pi-oracle 0.1.2 → 0.1.4

package/README.md

@@ -73,13 +73,13 @@ Not promised yet:
 
 ## Install
 
-Planned npm install path once published:
+npm:
 
 ```bash
 pi install npm:pi-oracle
 ```
 
-Current GitHub install path:
+GitHub:
 
 ```bash
 pi install https://github.com/fitchmultz/pi-oracle

package/extensions/oracle/worker/auth-bootstrap.mjs

@@ -5,6 +5,7 @@ import { appendFile, chmod, lstat, mkdir, readFile, rename, rm, writeFile } from
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { getCookies } from "@steipete/sweet-cookie";
+import { ensureAccountCookie, filterImportableAuthCookies } from "./auth-cookie-policy.mjs";
 
 const rawConfig = process.argv[2];
 if (!rawConfig) {
@@ -367,42 +368,6 @@ function stripQuery(url) {
   }
 }
 
-function normalizeSameSite(value) {
-  if (value === "Lax" || value === "Strict" || value === "None") return value;
-  return undefined;
-}
-
-function normalizeExpiration(expires) {
-  if (!expires || Number.isNaN(expires)) return undefined;
-  const value = Number(expires);
-  if (!Number.isFinite(value) || value <= 0) return undefined;
-  // Chrome cookie readers can surface expiries in a few formats:
-  // - Unix seconds (~1.7e9 in 2026)
-  // - Unix milliseconds (~1.7e12)
-  // - WebKit microseconds since 1601 (~1.3e16)
-  if (value > 10_000_000_000_000) return Math.round(value / 1_000_000 - 11644473600);
-  if (value > 10_000_000_000) return Math.round(value / 1000);
-  return Math.round(value);
-}
-
-function normalizeCookie(cookie, fallbackHost) {
-  if (!cookie?.name) return undefined;
-  const domain = typeof cookie.domain === "string" && cookie.domain.trim() ? cookie.domain.trim() : fallbackHost;
-  if (!domain) return undefined;
-
-  const expires = normalizeExpiration(cookie.expires);
-  return {
-    name: cookie.name,
-    value: cookie.value ?? "",
-    domain,
-    path: cookie.path || "/",
-    expires,
-    httpOnly: cookie.httpOnly ?? false,
-    secure: cookie.secure ?? true,
-    sameSite: normalizeSameSite(cookie.sameSite),
-  };
-}
-
 function cookieOrigins() {
   return Array.from(new Set([stripQuery(config.browser.chatUrl), ...CHATGPT_COOKIE_ORIGINS]));
 }
@@ -432,23 +397,20 @@ async function readSourceCookies() {
     await log(`sweet-cookie warnings: ${warnings.join(" | ")}`);
   }
 
-  const fallbackHost = new URL(config.browser.chatUrl).hostname;
-  const merged = new Map();
-  for (const cookie of cookies) {
-    const normalized = normalizeCookie(cookie, fallbackHost);
-    if (!normalized) continue;
-    const key = `${normalized.domain}:${normalized.name}`;
-    if (!merged.has(key)) merged.set(key, normalized);
-  }
-
-  const normalizedCookies = Array.from(merged.values());
+  const filtered = filterImportableAuthCookies(cookies, config.browser.chatUrl);
+  let normalizedCookies = filtered.cookies;
   await log(
-    `Read ${normalizedCookies.length} merged cookies: ${normalizedCookies.map((cookie) => `${cookie.name}@${cookie.domain}`).join(", ")}`,
+    `Read ${normalizedCookies.length} filtered auth cookies: ${normalizedCookies.map((cookie) => `${cookie.name}@${cookie.domain}`).join(", ")}`,
   );
+  if (filtered.dropped.length) {
+    await log(
+      `Dropped ${filtered.dropped.length} non-importable cookies: ` +
+        filtered.dropped.map(({ cookie, reason }) => `${cookie.name}@${cookie.domain}(${reason})`).join(", "),
+    );
+  }
 
   const hasSessionToken = normalizedCookies.some((cookie) => cookie.name.startsWith("__Secure-next-auth.session-token"));
   const hasAccountCookie = normalizedCookies.some((cookie) => cookie.name === "_account");
-  const fedrampCookie = normalizedCookies.find((cookie) => cookie.name === "_account_is_fedramp");
   await log(`Cookie presence: sessionToken=${hasSessionToken} account=${hasAccountCookie}`);
 
