openryoko 2026.8.31 → 2026.9.2

package/dist/src/gateway/api.js

@@ -1,6 +1,7 @@
 import http from "node:http";
 import crypto from "node:crypto";
 import fs from "node:fs";
+import os from "node:os";
 import path from "node:path";
 import yaml from "js-yaml";
 import cron from "node-cron";
@@ -368,7 +369,56 @@ export async function handleApiRequest(req, res, context) {
             if (await handleWorkflowApi(req, res, { method, pathname, url }, { service: context.workflowService, authenticated }))
                 return;
         }
-        // GET /api/automation/templates — the fill-in-the-blanks workflow shapes.
+        // GET /api/onboarding/engines — is each configured engine INSTALLED and
+        // STARTABLE, and what login state can be observed locally? This is an
+        // install check with the best available auth signal — the wizard words it
+        // that way. It never spends tokens or reaches the network. One probe runs
+        // at a time (shared in-flight promise) and the result is cached briefly,
+        // so a burst of requests spawns one set of child processes, not many.
+        if (method === "GET" && pathname === "/api/onboarding/engines") {
+            const config = context.getConfig();
+            res.setHeader("Cache-Control", "no-store");
+            return json(res, await probeOnboardingEngines(config));
+        }
+        // POST /api/onboarding/slack/connect — the whole Slack hookup as ONE
+        // server-side operation: verify both tokens, save, reload, and if the
+        // connector still fails to start, put the previous Slack config back and
+        // reload again. The wizard calls only this, so "a wrong token never
+        // overwrites a working connection" holds across the verify→save gap too.
+        if (method === "POST" && pathname === "/api/onboarding/slack/connect") {
+            const { readJsonBody } = await import("./http-helpers.js");
+            const read = await readJsonBody(req, res, { maxBytes: 16 * 1024 });
+            if (!read.ok)
+                return;
+            const body = read.body;
+            const botToken = typeof body?.botToken === "string" ? body.botToken.trim() : "";
+            const appToken = typeof body?.appToken === "string" ? body.appToken.trim() : "";
+            if (!botToken.startsWith("xoxb-") || !appToken.startsWith("xapp-")) {
+                return badRequest(res, "botToken must start with xoxb- and appToken with xapp-");
+            }
+            res.setHeader("Cache-Control", "no-store");
+            return json(res, await connectSlack(context, botToken, appToken));
+        }
+        // POST /api/onboarding/slack/verify — prove BOTH Slack tokens before
+        // anything is saved: auth.test for the bot token, apps.connections.open
+        // for the app token (Socket Mode). Nothing is written here; the wizard
+        // saves only after both answer ok, so a wrong token can never overwrite a
+        // working connection.
+        if (method === "POST" && pathname === "/api/onboarding/slack/verify") {
+            const { readJsonBody } = await import("./http-helpers.js");
+            const read = await readJsonBody(req, res, { maxBytes: 16 * 1024 });
+            if (!read.ok)
+                return;
+            const body = read.body;
+            const botToken = typeof body?.botToken === "string" ? body.botToken.trim() : "";
+            const appToken = typeof body?.appToken === "string" ? body.appToken.trim() : "";
+            if (!botToken.startsWith("xoxb-") || !appToken.startsWith("xapp-")) {
+                return badRequest(res, "botToken must start with xoxb- and appToken with xapp-");
+            }
+            res.setHeader("Cache-Control", "no-store");
+            return json(res, await verifySlackTokens(botToken, appToken));
+        }
+        // GET /api/automation/templates — the fill-in-the-blanks workflow shapes.    // GET /api/automation/templates — the fill-in-the-blanks workflow shapes.
         // Lives outside /api/workflows so a definition id can never shadow it.
         if (method === "GET" && pathname === "/api/automation/templates") {
             const { AUTOMATION_TEMPLATES } = await import("../workflows/templates.js");
@@ -1678,83 +1728,89 @@ Handle this as a priority request from a colleague.`;
             if (body.engines !== undefined && (typeof body.engines !== "object" || Array.isArray(body.engines))) {
                 return badRequest(res, "engines must be an object");
             }
-            // Deep-merge incoming config with existing config to preserve
-            // fields not included in the update (e.g. connector tokens).
