machinaos 0.0.76 → 0.0.78

package/server/services/claude_oauth.py

@@ -1,4 +1,26 @@
-"""Claude OAuth Service - Isolated login that doesn't affect user's main session."""
+"""Claude OAuth — project-local install + the documented `claude auth` subcommands.
+
+The Claude Code CLI lives at ``<repo>/data/claude-machina/npm/`` (on-demand
+``npm install`` on first use, mirroring the WhatsApp project-local layout).
+``CLAUDE_CONFIG_DIR`` points at ``<repo>/data/claude-machina/`` so the CLI
+manages its own credentials inside the project tree, isolated from the
+user's own ``~/.claude/`` session.
+
+Every subprocess call goes through ``services.events.cli.run_cli_command``
+— the canonical one-shot CLI helper used by Stripe / future plugins. Auth
+surface follows https://code.claude.com/docs/en/cli-reference verbatim:
+
+- ``claude auth login``  — opens the browser, writes credentials.
+- ``claude auth status`` — prints JSON; exits 0 when logged in / 1 otherwise.
+- ``claude auth logout`` — log out (CLI clears its own credentials).
+
+The CLI owns its own credentials file; we never read or write it.
+``login`` is a long-running one-shot (waits for the browser flow to
+complete) so callers schedule it as ``asyncio.create_task`` — same shape
+Stripe uses for ``stripe login --complete``.
+"""
+
+from __future__ import annotations
 
 import json
 import os
@@ -6,133 +28,137 @@ import shutil
 import subprocess
 import sys
 from pathlib import Path
-from typing import Dict, Any
+from typing import Any, Dict
 
 from core.logging import get_logger
+from services.events.cli import run_cli_command
 
 logger = get_logger(__name__)
 
-# Isolated directories for MachinaOs
-MACHINA_CLAUDE_DIR = Path.home() / ".claude-machina"
+# server/services/claude_oauth.py -> parents[2] is the repo root.
+_PROJECT_ROOT = Path(__file__).resolve().parents[2]
+
+MACHINA_CLAUDE_DIR = (_PROJECT_ROOT / "data" / "claude-machina").resolve()
 MACHINA_NPM_DIR = MACHINA_CLAUDE_DIR / "npm"
 
+# Generous timeout for browser-flow login; Stripe uses the same window.
+LOGIN_TIMEOUT_SECONDS = 600.0
+# One-shot status / logout return immediately.
+ONESHOT_TIMEOUT_SECONDS = 30.0
+
+
+def claude_binary_path() -> str:
+    """Return path to the project-local claude CLI, installing on miss.
 
-def _get_claude_cmd() -> str:
-    """Get path to isolated claude CLI, installing if needed."""
+    Single source of truth shared by the auth handler
+    (``services/cli_agent/_handlers.py``) AND the agent spawn
+    (``services/cli_agent/providers/anthropic_claude.py``) so both surfaces
+    use the same binary + ``CLAUDE_CONFIG_DIR``-isolated credentials."""
     if sys.platform == "win32":
-        claude_path = MACHINA_NPM_DIR / "claude.cmd"
+        bin_path = MACHINA_NPM_DIR / "node_modules" / ".bin" / "claude.cmd"
     else:
-        claude_path = MACHINA_NPM_DIR / "bin" / "claude"
+        bin_path = MACHINA_NPM_DIR / "node_modules" / ".bin" / "claude"
 
-    if claude_path.exists():
-        return str(claude_path)
+    if bin_path.exists():
+        return str(bin_path)
 
-    # Install claude-code in isolated location
-    logger.info("Installing Claude Code CLI in isolated environment...")
+    logger.info("Installing Claude Code CLI in project-local environment...")
     MACHINA_NPM_DIR.mkdir(parents=True, exist_ok=True)
 
     npm_cmd = shutil.which("npm")
     if not npm_cmd:
-        raise FileNotFoundError("npm not found")
+        raise FileNotFoundError("npm not found on PATH")
 
     result = subprocess.run(
         [npm_cmd, "install", "@anthropic-ai/claude-code", "--prefix", str(MACHINA_NPM_DIR)],
         capture_output=True,
         text=True,
     )
-
     if result.returncode != 0:
         logger.error(f"npm install failed: {result.stderr}")
         raise RuntimeError(f"Failed to install claude-code: {result.stderr}")
 
-    # Find the installed binary
-    if sys.platform == "win32":
-        claude_path = MACHINA_NPM_DIR / "node_modules" / ".bin" / "claude.cmd"
-    else:
-        claude_path = MACHINA_NPM_DIR / "node_modules" / ".bin" / "claude"
+    if not bin_path.exists():
+        raise FileNotFoundError(f"Claude CLI not found at {bin_path} after install")
 
