sneakoscope 8.1.2 → 8.2.0

package/dist/core/codex-lb/desktop-controller-v3/provider-commands.js

@@ -0,0 +1,182 @@
+import { testOpenRouterConnection } from '../../providers/openrouter/openrouter-account.js';
+import { openRouterSecretPaths } from '../../providers/openrouter/openrouter-secret-store.js';
+import { codexLbEnvPath, codexLbMetadataPath, readCodexLbModelCatalog } from '../codex-lb-env.js';
+import { configureProviderCredential, recordProviderCredentialValidation, removeProviderCredential } from '../provider-credentials.js';
+import { configureBridgeProviderProfile, resolveBridgeProviderRegistry, setBridgeProviderEnabled } from '../provider-registry.js';
+import { commandResult, activeProviderIds, controllerEnv, controllerPaths, nowIso, persistRuntimeSettings, providerCode, quiesceRunningBridge, resolveRawCredentials, stringArray, timeoutMs } from './shared.js';
+import { desktopBridgeStatusV3, loadCore } from './status.js';
+export async function configureProvider(request, options) {
+    const paths = controllerPaths(options);
+    const restartDeferred = await quiesceRunningBridge(await loadCore(options), options);
+    const configured = await configureProviderCredential({
+        provider_id: request.provider_id,
+        api_key: request.api_key,
+        ...(request.host ? { host: request.host } : {}),
+        home: paths.home,
+        processEnv: controllerEnv(options),
+        codexLbEnvPath: options.envPath || codexLbEnvPath(paths.home),
+        codexLbMetadataPath: options.metadataPath || codexLbMetadataPath(paths.home)
+    });
+    const rawCredentials = await resolveRawCredentials(options, paths);
+    const endpoint = request.provider_id === 'codex-lb'
+        ? rawCredentials['codex-lb'].endpoint_url
+        : 'https://openrouter.ai/api/v1';
+    if (!endpoint)
+        throw new Error(`${providerCode(request.provider_id)}_endpoint_missing`);
+    const registry = await configureBridgeProviderProfile({
+        provider_id: request.provider_id,
+        endpoint_url: endpoint,
+        enabled: true,
+        home: paths.home,
+        credentials: rawCredentials
+    });
+    const core = await loadCore(options);
+    if (core.activeCatalog.ok && core.policy) {
+        await persistRuntimeSettings({ ...core, registry }, options, { restartService: false });
+    }
+    const status = await desktopBridgeStatusV3(options);
+    const blockers = restartDeferred ? ['desktop_bridge_restart_deferred_until_provider_validation'] : [];
+    return commandResult('provider.configure', true, status, {
+        configuration: configured,
+        restart_deferred: restartDeferred,
+        recovery_action: restartDeferred ? `bridge provider validate ${request.provider_id}` : null,
+    }, blockers, options);
+}
+export async function validateProvider(providerId, options) {
+    const paths = controllerPaths(options);
+    const credentials = await resolveRawCredentials(options, paths);
+    const credential = credentials[providerId];
+    if (!credential.secret || !credential.fingerprint || !credential.endpoint_url) {
+        const status = await desktopBridgeStatusV3(options);
+        return commandResult('provider.validate', true, status, { provider_id: providerId, validated: false }, [`${providerCode(providerId)}_credential_missing`], options);
+    }
+    const registry = await resolveBridgeProviderRegistry({ home: paths.home, credentials });
+    const result = providerId === 'codex-lb'
+        ? await validateCodexLbCredential(credential, options, registry.profiles['codex-lb'].endpoint.auth_transport)
+        : await testOpenRouterConnection({
+            apiKey: credential.secret,
+            ...(options.fetchImpl ? { fetchImpl: options.fetchImpl } : {}),
+            timeoutMs: timeoutMs(options)
+        });
+    const ok = result.ok === true;
+    const blockers = stringArray(result.blockers);
+    if (!ok && blockers.length === 0)
+        blockers.push(`${providerCode(providerId)}_validation_failed`);
+    await recordProviderCredentialValidation({
+        provider_id: providerId,
+        credential,
+        state: ok ? 'ready' : validationFailureState(blockers),
+        checked_at: nowIso(options),
+        blockers,
+        warnings: stringArray(result.warnings),
+        home: paths.home,
+        validationPath: paths.validationPath,
+        resolveCurrentCredential: async () => (await resolveRawCredentials(options, paths))[providerId],
+    });
