mixdog 1.3.4 → 1.4.0

package/src/runtime/agent/orchestrator/providers/cursor-wire-transport.mjs

@@ -5,6 +5,7 @@ import http2 from 'node:http2';
 import { MAX_CONNECT_FRAME_BYTES, createCursorByteQueue } from './cursor-wire-guards.mjs';
 import { cursorClientVersion, warmCursorClientVersion } from './cursor-client-version.mjs';
 import { retryAfterMsFromError } from './retry-classifier.mjs';
+import { providerTimeoutError } from '../stall-policy.mjs';
 
 export { warmCursorClientVersion };
 
@@ -153,7 +154,9 @@ export function openCursorStream({ accessToken, path = RUN_PATH, url = API_URL }
     if (closed || session.closed || session.destroyed) return;
     try {
       session.ping(() => {});
-    } catch {}
+    } catch {
+      // the session may have closed since the check above
+    }
   }, H2_PING_INTERVAL_MS);
   ping.unref?.();
 
@@ -175,20 +178,28 @@ export function openCursorStream({ accessToken, path = RUN_PATH, url = API_URL }
     closeError = error || (status >= 400 ? httpStatusError(status, responseHeaders) : null);
     try {
       request.close();
-    } catch {}
+    } catch {
+      // the request stream may already be closed
+    }
     try {
       session.close();
-    } catch {}
+    } catch {
+      // the session may already be closed
+    }
     closeHandler?.(closeError);
   };
   const close = (error = null) => {
     if (closed) return;
     try {
       request.close(http2.constants.NGHTTP2_CANCEL);
-    } catch {}
+    } catch {
+      // the request stream may already be closed
+    }
     try {
       session.destroy();
-    } catch {}
+    } catch {
+      // the session may already be destroyed
+    }
     finish(error);
   };
 
@@ -243,17 +254,21 @@ export async function callCursorUnary({ accessToken, path, body, url = API_URL,
     let status = 0;
     let responseHeaders = null;
     let settled = false;
-    const timeout = setTimeout(() => finish(new Error('Cursor request timed out')), timeoutMs);
+    const timeout = setTimeout(() => finish(providerTimeoutError('Cursor request', timeoutMs)), timeoutMs);
     const finish = (error = null) => {
       if (settled) return;
       settled = true;
       clearTimeout(timeout);
       try {
         request.close();
-      } catch {}
+      } catch {
+        // the request stream may already be closed
+      }
       try {
         session.close();
-      } catch {}
+      } catch {
+        // the session may already be closed
+      }
       if (error) reject(error);
       else if (status >= 400) reject(httpStatusError(status, responseHeaders));
       else resolve(Buffer.concat(chunks));
@@ -322,7 +337,8 @@ export function parseEndStream(bytes) {
     if (!payload?.error) return null;
     const connectCode = String(payload.error.code || 'error').toLowerCase();
     const detail = String(payload.error.message || 'request failed');
-    const tooLarge = connectCode === 'resource_exhausted' && !THROTTLE_CUE_RE.test(detail) && REQUEST_TOO_LARGE_RE.test(detail);
+    const tooLarge =
+      connectCode === 'resource_exhausted' && !THROTTLE_CUE_RE.test(detail) && REQUEST_TOO_LARGE_RE.test(detail);
     const retryAfter =
       payload.error.retryAfter ??
       payload.error.retry_after ??

