openmausbot 0.1.63 → 0.1.66

package/dist-server/server/drivers/codex-device-auth.js

@@ -0,0 +1,234 @@
+import { randomUUID } from "node:crypto";
+import { realpathSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, dirname, isAbsolute, join, resolve } from "node:path";
+import { stripVTControlCharacters } from "node:util";
+import { killCliTree, spawnCli } from "../procs.js";
+const DEVICE_URL = "https://auth.openai.com/codex/device";
+const MAX_OUTPUT = 16_384;
+// Two configured instances can use the same on-disk login. Only the auth
+// operation is exclusive: normal turns are not blocked by this lock.
+const authenticatingHomes = new Set();
+function canonicalPath(path) {
+    try {
+        return realpathSync(path);
+    }
+    catch {
+        const parent = dirname(path);
+        return parent === path ? path : join(canonicalPath(parent), basename(path));
+    }
+}
+export function codexDevicePrompt(output) {
+    const clean = stripVTControlCharacters(output);
+    // Chunks may stop halfway through a code. Never publish the incomplete
+    // final line before its newline arrives.
+    const lines = clean.split(/\r?\n/).slice(0, -1).map((line) => line.trim());
+    // Do not turn arbitrary output into a link, or pass through query tokens.
+    if (!lines.some((line) => /^https:\/\/auth\.openai\.com\/codex\/device\/?$/.test(line)))
+        return null;
+    const userCode = lines.find((line) => /^[A-Z0-9]{4,8}-[A-Z0-9]{4,8}$/.test(line));
+    return userCode ? { authorizationUrl: DEVICE_URL, userCode } : null;
+}
+function loginFailure(output) {
+    if (/(unexpected argument|unrecognized (argument|option)|unknown option).*device-auth/i.test(output)) {
+        return "This server's Codex CLI needs updating for browser sign-in. Run npm install -g @openai/codex@latest on the server, then try again.";
+    }
+    if (/device.{0,40}(disabled|not enabled|not allowed)|enable.{0,40}device/i.test(output)) {
+        return "Enable device-code login in your ChatGPT security settings or ask your workspace admin to allow it, then try again.";
+    }
+    if (/expired|expiration|timed out/i.test(output)) {
+        return "The ChatGPT sign-in code expired. Start sign-in again for a new code.";
+    }
+    return "ChatGPT sign-in did not finish. Check the server's connection and that device-code login is enabled in ChatGPT, then try again.";
+}
+/** A fixed Codex login command, not a remotely accessible terminal. CLI
+ * output stays in bounded private memory; only a device URL/code is exposed. */
+export class CodexDeviceAuthController {
+    flow = null;
+    disposed = false;
+    options;
+    constructor(options) { this.options = options; }
+    async start() {
+        if (this.disposed)
+            throw new Error("This provider was removed. Refresh Settings before signing in.");
+        if (this.flow?.status.phase === "waiting") {
+            if (this.flow.ready)
+                return { ...this.flow.status, phase: "waiting" };
+            throw new Error("A ChatGPT sign-in is already starting. Please wait for the code.");
+        }
+        await this.flow?.stopping;
+        if (this.disposed)
+            throw new Error("This provider was removed. Refresh Settings before signing in.");
+        const env = this.options.environment();
+        const home = env.HOME || env.USERPROFILE || homedir();
+        if (!isAbsolute(home) || (env.CODEX_HOME && !isAbsolute(env.CODEX_HOME))) {
+            throw new Error("Use an absolute HOME and CODEX_HOME path for this server's Codex provider before signing in.");
+        }
+        const homeKey = canonicalPath(resolve(env.CODEX_HOME || join(home, ".codex")));
+        if (authenticatingHomes.has(homeKey)) {
+            throw new Error("A ChatGPT sign-in is already running for this server account. Finish or cancel it before starting another.");
+        }
+        authenticatingHomes.add(homeKey);
+        return new Promise((resolveStart, reject) => {
+            const flow = {
+                status: {
+                    phase: "waiting", flowId: randomUUID(), authorizationUrl: null,
+                    expiresAt: new Date(Date.now() + (this.options.lifetimeMs ?? 15 * 60_000)).toISOString(),
+                },
+                child: null, ready: false, resolve: resolveStart, reject, homeKey,
+                startupTimer: setTimeout(() => this.finish(flow, "failed", "Codex did not provide a sign-in code in time. Check the server connection and update Codex, then try again."), this.options.startupTimeoutMs ?? 30_000),
+                expiryTimer: setTimeout(() => this.finish(flow, "expired", "The ChatGPT sign-in code expired. Start sign-in again."), this.options.lifetimeMs ?? 15 * 60_000),
+            };
+            flow.startupTimer.unref();
+            flow.expiryTimer.unref();
+            this.flow = flow;
+            // Never overwrite a working login just because Connect was clicked twice.
+            this.run(flow, ["login", "status"], env, home, (code, output) => {
+                if (code === 0 && /^logged in.*chatgpt\b/im.test(output)) {
+                    this.finish(flow, "succeeded");
+                }
+                else if (code === 0 && /^logged in\b/im.test(output)) {
+                    this.finish(flow, "failed", "Codex already has a different sign-in method on this server. Ask the server administrator to review it before changing accounts.");
+                }
+                else if (code !== 0 && /^not logged in\b/im.test(output)) {
+                    this.run(flow, ["login", "--device-auth"], env, home, (loginCode, loginOutput) => {
+                        if (loginCode !== 0 || !flow.ready) {
+                            this.finish(flow, "failed", loginFailure(loginOutput));
+                            return;
+                        }
+                        // A successful command is not enough: verify credentials using the
+                        // same executable and environment that will run this client's bots.
