relay-codex 0.0.0-stage → 0.5.0

package/python/Menu.swift

@@ -0,0 +1,188 @@
+import AppKit
+
+final class MenuController: NSObject, NSApplicationDelegate, NSMenuDelegate {
+    var item: NSStatusItem!
+    var stream: Process?
+    var buffer = Data()
+    var current: [String: Any] = [:]
+    var message: String?
+    var reconnect: DispatchWorkItem?
+    var stopping = false
+    let command = Bundle.main.object(forInfoDictionaryKey: "RelayCommand") as? String ?? "/usr/bin/false"
+    let state = Bundle.main.object(forInfoDictionaryKey: "RelayState") as? String ?? ""
+
+    func applicationDidFinishLaunching(_ notification: Notification) {
+        let others = NSRunningApplication.runningApplications(withBundleIdentifier: "local.relay.menu")
+        if others.contains(where: { $0.processIdentifier != ProcessInfo.processInfo.processIdentifier }) { NSApp.terminate(nil); return }
+        NSApp.setActivationPolicy(.accessory)
+        item = NSStatusBar.system.statusItem(withLength: NSStatusItem.squareLength)
+        item.button?.title = ""
+        item.button?.setAccessibilityLabel("Relay account and session status")
+        updateIcon(attention: false)
+        render()
+        startStream()
+    }
+    func process(_ args: [String]) -> Process {
+        let proc = Process()
+        proc.executableURL = URL(fileURLWithPath: command)
+        proc.arguments = args
+        var env = ProcessInfo.processInfo.environment
+        let node = Bundle.main.object(forInfoDictionaryKey: "RelayNodeDirectory") as? String ?? "/opt/homebrew/bin"
+        env["PATH"] = node + ":/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:" + (env["PATH"] ?? "")
+        env["RELAY_STATE"] = state
+        proc.environment = env
+        return proc
+    }
+    func startStream() {
+        guard !stopping else { return }
+        let proc = process(["status", "--watch", "--json"])
+        let pipe = Pipe()
+        proc.standardOutput = pipe; proc.standardError = FileHandle.nullDevice
+        pipe.fileHandleForReading.readabilityHandler = { [weak self] handle in
+            let bytes = handle.availableData
+            guard !bytes.isEmpty else { handle.readabilityHandler = nil; return }
+            DispatchQueue.main.async { self?.receive(bytes) }
+        }
+        proc.terminationHandler = { [weak self] _ in
+            DispatchQueue.main.async {
+                guard let self = self, !self.stopping else { return }
+                self.message = "Status connection interrupted. Retrying in 30 seconds."
+                self.render()
+                let retry = DispatchWorkItem { [weak self] in self?.startStream() }
+                self.reconnect = retry
+                DispatchQueue.main.asyncAfter(deadline: .now() + 30, execute: retry)
+            }
+        }
+        do { buffer.removeAll(); try proc.run(); stream = proc }
+        catch { message = "Relay could not start. Open Terminal and run relay doctor."; render() }
+    }
+    func receive(_ bytes: Data) {
+        buffer.append(bytes)
+        while let newline = buffer.firstIndex(of: 10) {
+            let line = buffer.prefix(upTo: newline); buffer.removeSubrange(...newline)
+            if let value = (try? JSONSerialization.jsonObject(with: line)) as? [String: Any] {
+                current = value; message = nil; render()
+            }
+        }
+    }
+    func updateIcon(attention: Bool) {
+        let symbol = attention ? "exclamationmark.circle.fill" : "arrow.triangle.branch"
+        let image = NSImage(systemSymbolName: symbol, accessibilityDescription: attention ? "Relay needs attention" : "Relay")
+        image?.isTemplate = true
+        item.button?.image = image
+    }
+    func text(_ title: String, into menu: NSMenu) {
+        menu.addItem(NSMenuItem(title: title, action: nil, keyEquivalent: ""))
+    }
+    func action(_ title: String, args: [String], into menu: NSMenu) {
+        let entry = NSMenuItem(title: title, action: #selector(runAction(_:)), keyEquivalent: "")
+        entry.target = self; entry.representedObject = args; menu.addItem(entry)
+    }
+    func date(_ value: Any?) -> String {
+        guard let seconds = value as? Double else { return "unknown" }
+        return Date(timeIntervalSince1970: seconds).formatted(date: .abbreviated, time: .shortened)
+    }
+    func countdown(_ title: String, value: Any, into menu: NSMenu) {
+        let entry = NSMenuItem(title: title + ": " + date(value), action: nil, keyEquivalent: "")
+        entry.representedObject = ["label": title, "at": value]
+        menu.addItem(entry)
+    }
+    func updateTimes(_ menu: NSMenu) {
+        for entry in menu.items {
+            if let data = entry.representedObject as? [String: Any], let at = data["at"] as? Double, let label = data["label"] as? String {
+                let seconds = max(0, Int(at - Date().timeIntervalSince1970))