package/src/runtime/agent/orchestrator/providers/cursor.mjs

@@ -132,7 +132,9 @@ async function* responseSseEvents(response, signal) {
     if (signal) {
       try {
         signal.removeEventListener('abort', onAbort);
-      } catch {}
+      } catch {
+        // the abort listener may already be gone
+      }
     }
     if (aborted) await reader.cancel().catch(() => {});
   }
@@ -480,6 +482,7 @@ function selectParameterizedCursorVariant(group, requested, sendOpts = {}) {
     availableVariants[0] ||
     null;
   const parameters = { ...(defaultVariant?.parameters || {}), ...aliasParameters };
+  const defaultContext = parameters.context;
   const routeParameters =
     sendOpts.modelParameters && typeof sendOpts.modelParameters === 'object' ? sendOpts.modelParameters : {};
   for (const definition of group.definitions) {
@@ -501,9 +504,18 @@ function selectParameterizedCursorVariant(group, requested, sendOpts = {}) {
   ) {
     parameters.fast = sendOpts.fast === true ? 'true' : 'false';
   }
-  const selected = availableVariants.find((variant) =>
-    Object.entries(parameters).every(([id, value]) => String(variant.parameters?.[id] ?? '') === String(value))
-  );
+  const matches = (variant) =>
+    Object.entries(parameters).every(([id, value]) => String(variant.parameters?.[id] ?? '') === String(value));
+  let selected = availableVariants.find(matches);
+  // Keep a supported explicit context. A persisted context can exist in this
+  // mode but conflict with its requested effort/fast/other options. In that
+  // case try only the mode's default context, preserving every other choice
+  // and still rejecting the request unless the full combination is offered.
+  if (!selected && Object.hasOwn(routeParameters, 'context')) {
+    if (defaultContext === undefined) delete parameters.context;
+    else parameters.context = defaultContext;
+    selected = availableVariants.find(matches);
+  }
   if (!selected && availableVariants.length) {
     throw new Error(`Cursor model ${group.id} does not offer the selected parameter combination`);
   }
@@ -642,7 +654,9 @@ class CursorProviderBase {
     let emittedToolCall = false;
     try {
       sendOpts.onStageChange?.('requesting');
-    } catch {}
+    } catch {
+      // the stage observer is advisory
+    }
     try {
       const response = await runtime.handleChatCompletion(body, accessToken, {
         onStageChange: sendOpts.onStageChange,
@@ -657,7 +671,9 @@ class CursorProviderBase {
       });
       try {
         sendOpts.onStageChange?.('streaming');
-      } catch {}
+      } catch {
+        // the stage observer is advisory
+      }
       return await consumeCompatChatCompletionStream(responseSseEvents(response, signal), {
         signal,
         label: this.name,

package/src/runtime/agent/orchestrator/providers/devin-auth.mjs

@@ -0,0 +1,409 @@
+import { randomUUID } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, unlinkSync } from 'node:fs';
+import { createServer } from 'node:http';
+import { join, resolve } from 'node:path';
+import { resolvePluginData } from '../../../shared/plugin-paths.mjs';
+import { writeJsonAtomicSync } from '../../../shared/atomic-file.mjs';
+import { boundProviderAuthPath } from '../../../shared/provider-auth-binding.mjs';
+import { modelProxyClientMode } from '../../../shared/model-proxy-mode.mjs';
+import { openLoginUrl } from './lib/open-login-url.mjs';
+import { OAUTH_PAGE_CONTENT_TYPE, oauthErrorHtml, oauthSuccessHtml } from './lib/oauth-page.mjs';
+import { createOAuthPkce, parseOAuthCodeInput } from './lib/oauth-pkce.mjs';
+import {
+  accountIdentityFields,
+  decodeJwtPayload,
+  expiryFromAccessToken,
+  normalizeAccountIdentity,
+} from './lib/oauth-token-utils.mjs';
+
+const AUTHORIZE_URL = 'https://app.devin.ai/auth/cli/continue';
+const TOKEN_URL = 'https://api.devin.ai/auth/cli/token';
+const CALLBACK_HOST = '127.0.0.1';
+const CALLBACK_PORT = 59653;
+const CALLBACK_PATH = '/callback';
+const REDIRECT_URI = `http://${CALLBACK_HOST}:${CALLBACK_PORT}${CALLBACK_PATH}`;
+const LOGIN_TIMEOUT_MS = 5 * 60_000;
+const EXCHANGE_TIMEOUT_MS = 30_000;
+// The login token is the only credential and cannot be refreshed. A token
+// without a readable `exp` claim is assumed to live for a year.
