tide-commander 1.153.0 → 1.155.0

package/dist/src/packages/server/services/provider-credentials-service.js

@@ -0,0 +1,338 @@
+/**
+ * Provider Credentials Service (Grok + Codex)
+ *
+ * Same account-switcher model as claude-credentials-service, generalized for
+ * providers that keep a SINGLE active auth file plus named copies:
+ *   - Grok:  ~/.grok/auth.json   + ~/.grok/auth.<name>.json
+ *   - Codex: ~/.codex/auth.json  + ~/.codex/auth.<name>.json
+ *
+ * Operators keep accounts as named profiles and promote one to active when the
+ * current account hits limits. Tokens are never returned to clients — only
+ * non-secret metadata (email, plan label, expiry) + a stable fingerprint.
+ */
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import * as crypto from 'crypto';
+import { createLogger } from '../utils/logger.js';
+const log = createLogger('ProviderCredentials');
+// --- JWT helper (metadata only; never logs or returns the token) -----------
+function decodeJwtPayload(jwt) {
+    const parts = jwt.split('.');
+    if (parts.length < 2)
+        return null;
+    try {
+        const pad = parts[1] + '='.repeat((4 - (parts[1].length % 4)) % 4);
+        const json = Buffer.from(pad.replace(/-/g, '+').replace(/_/g, '/'), 'base64').toString('utf-8');
+        return JSON.parse(json);
+    }
+    catch {
+        return null;
+    }
+}
+function fingerprintToken(token) {
+    return crypto.createHash('sha256').update(token).digest('hex').slice(0, 12);
+}
+// --- Provider-specific parsers ---------------------------------------------
+/** Grok ~/.grok/auth.json: dict keyed by "issuer::client_id" → { key, email, expires_at, ... }. */
+function parseGrokCredentials(raw) {
+    try {
+        const data = JSON.parse(raw);
+        for (const entry of Object.values(data)) {
+            if (!entry || typeof entry !== 'object')
+                continue;
+            const token = typeof entry.key === 'string' ? entry.key : '';
+            if (!token)
+                continue;
+            const expiresRaw = entry.expires_at ?? entry.expiresAt;
+            let expiresAt = null;
+            if (typeof expiresRaw === 'number')
+                expiresAt = expiresRaw;
+            else if (typeof expiresRaw === 'string') {
+                const ms = Date.parse(expiresRaw);
+                expiresAt = Number.isFinite(ms) ? ms : null;
+            }
+            const email = typeof entry.email === 'string' ? entry.email : null;
+            const label = typeof entry.principal_type === 'string' ? entry.principal_type : null;
+            return { fingerprint: fingerprintToken(token), label, email, expiresAt, valid: true };
+        }
+        return { fingerprint: null, label: null, email: null, expiresAt: null, valid: false };
+    }
+    catch {
+        return { fingerprint: null, label: null, email: null, expiresAt: null, valid: false };
+    }
+}
+/** Codex ~/.codex/auth.json: { tokens: { access_token, id_token, ... } }; plan/email live in the id_token JWT. */
+function parseCodexCredentials(raw) {
+    try {
+        const data = JSON.parse(raw);
+        const tokens = data.tokens;
+        const accessToken = typeof tokens?.access_token === 'string' ? tokens.access_token : '';
+        const idToken = typeof tokens?.id_token === 'string' ? tokens.id_token : '';
+        // API-key-only auth (no ChatGPT login) is also valid.
+        const apiKey = typeof data.OPENAI_API_KEY === 'string' ? data.OPENAI_API_KEY : '';
+        const fpToken = accessToken || apiKey;
+        if (!fpToken)
+            return { fingerprint: null, label: null, email: null, expiresAt: null, valid: false };
+        let email = null;
+        let label = apiKey && !accessToken ? 'API key' : null;
+        let expiresAt = null;
+        const claims = idToken ? decodeJwtPayload(idToken) : null;
+        if (claims) {
+            if (typeof claims.email === 'string')
+                email = claims.email;
+            const auth = claims['https://api.openai.com/auth'];
+            if (auth && typeof auth.chatgpt_plan_type === 'string')
+                label = auth.chatgpt_plan_type;
+        }
+        // Access-token expiry (its own JWT exp) — the value the CLI refreshes on.
