFileSync(this.authPath, "{}", "utf-8");
-            chmodSync(this.authPath, 0o600);
-        }
+        ensureStorageFile(this.authPath);
         let release;
         try {
-            // Acquire exclusive lock with retry and timeout
             release = await lockfile.lock(this.authPath, {
-                retries: {
-                    retries: 10,
-                    factor: 2,
-                    minTimeout: 100,
-                    maxTimeout: 10000,
-                    randomize: true,
-                },
+                retries: { retries: 10, factor: 2, minTimeout: 100, maxTimeout: 10000, randomize: true },
                 stale: 30000,
             });
-            // Re-read file after acquiring lock
             this.reload();
-            const cred = this.data[providerId]?.[accountId];
-            if (cred?.type !== "oauth") {
+            const credential = this.data[providerId]?.[accountId];
+            if (credential?.type !== "oauth") {
                 return null;
             }
-            // Check if token is still expired after re-reading
-            if (Date.now() < cred.expires) {
-                // Token is now valid - another instance refreshed it
-                const apiKey = provider.getApiKey(cred);
-                return { apiKey, newCredentials: cred };
-            }
-            // Token still expired, we need to refresh
-            const oauthCreds = {};
-            for (const [key, value] of Object.entries(this.data[providerId] || {})) {
-                if (value.type === "oauth") {
-                    oauthCreds[key] = value;
-                }
+            if (Date.now() < credential.expires) {
+                return { apiKey: provider.getApiKey(credential), newCredentials: credential };
             }
-            const result = await getOAuthApiKey(providerId, oauthCreds);
-            if (result) {
-                this.data[providerId][accountId] = {
-                    type: "oauth",
-                    accountId,
-                    accountName: cred.accountName,
-                    ...result.newCredentials,
-                };
-                this.save();
-                return result;
+            const result = await getOAuthApiKey(providerId, collectOAuthCredentials(this.data[providerId]));
+            if (!result) {
+                return null;
             }
-            return null;
+            this.data[providerId][accountId] = {
+                type: "oauth",
+                accountId,
+                accountName: credential.accountName,
+                ...result.newCredentials,
+            };
+            this.save();
+            return result;
         }
         finally {
             if (release) {
@@ -350,83 +315,63 @@ export class AuthStorage {
                     await release();
                 }
                 catch {
-                    // Ignore unlock errors
+                    // Ignore unlock failures.
                 }
             }
         }
     }
-    /**
-     * Get API key for a provider and account.
-     * Priority:
-     * 1. Runtime override (CLI --api-key)
-     * 2. API key from auth.json
-     * 3. OAuth token from auth.json (auto-refreshed with locking)
-     * 4. Environment variable
-     * 5. Fallback resolver (models.json custom providers)
-     */
+    resolveCredentialSource(provider, accountId) {
+        const targetAccount = selectAccountId(provider, accountId, this.defaultAccounts);
+        const runtimeKey = this.runtimeOverrides.get(provider)?.get(targetAccount);
+        const credential = this.data[provider]?.[targetAccount];
+        const envKey = getEnvApiKey(provider);
+        const fallbackKey = this.fallbackResolver?.(provider);
+        return { targetAccount, runtimeKey, credential, envKey, fallbackKey };
+    }
     async getApiKey(providerId, accountId) {
-        // Use default account if not specified
-        const targetAccount = accountId || this.getDefaultAccount(providerId) || "default";
-        // Runtime override takes highest priority
-        const runtimeKey = this.runtimeOverrides.get(providerId)?.get(targetAccount);
-        if (runtimeKey) {
-            return runtimeKey;
+        const source = this.resolveCredentialSource(providerId, accountId);
+        if (source.runtimeKey) {
+            return source.runtimeKey;
         }
-        const cred = this.data[providerId]?.[targetAccount];
-        if (cred?.type === "api_key") {
-            return cred.key;
+        if (source.credential?.type === "api_key") {
+            return source.credential.key;
         }
-        if (cred?.type === "oauth") {
+        if (source.credential?.type === "oauth") {
             const provider = getOAuthProvider(providerId);
             if (!provider) {
                 return undefined;
             }
-            // Check if token needs refresh
-            const needsRefresh = Date.now() >= cred.expires;
-            if (needsRefresh) {
-                try {
-                    const result = await this.refreshOAuthTokenWithLock(providerId, targetAccount);
-                    if (result) {
-                        return result.apiKey;
-                    }
-                }
-                catch {
-                    // Refresh failed - re-read file
-                    this.reload();
-                    const updatedCred = this.data[providerId]?.[targetAccount];
-                    if (updatedCred?.type === "oauth" && Date.now() < updatedCred.expires) {
-                        return provider.getApiKey(updatedCred);
-                    }
-                    return undefined;
+            if (Date.now() < source.credential.expires) {
+                return provider.getApiKey(source.credential);
+            }
+            try {
+                const refreshed = await this.refreshOAuthTokenWithLock(providerId, source.targetAccount);
+                if (refreshed) {
+                    return refreshed.apiKey;
                 }
             }
-            else {
-                return provider.getApiKey(cred);
+            catch {
+                this.reload();
+                const updated = this.data[providerId]?.[source.targetAccount];
+                if (updated?.type === "oauth" && Date.now() < updated.expires) {
+                    return provider.getApiKey(updated);
+                }
+                return undefined;
             }
         }
-        // Fall back to environment variable
-        const envKey = getEnvApiKey(providerId);
-        if (envKey)
-            return envKey;
-        // Fall back to custom resolver
-        return this.fallbackResolver?.(providerId) ?? undefined;
-    }
-    /**
-     * Get all registered OAuth providers
-     */
+        return source.envKey ?? source.fallbackKey;
+    }
     getOAuthProviders() {
         return getOAuthProviders();
     }
-    /**
-     * Get account info for display
-     */
     getAccountInfo(provider, accountId) {
-        const cred = this.get(provider, accountId);
-        if (!cred)
+        const credential = this.data[provider]?.[accountId];
+        if (!credential) {
             return undefined;
+        }
         return {
-            name: cred.accountName || accountId,
-            type: cred.type,
+            name: credential.accountName || accountId,
+            type: credential.type,
         };
     }
 }