+                        flow.startupTimer = setTimeout(() => this.finish(flow, "failed", "Codex finished sign-in but could not confirm the account. Refresh Settings and try again."), this.options.startupTimeoutMs ?? 30_000);
+                        flow.startupTimer.unref();
+                        this.run(flow, ["login", "status"], env, home, (statusCode, statusOutput) => {
+                            this.finish(flow, statusCode === 0 && /^logged in.*chatgpt\b/im.test(statusOutput) ? "succeeded" : "failed", "Codex finished sign-in but did not confirm a ChatGPT account. Refresh Settings and try again.");
+                        });
+                    }, true);
+                }
+                else
+                    this.finish(flow, "failed", "Codex could not confirm the existing sign-in on this server. Update Codex and check its login status before trying again.");
+            });
+        });
+    }
+    async get(flowId) {
+        if (!flowId || this.flow?.status.flowId !== flowId)
+            throw new Error("This sign-in is no longer available. Start sign-in again.");
+        return { ...this.flow.status };
+    }
+    async cancel() {
+        if (this.flow?.status.phase === "waiting")
+            this.finish(this.flow, "cancelled", "ChatGPT sign-in cancelled.");
+        await this.flow?.stopping;
+        if (this.flow?.terminationFailed)
+            throw new Error(this.flow.status.message);
+    }
+    async dispose() {
+        this.disposed = true;
+        await this.cancel();
+        this.flow = null;
+    }
+    run(flow, args, env, cwd, done, parsePrompt = false) {
+        if (flow.status.phase !== "waiting")
+            return;
+        let child;
+        try {
+            child = spawnCli(this.options.cli, args, { env: { ...env, NO_COLOR: "1" }, cwd, stdio: ["pipe", "pipe", "pipe"] });
+        }
+        catch {
+            this.finish(flow, "failed", "Codex could not start on this server. Install or update the configured Codex CLI, then try again.");
+            return;
+        }
+        flow.child = child;
+        child.stdin.end();
+        let output = "";
+        const receive = (chunk) => {
+            if (flow.status.phase !== "waiting")
+                return;
+            if (output.length + chunk.length > MAX_OUTPUT) {
+                this.finish(flow, "failed", "Codex returned an unexpected sign-in response. Update the server's Codex CLI and try again.");
+                return;
+            }
+            output += chunk.toString("utf8");
+            const prompt = parsePrompt && !flow.ready ? codexDevicePrompt(output) : null;
+            if (prompt) {
+                flow.status = { ...flow.status, ...prompt };
+                flow.ready = true;
+                clearTimeout(flow.startupTimer);
+                flow.resolve({ ...flow.status, phase: "waiting" });
+            }
+        };
+        child.stdout.on("data", receive);
+        child.stderr.on("data", receive);
+        child.once("error", (error) => {
+            const message = error.code === "ENOENT"
+                ? "Codex is not installed on this server. Run npm install -g @openai/codex@latest on the server, then try again."
+                : "Codex could not start on this server. Check the configured CLI path and its executable permissions.";
+            this.finish(flow, "failed", message);
+        });
+        child.once("close", (code) => {
+            if (flow.child === child)
+                flow.child = null;
+            if (flow.status.phase === "waiting")
+                done(code, stripVTControlCharacters(output));
+            output = "";
+        });
+    }
+    finish(flow, phase, message) {
+        if (flow.status.phase !== "waiting")
+            return;
+        clearTimeout(flow.startupTimer);
+        clearTimeout(flow.expiryTimer);
+        flow.status = {
+            phase, flowId: flow.status.flowId, authorizationUrl: null, expiresAt: null,
+            ...(phase !== "succeeded" && message ? { message } : {}),
+        };
+        if (!flow.ready) {
+            if (phase === "succeeded")
+                flow.resolve({ ...flow.status, phase });
+            else
+                flow.reject(new Error(message ?? "ChatGPT sign-in did not finish."));
+        }
+        flow.stopping = this.stopChild(flow).catch(() => false).then((stopped) => {
+            const release = () => authenticatingHomes.delete(flow.homeKey);
+            if (stopped) {
+                release();
+                return;
+            }
+            flow.terminationFailed = true;
+            flow.status = { ...flow.status, phase: "failed", message: "Codex could not be stopped on this server. Ask the server administrator to stop the login process before trying again." };
+            // Retain the credential-home lock until the OS actually reports exit.
+            const child = flow.child;
+            if (!child || child.exitCode !== null || child.signalCode !== null)
+                release();
+            else
+                child.once("close", release);
+        });
+        if (phase === "succeeded")
+            void this.options.onAuthenticated?.().catch(() => { });
+    }
+    async stopChild(flow) {
+        const child = flow.child;
+        if (!child || await killCliTree(child, this.options.terminateTimeoutMs ?? 1500))
+            return true;
+        // A broken CLI may ignore SIGTERM. Do not leave a stale device flow able
+        // to write credentials after the user cancelled it.
+        if (process.platform !== "win32" && child.pid) {
+            try {
+                process.kill(-child.pid, "SIGKILL");
+            }
+            catch {
+                child.kill("SIGKILL");
+            }
+        }
+        else
+            child.kill("SIGKILL");
+        await new Promise((resolveStop) => {
+            if (child.exitCode !== null || child.signalCode !== null)
+                return resolveStop();
+            const timer = setTimeout(resolveStop, 1500);
+            timer.unref();
+            child.once("close", () => { clearTimeout(timer); resolveStop(); });
+        });
+        return child.exitCode !== null || child.signalCode !== null;
+    }
+}