-    if not claude_path.exists():
-        raise FileNotFoundError(f"Claude CLI not found at {claude_path} after install")
+    logger.info(f"Claude Code CLI installed at: {bin_path}")
+    return str(bin_path)
 
-    logger.info(f"Claude Code CLI installed at: {claude_path}")
-    return str(claude_path)
 
+def _claude_env() -> Dict[str, str]:
+    env = os.environ.copy()
+    env["CLAUDE_CONFIG_DIR"] = str(MACHINA_CLAUDE_DIR)
+    return env
 
-async def initiate_claude_oauth() -> Dict[str, Any]:
-    """Run claude login in isolated environment with auto-filled prompts."""
-    try:
-        MACHINA_CLAUDE_DIR.mkdir(exist_ok=True)
-
-        # Get or install claude CLI
-        claude_cmd = _get_claude_cmd()
-
-        env = os.environ.copy()
-        env["CLAUDE_CONFIG_DIR"] = str(MACHINA_CLAUDE_DIR)
-
-        # Run claude login with stdin to auto-fill prompts
-        # Claude login asks: 1) "Do you agree?" (yes) 2) "Open browser?" (yes)
-        if sys.platform == "win32":
-            # Windows: pipe inputs and let it open browser
-            process = subprocess.Popen(
-                [claude_cmd, "login"],
-                env=env,
-                stdin=subprocess.PIPE,
-                stdout=subprocess.PIPE,
-                stderr=subprocess.PIPE,
-                creationflags=subprocess.CREATE_NO_WINDOW,
-            )
-            # Send "yes" responses for the prompts
-            try:
-                process.stdin.write(b"yes\nyes\n")
-                process.stdin.flush()
-            except Exception:
-                pass
-        else:
-            # Unix: pipe inputs
-            process = subprocess.Popen(
-                [claude_cmd, "login"],
-                env=env,
-                stdin=subprocess.PIPE,
-                stdout=subprocess.PIPE,
-                stderr=subprocess.PIPE,
-            )
-            try:
-                process.stdin.write(b"yes\nyes\n")
-                process.stdin.flush()
-            except Exception:
-                pass
-
-        logger.info(f"Claude OAuth login started with PID {process.pid}")
-
-        return {
-            "success": True,
-            "message": "OAuth login started. Browser should open for authentication.",
-            "config_dir": str(MACHINA_CLAUDE_DIR),
-            "pid": process.pid,
-        }
-    except FileNotFoundError as e:
-        logger.error(f"CLI not found: {e}")
-        return {"success": False, "error": str(e)}
-    except Exception as e:
-        logger.error(f"Failed to start Claude OAuth: {e}")
-        return {"success": False, "error": str(e)}
-
-
-def get_claude_credentials() -> Dict[str, Any]:
-    """Read credentials from isolated config."""
+
+async def _run_auth(subcommand: str, *, timeout: float) -> Dict[str, Any]:
+    """Run ``claude auth <subcommand>`` via the canonical helper. Returns
+    the ``run_cli_command`` envelope (``{success, result, stdout, stderr,
+    error}``)."""
     try:
-        creds_path = MACHINA_CLAUDE_DIR / ".credentials.json"
-        if not creds_path.exists():
-            return {"success": False, "has_token": False}
-
-        with open(creds_path) as f:
-            creds = json.load(f)
-
-        return {
-            "success": True,
-            "has_token": bool(creds.get("accessToken")),
-            "access_token": creds.get("accessToken"),
-            "expires_at": creds.get("expiresAt"),
-        }
-    except Exception as e:
-        return {"success": False, "error": str(e)}
+        binary = claude_binary_path()
+    except (FileNotFoundError, RuntimeError) as e:
+        return {"success": False, "error": str(e), "stdout": "", "stderr": ""}
+
+    MACHINA_CLAUDE_DIR.mkdir(parents=True, exist_ok=True)
+    envelope = await run_cli_command(
+        binary=binary,
+        argv=["auth", subcommand],
+        timeout=timeout,
+        env=_claude_env(),
+    )
+    logger.info(
+        "[claude auth %s] success=%s stdout=%r stderr=%r",
+        subcommand,
+        envelope.get("success"),
+        (envelope.get("stdout") or "")[:512],
+        (envelope.get("stderr") or "")[:512],
+    )
+    return envelope
+
+
+async def claude_auth_status_info() -> Dict[str, Any]:
+    """Return parsed JSON from ``claude auth status``. Always includes
+    ``loggedIn: bool``; populates ``email``/``orgName``/``subscriptionType``
+    when logged in."""
+    envelope = await _run_auth("status", timeout=ONESHOT_TIMEOUT_SECONDS)
+    parsed = envelope.get("result")
+    if isinstance(parsed, dict):
+        parsed.setdefault("loggedIn", bool(envelope.get("success")))
+        return parsed
+
+    # Status returns exit 1 when not logged in; the JSON still parses but
+    # run_cli_command treats non-zero exits as failure and skips parsing.
+    # Fall back to parsing stdout directly so we still surface the body.
+    stdout = envelope.get("stdout") or ""
+    if stdout:
+        try:
+            data = json.loads(stdout)
+            if isinstance(data, dict):
+                data.setdefault("loggedIn", False)
+                return data
+        except json.JSONDecodeError:
+            pass
+    return {"loggedIn": bool(envelope.get("success"))}
+
+
+async def claude_auth_status() -> bool:
+    """True iff ``claude auth status`` reports loggedIn=True."""
+    info = await claude_auth_status_info()
+    return bool(info.get("loggedIn"))
+
+
+async def run_claude_login() -> Dict[str, Any]:
+    """Run ``claude auth login`` to completion. The CLI opens the user's
+    browser, runs its own callback server, and exits when the flow ends.
+
+    Long-running: callers should schedule this via ``asyncio.create_task``
+    (Stripe ``stripe login --complete`` precedent). Returns the envelope
+    from ``run_cli_command``."""
+    return await _run_auth("login", timeout=LOGIN_TIMEOUT_SECONDS)
+
+
+async def claude_auth_logout() -> bool:
+    """Run ``claude auth logout``. True on exit 0."""
+    envelope = await _run_auth("logout", timeout=ONESHOT_TIMEOUT_SECONDS)
+    return bool(envelope.get("success"))

