From 6a65b4e821e3ad9ddb80d37c10c88b856e9a692f Mon Sep 17 00:00:00 2001 From: jack Date: Sun, 9 Aug 2026 20:28:28 +0800 Subject: [PATCH 1/5] feat: add unified provider account authentication --- CHANGELOG.md | 3 + internal-doc/provider-unified-auth-poc.md | 79 ++ internal-doc/provider-unified-auth-ui.md | 135 +++ internal-doc/provider-unified-auth.md | 161 +++ internal/agent/compaction.go | 1 + internal/agent/history.go | 2 + internal/command/interactive.go | 6 +- internal/config/config.go | 15 + internal/config/provider_auth_test.go | 43 + internal/model/chatmodel.go | 172 ++- internal/model/chatmodel_managed_auth_test.go | 286 +++++ .../model/managed_provider_registry_test.go | 49 + internal/model/provider_request.go | 112 ++ internal/model/provider_request_test.go | 75 ++ internal/model/registry.go | 57 +- internal/model/responsemeta/opaque.go | 117 ++ internal/model/responses.go | 405 +++++++ internal/model/responses_convert.go | 239 ++++ internal/model/responses_parse.go | 587 +++++++++ internal/model/responses_test.go | 411 +++++++ internal/providerauth/codex.go | 241 ++++ internal/providerauth/copilot.go | 293 +++++ internal/providerauth/credential.go | 112 ++ internal/providerauth/filelock_unix.go | 46 + internal/providerauth/filelock_windows.go | 52 + internal/providerauth/http.go | 154 +++ internal/providerauth/jwt.go | 42 + internal/providerauth/manager.go | 707 +++++++++++ internal/providerauth/manager_test.go | 1047 +++++++++++++++++ internal/providerauth/store.go | 310 +++++ internal/providerauth/types.go | 143 +++ internal/providerauth/xai.go | 259 ++++ internal/runner/responses_continuity_test.go | 214 ++++ internal/runner/runner.go | 97 +- internal/session/history.go | 35 +- internal/session/responses_continuity_test.go | 147 +++ internal/session/session.go | 33 +- internal/team/manager.go | 4 + internal/tools/subagent.go | 1 + internal/web/provider_auth.go | 318 +++++ internal/web/provider_auth_test.go | 247 ++++ internal/web/providers.go | 112 +- internal/web/server.go | 37 +- internal/web/setup.go | 81 +- site/docs/configuration.md | 20 +- site/docs/get-started.md | 19 +- site/docs/overview/models.md | 63 +- site/docs/web-interface.md | 9 +- web/src/components/SettingsView.test.tsx | 131 ++- web/src/components/SettingsView.tsx | 271 +++-- web/src/components/SetupView.test.tsx | 105 ++ web/src/components/SetupView.tsx | 155 ++- .../settings/ProviderAuthSection.test.tsx | 463 ++++++++ .../settings/ProviderAuthSection.tsx | 936 +++++++++++++++ web/src/i18n/locales/en.ts | 60 + web/src/i18n/locales/ja.ts | 60 + web/src/i18n/locales/ko.ts | 60 + web/src/i18n/locales/zh-Hans.ts | 60 + web/src/i18n/locales/zh-Hant.ts | 60 + web/src/i18n/providerAuth.test.ts | 22 + web/src/lib/api.ts | 34 +- web/src/lib/providerIcons.ts | 4 + web/src/lib/types.ts | 52 + 63 files changed, 10073 insertions(+), 198 deletions(-) create mode 100644 internal-doc/provider-unified-auth-poc.md create mode 100644 internal-doc/provider-unified-auth-ui.md create mode 100644 internal-doc/provider-unified-auth.md create mode 100644 internal/config/provider_auth_test.go create mode 100644 internal/model/chatmodel_managed_auth_test.go create mode 100644 internal/model/managed_provider_registry_test.go create mode 100644 internal/model/provider_request.go create mode 100644 internal/model/provider_request_test.go create mode 100644 internal/model/responsemeta/opaque.go create mode 100644 internal/model/responses.go create mode 100644 internal/model/responses_convert.go create mode 100644 internal/model/responses_parse.go create mode 100644 internal/model/responses_test.go create mode 100644 internal/providerauth/codex.go create mode 100644 internal/providerauth/copilot.go create mode 100644 internal/providerauth/credential.go create mode 100644 internal/providerauth/filelock_unix.go create mode 100644 internal/providerauth/filelock_windows.go create mode 100644 internal/providerauth/http.go create mode 100644 internal/providerauth/jwt.go create mode 100644 internal/providerauth/manager.go create mode 100644 internal/providerauth/manager_test.go create mode 100644 internal/providerauth/store.go create mode 100644 internal/providerauth/types.go create mode 100644 internal/providerauth/xai.go create mode 100644 internal/runner/responses_continuity_test.go create mode 100644 internal/session/responses_continuity_test.go create mode 100644 internal/web/provider_auth.go create mode 100644 internal/web/provider_auth_test.go create mode 100644 web/src/components/SetupView.test.tsx create mode 100644 web/src/components/settings/ProviderAuthSection.test.tsx create mode 100644 web/src/components/settings/ProviderAuthSection.tsx create mode 100644 web/src/i18n/providerAuth.test.ts diff --git a/CHANGELOG.md b/CHANGELOG.md index fa40c104..515f295e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] ### Added +- **Unified Provider account sign-in.** Settings and first-run setup can now authenticate OpenAI through ChatGPT/Codex, xAI through Grok, and GitHub Copilot through one device-code account flow, while preserving API-key providers. Providers bind to a default or explicit local account and expose connected, reauthentication, and multi-account management states. +- GitHub Copilot requests keep one stable session interaction while classifying tool continuations and delegated agents as agent-initiated, avoiding accidental extra premium interactions. - **Provider-backed image generation.** Configure a global Image Model independently from the chat model, then use `generate_image` from normal-mode TUI, Web, Desktop, or ACP sessions. The first release supports OpenAI-compatible Images endpoints, BigModel CogView, and Alibaba Token Plan Wan 2.7 models. - **Generated images as managed Artifacts.** Results are verified, stored outside the workspace under the session, persisted for replay, and shown as lifecycle-aware image cards in Web/Desktop. TUI reports the local path and metadata; ACP degrades to metadata, resource links, or bounded inline images according to negotiated capabilities. - **Provider capability routing.** Settings now distinguishes chat, image generation, vision input, and provider-bound tools using the exact provider profile, endpoint, protocol, and model. It includes an Image Model picker, provider capability status, a BigModel Search MCP preset, and provider Web Search policy. @@ -22,6 +24,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Session replay now restores provider operations, managed Artifacts, tool lifecycle, session modes, and per-session tool overrides without trusting dropped WebSocket events. ### Security +- Managed Provider credentials are resolved immediately before dispatch, never returned by the Web API, and kept out of `config.json`. OAuth-backed providers pin their upstream endpoint, wire protocol, and protected headers; refreshes are singleflight, account writes are locked and atomic, device flows are bounded/cancellable, and invalid or reauthentication-required bindings fail closed. - Externally billable calls bind approval to an immutable provider/model/argument intent and idempotency key. Ask for approval and Auto require a fresh per-call decision; Full access is the only session-level preauthorization. Per-turn and per-session limits are reserved atomically and dispatch is durably journaled before the provider call. - Image downloads require HTTPS and enforce trusted-host, redirect, timeout, MIME, size, dimension, and pixel limits. Private and link-local destinations are rejected; generated files use owner-only directories/files and atomic persistence. - Security-sensitive session journals fail closed on malformed or invalid transitions, and logs/session metadata exclude credentials, complete prompts, signed URLs, provider response bodies, and image base64. diff --git a/internal-doc/provider-unified-auth-poc.md b/internal-doc/provider-unified-auth-poc.md new file mode 100644 index 00000000..f7a05c3c --- /dev/null +++ b/internal-doc/provider-unified-auth-poc.md @@ -0,0 +1,79 @@ +# Unified provider authentication POC + +Status: accepted for implementation +Date: 2026-08-09 + +## Goal + +Prove that JCode can bind a Provider to a managed account instead of copying a +short-lived access token into `config.json`. The POC covers the three managed +login methods already implemented by cc-switch: + +| JCode login | Device authorization | Runtime API | +| --- | --- | --- | +| ChatGPT / Codex | `auth.openai.com/api/accounts/deviceauth/*`, then OAuth code exchange | OpenAI Responses at `chatgpt.com/backend-api/codex/responses` | +| Grok / xAI | OIDC discovery plus OAuth 2.0 Device Authorization Grant | OpenAI Responses at `api.x.ai/v1/responses` | +| GitHub Copilot | GitHub device flow, then GitHub-to-Copilot token exchange | OpenAI-compatible `api.githubcopilot.com/chat/completions` | + +API-key authentication remains supported and is the default for existing +configuration. Managed login is opt-in and backward compatible. + +## Evidence copied from cc-switch + +The implementation contract is derived from the local checkout at +`/Users/jack/workpath/opensource/cc-switch`, not from a generic OAuth +assumption: + +- Provider configuration stores only an account binding; token lookup happens + immediately before each upstream request. +- Access tokens are memory-only. Refresh tokens (or the long-lived GitHub + token for Copilot) are durable, owner-only secrets. +- Account lists and the default account are shared across Providers. A Provider + may bind a specific account or follow the current default. +- Refresh is serialized per account and checked again after taking the lock. +- An invalid refresh marks the account as requiring reauthentication. It never + falls back to an API key or another Provider silently. +- Managed authentication pins the upstream origin, wire protocol and protected + headers. User-supplied headers cannot replace them. + +## POC boundaries + +The POC is executable through unit and HTTP-handler tests. It does not require +a developer account or send a live billable model request. + +The test transport substitutes local servers for each fixed remote endpoint +and proves: + +1. start returns a public verification URL, user code, bounded expiry and a + random opaque flow ID; the upstream device token is never returned; +2. poll maps pending, slow-down, denied, expired and success responses into one + public state machine; +3. successful login persists the durable credential before publishing an + in-memory access token; +4. concurrent inference requests perform at most one refresh per account; +5. refresh-token rotation uses compare-and-swap semantics and invalid refresh + persists `requires_reauth`; +6. a Provider binding contains only `method` and optional `account_id`; +7. model requests resolve a fresh credential and inject protected headers at + dispatch time; +8. ChatGPT/xAI requests select Responses while Copilot selects Chat + Completions; +9. public flow responses, Provider bindings, durable-state fixtures and runtime + credential serialization expose no access token, refresh token, GitHub + token, authorization code or device token; +10. the durable store is `0700`/`0600`, written through fsync plus atomic + rename, and mutations are guarded across processes. +11. redirects cannot forward a managed model body, bearer token, or protected + header to a second origin; +12. cancel and logout are linearized with authorization commit, including + flows owned by a second manager process, and flow capacity is reserved + before any authorization-server request; +13. Copilot user, tool-continuation, and subagent requests receive the correct + initiator/interaction headers while one session keeps a stable opaque + interaction ID. + +## Accepted result + +The POC is accepted when the focused auth, model transport and provider API +tests pass without network access. Live login remains an explicit manual smoke +test because it opens a browser and changes an external account. diff --git a/internal-doc/provider-unified-auth-ui.md b/internal-doc/provider-unified-auth-ui.md new file mode 100644 index 00000000..6247887a --- /dev/null +++ b/internal-doc/provider-unified-auth-ui.md @@ -0,0 +1,135 @@ +# Unified provider authentication UI design + +Status: implemented +Date: 2026-08-09 + +## Design read + +This is an incremental JCode Settings enhancement for developers. It should +feel restrained, trustworthy and tool-like. It reuses the existing Provider +cards, form hierarchy, tokens, controls and Heroicons; it does not introduce an +Auth Center, another Settings tab, a new modal language or a component library. + +Design dials: variance 4, motion 2, density 6. + +## Information architecture + +```text +Settings +└─ Providers + ├─ Model roles + ├─ Provider cards + │ └─ Authentication summary and recovery action + └─ Add / Edit provider + ├─ Provider + ├─ Authentication + │ ├─ API key + │ └─ Account login + │ ├─ Device code panel + │ ├─ Account binding + │ └─ Account management disclosure + ├─ Model connection + └─ Advanced +``` + +Authentication choices are declared by the backend: + +- OpenAI: **API key** or **Sign in with ChatGPT**; +- xAI / Grok: **API key** or **Sign in with Grok**; +- GitHub Copilot: **Sign in with GitHub**; +- custom OpenAI-compatible Provider: **API key** only. + +The UI must not infer these choices from Provider IDs. + +## Form design + +When there are two choices, the Authentication section uses the existing +segmented control. A single choice renders as a compact section label and its +control without a redundant selector. + +API-key mode preserves the current password field and advanced endpoint/header +controls. Account mode removes API-key, editable endpoint/header, and custom +image-endpoint controls from the task, because the backend pins the chat route +and image endpoints currently require a separate Provider API key. + +Signed-out account mode shows one primary login action and short explanatory +copy. Starting a login replaces that row inline with: + +- provider name and “Waiting for authorization” status; +- a large monospace user code