+const DEFAULT_TOKEN_LIFETIME_MS = 365 * 24 * 60 * 60_000;
+export const REAUTH_GUIDANCE = 'Open /providers in Mixdog to sign in again.';
+
+function reauthError(message) {
+  return Object.assign(new Error(message), { reauthRequired: true });
+}
+
+// Sign-in failures the desktop words in the user's language: the message leads
+// with `DEVIN_OAUTH_<CODE>:` and apps/desktop/src/renderer/oauth-failure-copy.ts
+// maps each code to its cause and remedy (like GMAIL_APP_PASSWORD_<CODE>).
+export const DEVIN_OAUTH_FAILURE_CODES = Object.freeze([
+  'DEVIN_OAUTH_CALLBACK_PORT_IN_USE',
+  'DEVIN_OAUTH_CALLBACK_SERVER_FAILED',
+  'DEVIN_OAUTH_LOGIN_TIMED_OUT',
+  'DEVIN_OAUTH_AUTHORIZATION_DENIED',
+  'DEVIN_OAUTH_STATE_MISMATCH',
+  'DEVIN_OAUTH_CODE_REQUIRED',
+  'DEVIN_OAUTH_TOKEN_EXCHANGE_FAILED',
+]);
+
+function loginFailure(code, text, props = {}) {
+  const failureCode = `DEVIN_OAUTH_${code}`;
+  return Object.assign(new Error(`${failureCode}: ${text}`), { failureCode }, props);
+}
+
+function credentialsPath() {
+  const bound = boundProviderAuthPath('devin-oauth');
+  if (bound) return resolve(bound);
+  const explicit = process.env.DEVIN_OAUTH_CREDENTIALS_PATH;
+  if (explicit) return resolve(explicit);
+  const dir = resolvePluginData();
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+  return join(dir, 'devin-oauth.json');
+}
+
+export function devinTokenExpiry(token) {
+  return expiryFromAccessToken(token);
+}
+
+// The login token is a JWT whose `sub` is the Devin user; no request needed.
+export function devinTokenIdentity(token) {
+  const payload = decodeJwtPayload(token);
+  return normalizeAccountIdentity({ id: payload?.sub, email: payload?.email });
+}
+
+function loadStoredCredentials() {
+  if (modelProxyClientMode()) return null;
+  const path = credentialsPath();
+  if (!existsSync(path)) return null;
+  try {
+    const raw = JSON.parse(readFileSync(path, 'utf8'));
+    if (!raw?.access_token) return null;
+    return {
+      ...raw,
+      expires_at: Number(raw.expires_at) || devinTokenExpiry(raw.access_token),
+      identity: normalizeAccountIdentity(raw.identity) || devinTokenIdentity(raw.access_token),
+      source: 'Mixdog token store',
+    };
+  } catch {
+    return null;
+  }
+}
+
+function saveCredentials(tokens) {
+  writeJsonAtomicSync(credentialsPath(), tokens, {
+    lock: true,
+    fsyncDir: true,
+    mode: 0o600,
+    secret: true,
+  });
+}
+
+function tokenRecord(accessToken) {
+  const identity = devinTokenIdentity(accessToken);
+  return {
+    access_token: accessToken,
+    refresh_token: null,
+    expires_at: devinTokenExpiry(accessToken) || Date.now() + DEFAULT_TOKEN_LIFETIME_MS,
+    ...(identity ? { identity } : {}),
+  };
+}
+
+export function hasDevinOAuthCredentials() {
+  const tokens = loadStoredCredentials();
+  if (!tokens?.access_token) return false;
+  const expiresAt = Number(tokens.expires_at) || 0;
+  return expiresAt === 0 || expiresAt > Date.now();
+}
+
+export function describeDevinOAuthCredentials() {
+  const tokens = loadStoredCredentials();
+  if (!tokens?.access_token) {
+    return {
+      authenticated: false,
+      usable: false,
+      refreshable: false,
+      reauthRequired: false,
+      status: 'Not Set',
+      detail: 'Mixdog token store',