+        const accessClaims = accessToken ? decodeJwtPayload(accessToken) : null;
+        if (accessClaims && typeof accessClaims.exp === 'number')
+            expiresAt = accessClaims.exp * 1000;
+        return { fingerprint: fingerprintToken(fpToken), label, email, expiresAt, valid: true };
+    }
+    catch {
+        return { fingerprint: null, label: null, email: null, expiresAt: null, valid: false };
+    }
+}
+// --- Provider registry (dir overridable for tests) -------------------------
+let dirOverrides = {};
+export function setProviderCredentialsDirForTests(overrides) {
+    dirOverrides = overrides;
+}
+function providerConfig(provider) {
+    if (provider === 'grok') {
+        return {
+            provider,
+            dir: dirOverrides.grok ?? path.join(os.homedir(), '.grok'),
+            activeFile: 'auth.json',
+            namedPrefix: 'auth.',
+            namedSuffix: '.json',
+            parse: parseGrokCredentials,
+        };
+    }
+    return {
+        provider,
+        dir: dirOverrides.codex ?? path.join(os.homedir(), '.codex'),
+        activeFile: 'auth.json',
+        namedPrefix: 'auth.',
+        namedSuffix: '.json',
+        parse: parseCodexCredentials,
+    };
+}
+const NAME_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$/;
+export function isValidProviderProfileName(name) {
+    if (typeof name !== 'string' || !NAME_RE.test(name))
+        return false;
+    if (name === 'json' || name.includes('/') || name.includes('\\') || name.includes('..'))
+        return false;
+    return true;
+}
+function assertValidName(name) {
+    if (!isValidProviderProfileName(name)) {
+        throw new Error(`Invalid profile name "${name}". Use 1–64 chars: letters, digits, dot, underscore, hyphen; must start with alphanumeric.`);
+    }
+}
+function activePath(cfg) {
+    return path.join(cfg.dir, cfg.activeFile);
+}
+function namedPath(cfg, name) {
+    return path.join(cfg.dir, `${cfg.namedPrefix}${name}${cfg.namedSuffix}`);
+}
+function parseFile(cfg, filePath) {
+    if (!fs.existsSync(filePath))
+        return null;
+    try {
+        const raw = fs.readFileSync(filePath, 'utf-8');
+        const meta = cfg.parse(raw);
+        return { raw, ...meta };
+    }
+    catch (err) {
+        log.warn(`Failed to parse ${cfg.provider} credentials at ${filePath}: ${err}`);
+        return { raw: '', fingerprint: null, label: null, email: null, expiresAt: null, valid: false };
+    }
+}
+function fileMtime(filePath) {
+    try {
+        return fs.statSync(filePath).mtimeMs;
+    }
+    catch {
+        return null;
+    }
+}
+function toMeta(cfg, id, name, filePath, parsed, isActive, matchesNamed) {
+    return {
+        id,
+        name,
+        isActive,
+        path: filePath,
+        valid: parsed?.valid ?? false,
+        fingerprint: parsed?.fingerprint ?? null,
+        label: parsed?.label ?? null,
+        email: parsed?.email ?? null,
+        expiresAt: parsed?.expiresAt ?? null,
+        mtimeMs: fileMtime(filePath),
+        matchesNamed,
+    };
+}
+function listNamedProfileNames(cfg) {
+    if (!fs.existsSync(cfg.dir))
+        return [];
+    const names = [];
+    for (const entry of fs.readdirSync(cfg.dir)) {
+        if (entry === cfg.activeFile)
+            continue;
+        if (!entry.startsWith(cfg.namedPrefix) || !entry.endsWith(cfg.namedSuffix))
+            continue;
+        const name = entry.slice(cfg.namedPrefix.length, entry.length - cfg.namedSuffix.length);
+        if (!name || !isValidProviderProfileName(name))
+            continue;
+        names.push(name);
+    }
+    names.sort((a, b) => a.localeCompare(b));
+    return names;
+}
+/** List the active auth file plus every named profile. Never returns tokens. */
