replicas-engine 0.1.667 → 0.1.671

package/dist/src/chunk-6WY7NPCL.js

@@ -0,0 +1,407 @@
+#!/usr/bin/env node
+import {
+  ENGINE_ENV,
+  setAgentCredentialSnapshot
+} from "./chunk-4FTBKGMO.js";
+import {
+  CODEX_AUTH_ENV_KEYS,
+  CODEX_AUTH_ENV_KEYS_BY_METHOD,
+  codexAuthEnvFromResponse,
+  createErrorResult,
+  createSuccessResult,
+  isRecord,
+  isValidAgentProvider
+} from "./chunk-TMERKNQV.js";
+
+// src/managers/codex-token-manager.ts
+import { promises as fs } from "fs";
+import path from "path";
+
+// src/managers/auth-env-transition.ts
+function applyAuthEnvTransition(params) {
+  const newOwned = new Set(params.authKeysByMethod[params.newMethod]);
+  const prevOwned = new Set(params.authKeysByMethod[params.prevMethod]);
+  for (const key of params.authKeys) {
+    const value = params.newEnvVars[key];
+    if (value !== void 0) {
+      for (const env of params.envs) {
+        env[key] = value;
+      }
+    } else if (prevOwned.has(key) && !newOwned.has(key)) {
+      for (const env of params.envs) {
+        delete env[key];
+      }
+    }
+  }
+}
+
+// src/services/credential-fallbacks.ts
+var fallbacksByAgent = /* @__PURE__ */ new Map();
+var exhaustedByAgent = /* @__PURE__ */ new Map();
+function recordCredentialFallback(notice) {
+  fallbacksByAgent.set(notice.provider, notice);
+}
+function listCredentialFallbacks() {
+  return [...fallbacksByAgent.values()].filter((notice) => {
+    const live = ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS[notice.provider];
+    if (!live) return false;
+    return notice.status === "switched" ? live.method === notice.candidateMethod && live.scope === notice.candidateScope : live.method === notice.exhaustedMethod && live.scope === notice.exhaustedScope;
+  });
+}
+function listExhaustedCredentials(provider) {
+  return [...exhaustedByAgent.get(provider)?.values() ?? []];
+}
+function recordExhaustedCredential(provider, credential) {
+  const spent = exhaustedByAgent.get(provider) ?? /* @__PURE__ */ new Map();
+  spent.set(`${credential.method}|${credential.scope}`, credential);
+  exhaustedByAgent.set(provider, spent);
+}
+
+// src/managers/base-refresh-manager.ts
+var BaseRefreshManager = class {
+  constructor(managerName, intervalMs = 15 * 60 * 1e3) {
+    this.managerName = managerName;
+    this.intervalMs = intervalMs;
+    this.health = {
+      isRunning: false,
+      intervalMs: this.intervalMs,
+      lastAttemptAt: null,
+      lastSuccessAt: null,
+      lastErrorAt: null,
+      lastErrorMessage: null
+    };
+  }
+  managerName;
+  intervalMs;
+  intervalHandle = null;
+  health;
+  async start() {
+    if (this.intervalHandle) {
+      return;
+    }
+    const skipReason = this.getSkipReason();
+    if (skipReason) {
+      console.log(`[${this.managerName}] Skipping: ${skipReason}`);
+      return;
+    }
+    console.log(`[${this.managerName}] Starting token refresh service`);
+    this.health.isRunning = true;
+    const config = this.getRuntimeConfig();
+    if (config) {
+      this.health.lastAttemptAt = (/* @__PURE__ */ new Date()).toISOString();
+      for (let attempt = 1; attempt <= 3; attempt++) {
+        try {
+          await this.doRefresh(config);
+          this.health.lastSuccessAt = (/* @__PURE__ */ new Date()).toISOString();
+          this.health.lastErrorAt = null;
+          this.health.lastErrorMessage = null;
+          break;
+        } catch (error) {
+          const message = error instanceof Error ? error.message : "Unknown error";
+          this.health.lastErrorAt = (/* @__PURE__ */ new Date()).toISOString();
+          this.health.lastErrorMessage = message;
+          if (attempt < 3) {
+            console.warn(`[${this.managerName}] Initial refresh attempt ${attempt} failed, retrying in 2s...`);