   if (!hasSessionToken) {
@@ -458,18 +420,11 @@ async function readSourceCookies() {
   }
 
   if (!hasAccountCookie) {
-    const isFedramp = /^(1|true|yes)$/i.test(String(fedrampCookie?.value || ""));
-    const fallbackAccountValue = isFedramp ? "fedramp" : "personal";
-    normalizedCookies.push({
-      name: "_account",
-      value: fallbackAccountValue,
-      domain: new URL(config.browser.chatUrl).hostname,
-      path: "/",
-      secure: true,
-      httpOnly: false,
-      sameSite: "Lax",
-    });
-    await log(`Synthesized missing _account cookie with value=${fallbackAccountValue}`);
+    const ensured = ensureAccountCookie(normalizedCookies, config.browser.chatUrl);
+    normalizedCookies = ensured.cookies;
+    if (ensured.synthesized) {
+      await log(`Synthesized missing _account cookie with value=${ensured.value}`);
+    }
   }
 
   return normalizedCookies;
@@ -658,6 +613,15 @@ function classifyChatPage({ url, snapshot, body, probe }) {
     };
   }
 
+  if (/http error 431|request header or cookie too large/i.test(text)) {
+    return {
+      state: "login_required",
+      message:
+        `Imported auth hit HTTP 431 during ChatGPT auth resolution, which usually means the imported cookie set is too large or stale. ` +
+        `Inspect ${LOG_PATH}.`,
+    };
+  }
+
   const outagePatterns = [
     /something went wrong/i,
     /a network error occurred/i,

package/extensions/oracle/worker/auth-cookie-policy.mjs

@@ -0,0 +1,155 @@
+const AUTH_COOKIE_NAME_PATTERNS = [
+  /^__Secure-next-auth\.session-token(?:\.|$)/,
+  /^__Secure-next-auth\.callback-url$/,
+  /^_account$/,
+  /^_account_is_fedramp$/,
+  /^_puid$/,
+  /^unified_session_manifest$/,
+  /^oai-(?:client-auth-info|client-auth-session|sc|did|hlib|asli|last-model-config|chat-web-route)$/,
+  /^auth-session-minimized(?:-client-checksum)?$/,
+  /^(?:login_session|auth_provider|hydra_redirect|iss_context|rg_context)$/,
+  /^cf_clearance$/,
+];
+
+const DROPPED_COOKIE_NAME_PATTERNS = [
+  /^_ga(?:_|$)/,
+  /^_uet/,
+  /^_rdt_uuid$/,
+  /^(?:marketing|analytics)_consent$/,
+  /^__cf_bm$/,
+  /^__cflb$/,
+  /^_cfuvid$/,
+  /^_dd_s$/,
+  /^g_state$/,
+  /^country$/,
+  /^oai-nav-state$/,
+  /^oai-login-csrf/,
+  /^__Secure-next-auth\.state$/,
+  /^__Host-next-auth\.csrf-token$/,
+];
+
+const BASE_ALLOWED_COOKIE_HOSTS = new Set([
+  'chatgpt.com',
+  'chat.openai.com',
+  'openai.com',
+  'auth.openai.com',
+  'sentinel.openai.com',
+  'atlas.openai.com',
+  'ws.chatgpt.com',
+]);
+
+function normalizeSameSite(value) {
+  if (value === 'Lax' || value === 'Strict' || value === 'None') return value;
+  return undefined;
+}
+
+function normalizeExpiration(expires) {
+  if (!expires || Number.isNaN(expires)) return undefined;
+  const value = Number(expires);
+  if (!Number.isFinite(value) || value <= 0) return undefined;
+  if (value > 10_000_000_000_000) return Math.round(value / 1_000_000 - 11644473600);
+  if (value > 10_000_000_000) return Math.round(value / 1000);
+  return Math.round(value);
+}
+
+function normalizeDomain(domain, fallbackHost) {
+  const raw = typeof domain === 'string' && domain.trim() ? domain.trim() : fallbackHost;
+  if (!raw) return undefined;
+  return raw.replace(/^\.+/, '').toLowerCase();
+}
+
+function allowedCookieHosts(chatUrl) {
+  const hosts = new Set(BASE_ALLOWED_COOKIE_HOSTS);
+  try {
+    hosts.add(new URL(chatUrl).hostname.toLowerCase());
+  } catch {
+    // ignore invalid URL here; caller validation happens elsewhere
+  }
+  return hosts;
+}
+
+function isAllowedCookieDomain(domain, chatUrl) {
+  const hosts = allowedCookieHosts(chatUrl);
+  return hosts.has(domain);
+}
+
+function matchesAny(patterns, value) {
+  return patterns.some((pattern) => pattern.test(value));