+                let remaining = seconds < 60 ? "under a minute" : seconds < 3600 ? "\(seconds / 60)m" : "\(seconds / 3600)h \((seconds % 3600) / 60)m"
+                entry.title = label + ": " + (seconds == 0 ? "due now" : "in " + remaining) + " · " + date(at)
+            }
+            if let child = entry.submenu { updateTimes(child) }
+        }
+    }
+    func render() {
+        let sessions = current["sessions"] as? [[String: Any]] ?? []
+        let accounts = current["accounts"] as? [[String: Any]] ?? []
+        let attention = message != nil || sessions.contains { ($0["state"] as? String) == "needs_attention" }
+        updateIcon(attention: attention)
+        item.button?.toolTip = "Relay · \(sessions.count) sessions · \(accounts.count) accounts"
+        let menu = NSMenu(); menu.delegate = self
+        text("Relay · \(sessions.count) sessions", into: menu)
+        if let message = message { text(message, into: menu) }
+        if accounts.isEmpty { text("Add an account with relay setup in Terminal.", into: menu) }
+        for account in accounts {
+            let name = account["name"] as? String ?? "Account"
+            let primary = account["primary"] as? [String: Any]
+            let remaining = (primary?["usedPercent"] as? NSNumber).map { "\(max(0, 100 - $0.intValue))% left" } ?? "allowance unknown"
+            let label = (account["enabled"] as? Bool ?? true) ? remaining : "disabled"
+            let submenu = NSMenu()
+            if let email = account["email"] as? String { text(email, into: submenu) }
+            text("Short window: \(remaining)", into: submenu)
+            if let secondary = account["secondary"] as? [String: Any], let used = secondary["usedPercent"] as? NSNumber { text("Weekly window: \(max(0, 100 - used.intValue))% left", into: submenu) }
+            if let reset = account["next_check"] { countdown("Next check", value: reset, into: submenu) }
+            text("Last checked: \(date(account["usage_checked_at"]))", into: submenu)
+            let entry = NSMenuItem(title: "\(name) · \(label)", action: nil, keyEquivalent: ""); entry.submenu = submenu; menu.addItem(entry)
+        }
+        menu.addItem(.separator())
+        for session in sessions {
+            let id = session["id"] as? String ?? ""
+            let name = session["name"] as? String ?? String(id.prefix(10))
+            let status = (session["state"] as? String ?? "unknown").replacingOccurrences(of: "_", with: " ")
+            let submenu = NSMenu()
+            text("Account: \(session["account"] as? String ?? "unknown")", into: submenu)
+            text("Model: \(session["model"] as? String ?? "unknown")", into: submenu)
+            if let next = session["next_wake"] { countdown("Next action", value: next, into: submenu) }
+            if let reason = session["reason"] as? String { text(reason.replacingOccurrences(of: "_", with: " "), into: submenu) }
+            action("Copy reconnect command", args: ["copy", "relay attach " + id], into: submenu)
+            action("Pause recovery", args: ["pause", id, "--wait"], into: submenu)
+            action("Resume recovery", args: ["unpause", id, "--wait"], into: submenu)
+            action("Review and retry…", args: ["confirm-retry", id], into: submenu)
+            let entry = NSMenuItem(title: "\(name) · \(status)", action: nil, keyEquivalent: ""); entry.submenu = submenu; menu.addItem(entry)
+        }
+        menu.addItem(.separator())
+        action("Copy dashboard command", args: ["copy", "relay status --watch"], into: menu)
+        action("Check allowance now", args: ["refresh"], into: menu)
+        let login = NSMenuItem(title: "Open at login", action: #selector(toggleLogin), keyEquivalent: ""); login.target = self
+        login.state = FileManager.default.fileExists(atPath: NSHomeDirectory() + "/Library/LaunchAgents/local.relay.menu.plist") ? .on : .off
+        menu.addItem(login)
+        let quit = NSMenuItem(title: "Quit Relay menu", action: #selector(quitMenu), keyEquivalent: "q"); quit.target = self; menu.addItem(quit)
+        item.menu = menu
+    }
+    func menuWillOpen(_ menu: NSMenu) {
+        updateTimes(menu)
+        for entry in menu.items where entry.title == "Open at login" {
+            entry.state = FileManager.default.fileExists(atPath: NSHomeDirectory() + "/Library/LaunchAgents/local.relay.menu.plist") ? .on : .off
+        }
+    }
+    @objc func runAction(_ sender: NSMenuItem) {
+        guard var args = sender.representedObject as? [String], !args.isEmpty else { return }
+        if args[0] == "copy" { NSPasteboard.general.clearContents(); NSPasteboard.general.setString(args[1], forType: .string); return }
+        if args[0] == "confirm-retry" {
+            let alert = NSAlert(); alert.messageText = "Continue this task?"; alert.informativeText = "Review any interrupted command or external action in the conversation before continuing."