+    };
+  }
+  const expiresAt = Number(tokens.expires_at) || 0;
+  const expired = expiresAt > 0 && expiresAt <= Date.now();
+  return {
+    authenticated: !expired,
+    usable: !expired,
+    refreshable: false,
+    reauthRequired: expired,
+    status: expired ? 'Reauth Required' : 'Access Only',
+    detail: tokens.source || 'Devin OAuth',
+    expiresAt: expiresAt || null,
+    ...accountIdentityFields(tokens.identity),
+  };
+}
+
+export function forgetDevinOAuthCredentials() {
+  const path = credentialsPath();
+  if (!existsSync(path)) return { removed: false };
+  unlinkSync(path);
+  return { removed: true };
+}
+
+export function generateDevinOAuthParams() {
+  const { verifier, challenge } = createOAuthPkce();
+  const state = randomUUID();
+  const params = new URLSearchParams({
+    response_type: 'code',
+    redirect_uri: REDIRECT_URI,
+    code_challenge: challenge,
+    code_challenge_method: 'S256',
+    state,
+    prompt: 'select_account',
+  });
+  return { verifier, challenge, state, loginUrl: `${AUTHORIZE_URL}?${params}` };
+}
+
+export async function exchangeDevinCode(code, verifier, { fetchFn = fetch, signal } = {}) {
+  const timeout = AbortSignal.timeout(EXCHANGE_TIMEOUT_MS);
+  let response;
+  try {
+    response = await fetchFn(TOKEN_URL, {
+      method: 'POST',
+      headers: { Accept: 'application/json', 'Content-Type': 'application/json' },
+      body: JSON.stringify({ code, code_verifier: verifier }),
+      signal: signal ? AbortSignal.any([signal, timeout]) : timeout,
+      redirect: 'error',
+    });
+  } catch (error) {
+    // A cancelled login keeps its own abort; any other failure to get an
+    // answer (network, timeout) is a coded exchange failure. The cause is not
+    // quoted: only its kind is.
+    if (signal?.aborted) throw error;
+    throw loginFailure(
+      'TOKEN_EXCHANGE_FAILED',
+      error?.name === 'TimeoutError' ? 'Devin token exchange timed out' : 'Devin token exchange request failed'
+    );
+  }
+  // Response bodies may carry the login token itself, so none is ever quoted
+  // in an error: only the status is reported.
+  if (!response.ok) {
+    throw loginFailure('TOKEN_EXCHANGE_FAILED', `Devin token exchange failed (${response.status})`, {
+      status: response.status,
+      httpStatus: response.status,
+    });
+  }
+  const data = await response.json().catch(() => null);
+  if (typeof data?.token !== 'string' || !data.token) {
+    throw loginFailure('TOKEN_EXCHANGE_FAILED', 'Devin token exchange returned no token');
+  }
+  return tokenRecord(data.token);
+}
+
+// The callback port is fixed, so at most one login can own it. A newer login
+// in this process takes the port over from the one it supersedes.
+let activeLogin = null;
+
+function listenOnCallbackPort(server) {
+  return new Promise((resolveListen, rejectListen) => {
+    server.once('error', rejectListen);
+    server.listen(CALLBACK_PORT, CALLBACK_HOST, () => {
+      server.off('error', rejectListen);
+      resolveListen();
+    });
+  });
+}
+
+// Logins start one at a time, in call order: ownership of the port is decided
+// only once the previous start has fully settled, so overlapping calls
+// supersede each other instead of racing for the bind.
