relmio 0.5.0 → 0.7.0

package/src/services/codex-login.js

@@ -9,7 +9,7 @@ import {
 
 const COMPOSE_FILE_NAME = "docker-compose.yml";
 const PROJECT_NAME_PATTERN =
-  /^relmio-codex-chatgpt-[a-f0-9]{32}$/u;
+  /^relmio-codex-(chatgpt|chat)-[a-f0-9]{32}$/u;
 const DEFAULT_RESPONSE_TIMEOUT_MS = 15_000;
 const DEFAULT_COMPLETION_TIMEOUT_MS = 300_000;
 const DEFAULT_TERMINATION_GRACE_MS = 2_000;
@@ -88,7 +88,12 @@ function validateOptions({
   if (maxLineBytes > maxStdoutBytes) {
     throw new TypeError("maxLineBytes cannot exceed maxStdoutBytes.");
   }
-  return { dockerHost: validatedDockerHost, projectName };
+  const projectKind = PROJECT_NAME_PATTERN.exec(projectName)?.[1];
+  return {
+    dockerHost: validatedDockerHost,
+    projectName,
+    serviceName: projectKind === "chat" ? "codex-chat" : "codex",
+  };
 }
 
 function validateVerificationUrl(value) {
@@ -205,7 +210,10 @@ export async function startCodexDeviceLogin({
         "run",
         "--rm",
         "--no-deps",
-        "codex",
+        ...(validated.serviceName === "codex-chat"
+          ? ["--entrypoint", "codex"]
+          : []),
+        validated.serviceName,
         "app-server",
         "--strict-config",
         "--stdio",

