sneakoscope 7.3.0 → 7.6.0

package/dist/core/codex-lb/desktop-bridge/types.js

@@ -0,0 +1,16 @@
+export const DESKTOP_BRIDGE_STATE_SCHEMA = 'sks.codex-lb-desktop-bridge.v1';
+export const DESKTOP_BRIDGE_ALLOWED_PATH_PREFIXES = [
+    '/backend-api/codex/',
+    '/backend-api/files',
+    '/backend-api/transcribe',
+    '/backend-api/wham/',
+    '/v1/',
+];
+export class DesktopBridgeError extends Error {
+    code;
+    constructor(code, options) {
+        super(code, options);
+        this.name = 'DesktopBridgeError';
+        this.code = code;
+    }
+}

package/dist/core/codex-lb/desktop-bridge/websocket-forward.js

@@ -0,0 +1,151 @@
+import net from 'node:net';
+import tls from 'node:tls';
+import { buildWebSocketHeaders } from './header-policy.js';
+import { rewriteLocationHeader } from './location-rewrite.js';
+import { resolveDesktopBridgeTarget } from './security.js';
+import { desktopBridgeListenOrigin } from './state.js';
+import { DesktopBridgeError } from './types.js';
+const MAX_UPGRADE_RESPONSE_HEAD_BYTES = 64 * 1024;
+const REDACTED_UPGRADE_RESPONSE_HEADERS = new Set([
+    'authorization',
+    'cookie',
+    'proxy-authenticate',
+    'proxy-authorization',
+    'set-cookie',
+    'x-codex-lb-api-key',
+]);
+function serializeHeaders(headers) {
+    return Object.entries(headers).flatMap(([name, value]) => {
+        if (value === undefined)
+            return [];
+        if (Array.isArray(value))
+            return value.map((entry) => `${name}: ${String(entry)}`);
+        return [`${name}: ${String(value)}`];
+    });
+}
+function rewriteUpgradeResponseHead(head, config) {
+    const text = head.toString('latin1');
+    const lines = text.split('\r\n');
+    const statusLine = lines.shift();
+    if (!statusLine || !/^HTTP\/1\.[01] \d{3}(?: |$)/.test(statusLine)) {
+        throw new DesktopBridgeError('bridge_websocket_response_invalid');
+    }
+    const output = [statusLine];
+    for (const line of lines) {
+        if (!line)
+            continue;
+        if (/^[ \t]/.test(line))
+            throw new DesktopBridgeError('bridge_websocket_response_invalid');
+        const colon = line.indexOf(':');
+        if (colon <= 0)
+            throw new DesktopBridgeError('bridge_websocket_response_invalid');
+        const rawName = line.slice(0, colon);
+        const name = rawName.toLowerCase();
+        const value = line.slice(colon + 1).trim();
+        if (REDACTED_UPGRADE_RESPONSE_HEADERS.has(name) || name.startsWith('access-control-'))
+            continue;
+        if (name === 'location') {
+            output.push(`${rawName}: ${rewriteLocationHeader(value, config.remoteBaseUrl, desktopBridgeListenOrigin(config))}`);
+            continue;
+        }
+        output.push(line);
+    }
+    return Buffer.from(`${output.join('\r\n')}\r\n\r\n`, 'latin1');
+}
+function writeUpgradeFailure(clientSocket) {
+    if (clientSocket.destroyed)
+        return;
+    clientSocket.end('HTTP/1.1 502 Bad Gateway\r\n'
+        + 'Content-Type: application/json\r\n'
+        + 'Cache-Control: no-store\r\n'
+        + 'Connection: close\r\n'
+        + '\r\n'
+        + '{"error":{"type":"sks_bridge_error","code":"bridge_websocket_upstream_unavailable"}}');
+}
+export function forwardWebSocket(req, clientSocket, head, config) {
+    const target = resolveDesktopBridgeTarget(req.url, config.remote);
+    const upstream = config.remote.secure
+        ? tls.connect({
+            host: config.remote.address,
+            port: config.remote.port,
+            ...(config.remote.tlsServername ? { servername: config.remote.tlsServername } : {}),
+        })
+        : net.connect({
+            host: config.remote.address,
+            port: config.remote.port,
+            family: config.remote.family,
+        });
+    let connected = false;