+export function listProviderCredentialProfiles(provider) {
+    const cfg = providerConfig(provider);
+    const activeFile = activePath(cfg);
+    const activeParsed = parseFile(cfg, activeFile);
+    const namedNames = listNamedProfileNames(cfg);
+    const namedByFp = new Map();
+    for (const name of namedNames) {
+        const parsed = parseFile(cfg, namedPath(cfg, name));
+        if (parsed?.fingerprint)
+            namedByFp.set(parsed.fingerprint, name);
+    }
+    const activeMatchesNamed = activeParsed?.fingerprint ? (namedByFp.get(activeParsed.fingerprint) ?? null) : null;
+    const active = fs.existsSync(activeFile)
+        ? toMeta(cfg, 'active', 'active', activeFile, activeParsed, true, activeMatchesNamed)
+        : null;
+    const profiles = namedNames.map((name) => {
+        const p = namedPath(cfg, name);
+        const parsed = parseFile(cfg, p);
+        const isActive = Boolean(activeParsed?.fingerprint) && parsed?.fingerprint === activeParsed?.fingerprint;
+        return toMeta(cfg, name, name, p, parsed, isActive, null);
+    });
+    return { provider, dir: cfg.dir, active, profiles };
+}
+function ensureDir(cfg) {
+    if (!fs.existsSync(cfg.dir))
+        fs.mkdirSync(cfg.dir, { recursive: true, mode: 0o700 });
+}
+/** Atomic write with restrictive permissions (credentials are secrets). */
+function writeAtomic(cfg, filePath, content) {
+    ensureDir(cfg);
+    const tmp = path.join(cfg.dir, `.auth.tmp.${process.pid}.${Date.now()}`);
+    fs.writeFileSync(tmp, content, { encoding: 'utf-8', mode: 0o600 });
+    fs.renameSync(tmp, filePath);
+    try {
+        fs.chmodSync(filePath, 0o600);
+    }
+    catch {
+        // best-effort
+    }
+}
+/**
+ * Switch the active account to a named profile. Optionally stash the current
+ * active account under a name first (so an unsaved live login isn't lost).
+ */
+export function switchProviderCredentialProfile(provider, name, opts = {}) {
+    assertValidName(name);
+    const cfg = providerConfig(provider);
+    const activeFile = activePath(cfg);
+    const targetFile = namedPath(cfg, name);
+    if (!fs.existsSync(targetFile))
+        throw new Error(`Named profile "${name}" not found`);
+    const targetParsed = parseFile(cfg, targetFile);
+    if (!targetParsed?.valid || !targetParsed.raw)
+        throw new Error(`Profile "${name}" has no valid credentials`);
+    const listing = listProviderCredentialProfiles(provider);
+    const previousMatchesNamed = listing.active?.matchesNamed ?? null;
+    let stashedAs = null;
+    if (listing.active?.valid) {
+        const stash = opts.stashActiveAs?.trim();
+        if (!previousMatchesNamed && stash) {
+            assertValidName(stash);
+            if (stash === name)
+                throw new Error('stashActiveAs cannot be the same as the profile you are switching to');
+            const stashFile = namedPath(cfg, stash);
+            if (fs.existsSync(stashFile)) {
+                const existing = parseFile(cfg, stashFile);
+                if (existing?.fingerprint && existing.fingerprint !== listing.active.fingerprint) {
+                    throw new Error(`Profile "${stash}" already exists with different credentials. Choose another name.`);
+                }
+            }
+            const activeRaw = parseFile(cfg, activeFile)?.raw;
+            if (!activeRaw)
+                throw new Error('Failed to read active credentials for stash');
+            writeAtomic(cfg, stashFile, activeRaw);
+            stashedAs = stash;
+            log.log(`Stashed previous active ${provider} credentials as profile "${stash}"`);
+        }
+        else if (previousMatchesNamed) {
+            // Keep the matched named copy in sync with the (possibly refreshed) active file.
