magpie-gemini-web 0.3.3 → 0.4.0

package/native-task/lib/runtime.mjs

@@ -0,0 +1,189 @@
+import child_process from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const BRIDGE_ROOT = fileURLToPath(new URL('../bridge', import.meta.url));
+const startupMap = new Map();
+const MAX_BODY = 1024 * 1024;
+
+export function getDefaultDataDir() {
+  return path.resolve(process.env.GEMINI_NATIVE_TASK_DATA_DIR || path.join(os.homedir(), '.local/share/gemini-native-task'));
+}
+
+export function ensurePrivateDataDir(dataDir, { create = false } = {}) {
+  if (typeof dataDir !== 'string' || !dataDir) throw new Error('Invalid data directory.');
+  const dir = path.resolve(dataDir);
+  if (create && !fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const st = fs.statSync(dir);
+  if (!st.isDirectory() || (typeof process.getuid === 'function' && st.uid !== process.getuid()) || (st.mode & 0o077)) {
+    throw new Error('Data directory must be private and owned by the current user.');
+  }
+  return fs.realpathSync(dir);
+}
+
+export function loadLocalConfig(dataDir) {
+  const dir = ensurePrivateDataDir(dataDir);
+  const cfgPath = path.join(dir, 'config.json');
+  const st = fs.lstatSync(cfgPath);
+  if (!st.isFile() || st.size > 16384 || (st.mode & 0o077) ||
+      (typeof process.getuid === 'function' && st.uid !== process.getuid())) {
+    throw new Error('Configuration must be a private, owned, regular file.');
+  }
+  const raw = JSON.parse(fs.readFileSync(cfgPath, 'utf8'));
+  if (raw?.version !== 1 || typeof raw.api_key !== 'string' || raw.api_key.length < 16 ||
+      typeof raw.instance_id !== 'string' || !raw.instance_id || raw.instance_id.length > 128 ||
+      !Number.isInteger(raw.port) || raw.port < 1024 || raw.port > 65535 ||
+      typeof raw.subject_sha256 !== 'string' || !/^[0-9a-f]{64}$/.test(raw.subject_sha256)) {
+    throw new Error('Invalid local bridge configuration.');
+  }
+  return { ...raw, dataDir: dir };
+}
+
+// Bound consumption, including streams without Content-Length. Cancel upstream
+// immediately on overflow or abort rather than buffering the rest of the body.
+export async function boundedBytes(stream, limit, signal) {
+  signal?.throwIfAborted();
+  if (!stream) return Buffer.alloc(0);
+  const reader = stream.getReader();
+  const parts = [];
+  let size = 0;
+  const abort = () => { void reader.cancel().catch(() => {}); };
+  signal?.addEventListener('abort', abort, { once: true });
+  try {
+    while (true) {
+      signal?.throwIfAborted();
+      const { value, done } = await reader.read();
+      signal?.throwIfAborted();
+      if (done) return Buffer.concat(parts, size);
+      size += value.byteLength;
+      if (size > limit) throw Object.assign(new Error('Body size limit exceeded.'), { code: 'body_too_large' });
+      parts.push(Buffer.from(value));
+    }
+  } catch (error) {
+    void reader.cancel().catch(() => {});
+    throw error;
+  } finally {
+    signal?.removeEventListener('abort', abort);
+    reader.releaseLock();
+  }
+}
+
+export async function probeHealth(baseURL, apiKey, instanceId, timeoutMs = 2000) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const res = await fetch(`${baseURL}/health`, {
+      headers: { Authorization: `Bearer ${apiKey}` }, signal: controller.signal, redirect: 'error',
+    });
+    if (res.status !== 200) {
+      void res.body?.cancel();
+      throw new Error(`Health check returned unexpected status ${res.status}`);
+    }
+    let body;
+    const bytes = await boundedBytes(res.body, 16384, controller.signal);
+    try { body = JSON.parse(bytes.toString('utf8')); }
+    catch { throw new Error('Health check response is not valid JSON.'); }
+    if (body?.service !== 'gemini-native-task') throw new Error('Port is in use by an unexpected service.');
+    if (body.instance_id !== instanceId) throw new Error('Port is in use by a mismatching instance ID.');
+    return body;
+  } catch (error) {
+    if (controller.signal.aborted) throw new Error('Health check timed out.');
+    if (error.code === 'body_too_large') throw new Error('Health check response exceeds 16KiB limit.');
+    if (error.code === 'ECONNREFUSED' || error.cause?.code === 'ECONNREFUSED') return null;
+    throw error;
+  } finally { clearTimeout(timer); }
+}
+
+export async function ensureService(options = {}, deps = {}) {
+  if (!options || typeof options !== 'object' || Array.isArray(options) ||
+      Object.keys(options).some(k => !['dataDir', 'startupTimeoutMs'].includes(k)) ||