-            let existing = {};
-            try {
-                existing = yaml.load(fs.readFileSync(CONFIG_PATH, "utf-8")) || {};
-            }
-            catch { /* start fresh if unreadable */ }
-            const merged = deepMerge(existing, body);
-            const yamlStr = yaml.dump(merged);
-            // Compare AGAINST THE MERGED config, not the request body — partial
-            // updates (e.g. saving only "portal.portalName") leave body.connectors
-            // undefined, which would falsely look like the connectors block was
-            // wiped. Use the deep-merged result so we only reload when the
-            // effective on-disk values actually changed.
-            //
-            // We also reload connectors when portal.portalName / portal.operatorName
-            // change, because SlackConnector captures those at construction and
-            // would otherwise keep displaying the old portal name in triage prompts
-            // until a daemon restart.
-            const portalSliceChanged = (() => {
-                const prev = existing.portal ?? {};
-                const next = merged.portal ?? {};
-                return prev.portalName !== next.portalName || prev.operatorName !== next.operatorName;
-            })();
-            const connectorsChanged = JSON.stringify(existing.connectors ?? null) !==
-                JSON.stringify(merged.connectors ?? null) ||
-                portalSliceChanged;
-            // Tell the watcher to skip its connector-reload reaction for the file
-            // write we're about to do — we'll handle the reload ourselves below
-            // so the user's "Save" feels instant. Without this, the watcher would
-            // fire ~500ms later and start a redundant disconnect/reconnect cycle.
-            if (connectorsChanged) {
-                context.suppressNextConnectorReload?.();
-            }
-            fs.writeFileSync(CONFIG_PATH, yamlStr);
-            invalidateModelRegistry(); // models/engines may have changed — rebuild on next read
-            logger.info("Config updated via API");
-            if (connectorsChanged && context.reloadAllConnectors) {
+            // Every read→merge→write→reload of config.yaml runs under one lock, so a
+            // concurrent writer (another PUT, the onboarding Slack connect and its
+            // rollback) can never interleave with — or be overwritten by — this one.
+            return withConfigLock(async () => {
+                // Deep-merge incoming config with existing config to preserve
+                // fields not included in the update (e.g. connector tokens).
+                let existing = {};
                 try {
-                    const reload = await context.reloadAllConnectors();
-                    // reloadAllConnectors() already updated currentConfig + sessionManager
-                    // internally. Make sure apiContext.config (returned by GET /api/config)
-                    // reflects the on-disk merge too — without this, the GET handler
-                    // would return the previous snapshot until the (suppressed) watcher
-                    // event fires.
-                    context.config = context.getConfig();
-                    context.emit("connectors:reloaded", reload);
-                    // reloadAllConnectors() collects per-connector start/stop failures
-                    // into reload.errors instead of throwing. Surface them clearly so
-                    // the UI doesn't show a misleading "Settings saved" toast when
-                    // the new Slack token actually failed to authenticate.
-                    const status = reload.errors.length > 0 ? "partial" : "ok";
-                    if (status === "partial") {
-                        logger.warn(`Config saved but ${reload.errors.length} connector(s) failed to (re)start: ${reload.errors.join(" | ")}`);
-                        // Allow the chokidar event for the file we just wrote to fire
-                        // a second reload attempt — useful for transient failures
-                        // (network blip during Slack reconnect, brief Discord gateway
-                        // outage, etc.). For permanent failures (bad token), the second
-                        // attempt will fail the same way; no harm done.
+                    existing = yaml.load(fs.readFileSync(CONFIG_PATH, "utf-8")) || {};
+                }
+                catch { /* start fresh if unreadable */ }
+                const merged = deepMerge(existing, body);
+                const yamlStr = yaml.dump(merged);
+                // Compare AGAINST THE MERGED config, not the request body — partial
+                // updates (e.g. saving only "portal.portalName") leave body.connectors
+                // undefined, which would falsely look like the connectors block was
+                // wiped. Use the deep-merged result so we only reload when the
+                // effective on-disk values actually changed.