package/src/services/local-chat-test.js

@@ -0,0 +1,361 @@
+import {
+  constants,
+  generateKeyPair as generateKeyPairCallback,
+  privateDecrypt,
+  randomUUID,
+} from "node:crypto";
+import { promisify } from "node:util";
+
+const generateKeyPair = promisify(generateKeyPairCallback);
+
+const MAX_SESSIONS = 8;
+const KEY_TTL_MS = 5 * 60 * 1_000;
+const REQUEST_TIMEOUT_MS = 120_000;
+const MAX_ENDPOINT_LENGTH = 64;
+const MAX_CIPHERTEXT_LENGTH = 4_096;
+const MAX_INPUT_LENGTH = 8_192;
+const MAX_CONVERSATION_ID_LENGTH = 160;
+const MAX_RESPONSE_BYTES = 16 * 1_024;
+const MAX_OUTPUT_LENGTH = 12 * 1_024;
+
+function requestError(message, statusCode = 400) {
+  return Object.assign(new Error(message), { statusCode });
+}
+
+function expiredKeyError() {
+  return requestError(
+    "This test credential has expired or was forgotten. Secure it again.",
+    409,
+  );
+}
+
+function adapterError(statusCode = 502) {
+  return requestError("The local adapter test could not be completed.", statusCode);
+}
+
+function isPlainObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function isBoundedText(value, maximumLength) {
+  return (
+    typeof value === "string" &&
+    value.length > 0 &&
+    value.length <= maximumLength &&
+    !/[\u0000-\u001f\u007f]/u.test(value)
+  );
+}
+
+export function parseLocalAdapterBaseUrl(value) {
+  if (typeof value !== "string" || value.length > MAX_ENDPOINT_LENGTH) {
+    throw requestError("Enter a valid local adapter address.");
+  }
+
+  const match = /^http:\/\/127\.0\.0\.1:([1-9]\d{0,4})\/?$/u.exec(value);
+  if (!match) {
+    throw requestError("Enter a valid local adapter address.");
+  }
+
+  const port = Number(match[1]);
+  if (!Number.isSafeInteger(port) || port < 1 || port > 65_535) {
+    throw requestError("Enter a valid local adapter address.");
+  }
+
+  return `http://127.0.0.1:${port}`;
+}
+
+function validateMessageRequest(request) {
+  if (!isPlainObject(request)) {
+    throw requestError("Enter a valid local adapter test request.");
+  }
+  const endpointBaseUrl = parseLocalAdapterBaseUrl(request.endpointBaseUrl);
+  if (!isBoundedText(request.keyId, 128)) {
+    throw expiredKeyError();
+  }
+  if (
+    typeof request.encryptedCredential !== "string" ||
+    request.encryptedCredential.length < 32 ||
+    request.encryptedCredential.length > MAX_CIPHERTEXT_LENGTH ||
+    !/^[A-Za-z0-9+/]+={0,2}$/u.test(request.encryptedCredential)
+  ) {
+    throw requestError("Secure the client credential again before testing.");
+  }
+  if (!isBoundedText(request.input, MAX_INPUT_LENGTH)) {
+    throw requestError("Enter a shorter chat message.");
+  }
+  if (
+    request.conversationId !== undefined &&
+    !isBoundedText(request.conversationId, MAX_CONVERSATION_ID_LENGTH)
+  ) {
+    throw requestError("Start a new conversation and try again.");
+  }
+
+  return {
+    endpointBaseUrl,
+    keyId: request.keyId,
+    encryptedCredential: request.encryptedCredential,
+    input: request.input,
+    ...(request.conversationId !== undefined
+      ? { conversationId: request.conversationId }
+      : {}),
+  };
+}
+
+function decodeCiphertext(value) {
+  const decoded = Buffer.from(value, "base64");
+  if (
+    decoded.length === 0 ||
+    decoded.toString("base64") !== value
+  ) {
+    decoded.fill(0);
+    throw requestError("Secure the client credential again before testing.");
+  }
+  return decoded;
+}
+
+async function readBoundedResponse(response) {
+  const contentLength = response.headers?.get?.("content-length");
+  if (
+    contentLength !== null &&
+    contentLength !== undefined &&
+    (!/^\d+$/u.test(contentLength) || Number(contentLength) > MAX_RESPONSE_BYTES)
+  ) {
+    throw adapterError();
+  }
+
+  const reader = response.body?.getReader?.();
+  if (!reader) {
+    throw adapterError();
+  }
+
+  const chunks = [];
+  let bytes = 0;
+  try {
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) {
+        break;
+      }
+      const chunk = Buffer.from(value);
+      bytes += chunk.length;
+      if (bytes > MAX_RESPONSE_BYTES) {
+        chunk.fill(0);
+        throw adapterError();
+      }
+      chunks.push(chunk);
+    }
+    return Buffer.concat(chunks).toString("utf8");
+  } finally {
+    for (const chunk of chunks) {
+      chunk.fill(0);
+    }
+    reader.releaseLock?.();
+  }
+}
+
+function parseAdapterResponse(text) {
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch {
+    throw adapterError();
+  }
+  if (
+    !isPlainObject(value) ||
+    !isBoundedText(value.conversationId, MAX_CONVERSATION_ID_LENGTH) ||
+    !isBoundedText(value.output, MAX_OUTPUT_LENGTH)
+  ) {
+    throw adapterError();
+  }
+  return {
+    conversationId: value.conversationId,
+    output: value.output,
+  };
+}
+
+function isTimeout(error) {
+  return error?.name === "AbortError" || error?.name === "TimeoutError";
+}
+
+export function createLocalChatTestService({
+  fetchImpl = fetch,
+  now = () => Date.now(),
+  keyTtlMs = KEY_TTL_MS,
+  maxSessions = MAX_SESSIONS,
+  requestTimeoutMs = REQUEST_TIMEOUT_MS,
+} = {}) {
+  const sessions = new Map();
+  let pendingKeyIssuances = 0;
+
+  function expireSession(keyId, session) {
+    if (sessions.get(keyId) !== session) {