+            await new Promise((resolve) => setTimeout(resolve, 2e3));
+          } else {
+            console.error(`[${this.managerName}] Initial refresh failed after 3 attempts:`, error);
+          }
+        }
+      }
+    }
+    this.scheduleNextRefresh();
+  }
+  async swapCredentials(params) {
+    if (!this.getRuntimeConfig()) {
+      return createErrorResult({ message: `${this.managerName} has no runtime config`, code: "not_configured" });
+    }
+    try {
+      console.log(`[${this.managerName}] Fetching fresh credentials from monolith (${params.failureKind})...`);
+      const excludeCredentials = listExhaustedCredentials(params.provider);
+      await params.refresh(excludeCredentials.length > 0 ? { excludeCredentials } : {});
+      if (params.isOauthNow()) {
+        this.start().catch((error) => {
+          console.error(`[${this.managerName}] Failed to restart OAuth refresh service after fallback:`, error);
+        });
+      }
+      return createSuccessResult();
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      console.error(`[${this.managerName}] Failed to fetch fresh credentials:`, error);
+      return createErrorResult({
+        message,
+        code: message.includes('"code":"no_credentials"') ? "no_credentials" : "refresh_failed"
+      });
+    }
+  }
+  stop() {
+    if (!this.intervalHandle) {
+      return;
+    }
+    clearTimeout(this.intervalHandle);
+    this.intervalHandle = null;
+    this.health.isRunning = false;
+    console.log(`[${this.managerName}] Stopped`);
+  }
+  getHealthStatus() {
+    return { ...this.health };
+  }
+  getSkipReason() {
+    return null;
+  }
+  getNextRefreshDelayMs() {
+    return this.intervalMs;
+  }
+  getRuntimeConfig() {
+    if (!ENGINE_ENV.REPLICAS_WORKSPACE_ID) {
+      return null;
+    }
+    return {
+      monolithUrl: ENGINE_ENV.REPLICAS_MONOLITH_URL,
+      workspaceId: ENGINE_ENV.REPLICAS_WORKSPACE_ID,
+      engineSecret: ENGINE_ENV.REPLICAS_ENGINE_SECRET
+    };
+  }
+  scheduleNextRefresh() {
+    const delayMs = this.getNextRefreshDelayMs();
+    this.health.intervalMs = delayMs;
+    this.intervalHandle = setTimeout(async () => {
+      await this.refreshOnce();
+      if (this.intervalHandle) this.scheduleNextRefresh();
+    }, delayMs);
+    console.log(`[${this.managerName}] Token refresh scheduled in ${Math.round(delayMs / 1e3)} seconds`);
+  }
+  async refreshOnce() {
+    if (this.getSkipReason()) {
+      return createSuccessResult();
+    }
+    const config = this.getRuntimeConfig();
+    if (!config) return createSuccessResult();
+    this.health.lastAttemptAt = (/* @__PURE__ */ new Date()).toISOString();
+    try {
+      await this.doRefresh(config);
+      this.health.lastSuccessAt = (/* @__PURE__ */ new Date()).toISOString();
+      this.health.lastErrorAt = null;
+      this.health.lastErrorMessage = null;
+      return createSuccessResult();
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Unknown error";
+      this.health.lastErrorAt = (/* @__PURE__ */ new Date()).toISOString();
+      this.health.lastErrorMessage = message;
+      console.error(`[${this.managerName}] Failed to refresh credentials:`, error);
+      return createErrorResult({ message });
+    }
+  }
+};
+
+// src/services/monolith-service.ts
+async function monolithRequest(path2, init = {}) {
+  if (!ENGINE_ENV.REPLICAS_WORKSPACE_ID) {
+    throw new Error("REPLICAS_WORKSPACE_ID is not set; cannot call monolith");
+  }
+  const headers = {
+    Authorization: `Bearer ${ENGINE_ENV.REPLICAS_ENGINE_SECRET}`,
+    "X-Workspace-Id": ENGINE_ENV.REPLICAS_WORKSPACE_ID
+  };
+  if (!(init.body instanceof FormData)) headers["Content-Type"] = "application/json";