+                //
+                // We also reload connectors when portal.portalName / portal.operatorName
+                // change, because SlackConnector captures those at construction and
+                // would otherwise keep displaying the old portal name in triage prompts
+                // until a daemon restart.
+                const portalSliceChanged = (() => {
+                    const prev = existing.portal ?? {};
+                    const next = merged.portal ?? {};
+                    return prev.portalName !== next.portalName || prev.operatorName !== next.operatorName;
+                })();
+                const connectorsChanged = JSON.stringify(existing.connectors ?? null) !==
+                    JSON.stringify(merged.connectors ?? null) ||
+                    portalSliceChanged;
+                // Tell the watcher to skip its connector-reload reaction for the file
+                // write we're about to do — we'll handle the reload ourselves below
+                // so the user's "Save" feels instant. Without this, the watcher would
+                // fire ~500ms later and start a redundant disconnect/reconnect cycle.
+                if (connectorsChanged) {
+                    context.suppressNextConnectorReload?.();
+                }
+                fs.writeFileSync(CONFIG_PATH, yamlStr);
+                invalidateModelRegistry(); // models/engines may have changed — rebuild on next read
+                _resetEngineProbeCache(); // engine bins may have changed — the onboarding probe must re-run
+                logger.info("Config updated via API");
+                if (connectorsChanged && context.reloadAllConnectors) {
+                    try {
+                        const reload = await context.reloadAllConnectors();
+                        // reloadAllConnectors() already updated currentConfig + sessionManager
+                        // internally. Make sure apiContext.config (returned by GET /api/config)
+                        // reflects the on-disk merge too — without this, the GET handler
+                        // would return the previous snapshot until the (suppressed) watcher
+                        // event fires.
+                        context.config = context.getConfig();
+                        context.emit("connectors:reloaded", reload);
+                        // reloadAllConnectors() collects per-connector start/stop failures
+                        // into reload.errors instead of throwing. Surface them clearly so
+                        // the UI doesn't show a misleading "Settings saved" toast when
+                        // the new Slack token actually failed to authenticate.
+                        const status = reload.errors.length > 0 ? "partial" : "ok";
+                        if (status === "partial") {
+                            logger.warn(`Config saved but ${reload.errors.length} connector(s) failed to (re)start: ${reload.errors.join(" | ")}`);
+                            // Allow the chokidar event for the file we just wrote to fire
+                            // a second reload attempt — useful for transient failures
+                            // (network blip during Slack reconnect, brief Discord gateway
+                            // outage, etc.). For permanent failures (bad token), the second
+                            // attempt will fail the same way; no harm done.
+                            context.clearSuppressNextConnectorReload?.();
+                        }
+                        return json(res, { status, connectorsReload: reload });
+                    }
+                    catch (err) {
+                        // Eager reload failed. Re-arm the watcher so the chokidar event
+                        // for the file we just wrote is NOT suppressed — it's now our only
+                        // chance to retry connector reload before the next external edit
+                        // or manual /api/connectors/reload. (suppressNextConnectorReload
+                        // was armed above; clearing it via a fresh suppress with 0 effect
+                        // isn't possible, so we expose a clear() instead via the API.)
                         context.clearSuppressNextConnectorReload?.();
+                        const message = err instanceof Error ? err.message : String(err);
+                        logger.error(`Eager connector reload after config save failed: ${message}`);
+                        return json(res, { status: "ok", connectorsReloadError: message });
                     }
-                    return json(res, { status, connectorsReload: reload });
                 }
-                catch (err) {
-                    // Eager reload failed. Re-arm the watcher so the chokidar event
-                    // for the file we just wrote is NOT suppressed — it's now our only
-                    // chance to retry connector reload before the next external edit
-                    // or manual /api/connectors/reload. (suppressNextConnectorReload
-                    // was armed above; clearing it via a fresh suppress with 0 effect
-                    // isn't possible, so we expose a clear() instead via the API.)