+      return;
+    }
+    clearTimeout(session.expiryTimer);
+    session.abortController?.abort();
+    session.privateKey = undefined;
+    sessions.delete(keyId);
+  }
+
+  function discardExpiredSessions() {
+    const currentTime = now();
+    for (const [keyId, session] of sessions) {
+      if (session.expiresAt <= currentTime) {
+        expireSession(keyId, session);
+      }
+    }
+  }
+
+  function resetAllSessions() {
+    for (const [keyId, session] of sessions) {
+      expireSession(keyId, session);
+    }
+  }
+
+  function getLiveSession(keyId) {
+    discardExpiredSessions();
+    const session = sessions.get(keyId);
+    if (!session || session.expiresAt <= now()) {
+      if (session) {
+        expireSession(keyId, session);
+      }
+      throw expiredKeyError();
+    }
+    return session;
+  }
+
+  return {
+    async issueKey() {
+      discardExpiredSessions();
+      if (sessions.size + pendingKeyIssuances >= maxSessions) {
+        throw requestError(
+          "Too many open tester sessions. Forget one or wait for it to expire.",
+          429,
+        );
+      }
+      pendingKeyIssuances += 1;
+      try {
+        const { publicKey, privateKey } = await generateKeyPair("rsa", {
+          modulusLength: 2_048,
+          publicExponent: 0x10001,
+        });
+        const keyId = randomUUID();
+        const expiresAt = now() + keyTtlMs;
+        const session = {
+          abortController: null,
+          expiresAt,
+          expiryTimer: null,
+          inFlight: false,
+          privateKey,
+        };
+        sessions.set(keyId, session);
+        session.expiryTimer = setTimeout(
+          () => expireSession(keyId, session),
+          keyTtlMs,
+        );
+        session.expiryTimer.unref?.();
+        return {
+          keyId,
+          publicKeyJwk: publicKey.export({ format: "jwk" }),
+          algorithm: "RSA-OAEP-256",
+          expiresAt: new Date(expiresAt).toISOString(),
+        };
+      } finally {
+        pendingKeyIssuances -= 1;
+      }
+    },
+
+    async message(untrustedRequest) {
+      const request = validateMessageRequest(untrustedRequest);
+      const session = getLiveSession(request.keyId);
+      if (session.inFlight) {
+        throw requestError("Wait for the current test message to finish.", 409);
+      }
+      session.inFlight = true;
+      let encryptedCredential;
+      let decryptedCredential;
+      let authorization;
+      let timeout;
+      try {
+        encryptedCredential = decodeCiphertext(request.encryptedCredential);
+        try {
+          decryptedCredential = privateDecrypt(
+            {
+              key: session.privateKey,
+              padding: constants.RSA_PKCS1_OAEP_PADDING,
+              oaepHash: "sha256",
+            },
+            encryptedCredential,
+          );
+        } catch {
+          throw requestError("Secure the client credential again before testing.");
+        }
+        if (
+          decryptedCredential.length === 0 ||
+          decryptedCredential.length > 512 ||
+          /[\r\n\u0000]/u.test(decryptedCredential.toString("utf8"))
+        ) {
+          throw requestError("Secure the client credential again before testing.");
+        }
+        authorization = `Bearer ${decryptedCredential.toString("utf8")}`;
+
+        let response;
+        try {
+          session.abortController = new AbortController();
+          timeout = setTimeout(
+            () => session.abortController?.abort(),
+            requestTimeoutMs,
+          );
+          response = await fetchImpl(`${request.endpointBaseUrl}/chat`, {
+            method: "POST",
+            headers: {
+              Accept: "application/json",
+              Authorization: authorization,
+              "Content-Type": "application/json",
+            },
+            body: JSON.stringify({
+              input: request.input,
+              ...(request.conversationId !== undefined
+                ? { conversationId: request.conversationId }
+                : {}),
+            }),
+            redirect: "error",
+            signal: session.abortController.signal,
+          });
+        } catch (error) {
+          throw adapterError(isTimeout(error) ? 504 : 502);
+        }
+        if (!response?.ok || response.status < 200 || response.status >= 300) {
+          throw adapterError();
+        }
+        return parseAdapterResponse(await readBoundedResponse(response));
+      } finally {
+        clearTimeout(timeout);
+        authorization = undefined;
+        encryptedCredential?.fill(0);
+        decryptedCredential?.fill(0);
+        session.abortController = null;
+        session.inFlight = false;
+      }
+    },
+
+    async reset(request) {
+      if (!isPlainObject(request) || !isBoundedText(request.keyId, 128)) {
+        throw requestError("Choose a valid tester session to forget.");
+      }
+      const session = sessions.get(request.keyId);
+      if (session) {
+        expireSession(request.keyId, session);
+      }
+      return { forgotten: true };
+    },
+
+    resetAll() {
+      resetAllSessions();
+    },
+
+    dispose() {
+      resetAllSessions();
+    },
+  };
+}