+    let responseHead = Buffer.alloc(0);
+    const connectTimer = setTimeout(() => {
+        upstream.destroy(new DesktopBridgeError('bridge_upstream_connect_timeout'));
+    }, config.connectTimeoutMs);
+    connectTimer.unref();
+    const fail = () => {
+        clearTimeout(connectTimer);
+        if (!connected)
+            writeUpgradeFailure(clientSocket);
+        else
+            clientSocket.destroy();
+    };
+    const onConnected = () => {
+        connected = true;
+        clearTimeout(connectTimer);
+        upstream.setNoDelay(true);
+        upstream.setTimeout(config.idleTimeoutMs, () => {
+            upstream.destroy(new DesktopBridgeError('bridge_upstream_idle_timeout'));
+        });
+        if (clientSocket instanceof net.Socket) {
+            clientSocket.setNoDelay(true);
+            clientSocket.setTimeout(config.idleTimeoutMs, () => clientSocket.destroy());
+        }
+        const headers = buildWebSocketHeaders(req.headers, config, target.host);
+        const requestHead = [
+            `${req.method || 'GET'} ${target.pathname}${target.search} HTTP/1.1`,
+            ...serializeHeaders(headers),
+            '',
+            '',
+        ].join('\r\n');
+        upstream.write(requestHead);
+        if (head.length)
+            upstream.write(head);
+        clientSocket.pipe(upstream);
+        const onHandshakeData = (chunk) => {
+            responseHead = Buffer.concat([responseHead, chunk]);
+            if (responseHead.length > MAX_UPGRADE_RESPONSE_HEAD_BYTES) {
+                upstream.destroy(new DesktopBridgeError('bridge_websocket_response_headers_too_large'));
+                return;
+            }
+            const boundary = responseHead.indexOf('\r\n\r\n');
+            if (boundary < 0)
+                return;
+            upstream.off('data', onHandshakeData);
+            const rawHead = responseHead.subarray(0, boundary);
+            const remaining = responseHead.subarray(boundary + 4);
+            try {
+                clientSocket.write(rewriteUpgradeResponseHead(rawHead, config));
+                if (remaining.length)
+                    clientSocket.write(remaining);
+            }
+            catch (error) {
+                upstream.destroy(error instanceof Error ? error : undefined);
+                return;
+            }
+            upstream.pipe(clientSocket);
+            responseHead = Buffer.alloc(0);
+        };
+        upstream.on('data', onHandshakeData);
+    };
+    if (config.remote.secure)
+        upstream.once('secureConnect', onConnected);
+    else
+        upstream.once('connect', onConnected);
+    upstream.once('error', fail);
+    upstream.once('close', () => {
+        clearTimeout(connectTimer);
+        if (!clientSocket.destroyed)
+            clientSocket.end();
+    });
+    clientSocket.once('error', () => upstream.destroy());
+    clientSocket.once('close', () => upstream.destroy());
+}

package/dist/core/codex-lb/desktop-center-credentials.js

@@ -0,0 +1,189 @@
+import fsp from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { exists, runProcess, which } from '../fsx.js';
+import { codexLbEnvPath, loadCodexLbEnv } from './codex-lb-env.js';
+export const CODEX_LB_STALE_ENV_TWINS = ['codex-lb.env', 'sks.env'];
+export const CODEX_LB_STALE_KEYCHAIN_SERVICES = ['CODEX_LB_API_KEY'];
+export const CODEX_LB_OFFICIAL_KEYCHAIN_SERVICE = 'sks-codex-lb';
+export async function loadOfficialCodexLbCredentials(opts = {}) {
+    const home = opts.home || process.env.HOME || os.homedir();
+    const load = opts.loadCodexLbEnvImpl || loadCodexLbEnv;
+    return load({
+        home,
+        processEnv: {},
+        envPath: opts.envPath || codexLbEnvPath(home),
+        ...(opts.metadataPath ? { metadataPath: opts.metadataPath } : {})
+    });
+}