package/server/services/cli_agent/__init__.py

@@ -0,0 +1,78 @@
+"""AI CLI agent framework — multi-provider, multi-instance, VSCode-pattern.
+
+Spawns N parallel Claude Code / Codex CLI sessions per workflow node,
+each isolated in its own git worktree, with a shared MCP server hosting
+MachinaOs tools (``mcp__machina__*``) discovered via VSCode-style
+lockfile.
+
+Self-registers per-provider WebSocket handlers
+(``claude_code_login``, ``claude_code_logout``, ``codex_cli_login``,
+``codex_cli_logout``) into ``services.ws_handler_registry`` on import,
+mirroring the telegram / whatsapp / stripe plugin folder pattern. The
+router does not need to know about us by name.
+"""
+
+from __future__ import annotations
+
+import logging as _logging
+
+# Pin every `[CC-Agent ...]` logger in this package at INFO so live
+# debugging surfaces without flipping the global LOG_LEVEL. Override with
+# ``logging.getLogger("services.cli_agent").setLevel(...)`` for quieter
+# runs.
+_logging.getLogger("services.cli_agent").setLevel(_logging.INFO)
+
+from services.cli_agent.factory import (
+    ALL_PROVIDERS,
+    SUPPORTED_PROVIDERS,
+    create_cli_provider,
+    is_supported,
+)
+from services.cli_agent.protocol import (
+    AICliProvider,
+    BatchResult,
+    CanonicalUsage,
+    SessionResult,
+)
+from services.cli_agent.types import (
+    AICliTaskSpec,
+    BaseAICliTaskSpec,
+    BatchResultModel,
+    BatchSummary,
+    ClaudeTaskSpec,
+    CodexTaskSpec,
+    GeminiTaskSpec,
+    SessionResultModel,
+    session_result_to_model,
+)
+
+# --- self-registration on import -------------------------------------------
+from services.ws_handler_registry import register_ws_handlers
+from services.cli_agent._handlers import WS_HANDLERS
+
+register_ws_handlers(WS_HANDLERS)
+
+
+__all__ = [
+    # Factory
+    "create_cli_provider",
+    "is_supported",
+    "SUPPORTED_PROVIDERS",
+    "ALL_PROVIDERS",
+    # Protocol + dataclasses
+    "AICliProvider",
+    "CanonicalUsage",
+    "SessionResult",
+    "BatchResult",
+    # Pydantic specs
+    "BaseAICliTaskSpec",
+    "ClaudeTaskSpec",
+    "CodexTaskSpec",
+    "GeminiTaskSpec",
+    "AICliTaskSpec",
+    # Pydantic result models
+    "SessionResultModel",
+    "BatchSummary",
+    "BatchResultModel",
+    "session_result_to_model",
+]