+}
+
+export function normalizeImportedCookie(cookie, fallbackHost) {
+  if (!cookie?.name) return undefined;
+  const domain = normalizeDomain(cookie.domain, fallbackHost);
+  if (!domain) return undefined;
+  return {
+    name: cookie.name,
+    value: cookie.value ?? '',
+    domain,
+    path: cookie.path || '/',
+    expires: normalizeExpiration(cookie.expires),
+    httpOnly: cookie.httpOnly ?? false,
+    secure: cookie.secure ?? true,
+    sameSite: normalizeSameSite(cookie.sameSite),
+  };
+}
+
+export function classifyImportedCookie(cookie, chatUrl) {
+  if (matchesAny(DROPPED_COOKIE_NAME_PATTERNS, cookie.name)) return 'noise';
+  if (!isAllowedCookieDomain(cookie.domain, chatUrl)) return 'foreign-domain';
+  if (!matchesAny(AUTH_COOKIE_NAME_PATTERNS, cookie.name)) return 'non-auth';
+  return 'keep';
+}
+
+export function filterImportableAuthCookies(cookies, chatUrl) {
+  const fallbackHost = (() => {
+    try {
+      return new URL(chatUrl).hostname;
+    } catch {
+      return 'chatgpt.com';
+    }
+  })();
+
+  const merged = new Map();
+  const dropped = [];
+  for (const cookie of cookies) {
+    const normalized = normalizeImportedCookie(cookie, fallbackHost);
+    if (!normalized) continue;
+    const disposition = classifyImportedCookie(normalized, chatUrl);
+    if (disposition !== 'keep') {
+      dropped.push({ cookie: normalized, reason: disposition });
+      continue;
+    }
+    const key = `${normalized.domain}:${normalized.name}`;
+    if (!merged.has(key)) merged.set(key, normalized);
+  }
+
+  return { cookies: Array.from(merged.values()), dropped };
+}
+
+export function ensureAccountCookie(cookies, chatUrl) {
+  const next = [...cookies];
+  const hasAccountCookie = next.some((cookie) => cookie.name === '_account');
+  if (hasAccountCookie) return { cookies: next, synthesized: false };
+
+  const fedrampCookie = next.find((cookie) => cookie.name === '_account_is_fedramp');
+  const isFedramp = /^(1|true|yes)$/i.test(String(fedrampCookie?.value || ''));
+  const fallbackAccountValue = isFedramp ? 'fedramp' : 'personal';
+  const domain = (() => {
+    try {
+      return new URL(chatUrl).hostname;
+    } catch {
+      return 'chatgpt.com';
+    }
+  })();
+
+  next.push({
+    name: '_account',
+    value: fallbackAccountValue,
+    domain,
+    path: '/',
+    secure: true,
+    httpOnly: false,
+    sameSite: 'Lax',
+  });
+  return { cookies: next, synthesized: true, value: fallbackAccountValue };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-oracle",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "ChatGPT web-oracle extension for pi with isolated browser auth, async jobs, and project-context archives.",
   "private": false,
   "license": "MIT",
@@ -27,7 +27,7 @@
     "extensions": ["./extensions/oracle/index.ts"]
   },
   "scripts": {
-    "check:oracle-extension": "node --check extensions/oracle/worker/run-job.mjs && node --check extensions/oracle/worker/auth-bootstrap.mjs && esbuild extensions/oracle/index.ts --bundle --platform=node --format=esm --external:@mariozechner/pi-coding-agent --external:@mariozechner/pi-ai --external:@sinclair/typebox --outfile=/tmp/pi-oracle-extension-check.js",
+    "check:oracle-extension": "node --check extensions/oracle/worker/run-job.mjs && node --check extensions/oracle/worker/auth-cookie-policy.mjs && node --check extensions/oracle/worker/auth-bootstrap.mjs && esbuild extensions/oracle/index.ts --bundle --platform=node --format=esm --external:@mariozechner/pi-coding-agent --external:@mariozechner/pi-ai --external:@sinclair/typebox --outfile=/tmp/pi-oracle-extension-check.js",
     "sanity:oracle": "tsx scripts/oracle-sanity.ts",
     "pack:check": "npm pack --dry-run"
   },