-                    context.clearSuppressNextConnectorReload?.();
-                    const message = err instanceof Error ? err.message : String(err);
-                    logger.error(`Eager connector reload after config save failed: ${message}`);
-                    return json(res, { status: "ok", connectorsReloadError: message });
-                }
-            }
-            return json(res, { status: "ok" });
+                return json(res, { status: "ok" });
+            });
         }
         // GET /api/logs
         if (method === "GET" && pathname === "/api/logs") {
@@ -2896,4 +2952,247 @@ deliverToConnector) {
         logger.error(`Web session ${currentSession.id} error: ${errMsg}`);
     }
 }
+// ---------------------------------------------------------------------------
+// Config write serialization (fork addition)
+// ---------------------------------------------------------------------------
+/** One writer at a time for config.yaml + connector reload. The chain never
+ *  rejects: a failing writer settles its own promise and the next waiter runs. */
+let configWriteChain = Promise.resolve();
+export function withConfigLock(work) {
+    const run = configWriteChain.then(work, work);
+    configWriteChain = run.then(() => undefined, () => undefined);
+    return run;
+}
+const ENGINE_PROBE_TTL_MS = 10_000;
+/** Cache and in-flight probe are keyed by the engine config they were taken
+ *  under, so a bin/default change is never answered from a stale result — and
+ *  a probe started under the old config only ever caches under the old key. */
+let engineProbeInFlight = null;
+let engineProbeCache = null;
+function engineProbeKey(config) {
+    return JSON.stringify({
+        default: config.engines.default,
+        claude: config.engines.claude?.bin, codex: config.engines.codex?.bin, gemini: config.engines.gemini?.bin,
+    });
+}
+function runBinary(bin, args, timeoutMs) {
+    return new Promise((resolve) => {
+        import("node:child_process").then(({ execFile }) => {
+            execFile(bin, args, { timeout: timeoutMs, windowsHide: true }, (err, stdout, stderr) => {
+                resolve({ ok: !err, stdout: String(stdout ?? ""), stderr: String(stderr ?? err?.message ?? "") });
+            });
+        });
+    });
+}
+async function probeEngine(name, bin) {
+    if (!bin)
+        return { name, configured: false, installed: false, runnable: false };
+    const { tryResolveBin } = await import("../shared/resolveBin.js");
+    const resolved = tryResolveBin(bin);
+    if (!resolved)
+        return { name, configured: true, installed: false, runnable: false, bin, error: `${bin} が PATH にありません` };
+    const version = await runBinary(resolved, ["--version"], 8_000);
+    if (!version.ok) {
+        return { name, configured: true, installed: true, runnable: false, bin: resolved,
+            error: version.stderr.trim().split("\n")[0] || "起動に失敗しました" };
+    }
+    return { name, configured: true, installed: true, runnable: true, bin: resolved, version: version.stdout.trim().split("\n")[0] };
+}
+/** What can be observed about Claude's login WITHOUT spending anything: an API
+ *  key in the environment, or the subscription OAuth file's expiry. Neither
+ *  proves the credential still works — the note says so. */
+function observeClaudeAuth() {
+    if (process.env.ANTHROPIC_API_KEY)
+        return { method: "api-key", note: "API キーが設定されています（有効性は初回実行時に判明）" };
+    try {
+        const dir = process.env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), ".claude");
+        const raw = fs.readFileSync(path.join(dir, ".credentials.json"), "utf-8");
+        const expiresAt = JSON.parse(raw)?.claudeAiOauth?.expiresAt;
+        if (typeof expiresAt === "number" && expiresAt > 0) {
+            const expired = expiresAt < Date.now();
+            return { method: "oauth", expiresAt: new Date(expiresAt).toISOString(), expired,
+                note: expired ? "ログインの期限が切れています（claude を一度起動すると更新されます）" : "ログイン情報があります（有効性は初回実行時に判明）" };
+        }
+        return { method: "unknown", note: "ログイン情報の形式を判定できませんでした" };
+    }
+    catch {
+        return { method: "none", note: "ログイン情報が見つかりません（端末で claude と入力してログイン）" };
+    }
+}
+/** `codex login status` answers with its exit code — the one engine that can
+ *  be asked directly, still without spending anything. */
+async function observeCodexAuth(resolvedBin) {
+    const status = await runBinary(resolvedBin, ["login", "status"], 8_000);