package/server/services/cli_agent/_handlers.py

@@ -0,0 +1,237 @@
+"""Per-provider WebSocket handlers for CLI-managed OAuth.
+
+Self-registered into ``services.ws_handler_registry`` from
+``services/cli_agent/__init__.py``. Naming convention matches Twitter /
+Google / Stripe — each provider gets its own message type
+(``claude_code_login`` / ``claude_code_logout`` / ``codex_cli_login`` /
+``codex_cli_logout``); the frontend dispatches with an empty payload.
+
+Claude flow uses the documented CLI subcommands from
+https://code.claude.com/docs/en/cli-reference (``claude auth login`` /
+``status`` / ``logout``). Every subprocess invocation goes through
+``services.events.cli.run_cli_command`` (Stripe precedent — see
+``nodes/stripe/_handlers.py``); the CLI owns its own credentials file
+and we never touch it.
+
+Login lifecycle:
+
+1. ``handle_claude_code_login`` schedules ``run_claude_login`` as an
+   ``asyncio.create_task`` (mirrors Stripe's ``stripe login --complete``)
+   and returns immediately. The CLI opens the user's browser; up to
+   10 minutes are allowed for the flow to complete.
+2. When the task resolves, ``_finalize_claude_login`` reads
+   ``claude auth status``, stores the synthetic ``"cli-managed"`` marker
+   along with the user's ``email``/``orgName`` via
+   ``auth_service.store_oauth_tokens()``, and fires
+   ``broadcast_credential_event("credential.oauth.connected", ...)`` —
+   the frontend's ``WebSocketContext`` re-fetches the catalogue.
+
+Logout runs ``claude auth logout`` (CLI clears its own credentials),
+drops the catalogue marker, and broadcasts ``.disconnected``.
+
+Codex login is not yet wired (no ``codex_oauth.py``); the handler returns
+a graceful error pointing the user at the manual flow.
+"""
+
+from __future__ import annotations
+
+import asyncio
+from typing import Any, Awaitable, Callable, Dict, Optional
+
+from fastapi import WebSocket
+
+from core.logging import get_logger
+
+logger = get_logger(__name__)
+
+
+# Synthetic marker stored in `auth_service` after a successful CLI login,
+# matching `nodes/stripe/_handlers.py:_MARKER_TOKEN`. Lets the catalogue's
+# generic `stored` check flip without per-provider code in the catalogue
+# handler.
+_MARKER_TOKEN = "cli-managed"
+
+
+# ---------------------------------------------------------------------------
+# Marker-token + credential-event broadcast (Stripe pattern)
+# ---------------------------------------------------------------------------
+
+async def _mark_logged_in(
+    catalogue_key: str,
+    *,
+    email: Optional[str] = None,
+    name: Optional[str] = None,
+) -> None:
+    from core.container import container
+    await container.auth_service().store_oauth_tokens(
+        provider=catalogue_key,
+        access_token=_MARKER_TOKEN,
+        refresh_token=_MARKER_TOKEN,
+        email=email,
+        name=name,
+    )
+
+
+async def _mark_logged_out(catalogue_key: str) -> None:
+    from core.container import container
+    await container.auth_service().remove_oauth_tokens(catalogue_key)
+
+
+async def _broadcast_credential_event(event_type: str, provider: str) -> None:
+    """Fire a CloudEvents-shaped catalogue-invalidation. Frontend listens
+    via ``WebSocketContext`` and re-fetches the catalogue."""
+    from services.status_broadcaster import get_status_broadcaster
+    await get_status_broadcaster().broadcast_credential_event(
+        event_type, provider=provider,
+    )
+
+
+# ---------------------------------------------------------------------------
+# Claude — `claude auth login` / `auth status` / `auth logout`
+# ---------------------------------------------------------------------------
+
+async def _finalize_claude_login() -> None:
+    """Run ``claude auth login`` to completion, then store user info +
+    broadcast on success."""
+    from services.claude_oauth import claude_auth_status_info, run_claude_login
+
+    try:
+        envelope = await run_claude_login()
+        if not envelope.get("success"):
+            logger.warning(
+                "[claude_code_login] CLI exited unsuccessfully: %s",
+                envelope.get("error") or envelope.get("stderr"),
+            )
+            return
+
+        info = await claude_auth_status_info()
+        if not info.get("loggedIn"):
+            logger.warning(
+                "[claude_code_login] CLI exited cleanly but auth status "
+                "reports not logged in: %s", info,
+            )
+            return
+
+        email = info.get("email")
+        org_name = info.get("orgName")