+    if (ok) {
+        const current = await loadCore(options);
+        if (current.activeCatalog.ok && current.policy) {
+            await persistRuntimeSettings(current, options, {
+                restartService: current.service.installed || current.service.running,
+                failClosedRestart: true,
+            });
+        }
+    }
+    const status = await desktopBridgeStatusV3(options);
+    return commandResult('provider.validate', true, status, { provider_id: providerId, validated: ok, validation: publicValidationResult(result) }, ok ? [] : blockers, options);
+}
+export async function setProviderState(providerId, enabled, operation, options) {
+    const paths = controllerPaths(options);
+    const restartService = enabled
+        ? null
+        : await quiesceRunningBridge(await loadCore(options), options);
+    const credentials = await resolveRawCredentials(options, paths);
+    await setBridgeProviderEnabled({
+        provider_id: providerId,
+        enabled,
+        home: paths.home,
+        credentials
+    });
+    const core = await loadCore(options);
+    if (core.activeCatalog.ok && core.policy) {
+        if (enabled)
+            await persistRuntimeSettings(core, options);
+        else {
+            await persistRuntimeSettings(core, options, {
+                restartService: Boolean(restartService) && activeProviderIds(core).length > 0,
+                failClosedRestart: true
+            });
+        }
+    }
+    const status = await desktopBridgeStatusV3(options);
+    return commandResult(operation, true, status, { provider_id: providerId, enabled }, [], options);
+}
+export async function removeCredential(providerId, options) {
+    const paths = controllerPaths(options);
+    const before = await loadCore(options);
+    const restartService = await quiesceRunningBridge(before, options);
+    const removal = await removeProviderCredential({
+        provider_id: providerId,
+        confirmed: true,
+        home: paths.home,
+        codexLbEnvPath: options.envPath || codexLbEnvPath(paths.home),
+        codexLbMetadataPath: options.metadataPath || codexLbMetadataPath(paths.home),
+        openRouterPaths: openRouterSecretPaths(controllerEnv(options))
+    });
+    if (removal.blockers.length > 0) {
+        const status = await desktopBridgeStatusV3(options);
+        return commandResult('provider.remove-credential', false, status, { removal }, removal.blockers, options);
+    }
+    const core = await loadCore(options);
+    if (core.activeCatalog.ok && core.policy) {
+        await persistRuntimeSettings(core, options, {
+            restartService: restartService && activeProviderIds(core).length > 0,
+            failClosedRestart: true
+        });
+    }
+    const status = await desktopBridgeStatusV3(options);
+    return commandResult('provider.remove-credential', removal.blockers.length === 0, status, { removal }, removal.blockers, options);
+}
+async function validateCodexLbCredential(credential, options, authTransport) {
+    if (!credential.secret || !credential.endpoint_url || !credential.fingerprint) {
+        throw new Error('codex_lb_credential_validation_binding_missing');
+    }
+    const loaded = {
+        schema: 'sks.codex-lb-env.v1', configured: true, missing: [], source: 'env-file',
+        source_priority: ['env-file'], base_url: credential.endpoint_url,
+        api_key: { present: true, usable: true, source: 'env-file', redacted: true, fingerprint: credential.fingerprint },
+        secret_api_key: credential.secret,
+        credential_binding: {
+            checked: true, present: true, valid: true, status: 'matched', metadata_path: '[validation-snapshot]',
+            api_key_matches: true, base_url_matches: true, blockers: [],
+        },
+        env_paths: [], keychain: { checked: false, available: false, status: 'not_used' },
+    };
+    const result = await readCodexLbModelCatalog({
+        loadedEnv: loaded,
+        ...(options.fetchImpl ? { fetchImpl: options.fetchImpl } : {}),
+        ...(options.codexLbLookup ? { lookup: options.codexLbLookup } : {}),
+        timeoutMs: timeoutMs(options),
+        gatewayAuthTransport: authTransport === 'x-codex-lb-api-key'
+            ? 'x-codex-lb-api-key' : 'authorization-bearer'
+    });
+    return {
+        schema: 'sks.codex-lb-provider-validation.v1',
+        ok: result.ok,
+        authenticated: result.ok,
+        model_count: result.models.length,