+export async function purgeStaleCodexLbCredentialTwins(opts = {}) {
+    const home = opts.home || process.env.HOME || os.homedir();
+    const codexHome = path.join(home, '.codex');
+    const removed = [];
+    const blockers = [];
+    for (const name of CODEX_LB_STALE_ENV_TWINS) {
+        const target = path.join(codexHome, name);
+        try {
+            await fsp.lstat(target);
+            await fsp.rm(target, { force: true });
+            removed.push(target);
+        }
+        catch (error) {
+            if (error?.code !== 'ENOENT') {
+                blockers.push(`stale_twin_remove_failed:${name}`);
+            }
+        }
+    }
+    const keychainCleared = [];
+    if (process.platform === 'darwin') {
+        const security = opts.securityBin
+            || await which('security').catch(() => null)
+            || (await exists('/usr/bin/security') ? '/usr/bin/security' : null);
+        const account = opts.account || process.env.USER || 'sks';
+        const run = opts.runProcessImpl || runProcess;
+        if (security) {
+            for (const service of CODEX_LB_STALE_KEYCHAIN_SERVICES) {
+                const result = await run(security, [
+                    'delete-generic-password',
+                    '-a',
+                    account,
+                    '-s',
+                    service
+                ], { timeoutMs: 5000, maxOutputBytes: 8192 }).catch(() => ({ code: 1, stdout: '', stderr: '' }));
+                if (result.code === 0 || /could not be found|errSecItemNotFound|-25300/i.test(String(result.stderr || result.stdout || ''))) {
+                    if (result.code === 0)
+                        keychainCleared.push(service);
+                }
+            }
+        }
+    }
+    return { removed, keychain_cleared: keychainCleared, blockers };
+}
+export async function syncDesktopCenterLaunchCredentials(opts = { mode: 'disabled' }) {
+    const home = opts.home || process.env.HOME || os.homedir();
+    const mode = String(opts.mode || 'disabled');
+    const platform = opts.platform || process.platform;
+    const purge = opts.skipPurge
+        ? { removed: [], keychain_cleared: [], blockers: [] }
+        : await purgeStaleCodexLbCredentialTwins({
+            home,
+            ...(opts.runProcessImpl ? { runProcessImpl: opts.runProcessImpl } : {})
+        });
+    const loaded = opts.loadedEnv || await loadOfficialCodexLbCredentials({
+        home,
+        ...(opts.loadCodexLbEnvImpl ? { loadCodexLbEnvImpl: opts.loadCodexLbEnvImpl } : {})
+    });
+    const fingerprint = loaded.api_key.fingerprint;
+    const basePresent = Boolean(loaded.base_url);
+    if (platform !== 'darwin' && !opts.force) {
+        return {
+            schema: 'sks.codex-lb-desktop-center-credentials.v1',
+            ok: true,
+            status: 'not_macos',
+            mode,
+            api_key_fingerprint: fingerprint,
+            base_url_present: basePresent,
+            launch_env: { api_key: 'skipped', base_url: 'skipped' },
+            stale_twins_removed: purge.removed,
+            stale_keychain_cleared: purge.keychain_cleared,
+            blockers: purge.blockers
+        };
+    }
+    const launchctl = opts.launchctlBin
+        || await which('launchctl').catch(() => null)
+        || (await exists('/bin/launchctl') ? '/bin/launchctl' : null);
+    if (!launchctl) {
+        return {
+            schema: 'sks.codex-lb-desktop-center-credentials.v1',
+            ok: false,
+            status: 'launchctl_missing',
+            mode,
+            api_key_fingerprint: fingerprint,
+            base_url_present: basePresent,
+            launch_env: { api_key: 'failed', base_url: 'failed' },
+            stale_twins_removed: purge.removed,
+            stale_keychain_cleared: purge.keychain_cleared,