package/dist-server/server/drivers/codex.js

@@ -23,6 +23,7 @@ import { augmentedPath, splitCliString } from "../env-path.js";
 import { classifyError, computeBackoff, RETRY_MAX_ATTEMPTS } from "./retry.js";
 import { appendNative } from "./native.js";
 import { codexDeveloperInstructions, syncCodexInstructions } from "./codex-instructions.js";
+import { CodexDeviceAuthController } from "./codex-device-auth.js";
 export { decodeCodexSelection, readCodexModelCatalog, STATIC_CODEX_MODELS } from "./codex-catalog.js";
 const DRIVER_KIND = "codex";
 const ASTRA_MODEL_ID = "gpt-6-astra";
@@ -424,6 +425,11 @@ export const CodexDriver = {
             }
         };
         await refreshModels();
+        const authentication = new CodexDeviceAuthController({
+            cli: config.cli,
+            environment: childEnv,
+            onAuthenticated: refreshModels,
+        });
         const listeners = new Set();
         const active = new Map();
         const emit = (event) => {
@@ -1105,6 +1111,9 @@ export const CodexDriver = {
                 return models;
             },
             refreshModels,
+            startAuthentication: () => authentication.start(),
+            getAuthentication: (flowId) => authentication.get(flowId),
+            cancelAuthentication: () => authentication.cancel(),
             snapshot,
             adapter: {
                 provider: DRIVER_KIND,
@@ -1143,6 +1152,7 @@ export const CodexDriver = {
                 },
             },
             dispose: async () => {
+                await authentication.dispose();
                 await Promise.all([...active.values()].map(({ stop }) => stop()));
                 listeners.clear();
             },