+            alert.addButton(withTitle: "Continue task"); alert.addButton(withTitle: "Cancel")
+            NSApp.activate(ignoringOtherApps: true)
+            guard alert.runModal() == .alertFirstButtonReturn else { return }
+            args = ["retry", args[1], "--wait"]
+        }
+        let proc = process(args); let pipe = Pipe(); proc.standardOutput = FileHandle.nullDevice; proc.standardError = pipe
+        DispatchQueue.global(qos: .utility).async { [weak self] in
+            do {
+                try proc.run(); let bytes = pipe.fileHandleForReading.readDataToEndOfFile(); proc.waitUntilExit()
+                if proc.terminationStatus != 0 { DispatchQueue.main.async { self?.message = String(data: bytes, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) ?? "Action failed. Check relay events."; self?.render() } }
+            } catch { DispatchQueue.main.async { self?.message = "Could not run that action."; self?.render() } }
+        }
+    }
+    @objc func toggleLogin() {
+        let enabled = FileManager.default.fileExists(atPath: NSHomeDirectory() + "/Library/LaunchAgents/local.relay.menu.plist")
+        runCommand(enabled ? ["menubar", "--no-startup", "--configure-only"] : ["menubar", "--configure-only"])
+    }
+    func runCommand(_ args: [String]) { let proc = process(args); proc.standardOutput = FileHandle.nullDevice; proc.standardError = FileHandle.nullDevice; try? proc.run() }
+    @objc func quitMenu() { stopping = true; reconnect?.cancel(); stream?.terminate(); NSApp.terminate(nil) }
+    func applicationWillTerminate(_ notification: Notification) { stopping = true; stream?.terminate() }
+}
+if CommandLine.arguments.contains("--self-check") {
+    let normal = NSImage(systemSymbolName: "arrow.triangle.branch", accessibilityDescription: "Relay")
+    let attention = NSImage(systemSymbolName: "exclamationmark.circle.fill", accessibilityDescription: "Relay needs attention")
+    print("Relay menu symbols available: \(normal != nil && attention != nil)")
+    exit(normal != nil && attention != nil ? 0 : 1)
+} else {
+    let app = NSApplication.shared
+    let delegate = MenuController(); app.delegate = delegate; app.run()
+}

package/python/broker.py

@@ -0,0 +1,297 @@
+"""Private Unix-socket credential authority. Tokens never enter the pool database."""
+
+import asyncio
+import contextlib
+import json
+import os
+from pathlib import Path
+import secrets
+import subprocess
+import sys
+import time
+import base64
+import hashlib
+
+from pool import file_lock, Pool
+from settings import atomic_json
+from processes import spawn
+
+LEGACY_CLIENT_REVISION = (
+    "b3b3a2c9e0da6e29ce54d2e1b4b747b4372b31d4eb193c0626eee6a86421c3f7"
+)
+PROTOCOL_VERSION = 1
+SOURCE_REVISION = hashlib.sha256(Path(__file__).read_bytes()).hexdigest()
+
+
+def paths(state):
+    # macOS Unix socket paths have a short length limit.