+        await _mark_logged_in("claude_code", email=email, name=org_name)
+        await _broadcast_credential_event(
+            "credential.oauth.connected", provider="claude_code",
+        )
+        logger.info(
+            "[claude_code_login] connected as %s (%s · %s)",
+            email or "unknown",
+            org_name or "unknown org",
+            info.get("subscriptionType") or "unknown plan",
+        )
+    except asyncio.CancelledError:
+        raise
+    except Exception as exc:  # pragma: no cover — defensive
+        logger.exception("[claude_code_login] finalize failed: %s", exc)
+
+
+async def handle_claude_code_login(
+    data: Dict[str, Any],  # noqa: ARG001 — frontend sends {}
+    websocket: WebSocket,  # noqa: ARG001 — registry signature
+) -> Dict[str, Any]:
+    """Spawn ``claude auth login`` in the background; let the CLI open
+    the user's browser. Idempotent re-click syncs the marker without
+    re-running the flow."""
+    from services.claude_oauth import claude_auth_status_info
+
+    info = await claude_auth_status_info()
+    if info.get("loggedIn"):
+        try:
+            await _mark_logged_in(
+                "claude_code",
+                email=info.get("email"),
+                name=info.get("orgName"),
+            )
+            await _broadcast_credential_event(
+                "credential.oauth.connected", provider="claude_code",
+            )
+        except Exception as exc:
+            logger.warning("[claude_code_login] mark/broadcast failed: %s", exc)
+        return {
+            "success": True,
+            "already_logged_in": True,
+            "email": info.get("email"),
+            "org_name": info.get("orgName"),
+            "subscription_type": info.get("subscriptionType"),
+            "message": "Already authenticated; refreshed status.",
+        }
+
+    asyncio.create_task(_finalize_claude_login(), name="claude_code_login")
+    return {
+        "success": True,
+        "message": "Claude is opening your browser to authenticate.",
+    }
+
+
+async def handle_claude_code_logout(
+    data: Dict[str, Any],  # noqa: ARG001
+    websocket: WebSocket,  # noqa: ARG001
+) -> Dict[str, Any]:
+    """Run ``claude auth logout`` (CLI clears its own credentials), drop
+    the catalogue marker, broadcast ``.disconnected``."""
+    from services.claude_oauth import claude_auth_logout
+
+    try:
+        await claude_auth_logout()
+        await _mark_logged_out("claude_code")
+        await _broadcast_credential_event(
+            "credential.oauth.disconnected", provider="claude_code",
+        )
+    except Exception as exc:
+        logger.warning("[claude_code_logout] failed: %s", exc)
+        return {"success": False, "error": str(exc)}
+    return {"success": True}
+
+
+# ---------------------------------------------------------------------------
+# Codex — login flow not yet wired; logout works for marker cleanup
+# ---------------------------------------------------------------------------
+
+async def handle_codex_cli_login(
+    data: Dict[str, Any],  # noqa: ARG001
+    websocket: WebSocket,  # noqa: ARG001
+) -> Dict[str, Any]:
+    return {
+        "success": False,
+        "error": (
+            "Codex login is not yet wired in MachinaOs. "
+            "Install with `npm install -g @openai/codex` and run "
+            "`codex login` in your terminal — then click Login again "
+            "to mark connected."
+        ),
+    }
+
+
+async def handle_codex_cli_logout(
+    data: Dict[str, Any],  # noqa: ARG001
+    websocket: WebSocket,  # noqa: ARG001
+) -> Dict[str, Any]:
+    try:
+        await _mark_logged_out("codex_cli")
+        await _broadcast_credential_event(
+            "credential.oauth.disconnected", provider="codex_cli",
+        )
+    except Exception as exc:
+        logger.warning("[codex_cli_logout] failed: %s", exc)
+        return {"success": False, "error": str(exc)}
+    return {"success": True}
+
+
+# ---------------------------------------------------------------------------
+# Registry payload — `services/cli_agent/__init__.py` registers these
+# into `services.ws_handler_registry` on package import.
+# ---------------------------------------------------------------------------
+
+WSHandler = Callable[[Dict[str, Any], WebSocket], Awaitable[Dict[str, Any]]]
+
+WS_HANDLERS: Dict[str, WSHandler] = {
+    "claude_code_login": handle_claude_code_login,
+    "claude_code_logout": handle_claude_code_logout,
+    "codex_cli_login": handle_codex_cli_login,
+    "codex_cli_logout": handle_codex_cli_logout,
+}