package/src/services/local-installer.js

@@ -6,6 +6,10 @@ import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 
 import {
   createCodexComposeFile,
+  createCodexChatComposeFile,
+  createCodexChatConfig,
+  createCodexChatDockerfile,
+  createCodexChatRequirements,
   createCodexConfig,
   createCodexDockerfile,
   createCodexRequirements,
@@ -39,6 +43,11 @@ const PROJECTS = Object.freeze({
     serviceName: "codex",
     containerPort: 4_500,
   }),
+  "codex-chat": Object.freeze({
+    projectPrefix: "relmio-codex-chat",
+    serviceName: "codex-chat",
+    containerPort: 14_501,
+  }),
 });
 const DOCKER_SELECTION_VARIABLES = Object.freeze([
   "DOCKER_HOST",
@@ -613,10 +622,9 @@ function replaceClientCredentialVerifier({ target, composeFile, tokenSha256 }) {
     throw new Error("The managed local endpoint configuration is invalid.");
   }
 
-  const pattern =
-    target === "openai-api"
-      ? /^([ \t]*RELMIO_GATEWAY_TOKEN_SHA256:[ \t]*)[a-f0-9]{64}([ \t]*)$/gmu
-      : /^([ \t]*-[ \t]+--ws-token-sha256[ \t]*\n[ \t]*-[ \t]+)[a-f0-9]{64}([ \t]*)$/gmu;
+  const pattern = target === "openai-api" || target === "codex-chat"
+    ? /^([ \t]*RELMIO_GATEWAY_TOKEN_SHA256:[ \t]*)[a-f0-9]{64}([ \t]*)$/gmu
+    : /^([ \t]*-[ \t]+--ws-token-sha256[ \t]*\n[ \t]*-[ \t]+)[a-f0-9]{64}([ \t]*)$/gmu;
   const matches = [...composeFile.matchAll(pattern)];
   if (matches.length !== 1) {
     throw new Error("The managed local endpoint configuration is invalid.");
@@ -745,30 +753,34 @@ export async function getLocalDockerStatus({
 }
 
 export async function restartLocalCodex(
-  { installDirectory },
+  { installDirectory, target = "codex-chatgpt" },
   dependencies = {},
 ) {
+  const safeTarget = validateLocalTarget(target);
+  if (safeTarget !== "codex-chatgpt" && safeTarget !== "codex-chat") {
+    throw new TypeError("The Codex login target is invalid.");
+  }
   const runProcess = dependencies.runProcess ?? runLocalProcess;
   const releaseLock = dependencies.changeLockHeld === true
     ? async () => {}
     : await acquireLocalProjectLock(
-        { installRoot: installDirectory, target: "codex-chatgpt" },
+        { installRoot: installDirectory, target: safeTarget },
         dependencies,
       );
   try {
   const attested = await attestLocalCodexInstallation(
-    { installDirectory },
+    { installDirectory, target: safeTarget },
     dependencies,
   );
 
   await runOrThrow(runProcess, {
     label: "Codex credential reload",
     file: "docker",
-    args: createComposeArgs("codex-chatgpt", attested.projectName, [
+    args: createComposeArgs(safeTarget, attested.projectName, [
       "restart",
       "--timeout",
       "10",
-      "codex",
+      PROJECTS[safeTarget].serviceName,
     ]),
     cwd: installDirectory,
     dockerHost: attested.dockerHost,
@@ -776,14 +788,14 @@ export async function restartLocalCodex(
   await runOrThrow(runProcess, {
     label: "Codex readiness wait",
     file: "docker",
-    args: createComposeArgs("codex-chatgpt", attested.projectName, [
+    args: createComposeArgs(safeTarget, attested.projectName, [
       "up",
       "-d",
       "--wait",
       "--wait-timeout",
       "90",
       "--no-deps",
-      "codex",
+      PROJECTS[safeTarget].serviceName,
     ]),
     cwd: installDirectory,
     dockerHost: attested.dockerHost,
@@ -1111,7 +1123,7 @@ function parseModelIds(value) {
 }
 
 async function verifyHttpEndpoint({ plan, clientCredential, fetchImpl }) {
-  const healthPath = plan.target === "openai-api" ? "/health" : "/readyz";
+  const healthPath = plan.target === "codex-chatgpt" ? "/readyz" : "/health";
   const httpEndpoint = `http://127.0.0.1:${plan.port}${healthPath}`;
   let health;
   try {
@@ -1126,6 +1138,29 @@ async function verifyHttpEndpoint({ plan, clientCredential, fetchImpl }) {
     throw new Error("The local endpoint did not pass its readiness check.");
   }
 