package/dist-server/server/harness/bus.js

@@ -12,7 +12,7 @@ import { newId } from "../contracts.js";
 const INCOMPLETE_LOG_MESSAGE = "Canonical event history is incomplete: OpenMausBot could not write one or more events to disk. Live updates will continue.";
 export class EventBus {
     listeners = new Set();
-    unsubscribes = [];
+    unsubscribes = new Map();
     pendingLogWarnings = new Map();
     appendLog;
     constructor(appendLog = appendFileSync) {
@@ -20,6 +20,7 @@ export class EventBus {
     }
     attach(instances) {
         for (const instance of instances) {
+            this.detach(instance.instanceId);
             const unsub = instance.adapter.onEvent((event) => {
                 // hard invariant borrowed from correlateRuntimeEventWithInstance:
                 // an adapter may only emit events for its own driver kind
@@ -29,7 +30,7 @@ export class EventBus {
                 }
                 this.publish({ ...event, providerInstanceId: instance.instanceId });
             });
-            this.unsubscribes.push(unsub);
+            this.unsubscribes.set(instance.instanceId, unsub);
         }
     }
     publish(event) {
@@ -80,7 +81,11 @@ export class EventBus {
         return () => this.listeners.delete(listener);
     }
     detachAll() {
-        for (const unsub of this.unsubscribes.splice(0))
-            unsub();
+        for (const id of this.unsubscribes.keys())
+            this.detach(id);
+    }
+    detach(instanceId) {
+        this.unsubscribes.get(instanceId)?.();
+        this.unsubscribes.delete(instanceId);
     }
 }

package/dist-server/server/harness/registry.js

@@ -35,6 +35,8 @@ export class ProviderRegistry {
     }
     async load(configs) {
         for (const [instanceId, entry] of Object.entries(configs)) {
+            // Account edits replace only their own process/session state.
+            await this.dispose(instanceId);
             const driver = this.driversByKind.get(entry.driver);
             if (!driver) {
                 this.byId.set(instanceId, {
@@ -122,6 +124,10 @@ export class ProviderRegistry {
         const instance = this.get(instanceId);
         return instance?.startAuthentication ? instance.startAuthentication() : null;
     }
+    async getAuthentication(instanceId, flowId) {
+        const instance = this.get(instanceId);
+        return instance?.getAuthentication ? instance.getAuthentication(flowId) : null;
+    }
     async completeAuthentication(instanceId, flowId, callbackUrl) {
         const instance = this.get(instanceId);
         if (!instance?.completeAuthentication)
@@ -200,6 +206,9 @@ export class ProviderRegistry {
                 },
                 access: driver?.metadata.access ?? "subscription",
                 install: driver?.install,
+                authentication: inst.startAuthentication
+                    ? { method: inst.getAuthentication ? "device-code" : "browser" }
+                    : undefined,
                 cli: this.cliByInstance.get(inst.instanceId),
                 cliDefault: cliDefaultOf(driver),
                 // every copy of the driver's default binary on the augmented PATH —
@@ -214,4 +223,10 @@ export class ProviderRegistry {
         this.byId.clear();
         this.cliByInstance.clear();
     }
+    async dispose(instanceId) {
+        const entry = this.byId.get(instanceId);
+        this.byId.delete(instanceId);
+        this.cliByInstance.delete(instanceId);
+        await entry?.live?.dispose();
+    }
 }