+let startQueue = Promise.resolve();
+
+export function beginDevinOAuthLogin(options) {
+  const started = startQueue.then(() => startDevinOAuthLogin(options));
+  startQueue = started.catch(() => {});
+  return started;
+}
+
+async function startDevinOAuthLogin({ openBrowser = true, timeoutMs = LOGIN_TIMEOUT_MS, fetchFn = fetch } = {}) {
+  activeLogin?.cancel();
+  const params = generateDevinOAuthParams();
+  const controller = new AbortController();
+  const server = createServer();
+  let timer = null;
+  let exchangePromise = null;
+  let settled = false;
+  let resolveLogin;
+  let rejectLogin;
+  const waitForCallback = new Promise((resolvePromise, rejectPromise) => {
+    resolveLogin = resolvePromise;
+    rejectLogin = rejectPromise;
+  });
+  // A caller may only ever cancel; that rejection must not go unhandled.
+  waitForCallback.catch(() => {});
+
+  const login = {
+    provider: 'devin-oauth',
+    url: params.loginUrl,
+    manualUrl: null,
+    waitForCallback,
+    // A remote client signs in on its own machine, where the redirect to this
+    // host's loopback listener cannot land: it pastes the final address (or
+    // code) back, and the state it carries must be this login's own.
+    completeCode: async (input) => {
+      const text = String(input || '').trim();
+      // An address carries its code and state as query parameters only: one
+      // without a code is not a bare code (the shared parser would take the
+      // whole address for one and spend it on the exchange).
+      const address = URL.canParse(text) ? new URL(text) : null;
+      const pasted = address
+        ? { code: address.searchParams.get('code') || '', state: address.searchParams.get('state') || '' }
+        : parseOAuthCodeInput(text, { allowHashState: true });
+      if (pasted.state && pasted.state !== params.state) throw loginFailure('STATE_MISMATCH', 'OAuth state mismatch');
+      if (!pasted.code) throw loginFailure('CODE_REQUIRED', 'Authorization code is required');
+      return await acceptCode(pasted.code);
+    },
+    cancel: () => finish(null, new Error('Devin OAuth cancelled')),
+  };
+
+  function finish(value, error = null) {
+    if (settled) return;
+    settled = true;
+    if (activeLogin === login) activeLogin = null;
+    // Work arriving after the login settled (or was cancelled) is rejected.
+    controller.abort();
+    clearTimeout(timer);
+    try {
+      server.close();
+      server.closeIdleConnections?.();
+    } catch {
+      /* already closed */
+    }
+    if (error) rejectLogin(error);
+    else resolveLogin(value);
+  }
+
+  // The authorization code is spent once: a duplicate callback joins the first
+  // exchange instead of failing the login.
+  const acceptCode = (code) => {
+    if (exchangePromise) return exchangePromise;
+    controller.signal.throwIfAborted();
+    // The browser deadline ends once a code arrives; the exchange has its own.
+    clearTimeout(timer);
+    exchangePromise = exchangeDevinCode(code, params.verifier, { fetchFn, signal: controller.signal }).then(
+      (tokens) => {
+        // A cancelled login never stores the account it was exchanging.
+        controller.signal.throwIfAborted();
+        saveCredentials(tokens);
+        return tokens;
+      }
+    );
+    exchangePromise.then(
+      (tokens) => finish(tokens),
+      (error) => finish(null, error instanceof Error ? error : new Error(String(error)))
+    );
+    return exchangePromise;
+  };
+
+  const reply = (res, status, html) => {
+    res.writeHead(status, { 'Content-Type': OAUTH_PAGE_CONTENT_TYPE, Connection: 'close' });
+    res.end(html);
+  };
+
+  const handleRequest = async (req, res) => {
+    const target = new URL(req.url || '/', REDIRECT_URI);
+    if (req.method !== 'GET' || target.pathname !== CALLBACK_PATH) {
+      res.writeHead(404);
+      res.end();
+      return;
+    }
+    // A request that is not this login's own is refused; the real callback
+    // may still arrive.