+            const matchedRaw = parseFile(cfg, activeFile)?.raw;
+            if (matchedRaw)
+                writeAtomic(cfg, namedPath(cfg, previousMatchesNamed), matchedRaw);
+        }
+    }
+    writeAtomic(cfg, activeFile, targetParsed.raw);
+    log.log(`Switched active ${provider} credentials to profile "${name}"`);
+    const after = listProviderCredentialProfiles(provider);
+    if (!after.active)
+        throw new Error('Active credentials missing after switch');
+    return { ok: true, active: after.active, profiles: after.profiles, stashedAs, previousMatchesNamed };
+}
+/** Save (copy) the current active credentials as a named profile. */
+export function saveActiveProviderCredentialProfile(provider, name, opts = {}) {
+    assertValidName(name);
+    const cfg = providerConfig(provider);
+    const activeParsed = parseFile(cfg, activePath(cfg));
+    if (!activeParsed?.valid || !activeParsed.raw)
+        throw new Error(`No valid active ${provider} credentials to save`);
+    const dest = namedPath(cfg, name);
+    if (fs.existsSync(dest) && !opts.force) {
+        const existing = parseFile(cfg, dest);
+        if (existing?.fingerprint && existing.fingerprint !== activeParsed.fingerprint) {
+            throw new Error(`Profile "${name}" already exists with different credentials. Pass force=true to overwrite.`);
+        }
+    }
+    writeAtomic(cfg, dest, activeParsed.raw);
+    log.log(`Saved active ${provider} credentials as profile "${name}"`);
+    return listProviderCredentialProfiles(provider);
+}
+/** Rename a named profile file. */
+export function renameProviderCredentialProfile(provider, from, to) {
+    assertValidName(from);
+    assertValidName(to);
+    if (from === to)
+        return listProviderCredentialProfiles(provider);
+    const cfg = providerConfig(provider);
+    const src = namedPath(cfg, from);
+    const dest = namedPath(cfg, to);
+    if (!fs.existsSync(src))
+        throw new Error(`Named profile "${from}" not found`);
+    if (fs.existsSync(dest))
+        throw new Error(`Profile "${to}" already exists`);
+    fs.renameSync(src, dest);
+    try {
+        fs.chmodSync(dest, 0o600);
+    }
+    catch {
+        // ignore
+    }
+    log.log(`Renamed ${provider} credentials profile "${from}" → "${to}"`);
+    return listProviderCredentialProfiles(provider);
+}
+/** Delete a named profile. */
+export function deleteProviderCredentialProfile(provider, name) {
+    assertValidName(name);
+    const cfg = providerConfig(provider);
+    const file = namedPath(cfg, name);
+    if (!fs.existsSync(file))
+        throw new Error(`Named profile "${name}" not found`);
+    fs.unlinkSync(file);
+    log.log(`Deleted ${provider} credentials profile "${name}"`);
+    return listProviderCredentialProfiles(provider);
+}

package/dist/src/packages/server/services/system-prompt-service.js

@@ -293,3 +293,97 @@ export function setInteractiveModeEnabled(enabled) {
         throw error;
     }
 }
+// ============================================================================
+// Codex App-Server Mode Setting
+// ============================================================================
+//
+// Experimental: when enabled, Codex agents run through a persistent
+// `codex app-server` JSON-RPC process instead of one `codex exec` process per
+// turn. The app-server protocol streams word-by-word agent-message deltas
+// (item/agentMessage/delta), which `codex exec --experimental-json` never
+// emits, so this is the only way Codex replies can typewriter in the UI.