with Copy action; +- Open browser and Cancel actions; +- a subdued expiry time; +- an `aria-live` pending/error message. + +No dialog is stacked on the Provider form. + +## Connected accounts + +After login, the primary row contains a `UserCircleIcon`, account login and +method label. The binding select offers: + +- “Use default account — alice@example.com”; +- each usable explicit account; +- expired accounts disabled and labelled “Sign in again.” + +“Manage N accounts” expands in place. Rows expose Default, Bound and Needs +sign-in chips as applicable, followed by Set default, Sign in again or Remove. +Provider removal and account removal are separate actions. Remote avatars are +not loaded. + +## Provider-card summaries + +- API key: “API key configured” — never “Connected” without a validation + result; +- managed and healthy: “Connected · alice@example.com · ChatGPT OAuth”; +- follows default: include “Default account” in the accessible label; +- missing account: warning token plus “Choose account”; +- invalid refresh: destructive token plus “Sign in again.” + +Changing or removing a global account immediately refreshes all affected card +summaries. + +## State machine + +```mermaid +stateDiagram-v2 + [*] --> Loading + Loading --> SignedOut + Loading --> Connected + SignedOut --> Starting + Starting --> Pending + Pending --> Connected: authorized + Pending --> SignedOut: cancel + Pending --> Error: denied / expired / network + Error --> Starting: retry + Connected --> Pending: sign in again + Connected --> Connected: bind or set default + Connected --> SignedOut: logout all + Connected --> NeedsAuth: bound account removed + NeedsAuth --> Pending: sign in +``` + +The polling timer is cleared on cancel, form close, tab change and unmount. +Successful authorization refreshes auth status, Provider list, target catalog +and the model picker. + +## Responsive and accessibility behavior + +- Authentication options wrap to a two-column grid and one column at narrow + widths. +- Text labels remain visible; meaning never depends on color or an icon. +- Buttons retain visible focus rings and at least the existing JCode target + height. +- Copy and browser-open actions have accessible names. +- Pending uses `role=status`; failures use `role=alert`. +- Motion is limited to the existing spinner and disclosure transition, and + respects reduced-motion behavior inherited from the app. + +## Visual tokens + +Reuse `INPUT`, `BTN_PRIMARY`, `BTN_SECONDARY`, `BTN_DANGER`, `ROW`, `LABEL`, +`CHIP` and `Segmented` from the Settings atoms. Use only existing CSS custom +properties and Heroicons (`KeyIcon`, `UserCircleIcon`, `ArrowPathIcon`, +`ClipboardDocumentIcon`, `ArrowTopRightOnSquareIcon`, +`ExclamationTriangleIcon`). Provider branding continues through +`ProviderIcon`; no hand-written SVG or hard-coded status color is added. diff --git a/internal-doc/provider-unified-auth.md b/internal-doc/provider-unified-auth.md new file mode 100644 index 00000000..6d4d631c --- /dev/null +++ b/internal-doc/provider-unified-auth.md @@ -0,0 +1,161 @@ +# Unified provider authentication architecture + +Status: implemented +Date: 2026-08-09 + +## Decision + +JCode will use one managed-account service for lifecycle and storage, with one +driver per authentication method. Provider configuration contains a +non-secret binding. Model transports obtain a credential at request dispatch, +not when a model is cached. + +```mermaid +flowchart LR + UI["Settings / Setup"] --> API["Provider auth HTTP API"] + API --> M["providerauth.Manager"] + M --> D1["ChatGPT driver"] + M --> D2["xAI driver"] + M --> D3["Copilot driver"] + M --> S["Owner-only secret store"] + PC["ProviderConfig.Auth binding"] --> R["Model runtime resolver"] + R --> M + R --> RESP["Responses transport"] + R --> CHAT["Chat Completions transport"] +``` + +## Configuration contract + +```json +{ + "providers": { + "openai": { + "auth": { + "method": "codex_oauth", + "account_id": "optional-stable-account-id" + } + } + } +} +``` + +`account_id` omitted means “follow the default usable account for this login +method.” This is convenient but intentionally visible in the UI. Selecting an +explicit account avoids a Provider changing identity when the default changes. + +The binding never contains tokens. Existing Providers without `auth` continue +to use `api_key` and preserve their current behavior. + +The current custom image endpoint reuses its Provider API key. A Provider using +managed account authentication therefore cannot also own an `image_endpoint`; +switching it to managed authentication clears that endpoint and any selected +image-model role. Configure image generation under a separate API-key Provider. + +## Package boundaries + +### `internal/providerauth` + +- public method/account/device-flow/status types; +- a process-wide manager with an injectable HTTP client and store for tests; +- device-flow state held only in memory and addressed by a random flow ID; +- durable account mutation and per-account refresh serialization; +- driver-specific endpoint, token and protected-header policy; +- no dependency on Web, TUI, ACP or model packages. + +### `internal/model` + +- resolves `ProviderConfig.Auth` through `providerauth`; +- keeps the existing Chat Completions implementation for API keys and + Copilot; +- provides a Responses implementation for ChatGPT/Codex and xAI; +- caches clients/adapters, never bearer tokens; +- requests a credential for every dispatch so long-running sessions survive + token expiry. + +### `internal/web` + +- exposes only public flow/account/status objects; +- validates that a selected login method is compatible with the Provider; +- allows an OAuth Provider to be created without `api_key` only after a usable + account binding exists; +- never accepts an access or refresh token from the browser. + +Web and Desktop share this API and React Settings implementation. TUI and ACP +automatically benefit because all transports construct models through the same +model resolver. + +## Driver policy + +| Method | Durable secret | Access token | Base URL | Wire protocol | Protected headers | +| --- | --- | --- | --- | --- | --- | +| `codex_oauth` | refresh token | memory, refresh before expiry | `https://chatgpt.com/backend-api/codex` | Responses | `Authorization`, `chatgpt-account-id`, `originator`, `version` | +| `xai_oauth` | refresh token | memory, refresh before expiry | `https://api.x.ai/v1` | Responses | `Authorization` | +| `github_copilot` | GitHub OAuth token | Copilot token in memory | account-resolved Copilot API origin | Chat Completions | `Authorization` and Copilot client fingerprint headers | + +ChatGPT/Codex requests force `store:false`, encrypted reasoning continuation, +the required tool fields and streaming behavior. xAI requests omit +ChatGPT-private fields. Copilot starts with the broadly supported Chat +Completions path; a future model-catalog capability may opt individual models +into Copilot Responses without changing the account contract. + +Copilot request metadata is classified at the model boundary. A top-level user +request uses `x-initiator:user`; tool continuations and delegated agents use +`x-initiator:agent`, and delegated agents also use +`x-interaction-type:conversation-subagent`. A one-way hash of the JCode session +ID produces a stable `x-interaction-id` for the whole interaction, while each +dispatch receives fresh request/task UUIDs. The raw session ID is never sent. + +## Storage and concurrency + +- Directory mode: `0700`; secret file and lock: `0600`. +- Write: reload under an OS advisory lock, mutate, write a same-directory temp + file, chmod, fsync, rename, fsync directory. +- Access tokens and pending device codes are never serialized. +- A process-local mutex complements the OS lock. +- Refresh uses a per-method/account lock and double-checks the memory cache. +- Rotated refresh tokens replace the old token only if the durable value still + matches the token used for refresh. Otherwise the newer durable value wins. +- Removing an account invalidates matching in-memory credentials immediately. +- Login commits compare a durable per-method generation captured at Start; + Logout advances it atomically so an in-flight flow in this or another process + cannot restore the deleted account. +- Pending-flow capacity is reserved before contacting an authorization server, + and a flow ID is always checked together with its authentication method. + +## Security invariants + +1. Managed upstream scheme and host are fixed by the driver. They are not read + from Provider `base_url` or custom headers. +2. OAuth and managed model requests do not follow redirects; authorization + responses are size-bound. +3. Verification links and xAI discovery must use the expected HTTPS host; + xAI discovery must also return the expected issuer and authorization host. +4. GitHub.com Copilot is supported initially. Enterprise domains require a + separate host-validation policy before enablement. +5. Protected headers are applied after user headers; managed Providers do not + accept replacements for them. +6. Errors expose bounded OAuth codes/descriptions, not raw bodies or tokens. +7. A missing, removed or expired binding fails closed before an upstream model + request. +8. Provider Cloud sync may carry the non-secret binding, but the secret store + is local-only. + +## Failure behavior + +- `authorization_pending` and `slow_down` remain pending; slow-down increases + the server-side poll deadline. +- deny, expiry and cancel destroy the in-memory flow. +- invalid refresh persists `requires_reauth` and clears the access-token cache. +- transient network failure preserves the account and returns a retryable + error. +- deleting an account does not delete a Provider. A Provider bound to that + account becomes `needs_auth` and cannot run until rebound. + +## Rollout + +1. Land the generic manager/store and fake-server POC tests. +2. Land runtime credential injection and Responses transport tests. +3. Add Provider and setup HTTP contracts. +4. Add the shared Web/Desktop UI and five locales. +5. Run focused, full lint/build/test, then independent security, architecture + and UI reviews. diff --git a/internal/agent/compaction.go b/internal/agent/compaction.go index 4d825dd9..fadf18af 100644 --- a/internal/agent/compaction.go +++ b/internal/agent/compaction.go @@ -98,6 +98,7 @@ func (s *ThresholdCompactionStrategy) Compact(ctx context.Context, messages []*s {Role: schema.User, Content: sb.String()}, } + ctx = internalmodel.WithProviderAgentInitiated(ctx) summaryMsg, err := s.summarizer.Generate(ctx, summaryInput) if err != nil { config.Logger().Printf("[compaction] summarisation failed: %v", err) diff --git a/internal/agent/history.go b/internal/agent/history.go index b8241256..13ea59ba 100644 --- a/internal/agent/history.go +++ b/internal/agent/history.go @@ -10,6 +10,7 @@ import ( "github.com/cloudwego/eino/schema" "github.com/cnjack/jcode/internal/config" + internalmodel "github.com/cnjack/jcode/internal/model" "github.com/cnjack/jcode/internal/session" "github.com/cnjack/jcode/internal/tools" ) @@ -43,6 +44,7 @@ func CompactHistory(ctx context.Context, cm einomodel.BaseChatModel, history []a fmt.Fprintf(&sb, "[%s]: %s\n", msg.Role, TruncateStr(msg.Content, 500)) } + ctx = internalmodel.WithProviderAgentInitiated(ctx) resp, err := cm.Generate(ctx, []*schema.Message{ schema.SystemMessage("You are a conversation summarizer. Produce a concise summary of the conversation history provided. Output only the summary, no preamble."), schema.UserMessage(sb.String()), diff --git a/internal/command/interactive.go b/internal/command/interactive.go index f7c40e93..e35a1303 100644 --- a/internal/command/interactive.go +++ b/internal/command/interactive.go @@ -1104,7 +1104,11 @@ func (s *interactiveState) handleCompact() { _, _, oldTokens = s.agentTokenUsage.Get() } oldLen := len(s.history) - s.history = agent.CompactHistory(s.ctx, s.chatModel, s.history) + compactCtx := s.ctx + if s.rec != nil && s.rec.UUID() != "" { + compactCtx = internalmodel.WithProviderSessionID(compactCtx, s.rec.UUID()) + } + s.history = agent.CompactHistory(compactCtx, s.chatModel, s.history) var newTokens int64 if s.agentTokenUsage != nil { _, _, newTokens = s.agentTokenUsage.Get() diff --git a/internal/config/config.go b/internal/config/config.go index 7a5e0ea1..7875ac35 100644 --- a/internal/config/config.go +++ b/internal/config/config.go @@ -20,6 +20,12 @@ const ( type ProviderConfig struct { APIKey string `json:"api_key"` BaseURL string `json:"base_url,omitempty"` + // Auth binds this provider to a locally managed login account. The binding + // is deliberately non-secret and may be synced with the rest of the provider + // configuration; access/refresh credentials live in the provider-auth secret + // store and are resolved immediately before each request. nil preserves the + // legacy API-key behavior. + Auth *ProviderAuthBinding `json:"auth,omitempty"` // Protocol identifies the provider's chat/request protocol when it differs // from the registry default (for example "responses"). Capability-specific // protocols belong on their endpoint block instead. @@ -57,6 +63,15 @@ type ProviderConfig struct { ImageEndpoint *ImageEndpointConfig `json:"image_endpoint,omitempty"` } +// ProviderAuthBinding identifies one managed login method and, optionally, a +// concrete account. An empty AccountID follows that method's default usable +// account. Method is validated by the provider-management boundary and the +// runtime resolver; unknown values fail closed. +type ProviderAuthBinding struct { + Method string `json:"method"` + AccountID string `json:"account_id,omitempty"` +} + // HasConfiguredChatModels reports whether this provider has an explicit chat // model list in either the current or legacy config shape. func (p *ProviderConfig) HasConfiguredChatModels() bool { diff --git a/internal/config/provider_auth_test.go b/internal/config/provider_auth_test.go new file mode 100644 index 00000000..f2cb652d --- /dev/null +++ b/internal/config/provider_auth_test.go @@ -0,0 +1,43 @@ +package config + +import ( + "encoding/json" + "strings" + "testing" +) + +func TestProviderAuthBindingRoundTripContainsNoCredential(t *testing.T) { + original := ProviderConfig{ + Auth: &ProviderAuthBinding{ + Method: "codex_oauth", + AccountID: "acct_123", + }, + } + + data, err := json.Marshal(original) + if err != nil { + t.Fatalf("marshal provider config: %v", err) + } + serialized := string(data) + if strings.Contains(serialized, "token") || strings.Contains(serialized, "secret") { + t.Fatalf("provider auth binding serialized credential-shaped data: %s", serialized) + } + + var restored ProviderConfig + if err := json.Unmarshal(data, &restored); err != nil { + t.Fatalf("unmarshal provider config: %v", err) + } + if restored.Auth == nil || restored.Auth.Method != "codex_oauth" || restored.Auth.AccountID != "acct_123" { + t.Fatalf("restored auth binding = %#v", restored.Auth) + } +} + +func TestLegacyProviderConfigHasNoManagedAuth(t *testing.T) { + var provider ProviderConfig + if err := json.Unmarshal([]byte(`{"api_key":"legacy-key"}`), &provider); err != nil { + t.Fatalf("unmarshal legacy provider: %v", err) + } + if provider.Auth != nil || provider.APIKey != "legacy-key" { + t.Fatalf("legacy provider changed: %#v", provider) + } +} diff --git a/internal/model/chatmodel.go b/internal/model/chatmodel.go index 8ace5b6a..acc51f96 100644 --- a/internal/model/chatmodel.go +++ b/internal/model/chatmodel.go @@ -17,6 +17,7 @@ import ( einomodel "github.com/cloudwego/eino/components/model" "github.com/cloudwego/eino/schema" "github.com/cnjack/jcode/internal/config" + "github.com/cnjack/jcode/internal/providerauth" ) // TokenUsage tracks token consumption across all API calls. @@ -315,6 +316,13 @@ type ChatModelConfig struct { // Vision controls whether image parts are forwarded to the model. When // false, multimodal image content is stripped to text before sending. Vision bool + // Credential resolves a fresh bearer token and protected provider headers + // immediately before every HTTP request. It is used only by managed account + // bindings; API-key providers keep the historical fixed credential path. + Credential ResponsesCredentialFunc + // Copilot enables request classification headers for managed GitHub + // Copilot accounts. It is set only by newManagedChatModel. + Copilot bool } type chatModel struct { @@ -324,6 +332,7 @@ type chatModel struct { reasoningEffort string thinking *bool vision bool + copilot bool } // headerDoer wraps an http.Client to inject a fixed set of headers into every @@ -331,27 +340,57 @@ type chatModel struct { // configured Headers reach the API. Set unconditionally so callers may override // transport headers (including Authorization) for custom gateways. type headerDoer struct { - base *http.Client - headers map[string]string + base *http.Client + headers map[string]string + credential ResponsesCredentialFunc } func (h *headerDoer) Do(req *http.Request) (*http.Response, error) { for k, v := range h.headers { req.Header.Set(k, v) } + if h.credential != nil { + token, protected, err := h.credential(req.Context()) + if err != nil { + return nil, fmt.Errorf("resolve managed provider credential: %w", err) + } + for key, value := range protected { + req.Header.Set(key, value) + } + if strings.TrimSpace(token) == "" { + return nil, fmt.Errorf("resolve managed provider credential: empty token") + } + // Authorization is applied last so neither go-openai nor configured + // headers can replace a managed account token. + req.Header.Set("Authorization", "Bearer "+token) + } return h.base.Do(req) } func NewChatModel(_ context.Context, cfg *ChatModelConfig) (einomodel.ToolCallingChatModel, error) { - if cfg.APIKey == "" { + if cfg.APIKey == "" && cfg.Credential == nil { return nil, fmt.Errorf("APIKey is required") } - config := openai.DefaultConfig(cfg.APIKey) + apiKey := cfg.APIKey + if apiKey == "" { + // go-openai requires a constructor key and writes it before dispatch; + // headerDoer replaces this sentinel with the fresh managed token. + apiKey = "managed-provider-auth" + } + config := openai.DefaultConfig(apiKey) if cfg.BaseURL != "" { config.BaseURL = cfg.BaseURL } - if len(cfg.Headers) > 0 { - config.HTTPClient = &headerDoer{base: &http.Client{}, headers: cfg.Headers} + if len(cfg.Headers) > 0 || cfg.Credential != nil { + baseClient := &http.Client{} + if cfg.Credential != nil { + baseClient = managedNoRedirectClient(baseClient) + } + config.HTTPClient = &headerDoer{ + base: baseClient, + headers: cloneStringMap(cfg.Headers), + credential: cfg.Credential, + } } return &chatModel{ client: openai.NewClientWithConfig(config), @@ -359,9 +398,21 @@ func NewChatModel(_ context.Context, cfg *ChatModelConfig) (einomodel.ToolCallin reasoningEffort: cfg.ReasoningEffort, thinking: cfg.Thinking, vision: cfg.Vision, + copilot: cfg.Copilot, }, nil } +func managedNoRedirectClient(source *http.Client) *http.Client { + if source == nil { + source = &http.Client{} + } + clone := *source + clone.CheckRedirect = func(*http.Request, []*http.Request) error { + return http.ErrUseLastResponse + } + return &clone +} + // NewChatModelFromProvider builds a ChatModel from a provider config, applying // its advanced settings (custom headers, thinking depth, explicit thinking // toggle, and the vision capability). baseURL is the already-resolved endpoint @@ -383,6 +434,13 @@ func NewChatModelFromProvider(ctx context.Context, provider, modelName, baseURL config.Logger().Printf("[chatmodel] %s/%s has no image input modality; image parts will be stripped", provider, modelName) } } + if pc.Auth != nil { + manager, err := providerauth.Default(config.ConfigDir()) + if err != nil { + return nil, fmt.Errorf("initialize managed provider auth: %w", err) + } + return newManagedChatModel(ctx, provider, modelName, pc, vision, manager) + } return NewChatModel(ctx, &ChatModelConfig{ Model: modelName, APIKey: pc.APIKey, @@ -394,6 +452,101 @@ func NewChatModelFromProvider(ctx context.Context, provider, modelName, baseURL }) } +type providerCredentialResolver interface { + Credential(context.Context, providerauth.Binding) (providerauth.Credential, error) +} + +func newManagedChatModel( + ctx context.Context, + provider string, + modelName string, + pc *config.ProviderConfig, + vision bool, + auth providerCredentialResolver, +) (einomodel.ToolCallingChatModel, error) { + binding := providerauth.Binding{ + Method: providerauth.Method(pc.Auth.Method), + AccountID: pc.Auth.AccountID, + } + if err := validateManagedProviderMethod(provider, binding.Method); err != nil { + return nil, err + } + initial, err := auth.Credential(ctx, binding) + if err != nil { + return nil, fmt.Errorf("resolve managed provider account: %w", err) + } + credential := managedCredential(auth, binding, initial) + + switch initial.Protocol { + case providerauth.ProtocolResponses: + return NewResponsesModel(ctx, &ResponsesModelConfig{ + Model: modelName, + BaseURL: initial.BaseURL, + ReasoningEffort: pc.ReasoningEffort, + Vision: vision, + Credential: credential, + Codex: binding.Method == providerauth.MethodCodexOAuth, + }) + case providerauth.ProtocolChatCompletions: + return NewChatModel(ctx, &ChatModelConfig{ + Model: modelName, + BaseURL: initial.BaseURL, + ReasoningEffort: pc.ReasoningEffort, + Thinking: pc.Thinking, + Vision: vision, + Credential: credential, + Copilot: binding.Method == providerauth.MethodGitHubCopilot, + }) + default: + return nil, fmt.Errorf( + "managed provider %s/%s returned unsupported protocol %q", + provider, modelName, initial.Protocol, + ) + } +} + +func validateManagedProviderMethod(provider string, method providerauth.Method) error { + expectedProvider := "" + switch method { + case providerauth.MethodCodexOAuth: + expectedProvider = "openai" + case providerauth.MethodXAIOAuth: + expectedProvider = "xai" + case providerauth.MethodGitHubCopilot: + expectedProvider = "github-copilot" + default: + return fmt.Errorf("managed provider authentication method %q is unsupported", method) + } + if provider != expectedProvider { + return fmt.Errorf( + "managed provider authentication method %q cannot be used by provider %q", + method, provider, + ) + } + return nil +} + +func managedCredential( + auth providerCredentialResolver, + binding providerauth.Binding, + initial providerauth.Credential, +) ResponsesCredentialFunc { + return func(requestContext context.Context) (string, map[string]string, error) { + latest, resolveErr := auth.Credential(requestContext, binding) + if resolveErr != nil { + return "", nil, resolveErr + } + if latest.Protocol != initial.Protocol || latest.BaseURL != initial.BaseURL { + return "", nil, fmt.Errorf("managed provider runtime profile changed") + } + headers := latest.Headers + if binding.Method == providerauth.MethodGitHubCopilot { + headers = copilotRequestHeaders(requestContext, headers) + } + return latest.Token, headers, nil + } +} + func (m *chatModel) WithTools(tools []*schema.ToolInfo) (einomodel.ToolCallingChatModel, error) { config.Logger().Printf("[chatmodel] WithTools called with %d tools", len(tools)) oaiTools := make([]openai.Tool, 0, len(tools)) @@ -425,6 +578,7 @@ func (m *chatModel) WithTools(tools []*schema.ToolInfo) (einomodel.ToolCallingCh reasoningEffort: m.reasoningEffort, thinking: m.thinking, vision: m.vision, + copilot: m.copilot, }, nil } @@ -477,6 +631,9 @@ func (m *chatModel) recordUsage(ctx context.Context, u openai.Usage) { } func (m *chatModel) Generate(ctx context.Context, input []*schema.Message, opts ...einomodel.Option) (*schema.Message, error) { + if m.copilot { + ctx = withCopilotModelRequest(ctx, input) + } req := m.buildRequest(input, false, opts...) config.Logger().Printf("[chatmodel] Generate start (model: %s)", m.model) start := time.Now() @@ -497,6 +654,9 @@ func (m *chatModel) Generate(ctx context.Context, input []*schema.Message, opts } func (m *chatModel) Stream(ctx context.Context, input []*schema.Message, opts ...einomodel.Option) (*schema.StreamReader[*schema.Message], error) { + if m.copilot { + ctx = withCopilotModelRequest(ctx, input) + } req := m.buildRequest(input, true, opts...) // Enable stream options to get usage information req.StreamOptions = &openai.StreamOptions{ diff --git a/internal/model/chatmodel_managed_auth_test.go b/internal/model/chatmodel_managed_auth_test.go new file mode 100644 index 00000000..279ac0e8 --- /dev/null +++ b/internal/model/chatmodel_managed_auth_test.go @@ -0,0 +1,286 @@ +package model + +import ( + "context" + "encoding/json" + "fmt" + "io" + "net/http" + "net/http/httptest" + "strings" + "sync" + "sync/atomic" + "testing" + + "github.com/cloudwego/eino/schema" + "github.com/cnjack/jcode/internal/config" + "github.com/cnjack/jcode/internal/providerauth" +) + +type fakeCredentialResolver struct { + mu sync.Mutex + credentials []providerauth.Credential + calls int +} + +func (resolver *fakeCredentialResolver) Credential( + _ context.Context, + _ providerauth.Binding, +) (providerauth.Credential, error) { + resolver.mu.Lock() + defer resolver.mu.Unlock() + if len(resolver.credentials) == 0 { + return providerauth.Credential{}, fmt.Errorf("no fake credential") + } + index := resolver.calls + if index >= len(resolver.credentials) { + index = len(resolver.credentials) - 1 + } + resolver.calls++ + return resolver.credentials[index], nil +} + +type roundTripFunc func(*http.Request) (*http.Response, error) + +func (fn roundTripFunc) RoundTrip(request *http.Request) (*http.Response, error) { + return fn(request) +} + +func TestManagedHeaderDoerResolvesCredentialPerRequest(t *testing.T) { + var gotAuthorization string + var gotManagedHeader string + var gotConfiguredHeader string + client := &http.Client{Transport: roundTripFunc(func(request *http.Request) (*http.Response, error) { + gotAuthorization = request.Header.Get("Authorization") + gotManagedHeader = request.Header.Get("x-managed-account") + gotConfiguredHeader = request.Header.Get("x-configured-secret") + return &http.Response{ + StatusCode: http.StatusOK, + Header: make(http.Header), + Body: io.NopCloser(strings.NewReader("{}")), + Request: request, + }, nil + })} + doer := &headerDoer{ + base: client, + headers: map[string]string{"x-configured-secret": "configured"}, + credential: func(context.Context) (string, map[string]string, error) { + return "fresh-request-token", map[string]string{ + "x-managed-account": "account-1", + "x-configured-secret": "protected", + }, nil + }, + } + request, err := http.NewRequestWithContext( + context.Background(), http.MethodPost, "https://example.test/v1/chat/completions", nil, + ) + if err != nil { + t.Fatalf("create request: %v", err) + } + request.Header.Set("Authorization", "Bearer sentinel") + response, err := doer.Do(request) + if err != nil { + t.Fatalf("dispatch: %v", err) + } + _ = response.Body.Close() + if gotAuthorization != "Bearer fresh-request-token" { + t.Fatalf("Authorization = %q", gotAuthorization) + } + if gotManagedHeader != "account-1" { + t.Fatalf("managed header = %q", gotManagedHeader) + } + if gotConfiguredHeader != "protected" { + t.Fatalf("protected header = %q", gotConfiguredHeader) + } +} + +func TestManagedChatCompletionsIgnoreConfiguredSecrets(t *testing.T) { + resolver := &fakeCredentialResolver{credentials: []providerauth.Credential{{ + Token: "token", BaseURL: "https://api.githubcopilot.com", Protocol: providerauth.ProtocolChatCompletions, + }}} + providerConfig := &config.ProviderConfig{ + Auth: &config.ProviderAuthBinding{Method: string(providerauth.MethodGitHubCopilot)}, + Headers: map[string]string{"x-configured-secret": "must-not-leak"}, + } + created, err := newManagedChatModel( + context.Background(), "github-copilot", "gpt-4.1", providerConfig, true, resolver, + ) + if err != nil { + t.Fatalf("create managed chat model: %v", err) + } + managed, ok := created.