+        http_status: result.http_status,
+        blockers: result.blockers,
+        warnings: []
+    };
+}
+function publicValidationResult(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return {};
+    const row = value;
+    return Object.fromEntries(Object.entries(row).filter(([key]) => !/(?:api.?key|secret|token|authorization|cookie|headers?|env)/i.test(key)));
+}
+function validationFailureState(blockers) {
+    return blockers.some((blocker) => /(?:401|403|auth|rejected|invalid_key|unauthorized)/i.test(blocker))
+        ? 'rejected' : 'unavailable';
+}

package/dist/core/codex-lb/desktop-controller-v3/shared.js

@@ -0,0 +1,279 @@
+import { createHash, randomUUID } from 'node:crypto';
+import os from 'node:os';
+import path from 'node:path';
+import { codexAuthPath, codexLbConfigPath } from '../../../cli/install-helpers-codex-lb-shared.js';
+import { bridgeRouteIndexPath, combinedBridgeCatalogPath, readActiveCombinedBridgeCatalog } from '../combined-catalog.js';
+import { codexLbEnvPath, codexLbMetadataPath } from '../codex-lb-env.js';
+import { bootstrapExistingDesktopBridgeService, desktopBridgeServicePaths, readDesktopBridgeClientCapability, resolveDesktopBridgeActivationSettings, stopDesktopBridgeService, writeDesktopBridgeServiceSettings } from '../desktop-service.js';
+import { desktopBridgeClientPath } from '../desktop-bridge/index.js';
+import { desktopBridgeUnificationReceiptDir } from '../migration-receipt.js';
+import { providerCredentialValidationPath, resolveAllProviderCredentials, resolveAllProviderCredentialsWithValidation } from '../provider-credentials.js';
+import { bridgeRoutePolicyPath } from '../provider-route-policy.js';
+import { sha256Stable } from '../route-index.js';
+export function controllerPaths(options) {
+    const env = controllerEnv(options);
+    const home = path.resolve(options.home || env.HOME || os.homedir());
+    const codexHome = path.join(home, '.codex');
+    return {
+        home,
+        codexHome,
+        configPath: path.resolve(options.configPath || codexLbConfigPath(home)),
+        authPath: path.resolve(options.authPath || codexAuthPath(home)),
+        receiptDir: path.resolve(options.receiptDir || desktopBridgeUnificationReceiptDir(home)),
+        catalogPath: path.resolve(options.catalogPath || combinedBridgeCatalogPath(codexHome)),
+        routeIndexPath: path.resolve(options.routeIndexPath || bridgeRouteIndexPath(codexHome)),
+        routePolicyPath: path.resolve(options.routePolicyPath || bridgeRoutePolicyPath(codexHome)),
+        validationPath: path.resolve(options.validationPath || providerCredentialValidationPath(home)),
+        diagnosticPath: path.resolve(options.diagnosticPath || path.join(codexHome, 'sks', 'sks-desktop-bridge-last-diagnostic.json'))
+    };
+}
+export async function resolveRawCredentials(options, paths) {
+    const env = controllerEnv(options);
+    return resolveAllProviderCredentials({
+        codexLb: {
+            home: paths.home,
+            processEnv: env,
+            codexLbEnvPath: options.envPath || codexLbEnvPath(paths.home),
+            codexLbMetadataPath: options.metadataPath || codexLbMetadataPath(paths.home)
+        },
+        openrouter: { home: paths.home, processEnv: env }
+    });
+}
+export async function resolveValidatedCredentials(options, paths) {
+    const env = controllerEnv(options);
+    return resolveAllProviderCredentialsWithValidation({
+        home: paths.home,
+        validationPath: paths.validationPath,
+        codexLb: {
+            home: paths.home,
+            processEnv: env,
+            codexLbEnvPath: options.envPath || codexLbEnvPath(paths.home),
+            codexLbMetadataPath: options.metadataPath || codexLbMetadataPath(paths.home)
+        },
+        openrouter: { home: paths.home, processEnv: env }
+    });
+}
+export function activeProviderIds(core) {
+    if (!core.policy)
+        return [];
+    return ['codex-lb', 'openrouter'].filter((providerId) => core.registry.profiles[providerId].enabled
+        && core.registry.profiles[providerId].state === 'ready'
+        && Object.values(core.policy.model_routes).some((route) => route.provider_id === providerId));
+}
+export function providerRegistrySnapshot(registry, routeIndex) {
+    const provider = (providerId) => {
+        const profile = registry.profiles[providerId];
+        const baseUrl = profile.endpoint.url