+    if (target.searchParams.get('state') !== params.state) {
+      reply(res, 400, oauthErrorHtml('The sign-in callback did not match this login.'));
+      return;
+    }
+    const authorizationError = target.searchParams.get('error');
+    if (authorizationError) {
+      // Only a plain OAuth error code is named; free text (error_description)
+      // may carry anything, secrets included, so it never reaches the message.
+      const code = /^[A-Za-z0-9_.-]{1,64}$/.test(authorizationError) ? ` (${authorizationError})` : '';
+      reply(res, 400, oauthErrorHtml('Devin did not authorize this sign-in.'));
+      // A late denial must not cancel an already accepted code.
+      if (!exchangePromise) {
+        finish(null, loginFailure('AUTHORIZATION_DENIED', `Authorization failed${code}`));
+      }
+      return;
+    }
+    const code = target.searchParams.get('code')?.trim();
+    if (!code) {
+      reply(res, 400, oauthErrorHtml('The sign-in callback carried no authorization code.'));
+      return;
+    }
+    try {
+      await acceptCode(code);
+      reply(res, 200, oauthSuccessHtml('Devin'));
+    } catch {
+      // The shared exchange reports its error through waitForCallback.
+      reply(res, 500, oauthErrorHtml('Devin could not complete the token exchange.'));
+    }
+  };
+
+  // Whatever a stray local client sends (a malformed target included) is
+  // answered here and never escapes the listener.
+  server.on('request', async (req, res) => {
+    try {
+      await handleRequest(req, res);
+    } catch {
+      if (res.headersSent) res.destroy();
+      else reply(res, 400, oauthErrorHtml('The sign-in callback was malformed.'));
+    }
+  });
+
+  try {
+    await listenOnCallbackPort(server);
+  } catch (error) {
+    const failure =
+      error?.code === 'EADDRINUSE'
+        ? loginFailure(
+            'CALLBACK_PORT_IN_USE',
+            `Callback port ${CALLBACK_HOST}:${CALLBACK_PORT} is already in use. Close the program using it (or another Devin sign-in) and try again.`,
+            { code: 'EADDRINUSE' }
+          )
+        : loginFailure(
+            'CALLBACK_SERVER_FAILED',
+            `Callback server failed on ${CALLBACK_HOST}:${CALLBACK_PORT}: ${error?.message || error}`
+          );
+    finish(null, failure);
+    throw failure;
+  }
+  // Once bound, a runtime fault on the listener ends the login.
+  server.on('error', (error) =>
+    finish(null, loginFailure('CALLBACK_SERVER_FAILED', `Callback server failed: ${error?.message || error}`))
+  );
+  timer = setTimeout(
+    () => finish(null, loginFailure('LOGIN_TIMED_OUT', `Browser authentication timed out after ${timeoutMs}ms`)),
+    timeoutMs
+  );
+  timer.unref?.();
+  activeLogin = login;
+
+  process.stderr.write(`\n[devin-oauth] Open the Devin sign-in page:\n${params.loginUrl}\n\n`);
+  if (openBrowser) await openLoginUrl('devin-oauth', params.loginUrl);
+  return login;
+}
+
+export async function loginDevinOAuth() {
+  const login = await beginDevinOAuthLogin();
+  return await login.waitForCallback;
+}
+
+// The login token cannot be refreshed: once it expires the user signs in again.
+export async function resolveDevinOAuthAccessToken() {
+  const tokens = loadStoredCredentials();
+  if (!tokens?.access_token) {
+    throw reauthError(`Devin OAuth is not connected. ${REAUTH_GUIDANCE}`);
+  }
+  if (tokens.expires_at > 0 && tokens.expires_at <= Date.now()) {
+    throw reauthError(`Devin login token expired and cannot be refreshed. ${REAUTH_GUIDANCE}`);
+  }
+  return tokens.access_token;
+}