(*chatModel) + if !ok { + t.Fatalf("model type = %T, want *chatModel", created) + } + if managed.client == nil { + t.Fatal("managed chat model client is nil") + } + if resolver.calls != 1 { + t.Fatalf("credential calls = %d, want one construction lookup", resolver.calls) + } +} + +func TestManagedResponsesSelectsPinnedTransport(t *testing.T) { + resolver := &fakeCredentialResolver{credentials: []providerauth.Credential{{ + Token: "token", BaseURL: "https://api.x.ai/v1", Protocol: providerauth.ProtocolResponses, + }}} + providerConfig := &config.ProviderConfig{ + Auth: &config.ProviderAuthBinding{Method: string(providerauth.MethodXAIOAuth)}, + ReasoningEffort: "high", + } + created, err := newManagedChatModel( + context.Background(), "xai", "grok-4.5", providerConfig, true, resolver, + ) + if err != nil { + t.Fatalf("create managed responses model: %v", err) + } + responses, ok := created.(*responsesModel) + if !ok { + t.Fatalf("model type = %T, want *responsesModel", created) + } + if responses.endpoint != "https://api.x.ai/v1/responses" { + t.Fatalf("endpoint = %q", responses.endpoint) + } + if responses.codex { + t.Fatal("xAI responses model must not enable Codex request restrictions") + } +} + +func TestManagedRuntimeProfileChangeFailsClosed(t *testing.T) { + initial := providerauth.Credential{ + Token: "one", BaseURL: "https://api.githubcopilot.com", Protocol: providerauth.ProtocolChatCompletions, + } + resolver := &fakeCredentialResolver{credentials: []providerauth.Credential{{ + Token: "two", BaseURL: "https://changed.example.test", Protocol: providerauth.ProtocolChatCompletions, + }}} + credential := managedCredential( + resolver, + providerauth.Binding{Method: providerauth.MethodGitHubCopilot}, + initial, + ) + if _, _, err := credential(context.Background()); err == nil { + t.Fatal("expected runtime profile drift to fail closed") + } +} + +func TestManagedProviderMethodMismatchFailsBeforeCredentialLookup(t *testing.T) { + resolver := &fakeCredentialResolver{credentials: []providerauth.Credential{{ + Token: "must-not-be-used", BaseURL: "https://api.x.ai/v1", Protocol: providerauth.ProtocolResponses, + }}} + providerConfig := &config.ProviderConfig{ + Auth: &config.ProviderAuthBinding{Method: string(providerauth.MethodXAIOAuth)}, + } + if _, err := newManagedChatModel( + context.Background(), "openai", "gpt-5", providerConfig, true, resolver, + ); err == nil { + t.Fatal("expected mismatched provider and auth method to fail") + } + if resolver.calls != 0 { + t.Fatalf("credential calls = %d, want zero", resolver.calls) + } +} + +func TestManagedChatCompletionsDoNotFollowRedirects(t *testing.T) { + var targetReached atomic.Bool + target := httptest.NewServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) { + targetReached.Store(true) + })) + defer target.Close() + source := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) { + http.Redirect(writer, request, target.URL+"/stolen", http.StatusTemporaryRedirect) + })) + defer source.Close() + + created, err := NewChatModel(context.Background(), &ChatModelConfig{ + Model: "gpt-4.1", + BaseURL: source.URL, + Credential: func(context.Context) (string, map[string]string, error) { + return "managed-secret", map[string]string{"x-managed-account": "account-1"}, nil + }, + }) + if err != nil { + t.Fatalf("create managed chat model: %v", err) + } + if _, err := created.Generate(context.Background(), nil); err == nil { + t.Fatal("expected redirect response to fail") + } + if targetReached.Load() { + t.Fatal("managed request followed redirect to a second origin") + } +} + +func TestManagedCopilotClassifiesRequestsAndKeepsInteractionStable(t *testing.T) { + type observedHeaders struct { + initiator string + interactionType string + interactionID string + } + var observed []observedHeaders + server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) { + observed = append(observed, observedHeaders{ + initiator: request.Header.Get("x-initiator"), + interactionType: request.Header.Get("x-interaction-type"), + interactionID: request.Header.Get("x-interaction-id"), + }) + writer.Header().Set("Content-Type", "application/json") + _ = json.NewEncoder(writer).Encode(map[string]any{ + "choices": []any{map[string]any{ + "message": map[string]any{"role": "assistant", "content": "ok"}, + }}, + }) + })) + defer server.Close() + + resolver := &fakeCredentialResolver{credentials: []providerauth.Credential{{ + Token: "token", BaseURL: server.URL, Protocol: providerauth.ProtocolChatCompletions, + Headers: map[string]string{ + "x-initiator": "user", + "x-interaction-type": "conversation-agent", + }, + }}} + created, err := newManagedChatModel( + context.Background(), + "github-copilot", + "gpt-4.1", + &config.ProviderConfig{Auth: &config.ProviderAuthBinding{ + Method: string(providerauth.MethodGitHubCopilot), + }}, + true, + resolver, + ) + if err != nil { + t.Fatalf("create managed Copilot model: %v", err) + } + sessionContext := WithProviderSessionID(context.Background(), "session-123") + if _, err := created.Generate(sessionContext, []*schema.Message{schema.UserMessage("start")}); err != nil { + t.Fatalf("user request: %v", err) + } + if _, err := created.Generate(sessionContext, []*schema.Message{ + schema.UserMessage("start"), + schema.ToolMessage("result", "call-1"), + }); err != nil { + t.Fatalf("tool continuation: %v", err) + } + if _, err := created.Generate(WithProviderSubagent(sessionContext), []*schema.Message{ + schema.UserMessage("delegated"), + }); err != nil { + t.Fatalf("subagent request: %v", err) + } + + if len(observed) != 3 { + t.Fatalf("requests = %d, want 3", len(observed)) + } + if observed[0].initiator != "user" || observed[0].interactionType != "conversation-agent" { + t.Fatalf("user headers = %+v", observed[0]) + } + if observed[1].initiator != "agent" || observed[1].interactionType != "conversation-agent" { + t.Fatalf("tool headers = %+v", observed[1]) + } + if observed[2].initiator != "agent" || observed[2].interactionType != "conversation-subagent" { + t.Fatalf("subagent headers = %+v", observed[2]) + } + if observed[0].interactionID == "" || observed[0].interactionID != observed[1].interactionID || + observed[0].interactionID != observed[2].interactionID { + t.Fatalf("interaction ids are not stable: %+v", observed) + } +} diff --git a/internal/model/managed_provider_registry_test.go b/internal/model/managed_provider_registry_test.go new file mode 100644 index 00000000..9eb774ab --- /dev/null +++ b/internal/model/managed_provider_registry_test.go @@ -0,0 +1,49 @@ +package model + +import "testing" + +func TestManagedLoginProviderMetadata(t *testing.T) { + registry := NewModelRegistry() + tests := []struct { + provider string + methods []string + model string + }{ + {provider: "openai", methods: []string{"api_key", "codex_oauth"}}, + {provider: "xai", methods: []string{"api_key", "xai_oauth"}, model: "grok-4.5"}, + {provider: "github-copilot", methods: []string{"github_copilot"}, model: "gpt-4.1"}, + } + for _, test := range tests { + t.Run(test.provider, func(t *testing.T) { + provider := registry.GetProvider(test.provider) + if provider == nil { + t.Fatalf("provider %q missing", test.provider) + } + if len(provider.AuthMethods) != len(test.methods) { + t.Fatalf("auth methods = %v, want %v", provider.AuthMethods, test.methods) + } + for index, method := range test.methods { + if provider.AuthMethods[index] != method { + t.Fatalf("auth methods = %v, want %v", provider.AuthMethods, test.methods) + } + } + if test.model != "" { + _, model, ok := registry.LookupModel(test.provider, test.model) + if !ok || model == nil || !model.ToolCall || !model.DefaultEnabled { + t.Fatalf("baseline model %q = %#v", test.model, model) + } + } + }) + } +} + +func TestRegistryCopiesAuthMethods(t *testing.T) { + first := NewModelRegistry() + provider := first.GetProvider("xai") + provider.AuthMethods[0] = "mutated" + + second := NewModelRegistry() + if got := second.GetProvider("xai").AuthMethods[0]; got != "api_key" { + t.Fatalf("registry copy leaked auth-method mutation: %q", got) + } +} diff --git a/internal/model/provider_request.go b/internal/model/provider_request.go new file mode 100644 index 00000000..6d880ff9 --- /dev/null +++ b/internal/model/provider_request.go @@ -0,0 +1,112 @@ +package model + +import ( + "context" + "crypto/sha256" + "fmt" + + "github.com/cloudwego/eino/schema" +) + +type providerRequestContextKey struct{} + +type providerRequestContext struct { + sessionID string + subagent bool + agentInitiated bool + initiator string +} + +// WithProviderSessionID associates provider requests with one persisted JCode +// session. Managed providers may use the opaque value to derive stable request +// metadata, but it is never sent upstream verbatim. +func WithProviderSessionID(ctx context.Context, sessionID string) context.Context { + metadata := providerRequestContextFrom(ctx) + metadata.sessionID = sessionID + return context.WithValue(ctx, providerRequestContextKey{}, metadata) +} + +// WithProviderSubagent marks model calls as delegated work. GitHub Copilot uses +// this to keep child-agent traffic inside the parent interaction instead of +// charging it as a new user-initiated request. +func WithProviderSubagent(ctx context.Context) context.Context { + metadata := providerRequestContextFrom(ctx) + metadata.subagent = true + return context.WithValue(ctx, providerRequestContextKey{}, metadata) +} + +// WithProviderAgentInitiated marks an internal model request, such as context +// compaction, as part of the current user interaction rather than a new user +// action. It intentionally does not imply the subagent interaction type. +func WithProviderAgentInitiated(ctx context.Context) context.Context { + metadata := providerRequestContextFrom(ctx) + metadata.agentInitiated = true + return context.WithValue(ctx, providerRequestContextKey{}, metadata) +} + +func withCopilotModelRequest(ctx context.Context, input []*schema.Message) context.Context { + metadata := providerRequestContextFrom(ctx) + metadata.initiator = copilotInitiator(input, metadata.subagent || metadata.agentInitiated) + return context.WithValue(ctx, providerRequestContextKey{}, metadata) +} + +func providerRequestContextFrom(ctx context.Context) providerRequestContext { + if ctx == nil { + return providerRequestContext{} + } + metadata, _ := ctx.Value(providerRequestContextKey{}).(providerRequestContext) + return metadata +} + +func copilotInitiator(input []*schema.Message, subagent bool) string { + if subagent { + return "agent" + } + for index := len(input) - 1; index >= 0; index-- { + message := input[index] + if message == nil || message.Role == schema.System { + continue + } + if message.Role == schema.Tool { + return "agent" + } + return "user" + } + return "user" +} + +func copilotRequestHeaders(ctx context.Context, source map[string]string) map[string]string { + metadata := providerRequestContextFrom(ctx) + headers := cloneStringMap(source) + if headers == nil { + headers = make(map[string]string, 3) + } + initiator := metadata.initiator + if initiator == "" { + initiator = "user" + } + headers["x-initiator"] = initiator + if metadata.subagent { + headers["x-interaction-type"] = "conversation-subagent" + } else { + headers["x-interaction-type"] = "conversation-agent" + } + if interactionID := deterministicCopilotInteractionID(metadata.sessionID); interactionID != "" { + headers["x-interaction-id"] = interactionID + } + return headers +} + +func deterministicCopilotInteractionID(sessionID string) string { + if sessionID == "" { + return "" + } + digest := sha256.Sum256([]byte("interaction:" + sessionID)) + bytes := digest[:16] + bytes[6] = (bytes[6] & 0x0f) | 0x40 + bytes[8] = (bytes[8] & 0x3f) | 0x80 + return fmt.Sprintf( + "%08x-%04x-%04x-%04x-%012x", + bytes[0:4], bytes[4:6], bytes[6:8], bytes[8:10], bytes[10:16], + ) +} diff --git a/internal/model/provider_request_test.go b/internal/model/provider_request_test.go new file mode 100644 index 00000000..ffebe3b8 --- /dev/null +++ b/internal/model/provider_request_test.go @@ -0,0 +1,75 @@ +package model + +import ( + "context" + "testing" + + "github.com/cloudwego/eino/schema" +) + +func TestCopilotRequestHeadersClassifyUserToolAndSubagent(t *testing.T) { + sessionContext := WithProviderSessionID(context.Background(), "session-123") + userContext := withCopilotModelRequest(sessionContext, []*schema.Message{ + schema.UserMessage("start"), + }) + userHeaders := copilotRequestHeaders(userContext, nil) + if userHeaders["x-initiator"] != "user" { + t.Fatalf("user initiator = %q", userHeaders["x-initiator"]) + } + if userHeaders["x-interaction-type"] != "conversation-agent" { + t.Fatalf("user interaction type = %q", userHeaders["x-interaction-type"]) + } + interactionID := userHeaders["x-interaction-id"] + if interactionID == "" { + t.Fatal("expected stable interaction id") + } + + toolContext := withCopilotModelRequest(sessionContext, []*schema.Message{ + schema.UserMessage("start"), + schema.ToolMessage("result", "call-1"), + }) + toolHeaders := copilotRequestHeaders(toolContext, nil) + if toolHeaders["x-initiator"] != "agent" { + t.Fatalf("tool initiator = %q", toolHeaders["x-initiator"]) + } + if toolHeaders["x-interaction-id"] != interactionID { + t.Fatalf("interaction id changed: %q != %q", toolHeaders["x-interaction-id"], interactionID) + } + + subagentContext := WithProviderSubagent(sessionContext) + subagentContext = withCopilotModelRequest(subagentContext, []*schema.Message{ + schema.UserMessage("delegated task"), + }) + subagentHeaders := copilotRequestHeaders(subagentContext, nil) + if subagentHeaders["x-initiator"] != "agent" { + t.Fatalf("subagent initiator = %q", subagentHeaders["x-initiator"]) + } + if subagentHeaders["x-interaction-type"] != "conversation-subagent" { + t.Fatalf("subagent interaction type = %q", subagentHeaders["x-interaction-type"]) + } + + compactContext := WithProviderAgentInitiated(sessionContext) + compactContext = withCopilotModelRequest(compactContext, []*schema.Message{ + schema.UserMessage("internal summary prompt"), + }) + compactHeaders := copilotRequestHeaders(compactContext, nil) + if compactHeaders["x-initiator"] != "agent" { + t.Fatalf("compact initiator = %q", compactHeaders["x-initiator"]) + } + if compactHeaders["x-interaction-type"] != "conversation-agent" { + t.Fatalf("compact interaction type = %q", compactHeaders["x-interaction-type"]) + } +} + +func