+            || (providerId === 'openrouter' ? 'https://openrouter.ai/api/v1' : 'https://invalid.codex-lb.local');
+        return {
+            provider_id: providerId,
+            enabled: profile.enabled,
+            base_url: baseUrl,
+            allowed_origins: [...profile.endpoint.allowed_origins],
+            auth_transport: profile.endpoint.auth_transport,
+            credential_state: profile.credential.state,
+            credential_fingerprint: profile.credential.fingerprint,
+            credential_generation: profile.profile_generation,
+            source_catalog_generation: routeIndex.providers[providerId].catalog_generation
+        };
+    };
+    const providers = {
+        'codex-lb': provider('codex-lb'),
+        openrouter: provider('openrouter')
+    };
+    return {
+        schema: 'sks.desktop-bridge-provider-registry.v1',
+        generation: sha256Stable(providers),
+        created_at: new Date().toISOString(),
+        providers
+    };
+}
+export async function persistRuntimeSettings(core, options, behavior = {}) {
+    if (!core.activeCatalog.ok || !core.policy)
+        return;
+    const snapshot = providerRegistrySnapshot(core.registry, core.activeCatalog.route_index);
+    const settings = await resolveDesktopBridgeActivationSettings({
+        ...options,
+        home: core.paths.home,
+        providerRegistry: snapshot,
+        routePolicy: core.policy
+    });
+    await writeDesktopBridgeServiceSettings(options.settingsPath || desktopBridgeServicePaths(core.paths.home).settings_path, settings);
+    const restartService = behavior.restartService ?? (core.service.installed || core.service.running);
+    if (!restartService)
+        return;
+    const restartOptions = {
+        ...options,
+        home: core.paths.home,
+        providerRegistry: snapshot,
+        routePolicy: core.policy
+    };
+    let restarted;
+    try {
+        restarted = await (options.bootstrapServiceImpl || bootstrapExistingDesktopBridgeService)(restartOptions);
+    }
+    catch (error) {
+        await stopAfterFailedRestart(restartOptions, options);
+        throw error;
+    }
+    if (!restarted.ok || !restarted.running) {
+        await stopAfterFailedRestart(restartOptions, options);
+        throw new Error(restarted.blockers[0] || 'desktop_bridge_restart_failed');
+    }
+}
+export async function quiesceRunningBridge(core, options) {
+    if (!core.service.running)
+        return false;
+    const stopped = await (options.stopServiceImpl || stopDesktopBridgeService)({
+        ...options,
+        home: core.paths.home
+    });
+    if (stopped.running) {
+        throw new Error(stopped.blockers[0] || 'desktop_bridge_process_still_running');
+    }
+    return true;
+}
+async function stopAfterFailedRestart(restartOptions, options) {
+    const stopped = await (options.stopServiceImpl || stopDesktopBridgeService)(restartOptions);
+    if (stopped.running)
+        throw new Error(stopped.blockers[0] || 'desktop_bridge_process_still_running');
+}
+export function serializedSettings(settings) {
+    return `${JSON.stringify({
+        schema: settings.schema,
+        listen_host: settings.listen_host,
+        listen_port: settings.listen_port,
+        provider_registry: settings.provider_registry,
+        route_policy: settings.route_policy,
+        provider_session_pins: settings.provider_session_pins,
+        client_capability_sha256: settings.client_capability_sha256,
+        allowed_origins: settings.allowed_origins,
+        connect_timeout_ms: settings.connect_timeout_ms,
+        idle_timeout_ms: settings.idle_timeout_ms
+    }, null, 2)}\n`;
+}
+export async function bridgeBaseUrl(settings, options) {
+    const host = settings.listen_host === '::1' ? '[::1]' : settings.listen_host;
+    return bridgeClientUrl(`http://${host}:${settings.listen_port}`, '/backend-api/codex', options, settings.client_capability_sha256);
+}
+export async function bridgeClientUrl(loopbackOrigin, canonicalPath, options, expectedCapabilitySha256) {
+    const origin = validatedBridgeClientOrigin(loopbackOrigin);
+    const home = path.resolve(options.home || controllerEnv(options).HOME || os.homedir());
+    const capabilityPath = path.resolve(options.clientCapabilityPath || desktopBridgeServicePaths(home).client_capability_path);
+    const capability = await readDesktopBridgeClientCapability(capabilityPath);
+    if (expectedCapabilitySha256
+        && createHash('sha256').update(capability).digest('hex') !== expectedCapabilitySha256) {