+      (options.dataDir !== undefined && (typeof options.dataDir !== 'string' || !options.dataDir)) ||
+      (options.startupTimeoutMs !== undefined && (!Number.isFinite(options.startupTimeoutMs) ||
+        options.startupTimeoutMs < 1000 || options.startupTimeoutMs > 60000))) {
+    throw new Error('Invalid bridge runtime options.');
+  }
+  const dir = ensurePrivateDataDir(options.dataDir ?? getDefaultDataDir());
+  if (!startupMap.has(dir)) {
+    const pending = startService(dir, options.startupTimeoutMs ?? 15000, deps);
+    startupMap.set(dir, pending);
+    void pending.finally(() => startupMap.delete(dir)).catch(() => {});
+  }
+  return startupMap.get(dir);
+}
+
+async function startService(dataDir, timeoutMs, deps) {
+  const config = loadLocalConfig(dataDir);
+  const baseURL = `http://127.0.0.1:${config.port}`;
+  const probe = deps.probeHealth ?? probeHealth;
+  const result = { baseURL, apiKey: config.api_key, instance_id: config.instance_id, dataDir };
+  const deadline = Date.now() + timeoutMs;
+  if (await probe(baseURL, config.api_key, config.instance_id, Math.min(2000, timeoutMs))) return result;
+  const pythonPath = path.join(dataDir, '.venv/bin/python');
+  if (!deps.spawn && !fs.existsSync(pythonPath)) throw new Error('Run setup to install the bridge virtual environment.');
+  const logPath = path.join(dataDir, 'daemon.log');
+  const logFd = fs.openSync(logPath, fs.constants.O_APPEND | fs.constants.O_CREAT | fs.constants.O_WRONLY | fs.constants.O_NOFOLLOW, 0o600);
+  let child;
+  try {
+    const st = fs.fstatSync(logFd);
+    if (!st.isFile() || (st.mode & 0o077)) throw new Error('Daemon log must be private.');
+    child = (deps.spawn ?? child_process.spawn)(pythonPath,
+      ['-m', 'gemini_native_bridge', 'serve', '--data-dir', dataDir], {
+        detached: true, stdio: ['ignore', logFd, logFd], cwd: BRIDGE_ROOT,
+        env: { ...process.env, PYTHONPATH: BRIDGE_ROOT },
+      });
+  } catch { throw new Error('Could not start the local bridge process.'); }
+  finally { fs.closeSync(logFd); }
+  let exited = false;
+  child.on('error', () => { exited = true; });
+  child.on('exit', () => { exited = true; });
+  child.unref();
+  while (Date.now() < deadline) {
+    await new Promise(resolve => setTimeout(resolve, 100));
+    if (exited) throw new Error('Local bridge process exited before becoming ready.');
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) break;
+    if (await probe(baseURL, config.api_key, config.instance_id, Math.min(1000, remaining))) return result;
+  }
+  throw new Error('Timed out waiting for the local bridge.');
+}
+
+function errorResponse(status, code, message) {
+  return new Response(JSON.stringify({ error: { code, type: 'invalid_request_error', message, param: null } }), {
+    status, headers: { 'Content-Type': 'application/json', 'X-Magpie-Sign-In': 'kept' },
+  });
+}
+
+export function createForwarder(serviceInfo, fetchImpl = globalThis.fetch) {
+  return async (input, init = {}) => {
+    try {
+      const original = input instanceof Request ? input : null;
+      const parsed = new URL(original?.url ?? String(input), serviceInfo.baseURL);
+      if (!['/v1/chat/completions', '/v1/models', '/health'].includes(parsed.pathname)) {
+        return errorResponse(404, 'not_found', 'Unsupported bridge path.');
+      }
+      const method = (init.method ?? original?.method ?? 'GET').toUpperCase();
+      const headers = new Headers(original?.headers);
+      new Headers(init.headers).forEach((v, k) => headers.set(k, v));
+      headers.delete('content-length');
+      headers.delete('transfer-encoding');
+      headers.set('authorization', `Bearer ${serviceInfo.apiKey}`);
+      const signal = init.signal ?? original?.signal;
+      signal?.throwIfAborted();
+      let body;
+      if (!['GET', 'HEAD'].includes(method)) {
+        const source = init.body !== undefined ? init.body : original?.body;
+        if (source != null) {
+          body = await boundedBytes(new Response(source).body, MAX_BODY, signal);
+        }
+      }
+      return await fetchImpl(`${serviceInfo.baseURL}${parsed.pathname}${parsed.search}`, {
+        method, headers, body, signal, redirect: 'error',
+      });
+    } catch (error) {
+      if (error.code === 'body_too_large') return errorResponse(400, 'request_too_large', 'Request exceeds 1 MiB limit.');
+      return errorResponse(409, 'bridge_network_error', 'Failed to communicate with local gemini-native-task bridge.');
+    }
+  };
+}