+            blockers: ['launchctl_missing', ...purge.blockers]
+        };
+    }
+    const run = opts.runProcessImpl || runProcess;
+    const setEnv = async (key, value) => {
+        const result = await run(launchctl, ['setenv', key, value], { timeoutMs: 5000, maxOutputBytes: 8192 });
+        return result.code === 0;
+    };
+    const unsetEnv = async (key) => {
+        const result = await run(launchctl, ['unsetenv', key], { timeoutMs: 5000, maxOutputBytes: 8192 });
+        return result.code === 0;
+    };
+    if (mode === 'desktop-dual-auth-compat') {
+        if (!loaded.secret_api_key || !loaded.base_url) {
+            return {
+                schema: 'sks.codex-lb-desktop-center-credentials.v1',
+                ok: false,
+                status: 'center_credentials_unavailable',
+                mode,
+                api_key_fingerprint: fingerprint,
+                base_url_present: basePresent,
+                launch_env: { api_key: 'failed', base_url: 'failed' },
+                stale_twins_removed: purge.removed,
+                stale_keychain_cleared: purge.keychain_cleared,
+                blockers: [
+                    ...(loaded.missing.length ? loaded.missing.map((item) => `codex_lb_missing:${item}`) : ['codex_lb_not_configured']),
+                    ...purge.blockers
+                ]
+            };
+        }
+        const keyOk = await setEnv('CODEX_LB_API_KEY', loaded.secret_api_key);
+        const baseOk = await setEnv('CODEX_LB_BASE_URL', loaded.base_url);
+        await unsetEnv('OPENROUTER_API_KEY');
+        return {
+            schema: 'sks.codex-lb-desktop-center-credentials.v1',
+            ok: keyOk && baseOk,
+            status: keyOk && baseOk ? 'desktop_compat_launch_env_synced' : 'desktop_compat_launch_env_failed',
+            mode,
+            api_key_fingerprint: fingerprint,
+            base_url_present: true,
+            launch_env: {
+                api_key: keyOk ? 'set' : 'failed',
+                base_url: baseOk ? 'set' : 'failed'
+            },
+            stale_twins_removed: purge.removed,
+            stale_keychain_cleared: purge.keychain_cleared,
+            blockers: [
+                ...(keyOk ? [] : ['launchctl_setenv_CODEX_LB_API_KEY_failed']),
+                ...(baseOk ? [] : ['launchctl_setenv_CODEX_LB_BASE_URL_failed']),
+                ...purge.blockers
+            ]
+        };
+    }
+    const keyUnset = await unsetEnv('CODEX_LB_API_KEY');
+    const openRouterUnset = await unsetEnv('OPENROUTER_API_KEY');
+    let baseStatus = 'skipped';
+    if (loaded.base_url && (mode === 'desktop-native-bridge' || mode === 'cli-provider')) {
+        baseStatus = await setEnv('CODEX_LB_BASE_URL', loaded.base_url) ? 'set' : 'failed';
+    }
+    else if (mode === 'disabled') {
+        baseStatus = await unsetEnv('CODEX_LB_BASE_URL') ? 'unset' : 'failed';
+    }
+    const ok = keyUnset && openRouterUnset && baseStatus !== 'failed';
+    return {
+        schema: 'sks.codex-lb-desktop-center-credentials.v1',
+        ok,
+        status: ok ? 'desktop_secret_launch_env_cleared' : 'desktop_launch_env_cleanup_failed',
+        mode,
+        api_key_fingerprint: fingerprint,
+        base_url_present: basePresent,
+        launch_env: {
+            api_key: keyUnset ? 'unset' : 'failed',
+            base_url: baseStatus
+        },
+        stale_twins_removed: purge.removed,
+        stale_keychain_cleared: purge.keychain_cleared,
+        blockers: [
+            ...(keyUnset ? [] : ['launchctl_unsetenv_CODEX_LB_API_KEY_failed']),
+            ...(openRouterUnset ? [] : ['launchctl_unsetenv_OPENROUTER_API_KEY_failed']),
+            ...(baseStatus === 'failed' ? ['launchctl_base_url_sync_failed'] : []),
+            ...purge.blockers
+        ]
+    };
+}