+  return fetch(`${ENGINE_ENV.REPLICAS_MONOLITH_URL}${path2}`, {
+    method: init.method ?? "POST",
+    headers,
+    body: init.body === void 0 ? void 0 : init.body instanceof FormData ? init.body : JSON.stringify(init.body),
+    signal: init.signal
+  });
+}
+var MonolithService = class {
+  async getRelaySubagentProviders() {
+    try {
+      const response = await monolithRequest("/v1/engine/relay-subagent-providers", { method: "GET" });
+      if (!response.ok) {
+        return null;
+      }
+      const body = await response.json();
+      return isRecord(body) && Array.isArray(body.providers) && body.providers.every((provider) => typeof provider === "string" && isValidAgentProvider(provider)) ? body.providers : null;
+    } catch {
+      return null;
+    }
+  }
+  async getOpenRouterModels() {
+    try {
+      const response = await monolithRequest("/v1/engine/openrouter-models", { method: "GET" });
+      if (!response.ok) {
+        return null;
+      }
+      const body = await response.json();
+      return isRecord(body) && Array.isArray(body.models) && body.models.every((model) => typeof model === "string") ? body.models : null;
+    } catch {
+      return null;
+    }
+  }
+  async sendEvent(event) {
+    if (!ENGINE_ENV.REPLICAS_WORKSPACE_ID) {
+      return;
+    }
+    try {
+      const response = await monolithRequest("/v1/engine/webhook", { body: event });
+      if (!response.ok) {
+        const errorText = await response.text();
+        console.error(`[MonolithService] Failed to send event: ${response.status} ${errorText}`);
+      }
+    } catch (error) {
+      console.error("[MonolithService] Failed to send event:", error);
+    }
+  }
+};
+var monolithService = new MonolithService();
+
+// src/managers/codex-token-manager.ts
+var CodexAspAuthMethodChangedError = class extends Error {
+};
+var CodexTokenManager = class extends BaseRefreshManager {
+  constructor() {
+    super("CodexTokenManager");
+  }
+  getSkipReason() {
+    if (ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD === "api_key" || ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD === "foundry") {
+      return `auth method is ${ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD}`;
+    }
+    if (!ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD && ENGINE_ENV.OPENAI_API_KEY) {
+      return "OPENAI_API_KEY is set";
+    }
+    return null;
+  }
+  async doRefresh(_config) {
+    await this.refreshWithRequest();
+  }
+  async refreshWithRequest(request) {
+    console.log("[CodexTokenManager] Refreshing Codex credentials...");
+    const response = await monolithRequest("/v1/engine/codex/refresh-credentials", {
+      body: request
+    });
+    if (!response.ok) {
+      const errorText = await response.text();
+      throw new Error(`Credentials refresh failed: ${response.status} ${errorText}`);
+    }
+    const data = await response.json();
+    await this.applyCredentialsResponse(data);
+    if (data.scope) {
+      setAgentCredentialSnapshot("codex", {
+        method: data.type,
+        scope: data.scope,
+        ...data.revision ? { revision: data.revision } : {}
+      });
+    }
+    console.log(`[CodexTokenManager] Credentials refreshed (method=${data.type})`);
+    return data;
+  }
+  async prepareAspOauthOptions() {
+    if (ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD !== "oauth") return {};
+    const response = await this.refreshWithRequest();
+    if (response.type !== "oauth") return {};
+    const login = this.buildAspOauthLogin(response);
+    let credential = login.credential;
+    return {
+      chatgptAuthTokens: login.tokens,
+      refreshChatgptAuthTokens: async (params) => {
+        const refreshed = await this.refreshAspOauthCredentials(