package/native-task/pyproject.toml

@@ -0,0 +1,18 @@
+[build-system]
+requires = ["setuptools>=61.0"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "gemini-native-bridge"
+version = "0.1.0"
+requires-python = ">=3.10"
+dependencies = [
+    "h2==4.3.0",
+    "jsonschema==4.25.1",
+]
+
+[tool.setuptools.packages.find]
+where = ["bridge"]
+
+[tool.setuptools.package-data]
+gemini_native_bridge = ["native_auth_keychain.swift"]

package/native-task/requirements.txt

@@ -0,0 +1,2 @@
+h2==4.3.0
+jsonschema==4.25.1

package/native-task/scripts/bridge.mjs

@@ -0,0 +1,97 @@
+#!/usr/bin/env node
+import child_process from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { boundedBytes, ensurePrivateDataDir, ensureService, getDefaultDataDir, loadLocalConfig, probeHealth } from '../lib/runtime.mjs';
+
+const ROOT_DIR = fileURLToPath(new URL('..', import.meta.url));
+const BRIDGE_DIR = path.join(ROOT_DIR, 'bridge');
+const SETUP_FLAGS = ['data-dir', 'auth-file', 'task-headers', 'tool-headers', 'task-template', 'turn-template', 'binary', 'port'];
+const REQUIRED = ['auth-file', 'task-headers', 'tool-headers', 'task-template', 'turn-template'];
+function safeError(message) { return Object.assign(new Error(message), { safeMessage: true }); }
+
+function validateFlags(command, flags) {
+  if (!['setup', 'start', 'status', 'stop'].includes(command)) throw safeError('Usage: bridge.mjs setup|start|status|stop [options]');
+  for (const [key, value] of Object.entries(flags)) {
+    if (!(command === 'setup' ? SETUP_FLAGS : ['data-dir']).includes(key) || typeof value !== 'string' || !value) {
+      throw safeError('Unsupported option or missing option value.');
+    }
+  }
+  if (command === 'setup') {
+    if (REQUIRED.some(key => !flags[key])) throw safeError('Setup requires auth-file, task-headers, tool-headers, task-template and turn-template.');
+    if (flags.port !== undefined && (!/^[0-9]{4,5}$/.test(flags.port) || Number(flags.port) < 1024 || Number(flags.port) > 65535)) {
+      throw safeError('Port must be an integer between 1024 and 65535.');
+    }
+  }
+}
+
+export function parseArgs(args) {
+  const [command, ...rest] = args;
+  const flags = {};
+  for (let i = 0; i < rest.length; i += 2) {
+    const flag = rest[i];
+    const value = rest[i + 1];
+    if (!flag.startsWith('--') || typeof value !== 'string' || value.startsWith('--') || Object.hasOwn(flags, flag.slice(2))) {
+      throw safeError('Expected distinct --option value pairs.');
+    }
+    flags[flag.slice(2)] = value;
+  }
+  validateFlags(command, flags);
+  return { command, flags };
+}
+
+export async function setup(flags, deps = {}) {
+  validateFlags('setup', flags);
+  const dataDir = ensurePrivateDataDir(flags['data-dir'] ?? getDefaultDataDir(), { create: true });
+  if (fs.existsSync(path.join(dataDir, 'config.json'))) throw safeError('Configuration already exists. Preserve it or choose a new data directory.');
+  const exec = deps.execFileSync ?? child_process.execFileSync;
+  const venvDir = path.join(dataDir, '.venv');
+  if (!fs.existsSync(venvDir)) exec('python3', ['-m', 'venv', venvDir], { stdio: 'pipe', timeout: 60000 });
+  exec(path.join(venvDir, 'bin/pip'), ['install', '-r', path.join(ROOT_DIR, 'requirements.txt')], { stdio: 'pipe', timeout: 120000 });
+  const args = ['-m', 'gemini_native_bridge', 'bootstrap', '--data-dir', dataDir];
+  for (const key of [...REQUIRED, 'binary', 'port']) if (flags[key] !== undefined) args.push(`--${key}`, flags[key]);