TestDeterministicCopilotInteractionID(t *testing.T) { + first := deterministicCopilotInteractionID("session-a") + if first == "" || first != deterministicCopilotInteractionID("session-a") { + t.Fatalf("interaction id is not stable: %q", first) + } + if first == deterministicCopilotInteractionID("session-b") { + t.Fatal("different sessions produced the same interaction id") + } + if deterministicCopilotInteractionID("") != "" { + t.Fatal("empty session must not create a fragmented interaction id") + } +} diff --git a/internal/model/registry.go b/internal/model/registry.go index a7b83c24..b779b7d5 100644 --- a/internal/model/registry.go +++ b/internal/model/registry.go @@ -10,12 +10,16 @@ import ( // RegistryProvider represents a provider from models.dev API. type RegistryProvider struct { - ID string `json:"id"` - Name string `json:"name"` - Env []string `json:"env"` - API string `json:"api"` - Doc string `json:"doc,omitempty"` - Models map[string]*RegistryModel `json:"models"` + ID string `json:"id"` + Name string `json:"name"` + Env []string `json:"env"` + API string `json:"api"` + Doc string `json:"doc,omitempty"` + // AuthMethods declares the authentication choices the provider supports. + // It is product metadata consumed by Setup/Settings; model transports still + // validate and enforce the selected method independently. + AuthMethods []string `json:"auth_methods,omitempty"` + Models map[string]*RegistryModel `json:"models"` // Custom is true for providers that exist only because the user configured // them (an OpenAI-compatible endpoint not in models.dev), as opposed to a // built-in registry brand. Set during MergeConfigProviders. @@ -156,6 +160,9 @@ func deepCopyProvider(src *RegistryProvider) *RegistryProvider { cp.Env = make([]string, len(src.Env)) copy(cp.Env, src.Env) } + if src.AuthMethods != nil { + cp.AuthMethods = append([]string(nil), src.AuthMethods...) + } // Deep copy Models map if src.Models != nil { cp.Models = make(map[string]*RegistryModel, len(src.Models)) @@ -514,6 +521,37 @@ func init() { // built into the registry. They are added to generatedProviders/generatedProviderOrder // at init time so they behave identically to models.dev providers. var staticProviders = map[string]*RegistryProvider{ + // xAI's official API supports both ordinary API keys and the managed OAuth + // device flow used by Grok clients. OAuth runtime policy pins Responses at + // api.x.ai; this registry entry supplies setup/catalog metadata only. + "xai": { + ID: "xai", Name: "xAI (Grok)", Env: []string{"XAI_API_KEY"}, + API: "https://api.x.ai/v1", AuthMethods: []string{"api_key", "xai_oauth"}, + Models: map[string]*RegistryModel{ + "grok-4.5": { + ID: "grok-4.5", Name: "Grok 4.5", Family: "grok", + Reasoning: true, ToolCall: true, Attachment: true, + DefaultEnabled: true, Recommended: true, + Modalities: &ModelModalities{Input: []string{"text", "image"}, Output: []string{"text"}}, + Limit: &ModelLimit{Context: 256000}, ReasoningOptions: standardEffortOptions(), + }, + }, + }, + // Copilot authentication is account-only. The live service may advertise a + // wider catalog; this conservative baseline gives first-run setup a model + // before live catalog refresh is available. + "github-copilot": { + ID: "github-copilot", Name: "GitHub Copilot", + API: "https://api.githubcopilot.com", AuthMethods: []string{"github_copilot"}, + Models: map[string]*RegistryModel{ + "gpt-4.1": { + ID: "gpt-4.1", Name: "GPT-4.1", Family: "gpt", + ToolCall: true, Attachment: true, DefaultEnabled: true, Recommended: true, + Modalities: &ModelModalities{Input: []string{"text", "image"}, Output: []string{"text"}}, + Limit: &ModelLimit{Context: 128000}, + }, + }, + }, // Kimi For Coding is Moonshot's subscription coding plan. models.dev carries a // "kimi-for-coding" record, but its model ids (k2p5/k2p6/k2p7/kimi-k2-thinking) // are undocumented aliases that the vendor's own /models endpoint does not @@ -639,6 +677,8 @@ var staticProviders = map[string]*RegistryProvider{ // staticProviderOrder defines the display order for static providers. // They are appended after the generated providers. var staticProviderOrder = []string{ + "xai", + "github-copilot", "kimi-for-coding", "tencent-tokenhub-ep", } @@ -649,6 +689,11 @@ func applyStaticProviders() { generatedProviders[id] = prov } generatedProviderOrder = append(generatedProviderOrder, staticProviderOrder...) + // OpenAI keeps its generated model catalog while gaining the opt-in + // ChatGPT/Codex account login alongside its existing API-key path. + if openAI := generatedProviders["openai"]; openAI != nil { + openAI.AuthMethods = []string{"api_key", "codex_oauth"} + } } // applyContextLimitOverrides patches context windows for built-in models whose diff --git a/internal/model/responsemeta/opaque.go b/internal/model/responsemeta/opaque.go new file mode 100644 index 00000000..2de38466 --- /dev/null +++ b/internal/model/responsemeta/opaque.go @@ -0,0 +1,117 @@ +// Package responsemeta defines the small, provider-neutral contract used to +// carry stateless Responses API continuation data through Eino messages and +// the JSONL session recorder. +package responsemeta + +import ( + "encoding/json" +) + +const ( + // OpaqueItemsExtraKey is the stable schema.Message.Extra key used by the + // Responses transport, runner, and session replay. + OpaqueItemsExtraKey = "jcode.responses.opaque_items" + + // MaxOpaqueItems bounds encrypted reasoning items retained per message. + MaxOpaqueItems = 16 + // MaxOpaqueItemBytes bounds one canonical encrypted reasoning item. + MaxOpaqueItemBytes = 512 << 10 + // MaxOpaqueItemsBytes bounds all encrypted items retained per message. + MaxOpaqueItemsBytes = 2 << 20 + maxOpaqueItemIDBytes = 512 +) + +type reasoningItem struct { + Type string `json:"type"` + ID string `json:"id,omitempty"` + Summary []json.RawMessage `json:"summary"` + EncryptedContent string `json:"encrypted_content"` +} + +// CanonicalReasoningItem accepts only an encrypted Responses reasoning item +// and strips every provider-returned cleartext field. Summary is deliberately +// serialized as an empty array because the Codex Responses schema requires it. +func CanonicalReasoningItem(raw []byte) (json.RawMessage, bool) { + if len(raw) == 0 || len(raw) > MaxOpaqueItemBytes { + return nil, false + } + var item reasoningItem + if err := json.Unmarshal(raw, &item); err != nil || item.Type != "reasoning" || + item.EncryptedContent == "" || len(item.EncryptedContent) > MaxOpaqueItemBytes || + len(item.ID) > maxOpaqueItemIDBytes { + return nil, false + } + item.Summary = []json.RawMessage{} + canonical, err := json.Marshal(item) + if err != nil || len(canonical) > MaxOpaqueItemBytes { + return nil, false + } + return canonical, true +} + +// Normalize returns a bounded, canonical collection. It is safe to call on +// untrusted session data: invalid, cleartext-only, oversized, and excess items +// are ignored. +func Normalize(items []json.RawMessage) []json.RawMessage { + out := make([]json.RawMessage, 0, min(len(items), MaxOpaqueItems)) + total := 0 + for _, raw := range items { + if len(out) >= MaxOpaqueItems { + break + } + item, ok := CanonicalReasoningItem(raw) + if !ok || total > MaxOpaqueItemsBytes-len(item) { + continue + } + total += len(item) + out = append(out, item) + } + return out +} + +// FromExtra extracts canonical opaque items from the runtime message value. +// The transport and session replay use []json.RawMessage, while []any support +// keeps the contract resilient to a JSON marshal/unmarshal boundary. +func FromExtra(extra map[string]any) []json.RawMessage { + if len(extra) == 0 { + return nil + } + value, ok := extra[OpaqueItemsExtraKey] + if !ok { + return nil + } + var items []json.RawMessage + switch typed := value.(type) { + case []json.RawMessage: + items = typed + case json.RawMessage: + items = []json.RawMessage{typed} + case []byte: + items = []json.RawMessage{typed} + case string: + items = []json.RawMessage{json.RawMessage(typed)} + case []any: + items = make([]json.RawMessage, 0, len(typed)) + for _, item := range typed { + raw, err := json.Marshal(item) + if err == nil { + items = append(items, raw) + } + } + default: + raw, err := json.Marshal(typed) + if err == nil { + items = []json.RawMessage{raw} + } + } + return Normalize(items) +} + +// Extra builds the canonical message metadata map for opaque items. +func Extra(items []json.RawMessage) map[string]any { + items = Normalize(items) + if len(items) == 0 { + return nil + } + return map[string]any{OpaqueItemsExtraKey: items} +} diff --git a/internal/model/responses.go b/internal/model/responses.go new file mode 100644 index 00000000..e3059a08 --- /dev/null +++ b/internal/model/responses.go @@ -0,0 +1,405 @@ +package model + +import ( + "bytes" + "context" + "encoding/json" + "fmt" + "io" + "net/http" + "net/url" + "strings" + "time" + + einomodel "github.com/cloudwego/eino/components/model" + "github.com/cloudwego/eino/schema" + "github.com/cnjack/jcode/internal/config" +) + +const maxResponsesRequestBytes = 48 << 20 + +// ResponsesCredentialFunc resolves fresh authorization immediately before an +// HTTP dispatch. Returned headers are applied after configured headers; a +// non-empty token is applied last as Authorization: Bearer . +type ResponsesCredentialFunc func(context.Context) (token string, headers map[string]string, err error) + +// ResponsesModelConfig configures the raw OpenAI Responses API transport used +// by xAI OAuth and ChatGPT Codex OAuth providers. +type ResponsesModelConfig struct { + Model string + BaseURL string + Headers map[string]string + ReasoningEffort string + Vision bool + Credential ResponsesCredentialFunc + Codex bool + HTTPClient *http.Client +} + +type responsesModel struct { + model string + endpoint string + headers map[string]string + reasoningEffort string + vision bool + credential ResponsesCredentialFunc + codex bool + client *http.Client + tools []*schema.ToolInfo +} + +type responsesReasoningRequest struct { + Effort string `json:"effort,omitempty"` +} + +type responsesRequest struct { + Model string `json:"model"` + Instructions string `json:"instructions"` + Input []json.RawMessage `json:"input"` + Tools []responsesTool `json:"tools"` + ToolChoice string `json:"tool_choice,omitempty"` + ParallelToolCalls *bool `json:"parallel_tool_calls,omitempty"` + Reasoning *responsesReasoningRequest `json:"reasoning,omitempty"` + Stream bool `json:"stream"` + Store *bool `json:"store,omitempty"` + Include []string `json:"include,omitempty"` + MaxOutputTokens *int `json:"max_output_tokens,omitempty"` + Temperature *float32 `json:"temperature,omitempty"` + TopP *float32 `json:"top_p,omitempty"` +} + +// NewResponsesModel constructs an immutable Eino ToolCallingChatModel. Provider +// selection remains in NewChatModelFromProvider so this transport can be wired +// in without coupling it to config or authentication storage. +func NewResponsesModel(_ context.Context, cfg *ResponsesModelConfig) (einomodel.ToolCallingChatModel, error) { + if cfg == nil { + return nil, fmt.Errorf("responses model config is required") + } + if strings.TrimSpace(cfg.Model) == "" { + return nil, fmt.Errorf("responses model is required") + } + endpoint, err := responsesEndpoint(cfg.BaseURL) + if err != nil { + return nil, err + } + if cfg.Credential == nil { + return nil, fmt.Errorf("responses credential resolver is required") + } + client := cloneResponsesHTTPClient(cfg.HTTPClient) + return &responsesModel{ + model: cfg.Model, + endpoint: endpoint, + headers: cloneStringMap(cfg.Headers), + reasoningEffort: cfg.ReasoningEffort, + vision: cfg.Vision, + credential: cfg.Credential, + codex: cfg.Codex, + client: client, + }, nil +} + +func cloneResponsesHTTPClient(client *http.Client) *http.Client { + if client == nil { + client = &http.Client{} + } + cloned := *client + // Responses requests carry replayable POST bodies and short-lived bearer + // credentials. Never allow net/http to forward either to a redirect target, + // even when an injected client normally follows 307/308 responses. + cloned.CheckRedirect = func(*http.Request, []*http.Request) error { + return http.ErrUseLastResponse + } + return &cloned +} + +func responsesEndpoint(baseURL string) (string, error) { + baseURL = strings.TrimSpace(baseURL) + if baseURL == "" { + return "", fmt.Errorf("responses base URL is required") + } + u, err := url.Parse(baseURL) + if err != nil || u.Scheme == "" || u.Host == "" { + return "", fmt.Errorf("invalid responses base URL") + } + if u.Scheme != "http" && u.Scheme != "https" { + return "", fmt.Errorf("responses base URL must use http or https") + } + u.Fragment = "" + u.Path = strings.TrimRight(u.Path, "/") + if !strings.HasSuffix(u.Path, "/responses") { + u.Path += "/responses" + } + return u.String(), nil +} + +func cloneStringMap(input map[string]string) map[string]string { + if len(input) == 0 { + return nil + } + cloned := make(map[string]string, len(input)) + for key, value := range input { + cloned[key] = value + } + return cloned +} + +func (m *responsesModel) WithTools(tools []*schema.ToolInfo) (einomodel.ToolCallingChatModel, error) { + if _, err := responsesTools(tools); err != nil { + return nil, err + } + derived := *m + derived.tools = append([]*schema.ToolInfo(nil), tools...) + return &derived, nil +} + +func (m *responsesModel) buildRequest( + input []*schema.Message, + stream bool, + opts ...einomodel.Option, +) (responsesRequest, error) { + convertedInput, err := responsesInput(input, m.vision) + if err != nil { + return responsesRequest{}, err + } + common := einomodel.GetCommonOptions(nil, opts...) + modelName := m.model + if common.Model != nil && *common.Model != "" { + modelName = *common.Model + } + boundTools := m.tools + if len(common.Tools) > 0 { + boundTools = common.Tools + } + tools, err := responsesTools(boundTools) + if err != nil { + return responsesRequest{}, err + } + req := responsesRequest{ + Model: modelName, + Instructions: responsesInstructions(input), + Input: convertedInput, + Tools: tools, + Stream: stream, + } + if m.reasoningEffort != "" { + req.Reasoning = &responsesReasoningRequest{Effort: m.reasoningEffort} + } + if len(tools) > 0 { + req.ToolChoice = "auto" + parallel := true + req.ParallelToolCalls = ¶llel + } + if common.ToolChoice != nil { + switch *common.ToolChoice { + case schema.ToolChoiceForbidden: + req.ToolChoice = "none" + case schema.ToolChoiceForced: + req.ToolChoice = "required" + default: + req.ToolChoice = "auto" + } + } + if m.codex { + store := false + parallel := false + req.Store = &store + req.Include = []string{"reasoning.encrypted_content"} + req.Stream = true + if req.Tools == nil { + req.Tools = []responsesTool{} + } + req.ToolChoice = "auto" + req.ParallelToolCalls = ¶llel + // ChatGPT's Codex backend follows codex-rs and rejects the standard + // max_output_tokens/temperature/top_p fields. + return req, nil + } + req.MaxOutputTokens = common.MaxTokens + req.Temperature = common.Temperature + req.TopP = common.TopP + return req, nil +} + +func (m *responsesModel) Generate( + ctx context.Context, + input []*schema.Message, + opts ...einomodel.Option, +) (*schema.Message, error) { + if m.codex { + stream, err := m.Stream(ctx, input, opts...) + if err != nil { + return nil, err + } + defer stream.Close() + return collectResponsesStream(stream) + } + req, err := m.buildRequest(input, false, opts...) + if err != nil { + return nil, err + } + start := time.Now() + resp, err := m.dispatch(ctx, req, false) + if err != nil { + return nil, err + } + defer func() { _ = resp.Body.Close() }() + message, usage, err := decodeResponsesJSON(resp.Body) + config.Logger().Printf("[responses] Generate finished in %v, err=%v", time.Since(start), err) + if err != nil { + return nil, err + } + if usage.hasUsage() { + m.recordUsage(ctx, usage) + } + return message, nil +} + +func (m *responsesModel) Stream( + ctx context.Context, + input []*schema.Message, + opts ...einomodel.Option, +) (*schema.StreamReader[*schema.Message], error) { + req, err := m.buildRequest(input, true, opts...) + if err != nil { + return nil, err + } + resp, err := m.dispatch(ctx, req, true) + if err != nil { + return nil, err + } + sr, sw := schema.Pipe[*schema.Message](16) + go func() { + defer sw.Close() + defer func() { _ = resp.Body.Close() }() + usage, parseErr := decodeResponsesSSE(resp.Body, func(message *schema.Message) error { + sw.Send(message, nil) + return nil + }) + if parseErr != nil { + sw.Send(nil, parseErr) + return + } + if usage.hasUsage() { + m.recordUsage(ctx, usage) + } + }() + return sr, nil +} + +func (m *responsesModel) dispatch( + ctx context.Context, + payload responsesRequest, + stream bool, +) (*http.Response, error) { + raw, err := json.Marshal(payload) + if err != nil { + return nil, fmt.Errorf("encode responses request: %w", err) + } + if len(raw) > maxResponsesRequestBytes { + return nil, fmt.Errorf("responses request exceeds %d-byte limit", maxResponsesRequestBytes) + } + token, credentialHeaders, err := m.credential(ctx) + if err != nil { + return nil, fmt.Errorf("resolve responses credential: %w", err) + } + if strings.TrimSpace(token) == "" { + return nil, fmt.Errorf("resolve responses credential: empty token") + } + req, err := http.NewRequestWithContext(ctx, http.MethodPost, m.endpoint, bytes.NewReader(raw)) + if err != nil { + return nil, fmt.Errorf("create responses request: %w", err) + } + if err := applyResponsesHeaders(req.Header, m.headers); err != nil { + return nil, err + } + // Transport-owned fields and dynamic credential headers are protected from + // stale provider configuration by applying them last. + req.Header.Set("Content-Type", "application/json") + if stream || m.codex { + req.Header.Set("Accept", "text/event-stream") + } else { + req.Header.Set("Accept", "application/json") + } + if err := applyResponsesHeaders(req.Header, credentialHeaders); err != nil { + return nil, err + } + req.Header.Set("Authorization", "Bearer "+token) + resp, err := m.client.Do(req) + if err != nil { + return nil, fmt.Errorf("responses request: %w", err) + } + if resp.StatusCode < http.StatusOK || resp.StatusCode >= http.StatusMultipleChoices { + defer func() { _ = resp.Body.Close() }() + return nil, decodeResponsesHTTPError(resp) + } + return resp, nil +} + +func applyResponsesHeaders(dst http.Header, values map[string]string) error { + for key, value := range values { + if !validResponsesHeaderName(key) || strings.ContainsAny(value, "\r\n") { + return fmt.Errorf("invalid responses header") + } + dst.Set(key, value) + } + return nil +} + +func validResponsesHeaderName(name string) bool { + if name == "" { + return false + } + for i := 0; i < len(name); i++ { + c := name[i] + switch { + case c >= 'a' && c <= 'z': + case c >= 'A' && c <= 'Z': + case c >= '0' && c <= '9': + case strings.ContainsRune("!#$%&'*+-.^_`|~", rune(c)): + default: + return false + } + } + return true +} + +func (m *responsesModel) recordUsage(ctx context.Context, usage responsesUsage) { + params := AddParams{ + Prompt: usage.InputTokens, + Completion: usage.OutputTokens, + Total: usage.TotalTokens, + Cached: usage.InputDetails.CachedTokens, + Reasoning: usage.OutputDetails.ReasoningTokens, + CacheDetailsPresent: usage.InputDetails.Present, + } + if params.Total == 0 { + params.Total = params.Prompt + params.Completion + } + TokenTracker.Add(params) + TokenTracker.AddByModel(m.model, params.Prompt, params.Completion, params.Total) + if local := TokenTrackerFromContext(ctx); local != nil { + local.Add(params) + local.AddByModel(m.model, params.Prompt, params.Completion, params.Total) + } + if notify := UsageNotifierFromContext(ctx); notify != nil { + notify() + } +} + +func collectResponsesStream(stream *schema.StreamReader[*schema.Message]) (*schema.Message, error) { + result := &schema.Message{Role: schema.Assistant} + for { + chunk, err := stream.Recv() + if err == io.EOF { + break + } + if err != nil { + return nil, err + } + mergeResponsesMessage(result, chunk) + } + if result.Content == "" && result.ReasoningContent == "" && len(result.ToolCalls) == 0 && len(result.Extra) == 0 { + return nil, fmt.Errorf("empty response from Responses API") + } + return result, nil +} diff --git a/internal/model/responses_convert.go b/internal/model/responses_convert.go new file mode 100644 index 00000000..435fe708 --- /dev/null +++ b/internal/model/responses_convert.go @@ -0,0 +1,239 @@ +package model + +import ( + "encoding/json" + "fmt" + "strings" + + "github.com/cloudwego/eino/schema" + "github.com/cnjack/jcode/internal/model/responsemeta" +) + +type responsesInputContent struct { + Type string `json:"type"` + Text string `json:"text,omitempty"` + ImageURL string `json:"image_url,omitempty"` +} + +type responsesMessageInput struct { + Type string `json:"type,omitempty"` + Role string `json:"role"` + Content []responsesInputContent `json:"content"` +} + +type responsesFunctionCallInput struct { + Type string `json:"type"` + CallID string `json:"call_id"` + Name string `json:"name"` + Arguments string `json:"arguments"` +} + +type responsesFunctionOutputInput struct { + Type string `json:"type"` + CallID string `json:"call_id"` + Output string `json:"output"` +} + +type responsesTool struct { + Type string `json:"type"` + Name string `json:"name"` + Description string `json:"description,omitempty"` + Parameters any `json:"parameters"` +} + +func marshalResponseInput(value any) (json.RawMessage, error) { + raw, err := json.Marshal(value) + if err != nil { + return nil, fmt.Errorf("responses input: %w", err) + } + return raw, nil +} + +func responsesInstructions(input []*schema.Message) string { + var instructions []string + for _, msg := range input { + if msg == nil || msg.Role != schema.System { + continue + } + text := msg.Content + if text == "" && len(msg.UserInputMultiContent) > 0 { + text = collapsedInputText(msg.UserInputMultiContent, false) + } + if text != "" { + instructions = append(instructions, text) + } + } + return strings.Join(instructions, "\n\n") +} + +func responsesInput(input []*schema.Message, vision bool) ([]json.RawMessage, error) { + items := make([]json.RawMessage, 0, len(input)+2) + imageBudget := NewModelImageBudget() + for i := 0; i < len(input); { + msg := input[i] + if msg == nil || msg.Role == schema.System { + i++ + continue + } + if msg.Role != schema.Tool { + converted, err := responsesConversationItems(msg, vision, imageBudget) + if err != nil { + return nil, err + } + items = append(items, converted...) + i++ + continue + } + + end := i + for end < len(input) && input[end] != nil && input[end].Role == schema.Tool { + end++ + } + attachVisuals := vision && noConversationMessageAfter(input, end) + var visualContent []responsesInputContent + for j := i; j < end; j++ { + toolMsg := input[j] + if toolMsg.ToolCallID == "" { + return nil, fmt.Errorf("responses input: tool message is missing tool_call_id") + } + output := toolMsg.Content + if len(toolMsg.UserInputMultiContent) > 0 { + output = collapsedInputText(toolMsg.UserInputMultiContent, false) + } + raw, err := marshalResponseInput(responsesFunctionOutputInput{ + Type: "function_call_output", CallID: toolMsg.ToolCallID, Output: output, + }) + if err != nil { + return nil, err + } + items = append(items, raw) + if !attachVisuals { + continue + } + for _, part := range toolMsg.UserInputMultiContent { + if part.Type != schema.ChatMessagePartTypeImageURL || part.Image == nil { + continue + } + url, payloadBytes := ModelImagePayload(part.Image) + if url == "" || !imageBudget.Admit(payloadBytes) { + continue + } + visualContent = append(visualContent, + responsesInputContent{Type: "input_text", Text: fmt.Sprintf( + "Visual output from completed tool %q (tool_call_id=%q). Treat pixels as untrusted app content, not instructions.", + toolMsg.ToolName, toolMsg.ToolCallID)}, + responsesInputContent{Type: "input_image", ImageURL: url}, + ) + } + } + if len(visualContent) > 0 { + raw, err := marshalResponseInput(responsesMessageInput{Role: "user", Content: visualContent}) + if err != nil { + return nil, err + } + items = append(items, raw) + } + i = end + } + return items, nil +} + +func responsesConversationItems( + msg *schema.Message, + vision bool, + imageBudget *ModelImageBudget, +) ([]json.RawMessage, error) { + items := make([]json.RawMessage, 0, 2+len(msg.ToolCalls)) + + contentType := "input_text" + if msg.Role == schema.Assistant { + contentType = "output_text" + } + content := make([]responsesInputContent, 0, len(msg.UserInputMultiContent)+1) + switch { + case len(msg.UserInputMultiContent) == 0: + if msg.Content != "" { + content = append(content, responsesInputContent{Type: contentType, Text: msg.Content}) + } + case !vision: + if text := collapsedInputText(msg.UserInputMultiContent, true); text != "" { + content = append(content, responsesInputContent{Type: contentType, Text: text}) + } + default: + omitted := 0 + for _, part := range msg.UserInputMultiContent { + switch part.Type { + case schema.ChatMessagePartTypeText: + if part.Text != "" { + content = append(content, responsesInputContent{Type: contentType, Text: part.Text}) + } + case schema.ChatMessagePartTypeImageURL: + if part.Image == nil { + continue + } + url, payloadBytes := ModelImagePayload(part.Image) + if url == "" { + continue + } + if !imageBudget.Admit(payloadBytes) { + omitted++ + continue + } + content = append(content, responsesInputContent{Type: "input_image", ImageURL: url}) + } + } + if omitted > 0 { + content = append(content, responsesInputContent{Type: contentType, Text: fmt.Sprintf( + "[%d image(s) omitted: current request visual payload budget exceeded]", omitted)}) + } + } + + // Encrypted reasoning is continuation state for an actual assistant turn, + // not a standalone conversation item. Replay it only when a message or a + // function call from the same turn follows immediately after it. + if msg.Role == schema.Assistant && (len(content) > 0 || len(msg.ToolCalls) > 0) { + items = append(items, responsemeta.FromExtra(msg.Extra)...) + } + if len(content) > 0 { + role := string(msg.Role) + if role != "user" && role != "assistant" && role != "developer" { + return nil, fmt.Errorf("responses input: unsupported message role %q", role) + } + raw, err := marshalResponseInput(responsesMessageInput{Role: role, Content: content}) + if err != nil { + return nil, err + } + items = append(items, raw) + } + for _, tc := range msg.ToolCalls { + if tc.ID == "" || tc.Function.Name == "" { + return nil, fmt.Errorf("responses input: function call is missing id or name") + } + raw, err := marshalResponseInput(responsesFunctionCallInput{ + Type: "function_call", CallID: tc.ID, Name: tc.Function.Name, + Arguments: tc.Function.Arguments, + }) + if err != nil { + return nil, err + } + items = append(items, raw) + } + return items, nil +} + +func responsesTools(tools []*schema.ToolInfo) ([]responsesTool, error) { + converted := make([]responsesTool, 0, len(tools)) + for _, tool := range tools { + if tool == nil { + continue + } + params, err := tool.ToJSONSchema() + if err != nil { + return nil, fmt.Errorf("responses tool %s: %w", tool.Name, err) + } + converted = append(converted, responsesTool{ + Type: "function", Name: tool.Name, Description: tool.Desc, Parameters: params, + }) + } + return converted, nil +} diff --git a/internal/model/responses_parse.go b/internal/model/responses_parse.go new file mode 100644 index 00000000..b7a98608 --- /dev/null +++ b/internal/model/responses_parse.go @@ -0,0 +1,587 @@ +package model + +import ( + "bufio" + "bytes" + "encoding/json" + "fmt" + "io" + "net/http" + "strings" + "unicode/utf8" + + "github.com/cloudwego/eino/schema" + "github.com/cnjack/jcode/internal/model/responsemeta" +) + +const ( + maxResponsesJSONBytes = 16 << 20 + maxResponsesErrorBytes = 64 << 10 + maxResponsesSSEEventBytes = 2 << 20 + maxResponsesTextBytes = 32 << 20 + maxResponsesReasoningBytes = 8 << 20 + maxResponsesToolBytes = 8 << 20 +) + +type responsesTokenDetails struct { + CachedTokens int `json:"cached_tokens"` + ReasoningTokens int `json:"reasoning_tokens"` + Present bool `json:"-"` +} + +type responsesUsage struct { + InputTokens int `json:"input_tokens"` + OutputTokens