+// Like interactive mode, the setting is read live at each launch — no server
+// restart needed to switch.
+const CODEX_APP_SERVER_MODE_FILE = path.join(DATA_DIR, 'codex-app-server-mode.json');
+/**
+ * Check if experimental Codex app-server (streaming) mode is enabled.
+ */
+export function isCodexAppServerModeEnabled() {
+    ensureDataDir();
+    try {
+        if (fs.existsSync(CODEX_APP_SERVER_MODE_FILE)) {
+            const data = JSON.parse(fs.readFileSync(CODEX_APP_SERVER_MODE_FILE, 'utf-8'));
+            return data.enabled;
+        }
+    }
+    catch (error) {
+        log.error(` Failed to load codex app-server mode setting: ${error.message}`);
+    }
+    // Default ON: streaming (app-server) is the default for Codex agents. An
+    // explicit toggle-off is still respected (the file above wins).
+    return true;
+}
+/**
+ * Enable/disable experimental Codex app-server (streaming) mode.
+ */
+export function setCodexAppServerModeEnabled(enabled) {
+    ensureDataDir();
+    const data = {
+        enabled,
+        updatedAt: Date.now(),
+    };
+    try {
+        fs.writeFileSync(CODEX_APP_SERVER_MODE_FILE, JSON.stringify(data, null, 2), 'utf-8');
+        log.log(` Codex app-server mode setting updated: enabled=${enabled}`);
+    }
+    catch (error) {
+        log.error(` Failed to save codex app-server mode setting: ${error.message}`);
+        throw error;
+    }
+}
+// ============================================================================
+// OpenCode Server Mode Setting
+// ============================================================================
+//
+// Experimental: when enabled, OpenCode agents run through a persistent, detached
+// `opencode serve` HTTP server instead of one `opencode run` process per turn.
+// The server streams word-by-word `message.part.delta` tokens over SSE (which
+// `opencode run --format json` never emits) and survives commander restarts.
+// Read live at each launch — no server restart needed to switch.
+const OPENCODE_SERVER_MODE_FILE = path.join(DATA_DIR, 'opencode-server-mode.json');
+/**
+ * Check if experimental OpenCode server (streaming) mode is enabled.
+ */
+export function isOpencodeServerModeEnabled() {
+    ensureDataDir();
+    try {
+        if (fs.existsSync(OPENCODE_SERVER_MODE_FILE)) {
+            const data = JSON.parse(fs.readFileSync(OPENCODE_SERVER_MODE_FILE, 'utf-8'));
+            return data.enabled;
+        }
+    }
+    catch (error) {
+        log.error(` Failed to load opencode server mode setting: ${error.message}`);
+    }
+    // Default ON: streaming (opencode serve) is the default for OpenCode agents.
+    // An explicit toggle-off is still respected (the file above wins).
+    return true;
+}
+/**
+ * Enable/disable experimental OpenCode server (streaming) mode.
+ */
+export function setOpencodeServerModeEnabled(enabled) {
+    ensureDataDir();
+    const data = {
+        enabled,
+        updatedAt: Date.now(),
+    };
+    try {
+        fs.writeFileSync(OPENCODE_SERVER_MODE_FILE, JSON.stringify(data, null, 2), 'utf-8');
+        log.log(` OpenCode server mode setting updated: enabled=${enabled}`);
+    }
+    catch (error) {
+        log.error(` Failed to save opencode server mode setting: ${error.message}`);
+        throw error;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tide-commander",
-  "version": "1.153.0",
+  "version": "1.155.0",
   "description": "Visual multi-agent orchestrator and manager for Claude Code with 3D/2D interface",
   "repository": {
     "type": "git",