+  const output = exec(path.join(venvDir, 'bin/python'), args, {
+    env: { ...process.env, PYTHONPATH: BRIDGE_DIR }, cwd: BRIDGE_DIR, stdio: 'pipe', timeout: 120000,
+  });
+  // Only publish the known, nonsecret bootstrap fields.
+  const result = JSON.parse(output.toString());
+  if (result.configured !== true) throw safeError('Bootstrap did not complete.');
+  return JSON.stringify({ configured: true, port: result.port, account_label: result.account_label, instance_id: result.instance_id }) + '\n';
+}
+
+export async function main(args = process.argv.slice(2)) {
+  const { command, flags } = parseArgs(args);
+  const dataDir = flags['data-dir'] ?? getDefaultDataDir();
+  if (command === 'setup') return process.stdout.write(await setup(flags));
+  if (command === 'start') {
+    const service = await ensureService({ dataDir });
+    return process.stdout.write(JSON.stringify({ status: 'running', baseURL: service.baseURL, instance_id: service.instance_id, dataDir: service.dataDir }) + '\n');
+  }
+  const config = loadLocalConfig(dataDir);
+  const baseURL = `http://127.0.0.1:${config.port}`;
+  const health = await probeHealth(baseURL, config.api_key, config.instance_id);
+  if (command === 'status') {
+    return process.stdout.write(JSON.stringify({ status: health ? 'running' : 'stopped', port: config.port, active_tasks: health?.active_tasks, instance_id: config.instance_id }) + '\n');
+  }
+  if (!health) return process.stdout.write('{"status":"already_stopped"}\n');
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), 5000);
+  try {
+    const res = await fetch(`${baseURL}/v1/native/shutdown`, {
+      method: 'POST', headers: { Authorization: `Bearer ${config.api_key}`, 'Content-Type': 'application/json' },
+      body: '{}', signal: controller.signal, redirect: 'error',
+    });
+    if (res.status !== 202) throw safeError('Local bridge rejected shutdown.');
+    const result = JSON.parse((await boundedBytes(res.body, 16384, controller.signal)).toString());
+    if (result.status !== 'shutting_down') throw safeError('Invalid shutdown acknowledgement.');
+    process.stdout.write('{"status":"shutting_down"}\n');
+  } finally { clearTimeout(timer); }
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === path.resolve(process.argv[1])) {
+  main().catch(error => {
+    process.stderr.write((error.safeMessage ? error.message : 'Bridge command failed. Check configuration, private file permissions and local service availability.') + '\n');
+    process.exitCode = 1;
+  });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "magpie-gemini-web",
-  "version": "0.3.3",
+  "version": "0.4.0",
   "description": "Gemini Web provider for Magpie, backed by gemini-web2api-go",
   "type": "module",
   "main": "./index.mjs",
@@ -20,8 +20,16 @@
   "files": [
     "index.mjs",
     "lib/",
-    "scripts/",
+    "scripts/backend.mjs",
+    "scripts/backend-argon.mjs",
     "patches/",
+    "native-task/lib/",
+    "native-task/bridge/",
+    "native-task/scripts/bridge.mjs",
+    "native-task/requirements.txt",
+    "native-task/pyproject.toml",
+    "native-task/README.md",
+    "native-task/LICENSE",
     "README.md",
     "README.en.md",
     "LICENSE",
@@ -40,7 +48,7 @@
   },
   "license": "MIT",
   "scripts": {
-    "test": "node --test test/*.test.mjs",
+    "test": "node --test test/*.test.mjs native-task/test/*.test.mjs",
     "backend:install": "node scripts/backend.mjs install",
     "backend:start": "node scripts/backend.mjs start",
     "backend:status": "node scripts/backend.mjs status",