+    if (status.ok)
+        return { method: "chatgpt", note: (status.stdout.trim().split("\n")[0] || "ログイン済み") };
+    return { method: "none", note: "未ログインです（端末で codex login を実行）" };
+}
+async function probeOnboardingEngines(config) {
+    const key = engineProbeKey(config);
+    if (engineProbeCache && engineProbeCache.key === key && Date.now() - engineProbeCache.at < ENGINE_PROBE_TTL_MS) {
+        return engineProbeCache.value;
+    }
+    if (engineProbeInFlight && engineProbeInFlight.key === key)
+        return engineProbeInFlight.promise;
+    const promise = (async () => {
+        const [claude, codex, gemini] = await Promise.all([
+            probeEngine("claude", config.engines.claude?.bin),
+            probeEngine("codex", config.engines.codex?.bin),
+            probeEngine("gemini", config.engines.gemini?.bin),
+        ]);
+        if (claude.runnable)
+            claude.auth = observeClaudeAuth();
+        if (codex.runnable && codex.bin)
+            codex.auth = await observeCodexAuth(codex.bin);
+        const value = {
+            default: config.engines.default, probedAt: new Date().toISOString(),
+            engines: [claude, codex, ...(gemini.configured ? [gemini] : [])],
+        };
+        // Only the newest config's probe may become "the" cache; a probe that ran
+        // under a config since replaced must not resurrect a stale answer.
+        if (!engineProbeCache || engineProbeCache.key === key || engineProbeInFlight?.key === key) {
+            engineProbeCache = { key, at: Date.now(), value };
+        }
+        return value;
+    })();
+    engineProbeInFlight = { key, promise };
+    promise.finally(() => { if (engineProbeInFlight?.promise === promise)
+        engineProbeInFlight = null; });
+    return promise;
+}
+/** Exposed for tests: forget the cached probe. */
+export function _resetEngineProbeCache() {
+    engineProbeCache = null;
+    engineProbeInFlight = null;
+}
+async function slackApi(method, token) {
+    try {
+        const response = await fetch(`https://slack.com/api/${method}`, {
+            method: "POST",
+            headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/x-www-form-urlencoded" },
+            signal: AbortSignal.timeout(10_000),
+        });
+        if (!response.ok) {
+            logger.warn(`[onboarding] Slack ${method} answered HTTP ${response.status}`);
+            return { ok: false, error: `http_${response.status}` };
+        }
+        const payload = await response.json();
+        return { ...payload, ok: payload.ok === true };
+    }
+    catch (err) {
+        // The raw message (DNS, TLS, timeout details) goes to the log; the client
+        // gets a stable, non-leaky code.
+        logger.warn(`[onboarding] Slack ${method} request failed: ${err instanceof Error ? err.message : String(err)}`);
+        return { ok: false, error: "network_error" };
+    }
+}
+async function verifySlackTokens(botToken, appToken) {
+    const [bot, app] = await Promise.all([
+        slackApi("auth.test", botToken),
+        slackApi("apps.connections.open", appToken),
+    ]);
+    const botResult = bot.ok
+        ? { ok: true, team: typeof bot.team === "string" ? bot.team : undefined, user: typeof bot.user === "string" ? bot.user : undefined }
+        : { ok: false, error: bot.error ?? "auth.test failed" };
+    const appResult = app.ok ? { ok: true } : { ok: false, error: app.error ?? "apps.connections.open failed" };
+    return { ok: botResult.ok && appResult.ok, bot: botResult, app: appResult };
+}
+/** Merge a patch into config.yaml and reload connectors — the same steps
+ *  PUT /api/config performs, callable from a server-side flow that has to
+ *  read the outcome and possibly undo the write. */
+async function writeConfigPatchAndReload(context, patch) {
+    let existing = {};
+    try {
+        existing = yaml.load(fs.readFileSync(CONFIG_PATH, "utf-8")) || {};
+    }
+    catch { /* first write */ }
+    const merged = deepMerge(existing, patch);
+    context.suppressNextConnectorReload?.();
+    fs.writeFileSync(CONFIG_PATH, yaml.dump(merged));
+    invalidateModelRegistry();
+    _resetEngineProbeCache();
+    if (!context.reloadAllConnectors)
+        return { status: "ok" };
+    try {
+        const reload = await context.reloadAllConnectors();
+        context.config = context.getConfig();
+        context.emit("connectors:reloaded", reload);