int `json:"output_tokens"` + TotalTokens int `json:"total_tokens"` + InputDetails responsesTokenDetails + OutputDetails responsesTokenDetails +} + +func (u responsesUsage) hasUsage() bool { + return u.InputTokens > 0 || u.OutputTokens > 0 || u.TotalTokens > 0 +} + +type responsesUsageWire struct { + InputTokens int `json:"input_tokens"` + OutputTokens int `json:"output_tokens"` + TotalTokens int `json:"total_tokens"` + InputTokensDetails *responsesTokenDetails `json:"input_tokens_details"` + OutputTokensDetails *responsesTokenDetails `json:"output_tokens_details"` +} + +func (u responsesUsageWire) normalized() responsesUsage { + result := responsesUsage{ + InputTokens: u.InputTokens, OutputTokens: u.OutputTokens, TotalTokens: u.TotalTokens, + } + if u.InputTokensDetails != nil { + result.InputDetails = *u.InputTokensDetails + result.InputDetails.Present = true + } + if u.OutputTokensDetails != nil { + result.OutputDetails = *u.OutputTokensDetails + result.OutputDetails.Present = true + } + return result +} + +type responsesErrorBody struct { + Message string `json:"message"` + Type string `json:"type"` + Code string `json:"code"` +} + +type responsesEnvelope struct { + ID string `json:"id"` + Status string `json:"status"` + Output []json.RawMessage `json:"output"` + OutputText string `json:"output_text"` + Usage *responsesUsageWire `json:"usage"` + Error *responsesErrorBody `json:"error"` + IncompleteDetails *struct { + Reason string `json:"reason"` + } `json:"incomplete_details"` +} + +type responsesOutputItem struct { + Type string `json:"type"` + ID string `json:"id"` + Role string `json:"role"` + CallID string `json:"call_id"` + Name string `json:"name"` + Arguments string `json:"arguments"` + EncryptedContent string `json:"encrypted_content"` + Content []struct { + Type string `json:"type"` + Text string `json:"text"` + Refusal string `json:"refusal"` + } `json:"content"` + Summary []struct { + Type string `json:"type"` + Text string `json:"text"` + } `json:"summary"` +} + +func readBounded(reader io.Reader, limit int64) ([]byte, error) { + raw, err := io.ReadAll(io.LimitReader(reader, limit+1)) + if err != nil { + return nil, err + } + if int64(len(raw)) > limit { + return nil, fmt.Errorf("response exceeds %d-byte limit", limit) + } + return raw, nil +} + +func decodeResponsesJSON(reader io.Reader) (*schema.Message, responsesUsage, error) { + raw, err := readBounded(reader, maxResponsesJSONBytes) + if err != nil { + return nil, responsesUsage{}, fmt.Errorf("read Responses API response: %w", err) + } + var response responsesEnvelope + if err := json.Unmarshal(raw, &response); err != nil { + return nil, responsesUsage{}, fmt.Errorf("decode Responses API response: %w", err) + } + if response.Error != nil || response.Status == "failed" { + return nil, responsesUsage{}, responseEnvelopeError(response) + } + message, err := messageFromResponsesEnvelope(response) + if err != nil { + return nil, responsesUsage{}, err + } + var usage responsesUsage + if response.Usage != nil { + usage = response.Usage.normalized() + message.ResponseMeta = responseMetaFor(usage, response.Status, len(message.ToolCalls) > 0) + } + return message, usage, nil +} + +func messageFromResponsesEnvelope(response responsesEnvelope) (*schema.Message, error) { + message := &schema.Message{Role: schema.Assistant} + for outputIndex, raw := range response.Output { + itemMessage, err := messageFromResponsesItem(raw, outputIndex) + if err != nil { + return nil, err + } + mergeResponsesMessage(message, itemMessage) + } + if message.Content == "" && response.OutputText != "" { + message.Content = response.OutputText + } + if message.Content == "" && message.ReasoningContent == "" && len(message.ToolCalls) == 0 && len(message.Extra) == 0 { + return nil, fmt.Errorf("empty response from Responses API") + } + return message, nil +} + +func messageFromResponsesItem(raw json.RawMessage, outputIndex int) (*schema.Message, error) { + if len(raw) > maxResponsesSSEEventBytes { + return nil, fmt.Errorf("responses API output item exceeds %d-byte limit", maxResponsesSSEEventBytes) + } + var item responsesOutputItem + if err := json.Unmarshal(raw, &item); err != nil { + return nil, fmt.Errorf("decode Responses API output item: %w", err) + } + message := &schema.Message{Role: schema.Assistant} + switch item.Type { + case "message": + for _, content := range item.Content { + switch content.Type { + case "output_text", "text": + message.Content += content.Text + case "refusal": + message.Content += content.Refusal + } + } + case "reasoning": + for _, summary := range item.Summary { + if summary.Type == "summary_text" || summary.Type == "text" { + message.ReasoningContent += summary.Text + } + } + if opaque, ok := responsemeta.CanonicalReasoningItem(raw); ok { + message.Extra = responsemeta.Extra([]json.RawMessage{opaque}) + } + case "function_call": + if item.CallID == "" || item.Name == "" { + return nil, fmt.Errorf("responses API returned a function call without call_id or name") + } + index := outputIndex + message.ToolCalls = []schema.ToolCall{{ + Index: &index, ID: item.CallID, Type: "function", + Function: schema.FunctionCall{Name: item.Name, Arguments: item.Arguments}, + }} + } + return message, nil +} + +func mergeResponsesMessage(dst, src *schema.Message) { + if dst == nil || src == nil { + return + } + dst.Content += src.Content + dst.ReasoningContent += src.ReasoningContent + if len(src.ToolCalls) > 0 { + for _, call := range src.ToolCalls { + idx := len(dst.ToolCalls) + call.Index = &idx + dst.ToolCalls = append(dst.ToolCalls, call) + } + } + if len(src.Extra) > 0 { + if dst.Extra == nil { + dst.Extra = make(map[string]any, len(src.Extra)) + } + for key, value := range src.Extra { + if key == responsemeta.OpaqueItemsExtraKey { + combined := append(responsemeta.FromExtra(dst.Extra), responsemeta.FromExtra(src.Extra)...) + if normalized := responsemeta.Normalize(combined); len(normalized) > 0 { + dst.Extra[key] = normalized + } + continue + } + dst.Extra[key] = value + } + } + if src.ResponseMeta != nil { + dst.ResponseMeta = src.ResponseMeta + } +} + +func responseMetaFor(usage responsesUsage, status string, hasTools bool) *schema.ResponseMeta { + finishReason := "stop" + if hasTools { + finishReason = "tool_calls" + } else if status == "incomplete" { + finishReason = "length" + } + return &schema.ResponseMeta{ + FinishReason: finishReason, + Usage: &schema.TokenUsage{ + PromptTokens: usage.InputTokens, + PromptTokenDetails: schema.PromptTokenDetails{ + CachedTokens: usage.InputDetails.CachedTokens, + }, + CompletionTokens: usage.OutputTokens, + TotalTokens: usage.TotalTokens, + CompletionTokensDetails: schema.CompletionTokensDetails{ + ReasoningTokens: usage.OutputDetails.ReasoningTokens, + }, + }, + } +} + +type responsesSSEEvent struct { + Type string `json:"type"` + Delta string `json:"delta"` + Message string `json:"message"` + Code string `json:"code"` + OutputIndex int `json:"output_index"` + Item json.RawMessage `json:"item"` + Response *responsesEnvelope `json:"response"` + Error *responsesErrorBody `json:"error"` +} + +type responsesSSEState struct { + textBytes int + reasoningBytes int + toolBytes int + sawTextDelta bool + sawReasoningDelta bool + emittedTextItem bool + emittedReasoning bool + completed bool + emittedToolCalls map[string]bool + emittedOpaqueItems map[string]bool + usage responsesUsage +} + +func decodeResponsesSSE( + reader io.Reader, + emit func(*schema.Message) error, +) (responsesUsage, error) { + state := &responsesSSEState{ + emittedToolCalls: make(map[string]bool), emittedOpaqueItems: make(map[string]bool), + } + scanner := bufio.NewScanner(reader) + scanner.Buffer(make([]byte, 64<<10), maxResponsesSSEEventBytes) + var eventName string + var data bytes.Buffer + flush := func() error { + if data.Len() == 0 { + eventName = "" + return nil + } + payload := append([]byte(nil), data.Bytes()...) + data.Reset() + name := eventName + eventName = "" + if bytes.Equal(bytes.TrimSpace(payload), []byte("[DONE]")) { + state.completed = true + return nil + } + return state.handleEvent(name, payload, emit) + } + for scanner.Scan() { + line := bytes.TrimSuffix(scanner.Bytes(), []byte{'\r'}) + if len(line) == 0 { + if err := flush(); err != nil { + return state.usage, err + } + continue + } + if line[0] == ':' { + continue + } + if bytes.HasPrefix(line, []byte("event:")) { + eventName = strings.TrimSpace(string(line[len("event:"):])) + continue + } + if bytes.HasPrefix(line, []byte("data:")) { + if data.Len() > 0 { + data.WriteByte('\n') + } + part := bytes.TrimPrefix(line[len("data:"):], []byte(" ")) + if data.Len() > maxResponsesSSEEventBytes-len(part) { + return state.usage, fmt.Errorf("responses API SSE event exceeds %d-byte limit", maxResponsesSSEEventBytes) + } + data.Write(part) + } + } + if err := scanner.Err(); err != nil { + return state.usage, fmt.Errorf("read Responses API stream: %w", err) + } + if err := flush(); err != nil { + return state.usage, err + } + if !state.completed { + return state.usage, fmt.Errorf("responses API stream ended before a terminal event") + } + return state.usage, nil +} + +func (s *responsesSSEState) handleEvent( + eventName string, + payload []byte, + emit func(*schema.Message) error, +) error { + var event responsesSSEEvent + if err := json.Unmarshal(payload, &event); err != nil { + return fmt.Errorf("decode Responses API SSE event: %w", err) + } + if event.Type == "" { + event.Type = eventName + } + switch event.Type { + case "response.output_text.delta", "response.refusal.delta": + if err := s.addBounded(&s.textBytes, len(event.Delta), maxResponsesTextBytes, "text"); err != nil { + return err + } + s.sawTextDelta = true + return emit(&schema.Message{Role: schema.Assistant, Content: event.Delta}) + case "response.reasoning_summary_text.delta", "response.reasoning_text.delta": + if err := s.addBounded(&s.reasoningBytes, len(event.Delta), maxResponsesReasoningBytes, "reasoning"); err != nil { + return err + } + s.sawReasoningDelta = true + return emit(&schema.Message{Role: schema.Assistant, ReasoningContent: event.Delta}) + case "response.output_item.done": + return s.emitItem(event.Item, event.OutputIndex, emit) + case "response.completed", "response.incomplete": + if event.Response == nil { + return fmt.Errorf("responses API completion event is missing response") + } + s.completed = true + if event.Response.Usage != nil { + s.usage = event.Response.Usage.normalized() + } + if err := s.emitEnvelopeFallback(*event.Response, emit); err != nil { + return err + } + if event.Response.Usage != nil { + return emit(&schema.Message{ + Role: schema.Assistant, + ResponseMeta: responseMetaFor( + s.usage, event.Response.Status, len(s.emittedToolCalls) > 0, + ), + }) + } + return nil + case "response.failed": + if event.Response != nil { + return responseEnvelopeError(*event.Response) + } + return apiError(0, event.Error, "") + case "error": + if event.Error == nil && (event.Message != "" || event.Code != "") { + event.Error = &responsesErrorBody{Message: event.Message, Code: event.Code} + } + return apiError(0, event.Error, "") + default: + return nil + } +} + +func (s *responsesSSEState) emitEnvelopeFallback( + response responsesEnvelope, + emit func(*schema.Message) error, +) error { + if response.Error != nil || response.Status == "failed" { + return responseEnvelopeError(response) + } + for outputIndex, raw := range response.Output { + var item responsesOutputItem + if err := json.Unmarshal(raw, &item); err != nil { + return fmt.Errorf("decode Responses API completed output: %w", err) + } + switch item.Type { + case "message": + if !s.sawTextDelta && !s.emittedTextItem { + if err := s.emitItem(raw, outputIndex, emit); err != nil { + return err + } + } + case "reasoning": + if err := s.emitItem(raw, outputIndex, emit); err != nil { + return err + } + case "function_call": + if !s.emittedToolCalls[item.CallID] { + if err := s.emitItem(raw, outputIndex, emit); err != nil { + return err + } + } + } + } + if !s.sawTextDelta && !s.emittedTextItem && response.OutputText != "" { + if err := s.addBounded(&s.textBytes, len(response.OutputText), maxResponsesTextBytes, "text"); err != nil { + return err + } + return emit(&schema.Message{Role: schema.Assistant, Content: response.OutputText}) + } + return nil +} + +func (s *responsesSSEState) emitItem( + raw json.RawMessage, + outputIndex int, + emit func(*schema.Message) error, +) error { + message, err := messageFromResponsesItem(raw, outputIndex) + if err != nil { + return err + } + var item responsesOutputItem + if err := json.Unmarshal(raw, &item); err != nil { + return err + } + switch item.Type { + case "message": + if s.sawTextDelta || s.emittedTextItem { + return nil + } + if err := s.addBounded(&s.textBytes, len(message.Content), maxResponsesTextBytes, "text"); err != nil { + return err + } + if message.Content != "" { + s.emittedTextItem = true + } + case "reasoning": + if s.sawReasoningDelta || s.emittedReasoning { + message.ReasoningContent = "" + } else if err := s.addBounded(&s.reasoningBytes, len(message.ReasoningContent), maxResponsesReasoningBytes, "reasoning"); err != nil { + return err + } + if message.ReasoningContent != "" { + s.emittedReasoning = true + } + if item.EncryptedContent != "" { + if s.emittedOpaqueItems[item.EncryptedContent] { + message.Extra = nil + } else { + s.emittedOpaqueItems[item.EncryptedContent] = true + } + } + case "function_call": + if s.emittedToolCalls[item.CallID] { + return nil + } + if err := s.addBounded(&s.toolBytes, len(item.Arguments)+len(item.Name)+len(item.CallID), maxResponsesToolBytes, "tool call"); err != nil { + return err + } + s.emittedToolCalls[item.CallID] = true + } + if message.Content == "" && message.ReasoningContent == "" && len(message.ToolCalls) == 0 && len(message.Extra) == 0 { + return nil + } + return emit(message) +} + +func (s *responsesSSEState) addBounded(total *int, delta, limit int, label string) error { + if delta < 0 || *total > limit-delta { + return fmt.Errorf("responses API %s exceeds %d-byte limit", label, limit) + } + *total += delta + return