+  if (plan.target === "codex-chat" && clientCredential !== undefined) {
+    let verification;
+    try {
+      verification = await fetchImpl(
+        `http://127.0.0.1:${plan.port}/auth/verify`,
+        {
+          method: "GET",
+          headers: { Authorization: `Bearer ${clientCredential}` },
+          signal: AbortSignal.timeout(10_000),
+        },
+      );
+    } catch {
+      throw new Error(
+        "The Codex Chat client credential could not be verified.",
+      );
+    }
+    if (!verification.ok) {
+      throw new Error(
+        "The Codex Chat client credential could not be verified.",
+      );
+    }
+  }
+
   if (plan.target !== "openai-api" || clientCredential === undefined) {
     return [];
   }
@@ -1275,6 +1310,13 @@ async function defaultReadGatewaySource() {
   );
 }
 
+async function defaultReadCodexChatSource() {
+  return defaultFileSystem.readFile(
+    new URL("../gateway/codex-chat.js", import.meta.url),
+    "utf8",
+  );
+}
+
 async function attestManagedLocalEndpoint(
   { target, installDirectory, missingMessage, notRunningMessage },
   {
@@ -1334,12 +1376,16 @@ async function attestManagedLocalEndpoint(
 }
 
 export async function attestLocalCodexInstallation(
-  { installDirectory },
+  { installDirectory, target = "codex-chatgpt" },
   dependencies = {},
 ) {
+  const safeTarget = validateLocalTarget(target);
+  if (safeTarget !== "codex-chatgpt" && safeTarget !== "codex-chat") {
+    throw new TypeError("The Codex login target is invalid.");
+  }
   const attested = await attestManagedLocalEndpoint(
     {
-      target: "codex-chatgpt",
+      target: safeTarget,
       installDirectory,
       missingMessage: "Install the local Codex endpoint before signing in.",
       notRunningMessage: "The managed local Codex endpoint is not running.",
@@ -1611,6 +1657,7 @@ export async function installLocalEndpoint(
     randomBytes = createRandomBytes,
     isPortAvailable = isLoopbackPortAvailable,
     readGatewaySource = defaultReadGatewaySource,
+    readCodexChatSource = defaultReadCodexChatSource,
     fetchImpl = fetch,
     verifyCodexCapability = verifyCodexWebSocketCapability,
     platform = process.platform,
@@ -1727,6 +1774,39 @@ export async function installLocalEndpoint(
       gatewaySource,
       0o600,
     );
+  } else if (normalizedPlan.target === "codex-chat") {
+    const gatewaySource = await readCodexChatSource();
+    if (
+      typeof gatewaySource !== "string" ||
+      gatewaySource.length === 0 ||
+      gatewaySource.length > 512 * 1024
+    ) {
+      throw new Error("The packaged Codex Chat runtime is invalid.");
+    }
+    dockerfile = createCodexChatDockerfile();
+    composeFile = createCodexChatComposeFile({
+      port: normalizedPlan.port,
+      tokenSha256,
+      installId,
+    });
+    await writeManagedFile(
+      fileSystem,
+      join(installRoot, "gateway.mjs"),
+      gatewaySource,
+      0o600,
+    );
+    await writeManagedFile(
+      fileSystem,
+      join(installRoot, "config.toml"),
+      createCodexChatConfig(),
+      0o600,
+    );
+    await writeManagedFile(
+      fileSystem,
+      join(installRoot, "requirements.toml"),
+      createCodexChatRequirements(),
+      0o600,
+    );
   } else {
     dockerfile = createCodexDockerfile();
     composeFile = createCodexComposeFile({