+        if (reload.errors.length > 0)
+            context.clearSuppressNextConnectorReload?.();
+        return { status: reload.errors.length > 0 ? "partial" : "ok", connectorsReload: reload };
+    }
+    catch (err) {
+        context.clearSuppressNextConnectorReload?.();
+        return { status: "ok", connectorsReloadError: err instanceof Error ? err.message : String(err) };
+    }
+}
+function slackFailure(outcome) {
+    if (outcome.connectorsReloadError)
+        return outcome.connectorsReloadError;
+    const errors = outcome.connectorsReload?.errors ?? [];
+    const slack = errors.find((line) => /slack/i.test(line));
+    if (slack)
+        return slack;
+    if (outcome.status === "partial" && errors.length > 0)
+        return errors.join(" | ");
+    return null;
+}
+function readSlackBlock() {
+    try {
+        const current = yaml.load(fs.readFileSync(CONFIG_PATH, "utf-8")) || {};
+        return current.connectors?.slack ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+async function connectSlack(context, botToken, appToken) {
+    const verified = await verifySlackTokens(botToken, appToken);
+    if (!verified.ok)
+        return { ok: false, stage: "verify", error: "token verification failed", bot: verified.bot, app: verified.app };
+    // Snapshot → write → reload → (rollback) is ONE critical section: a PUT
+    // /api/config or a second connect waits for it, so the snapshot we would
+    // restore can never be older than what a concurrent writer put down.
+    return withConfigLock(async () => {
+        const previousSlack = readSlackBlock();
+        const previous = previousSlack ? "config" : "none";
+        const outcome = await writeConfigPatchAndReload(context, { connectors: { slack: { botToken, appToken } } });
+        const failure = slackFailure(outcome);
+        if (!failure)
+            return { ok: true, team: verified.bot.team, user: verified.bot.user };
+        // The connector did not come up on tokens Slack itself accepted. Put the
+        // previous configuration back (or remove the block if there was none) —
+        // but only if the block on disk is still OURS: an out-of-band editor may
+        // have written something else meanwhile, and that is theirs to keep.
+        const onDisk = readSlackBlock();
+        if (onDisk?.botToken !== botToken || onDisk?.appToken !== appToken) {
+            logger.warn(`[onboarding] Slack connect failed (${failure}) but the Slack config changed concurrently — leaving it as is`);
+            return { ok: false, stage: "reload", error: failure, previous, rolledBack: false,
+                restored: { disk: false, running: false }, rollbackSkipped: "config changed concurrently" };
+        }
+        logger.warn(`[onboarding] Slack connect failed after save (${failure}) — ${previous === "config" ? "restoring previous Slack config" : "removing the Slack block again"}`);
+        let rollback;
+        try {
+            rollback = await writeConfigPatchAndReload(context, { connectors: { slack: previousSlack ?? null } });
+        }
+        catch (err) {
+            const rollbackError = err instanceof Error ? err.message : String(err);
+            logger.error(`[onboarding] Slack rollback write failed: ${rollbackError}`);
+            return { ok: false, stage: "reload", error: failure, previous, rolledBack: false,
+                restored: { disk: false, running: false }, rollbackError };
+        }
+        // The rollback is only a rollback if the live side settled on the restored
+        // file: the previous connector came back up (previous:"config"), or the
+        // removal reload finished without a Slack error (previous:"none"). A
+        // partial/errored second reload is reported as such in both cases — the
+        // file is back, the connectors are not known to be.
+        const rollbackFailure = slackFailure(rollback);
+        if (rollbackFailure) {
+            logger.error(`[onboarding] Slack rollback wrote the previous config but the connectors did not settle on it: ${rollbackFailure}`);
+            return { ok: false, stage: "reload", error: failure, previous, rolledBack: false,
+                restored: { disk: true, running: false }, rollbackError: rollbackFailure };
+        }
+        return { ok: false, stage: "reload", error: failure, previous, rolledBack: true, restored: { disk: true, running: previous === "config" } };
+    });
+}
 //# sourceMappingURL=api.js.map