+    import hashlib
+
+    name = hashlib.sha256(str(state.resolve()).encode()).hexdigest()[:20]
+    root = Path("/private/tmp") / f"codex-accounts-{os.getuid()}-{name}"
+    root.mkdir(mode=0o700, exist_ok=True)
+    if root.is_symlink() or root.stat().st_uid != os.getuid():
+        raise RuntimeError("Unsafe local socket directory")
+    root.chmod(0o700)
+    return root / "broker.sock", state / "broker.json"
+
+
+async def exchange(state, request, timeout=60):
+    socket, meta = paths(state)
+    data = json.loads(meta.read_text())
+
+    async def call():
+        reader, writer = await asyncio.open_unix_connection(
+            str(socket), limit=4 * 1024 * 1024
+        )
+        try:
+            writer.write(
+                json.dumps({"token": data["token"], **request}).encode() + b"\n"
+            )
+            await writer.drain()
+            response = json.loads(await reader.readline())
+            if not response.get("ok"):
+                raise RuntimeError("Credential operation unavailable")
+            return response.get("result")
+        finally:
+            writer.close()
+            await writer.wait_closed()
+
+    return await asyncio.wait_for(call(), timeout)
+
+
+async def ensure(state, binary):
+    async with file_lock(state / "broker-start.lock"):
+        try:
+            running = await exchange(state, {"op": "ping"}, 3)
+            if running.get("protocol", 1) == PROTOCOL_VERSION:
+                return
+            await exchange(state, {"op": "stop"}, 3)
+            for _ in range(50):
+                if not paths(state)[1].exists():
+                    break
+                await asyncio.sleep(0.1)
+        except (OSError, ValueError, RuntimeError, asyncio.TimeoutError):
+            pass
+        spawn(
+            [
+                sys.executable,
+                str(Path(__file__).with_name("router.py")),
+                "_broker",
+                "--binary",
+                binary,
+            ],
+            env={
+                **os.environ,
+                "CODEX_ACCOUNTS_STATE": str(state),
+                "RELAY_STATE": str(state),
+            },
+            stdin=subprocess.DEVNULL,
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+            start_new_session=True,
+        )
+        deadline = time.monotonic() + 15
+        while time.monotonic() < deadline:
+            try:
+                await exchange(state, {"op": "ping"}, 2)
+                return
+            except (OSError, ValueError, RuntimeError, asyncio.TimeoutError):
+                await asyncio.sleep(0.1)
+        raise RuntimeError("Local credential coordinator did not start")
+
+
+class ClientAccount:
+    def __init__(self, label, home, binary, pool):
+        self.label, self.home, self.binary, self.pool = label, home, binary, pool
+
+    async def call(self, op, **params):
+        from router import RouterError
+
+        try:
+            await ensure(self.pool.state, self.binary)
+            return await exchange(
+                self.pool.state, {"op": op, "label": self.label, **params}
+            )
+        except (OSError, ValueError, RuntimeError, asyncio.TimeoutError):
+            raise RouterError(
+                "Account coordinator could not complete this operation. Check doctor or reauthenticate this account."
+            ) from None
+
+    async def credentials(self, refresh=False):
+        return await self.call("credentials", refresh=refresh)
+
+    async def usage(self, force=False):
+        return await self.call(
+            "usage", force=force, after=time.time() if force else None
+        )
+
+    async def network(self):
+        return await self.call("network")
+
+    async def close(self):
+        pass
+
+
+async def serve(state, binary):
+    from router import Account, account_home, labels, read_keychain
+
+    socket, meta = paths(state)
+    async with file_lock(state / "broker-owner.lock"):
+        socket.unlink(missing_ok=True)
+        token = secrets.token_urlsafe(32)
+        atomic_json(meta, {"token": token, "pid": os.getpid()})
+        pool = Pool(state)
+        accounts = {}
+        locks = {}
+        stamps = {}
+        refreshed = {}
+        last_used = time.monotonic()
+        network = {"at": 0, "value": None}
+        stop = asyncio.Event()
+
+        async def handle(reader, writer):
+            nonlocal last_used
+            response = {"ok": False}
+            try:
+                raw = await asyncio.wait_for(reader.readline(), 5)
+                request = json.loads(raw)
+                if not secrets.compare_digest(str(request.get("token", "")), token):
+                    return
+                last_used = time.monotonic()
+                op = request.get("op")
+                if op == "ping":
+                    response = {
+                        "ok": True,
+                        "result": {
+                            "pid": os.getpid(),
+                            "revision": LEGACY_CLIENT_REVISION,
+                            "protocol": PROTOCOL_VERSION,
+                            "build": SOURCE_REVISION,
+                        },
+                    }
+                elif op == "stop":
+                    response = {"ok": True, "result": True}
+                    stop.set()
+                elif op == "network":
+                    if time.monotonic() - network["at"] > 30:
+                        try:
+                            _, connection = await asyncio.wait_for(
+                                asyncio.open_connection("auth.openai.com", 443), 3
+                            )
+                            connection.close()
+                            await connection.wait_closed()
+                            network["value"] = True
+                        except (OSError, asyncio.TimeoutError):
+                            network["value"] = False
+                        network["at"] = time.monotonic()
+                    response = {"ok": True, "result": network["value"]}
+                else:
+                    label = request.get("label", "")
+                    if label not in labels(state):
+                        raise ValueError()
+                    if pool.options(label).get("maintenance") and op != "invalidate":
+                        raise ValueError()
+                    lock = locks.setdefault(label, asyncio.Lock())
+                    async with lock:
+                        # Enrollment writes a new generation marker and invalidates
+                        # this authority before any cached manager is reused.