+          credential,
+          `Codex ASP requested an external token refresh (${params.reason})`
+        );
+        if (!refreshed.ok) {
+          if (refreshed.error.code === "method_changed") {
+            throw new CodexAspAuthMethodChangedError(refreshed.error.message);
+          }
+          throw new Error(refreshed.error.message);
+        }
+        credential = refreshed.data.credential;
+        return refreshed.data.tokens;
+      }
+    };
+  }
+  async refreshAspOauthCredentials(failedCredential, failureReason) {
+    try {
+      const response = await this.refreshWithRequest({
+        failedMethod: "oauth",
+        ...failedCredential?.method === "oauth" ? { failedCredential } : {},
+        failureKind: "rejected",
+        failureReason
+      });
+      if (response.type !== "oauth") {
+        return createErrorResult({
+          message: `${failureReason}; credentials changed to ${response.type}, so the app server must restart`,
+          code: "method_changed"
+        });
+      }
+      return createSuccessResult(this.buildAspOauthLogin(response));
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      return createErrorResult({
+        message,
+        code: message.includes('"code":"no_credentials"') ? "no_credentials" : "refresh_failed"
+      });
+    }
+  }
+  async fetchFreshCredentials(failureReason, failureKind = "rejected", failedCredential = ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS.codex) {
+    const failedMethod = failedCredential?.method === "oauth" || failedCredential?.method === "api_key" || failedCredential?.method === "foundry" ? failedCredential.method : ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD;
+    return this.swapCredentials({
+      provider: "codex",
+      failureKind,
+      refresh: async (exclusions) => {
+        await this.refreshWithRequest(
+          failedMethod === "oauth" || failedMethod === "api_key" || failedMethod === "foundry" ? {
+            failedMethod,
+            ...failedCredential?.method === failedMethod ? { failedCredential } : {},
+            failureReason,
+            failureKind,
+            ...exclusions
+          } : exclusions
+        );
+      },
+      isOauthNow: () => ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD === "oauth"
+    });
+  }
+  async applyCredentialsResponse(response) {
+    await this.removeOauthCredentialsFile();
+    const envVars = codexAuthEnvFromResponse(response);
+    applyAuthEnvTransition({
+      prevMethod: ENGINE_ENV.REPLICAS_CODEX_AUTH_METHOD ?? "none",
+      newMethod: envVars.REPLICAS_CODEX_AUTH_METHOD ?? "none",
+      authKeys: CODEX_AUTH_ENV_KEYS,
+      authKeysByMethod: CODEX_AUTH_ENV_KEYS_BY_METHOD,
+      newEnvVars: envVars,
+      envs: [ENGINE_ENV, process.env]
+    });
+  }
+  buildAspOauthLogin(response) {
+    const credential = ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS.codex;
+    return {
+      tokens: {
+        accessToken: response.accessToken,
+        chatgptAccountId: response.accountId,
+        chatgptPlanType: null
+      },
+      ...credential?.method === "oauth" ? { credential } : {}
+    };
+  }
+  async removeOauthCredentialsFile() {
+    const authPath = path.join(ENGINE_ENV.HOME_DIR, ".codex", "auth.json");
+    try {
+      await fs.unlink(authPath);
+    } catch (error) {
+      if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) throw error;
+    }
+  }
+};
+var codexTokenManager = new CodexTokenManager();
+
+export {
+  applyAuthEnvTransition,
+  recordCredentialFallback,
+  listCredentialFallbacks,
+  recordExhaustedCredential,
+  BaseRefreshManager,
+  monolithRequest,
+  monolithService,
+  CodexAspAuthMethodChangedError,
+  CodexTokenManager,
+  codexTokenManager
+};