+        throw new Error('desktop_bridge_client_capability_mismatch');
+    }
+    return `${origin}${desktopBridgeClientPath(capability, canonicalPath)}`;
+}
+function validatedBridgeClientOrigin(value) {
+    let parsed;
+    try {
+        parsed = new URL(String(value || ''));
+    }
+    catch {
+        throw new Error('desktop_bridge_loopback_origin_invalid');
+    }
+    const hostname = parsed.hostname.replace(/^\[|\]$/g, '').toLowerCase();
+    const port = Number(parsed.port);
+    if (!['http:', 'ws:'].includes(parsed.protocol)
+        || !['127.0.0.1', '::1', 'localhost'].includes(hostname)
+        || !Number.isInteger(port)
+        || port < 49_152
+        || port > 65_535
+        || parsed.username
+        || parsed.password
+        || (parsed.pathname !== '/' && parsed.pathname !== '')
+        || parsed.search
+        || parsed.hash) {
+        throw new Error('desktop_bridge_loopback_origin_invalid');
+    }
+    return parsed.origin;
+}
+export function serviceLoopbackOrigin(service) {
+    if (service.state?.listen_origin)
+        return service.state.listen_origin;
+    const settings = service.settings;
+    if (!settings)
+        return null;
+    const host = settings.listen_host === '::1' ? '[::1]' : settings.listen_host;
+    return `http://${host}:${settings.listen_port}`;
+}
+export function commandResult(operation, executionOk, status, result, blockers, options) {
+    const checkedAt = nowIso(options);
+    const readiness = status?.readiness || { ready: false, blockers: [...blockers], warnings: [] };
+    return {
+        schema: 'sks.desktop-bridge-command-result.v1',
+        operation,
+        operation_id: makeId('operation', options),
+        correlation_id: status?.correlation_id || makeId('correlation', options),
+        checked_at: checkedAt,
+        ok: executionOk,
+        execution: {
+            ok: executionOk,
+            status: executionOk ? (blockers.length > 0 ? 'partial' : 'completed') : 'failed',
+            blockers: unique(blockers)
+        },
+        readiness: {
+            ready: readiness.ready,
+            blockers: [...readiness.blockers],
+            warnings: [...readiness.warnings]
+        },
+        status,
+        result,
+        recovery_action: blockers.length > 0 ? recoveryActions(blockers)[0] || 'review_bridge_status' : null
+    };
+}
+export function emptyScope(scope, checkedAt) {
+    return {
+        schema: 'sks.scope-capability-summary.v1',
+        scope,
+        state: 'not_attempted',
+        checked_at: checkedAt,
+        capabilities: {},
+        blockers: [],
+        warnings: []
+    };
+}
+export function recoveryActions(blockers) {
+    return unique(blockers.map((blocker) => {
+        if (blocker.includes('credential') && blocker.includes('codex'))
+            return 'configure_codex_lb_credential';
+        if (blocker.includes('credential') && blocker.includes('openrouter'))
+            return 'configure_openrouter_credential';
+        if (blocker.includes('catalog') || blocker.includes('route'))
+            return 'retry_catalog_sync';
+        if (blocker.includes('oauth'))
+            return 'review_desktop_authentication';
+        if (blocker.includes('bridge'))
+            return 'repair_bridge_service';
+        return 'review_bridge_status';
+    }));
+}
+export function controllerEnv(options) {
+    const home = options.home || options.env?.HOME || process.env.HOME || os.homedir();
+    return { ...process.env, ...(options.env || {}), HOME: home };
+}
+export function timeoutMs(options) {
+    return Math.max(500, Math.min(30_000, Number(options.timeoutMs || 10_000)));
+}
+export function nowIso(options) {
+    return (options.now ? options.now() : new Date()).toISOString();
+}
+export function makeId(prefix, options) {
+    return `${prefix}-${options.id ? options.id() : randomUUID()}`;
+}
+export function providerCode(providerId) {
+    return providerId === 'codex-lb' ? 'codex_lb' : 'openrouter';
+}
+export function safeCode(error, fallback) {
+    const message = error instanceof Error ? error.message : String(error || '');
+    return /^[a-z0-9_:/.-]{1,240}$/i.test(message) ? message : fallback;
+}
+export function stringArray(value) {
+    return Array.isArray(value) ? value.map(String).filter(Boolean) : [];
+}
+export function unique(values) {
+    return [...new Set(values.map((value) => String(value || '').trim()).filter(Boolean))];
+}