+                        marker = account_home(state, label) / "enrolled"
+                        stamp = marker.stat().st_mtime_ns
+                        if label in accounts and stamps.get(label) != stamp:
+                            await accounts.pop(label).close()
+                        account = accounts.setdefault(
+                            label,
+                            Account(label, account_home(state, label), binary, pool),
+                        )
+                        stamps[label] = stamp
+                        async with file_lock(account.home / "credential.lock"):
+                            if op == "credentials":
+                                value = None
+                                with contextlib.suppress(Exception):
+                                    candidate = await asyncio.to_thread(
+                                        read_keychain, account.home
+                                    )
+                                    part = candidate["accessToken"].split(".")[1]
+                                    expires = json.loads(
+                                        base64.urlsafe_b64decode(
+                                            part + "=" * (-len(part) % 4)
+                                        )
+                                    ).get("exp", 0)
+                                    if expires > time.time() + 120 and (
+                                        not request.get("refresh")
+                                        or time.monotonic() - refreshed.get(label, 0)
+                                        < 30
+                                    ):
+                                        value = candidate
+                                if value is None:
+                                    await account.start()
+                                    result = await account.rpc.call(
+                                        "account/read",
+                                        {"refreshToken": bool(request.get("refresh"))},
+                                    )
+                                    if not result.get("account"):
+                                        raise ValueError()
+                                    value = await asyncio.to_thread(
+                                        read_keychain, account.home
+                                    )
+                                    if request.get("refresh"):
+                                        refreshed[label] = time.monotonic()
+                            elif op == "usage":
+                                value = (
+                                    pool.cached(label, not_before=request.get("after"))
+                                    if request.get("force") and request.get("after")
+                                    else pool.cached(label)
+                                    if not request.get("force")
+                                    else None
+                                )
+                                if value is None:
+                                    await account.start()
+                                    value = await account.rpc.call(
+                                        "account/rateLimits/read"
+                                    )
+                                    pool.save(label, value)
+                            elif op == "invalidate":
+                                await account.close()
+                                accounts.pop(label, None)
+                                value = True
+                            else:
+                                raise ValueError()
+                        response = {"ok": True, "result": value}
+            except (Exception, asyncio.CancelledError):
+                response = {"ok": False}
+            finally:
+                with contextlib.suppress(Exception):
+                    writer.write(json.dumps(response).encode() + b"\n")
+                    await writer.drain()
+                writer.close()
+                with contextlib.suppress(Exception):
+                    await writer.wait_closed()
+
+        server = await asyncio.start_unix_server(
+            handle, str(socket), limit=4 * 1024 * 1024
+        )
+        socket.chmod(0o600)
+        try:
+            while not stop.is_set():
+                try:
+                    await asyncio.wait_for(stop.wait(), 30)
+                except asyncio.TimeoutError:
+                    pass
+                import settings
+
+                if (
+                    time.monotonic() - last_used
+                    > settings.load(state)["broker_idle_seconds"]
+                    and not pool.detail()
+                ):
+                    break
+        finally:
+            server.close()
+            await server.wait_closed()
+            await asyncio.gather(
+                *(a.close() for a in accounts.values()), return_exceptions=True
+            )
+            pool.close()
+            socket.unlink(missing_ok=True)
+            meta.unlink(missing_ok=True)