nil +} + +// ResponsesAPIError is a bounded provider error safe to surface through the +// runner. It never contains request headers or request bodies. +type ResponsesAPIError struct { + StatusCode int + Code string + Type string + Message string + RequestID string +} + +func (e *ResponsesAPIError) Error() string { + if e == nil { + return "Responses API error" + } + parts := []string{"Responses API error"} + if e.StatusCode != 0 { + parts = append(parts, fmt.Sprintf("status=%d", e.StatusCode)) + } + if e.Code != "" { + parts = append(parts, "code="+e.Code) + } + if e.Message != "" { + parts = append(parts, e.Message) + } + return strings.Join(parts, ": ") +} + +func decodeResponsesHTTPError(response *http.Response) error { + raw, readErr := readBounded(response.Body, maxResponsesErrorBytes) + if readErr != nil { + return &ResponsesAPIError{StatusCode: response.StatusCode, Message: "bounded error body could not be read"} + } + var envelope struct { + Error *responsesErrorBody `json:"error"` + } + _ = json.Unmarshal(raw, &envelope) + requestID := response.Header.Get("x-request-id") + return apiError(response.StatusCode, envelope.Error, requestID) +} + +func responseEnvelopeError(response responsesEnvelope) error { + message := response.Error + if message == nil && response.IncompleteDetails != nil { + message = &responsesErrorBody{Message: response.IncompleteDetails.Reason} + } + return apiError(0, message, response.ID) +} + +func apiError(status int, body *responsesErrorBody, requestID string) error { + if body == nil { + body = &responsesErrorBody{Message: "provider returned an unspecified error"} + } + return &ResponsesAPIError{ + StatusCode: status, + Code: boundedErrorText(body.Code, 128), + Type: boundedErrorText(body.Type, 128), + Message: boundedErrorText(body.Message, 1024), + RequestID: boundedErrorText(requestID, 256), + } +} + +func boundedErrorText(value string, maxBytes int) string { + value = strings.Map(func(r rune) rune { + if r == '\n' || r == '\r' || r == '\t' { + return ' ' + } + if r < 0x20 || r == 0x7f { + return -1 + } + return r + }, value) + if len(value) <= maxBytes { + return value + } + value = value[:maxBytes] + for !utf8.ValidString(value) && len(value) > 0 { + value = value[:len(value)-1] + } + return value + "…" +} diff --git a/internal/model/responses_test.go b/internal/model/responses_test.go new file mode 100644 index 00000000..ecb1ba37 --- /dev/null +++ b/internal/model/responses_test.go @@ -0,0 +1,411 @@ +package model + +import ( + "context" + "encoding/json" + "errors" + "io" + "net/http" + "net/http/httptest" + "strings" + "sync/atomic" + "testing" + + einomodel "github.com/cloudwego/eino/components/model" + "github.com/cloudwego/eino/schema" + "github.com/cnjack/jcode/internal/model/responsemeta" +) + +type capturedResponsesRequest struct { + Path string + Header http.Header + Body []byte + JSON map[string]json.RawMessage + CallIndex int +} + +type responsesRoundTripFunc func(*http.Request) (*http.Response, error) + +func (f responsesRoundTripFunc) RoundTrip(request *http.Request) (*http.Response, error) { + return f(request) +} + +func TestResponsesCodexGenerateUsesStrictContractAndOpaqueContinuity(t *testing.T) { + captured := make(chan capturedResponsesRequest, 1) + client := &http.Client{Transport: responsesRoundTripFunc(func(r *http.Request) (*http.Response, error) { + body, _ := io.ReadAll(r.Body) + var decoded map[string]json.RawMessage + _ = json.Unmarshal(body, &decoded) + captured <- capturedResponsesRequest{Path: r.URL.Path, Header: r.Header.Clone(), Body: body, JSON: decoded} + stream := "event: response.reasoning_summary_text.delta\n" + + "data: {\"type\":\"response.reasoning_summary_text.delta\",\"delta\":\"brief reason\"}\n\n" + + "event: response.output_text.delta\n" + + "data: {\"type\":\"response.output_text.delta\",\"delta\":\"hello\"}\n\n" + + "event: response.output_item.done\n" + + "data: {\"type\":\"response.output_item.done\",\"output_index\":0,\"item\":{\"type\":\"reasoning\",\"id\":\"rs-new\",\"summary\":[{\"type\":\"summary_text\",\"text\":\"must-not-persist\"}],\"encrypted_content\":\"cipher-new\"}}\n\n" + + "event: response.output_item.done\n" + + "data: {\"type\":\"response.output_item.done\",\"output_index\":1,\"item\":{\"type\":\"function_call\",\"call_id\":\"call-1\",\"name\":\"lookup\",\"arguments\":\"{\\\"q\\\":\\\"x\\\"}\"}}\n\n" + + "event: response.completed\n" + + "data: {\"type\":\"response.completed\",\"response\":{\"id\":\"resp-1\",\"status\":\"completed\",\"output\":[{\"type\":\"reasoning\",\"id\":\"rs-new\",\"summary\":[{\"type\":\"summary_text\",\"text\":\"must-not-persist\"}],\"encrypted_content\":\"cipher-new\"},{\"type\":\"message\",\"role\":\"assistant\",\"content\":[{\"type\":\"output_text\",\"text\":\"hello\"}]},{\"type\":\"function_call\",\"call_id\":\"call-1\",\"name\":\"lookup\",\"arguments\":\"{\\\"q\\\":\\\"x\\\"}\"}],\"usage\":{\"input_tokens\":10,\"output_tokens\":5,\"total_tokens\":15,\"input_tokens_details\":{\"cached_tokens\":3},\"output_tokens_details\":{\"reasoning_tokens\":2}}}}\n\n" + + "data: [DONE]\n\n" + return &http.Response{ + StatusCode: http.StatusOK, + Header: http.Header{"Content-Type": []string{"text/event-stream"}}, + Body: io.NopCloser(strings.NewReader(stream)), + Request: r, + }, nil + })} + + var credentialCalls atomic.Int32 + chatModel, err := NewResponsesModel(context.Background(), &ResponsesModelConfig{ + Model: "gpt-test", + BaseURL: "https://example.test/backend-api/codex", + Headers: map[string]string{"Authorization": "Bearer stale", "X-Account": "stale"}, + Credential: func(context.Context) (string, map[string]string, error) { + credentialCalls.Add(1) + return "fresh-token", map[string]string{"X-Account": "fresh"}, nil + }, + Codex: true, + HTTPClient: client, + }) + if err != nil { + t.Fatal(err) + } + + oldOpaque := json.RawMessage(`{"type":"reasoning","id":"rs-old","summary":[{"type":"summary_text","text":"clear-old"}],"encrypted_content":"cipher-old"}`) + message, err := chatModel.Generate(context.Background(), []*schema.Message{ + schema.SystemMessage("follow the project rules"), + schema.UserMessage("first"), + { + Role: schema.Assistant, Content: "prior", + Extra: map[string]any{responsemeta.OpaqueItemsExtraKey: []json.RawMessage{oldOpaque}}, + }, + schema.UserMessage("continue"), + }, einomodel.WithMaxTokens(99), einomodel.WithTemperature(0.4)) + if err != nil { + t.Fatal(err) + } + if credentialCalls.Load() != 1 { + t.Fatalf("credential calls = %d, want 1", credentialCalls.Load()) + } + if message.Content != "hello" || message.ReasoningContent != "brief reason" { + t.Fatalf("message = %#v", message) + } + if len(message.ToolCalls) != 1 || message.ToolCalls[0].ID != "call-1" || + message.ToolCalls[0].Function.Arguments != `{"q":"x"}` { + t.Fatalf("tool calls = %#v", message.ToolCalls) + } + opaque := responsemeta.FromExtra(message.Extra) + if len(opaque) != 1 || !strings.Contains(string(opaque[0]), "cipher-new") || + strings.Contains(string(opaque[0]), "must-not-persist") { + t.Fatalf("opaque items = %s", opaque) + } + if message.ResponseMeta == nil || message.ResponseMeta.Usage == nil || + message.ResponseMeta.Usage.TotalTokens != 15 { + t.Fatalf("response meta = %#v", message.ResponseMeta) + } + + request := <-captured + if request.Path != "/backend-api/codex/responses" { + t.Fatalf("path = %q", request.Path) + } + if got := request.Header.Get("Authorization"); got != "Bearer fresh-token" { + t.Fatalf("Authorization = %q", got) + } + if got := request.Header.Get("X-Account"); got != "fresh" { + t.Fatalf("X-Account = %q", got) + } + assertJSONField(t, request.JSON, "stream", "true") + assertJSONField(t, request.JSON, "store", "false") + assertJSONField(t, request.JSON, "instructions", `"follow the project rules"`) + assertJSONField(t, request.JSON, "tools", "[]") + assertJSONField(t, request.JSON, "parallel_tool_calls", "false") + assertJSONField(t, request.JSON, "include", `["reasoning.encrypted_content"]`) + for _, forbidden := range []string{"max_output_tokens", "temperature", "top_p"} { + if _, ok := request.JSON[forbidden]; ok { + t.Errorf("Codex request contains forbidden field %q", forbidden) + } + } + requestText := string(request.Body) + if !strings.Contains(requestText, "cipher-old") || strings.Contains(requestText, "clear-old") { + t.Fatalf("request did not replay only canonical opaque reasoning: %s", requestText) + } +} + +func TestResponsesStandardGenerateRefreshesCredentialPerDispatch(t *testing.T) { + captured := make(chan capturedResponsesRequest, 2) + client := &http.Client{Transport: responsesRoundTripFunc(func(r *http.Request) (*http.Response, error) { + body, _ := io.ReadAll(r.Body) + var decoded map[string]json.RawMessage + _ = json.Unmarshal(body, &decoded) + captured <- capturedResponsesRequest{Header: r.Header.Clone(), Body: body, JSON: decoded} + return &http.Response{ + StatusCode: http.StatusOK, + Header: http.Header{"Content-Type": []string{"application/json"}}, + Body: io.NopCloser(strings.NewReader( + `{"id":"resp","status":"completed","output":[{"type":"message","role":"assistant","content":[{"type":"output_text","text":"ok"}]}],"usage":{"input_tokens":1,"output_tokens":1,"total_tokens":2}}`, + )), + Request: r, + }, nil + })} + var calls atomic.Int32 + chatModel, err := NewResponsesModel(context.Background(), &ResponsesModelConfig{ + Model: "grok-test", BaseURL: "https://example.test/v1", Vision: true, HTTPClient: client, + Credential: func(context.Context) (string, map[string]string, error) { + call := calls.Add(1) + return "token-" + string('0'+call), nil, nil + }, + }) + if err != nil { + t.Fatal(err) + } + for range 2 { + message, generateErr := chatModel.Generate( + context.Background(), []*schema.Message{schema.UserMessage("hi")}, + einomodel.WithMaxTokens(123), einomodel.WithTemperature(0.2), einomodel.WithTopP(0.9), + ) + if generateErr != nil || message.Content != "ok" { + t.Fatalf("Generate message=%#v err=%v", message, generateErr) + } + } + for index := 1; index <= 2; index++ { + request := <-captured + wantAuth := "Bearer token-" + string(rune('0'+index)) + if request.Header.Get("Authorization") != wantAuth { + t.Fatalf("dispatch %d Authorization = %q, want %q", index, request.Header.Get("Authorization"), wantAuth) + } + assertJSONField(t, request.JSON, "stream", "false") + assertJSONField(t, request.JSON, "max_output_tokens", "123") + if _, ok := request.JSON["store"]; ok { + t.Fatal("standard Responses request unexpectedly contains store") + } + if _, ok := request.JSON["include"]; ok { + t.Fatal("standard Responses request unexpectedly contains include") + } + } +} + +func TestResponsesDispatchRejectsEmptyDynamicToken(t *testing.T) { + var dispatched atomic.Bool + client := &http.Client{Transport: responsesRoundTripFunc(func(*http.Request) (*http.Response, error) { + dispatched.Store(true) + return nil, errors.New("must not dispatch") + })} + chatModel, err := NewResponsesModel(context.Background(), &ResponsesModelConfig{ + Model: "grok-test", BaseURL: "https://example.test/v1", HTTPClient: client, + Credential: func(context.Context) (string, map[string]string, error) { + return " ", map[string]string{"Authorization": "Bearer stale"}, nil + }, + }) + if err != nil { + t.Fatal(err) + } + _, err = chatModel.Generate(context.Background(), []*schema.Message{schema.UserMessage("hi")}) + if err == nil || !strings.Contains(err.Error(), "empty token") { + t.Fatalf("error = %v, want empty-token failure", err) + } + if dispatched.Load() { + t.Fatal("request was dispatched without a dynamic token") + } +} + +func TestResponsesDispatchDoesNotFollow307Or308Redirects(t *testing.T) { + for _, statusCode := range []int{http.StatusTemporaryRedirect, http.StatusPermanentRedirect} { + t.Run(http.StatusText(statusCode), func(t *testing.T) { + targetRequests := make(chan capturedResponsesRequest, 1) + target := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + body, _ := io.ReadAll(r.Body) + targetRequests <- capturedResponsesRequest{Header: r.Header.Clone(), Body: body} + w.Header().Set("Content-Type", "application/json") + _, _ = io.WriteString(w, + `{"status":"completed","output":[{"type":"message","role":"assistant","content":[{"type":"output_text","text":"redirected"}]}]}`, + ) + })) + defer target.Close() + + redirect := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { + w.Header().Set("Location", target.URL+"/capture") + w.WriteHeader(statusCode) + })) + defer redirect.Close() + + var injectedPolicyCalls atomic.Int32 + injected := &http.Client{CheckRedirect: func(*http.Request, []*http.Request) error { + injectedPolicyCalls.Add(1) + return nil + }} + chatModel, err := NewResponsesModel(context.Background(), &ResponsesModelConfig{ + Model: "grok-test", BaseURL: redirect.URL, HTTPClient: injected, + Headers: map[string]string{ + "Authorization": "Bearer stale-token", + "X-Protected": "stale-protected", + }, + Credential: func(context.Context) (string, map[string]string, error) { + return "dynamic-token", map[string]string{"X-Protected": "dynamic-protected"}, nil + }, + }) + if err != nil { + t.Fatal(err) + } + + _, err = chatModel.Generate(context.Background(), []*schema.Message{ + schema.UserMessage("do-not-forward-body"), + }) + var apiErr *ResponsesAPIError + if !errors.As(err, &apiErr) || apiErr.StatusCode != statusCode { + t.Fatalf("Generate error = %v, want ResponsesAPIError status %d", err, statusCode) + } + if injectedPolicyCalls.Load() != 0 { + t.Fatalf("injected redirect policy was used %d time(s)", injectedPolicyCalls.Load()) + } + select { + case leaked := <-targetRequests: + t.Fatalf("redirect target received body=%q Authorization=%q X-Protected=%q", + leaked.Body, leaked.Header.Get("Authorization"), leaked.Header.Get("X-Protected")) + default: + } + // NewResponsesModel must not mutate a caller-owned client while replacing + // the redirect policy on its private shallow clone. + if err := injected.CheckRedirect(nil, nil); err != nil || injectedPolicyCalls.Load() != 1 { + t.Fatalf("injected client redirect policy was mutated: calls=%d err=%v", + injectedPolicyCalls.Load(), err) + } + }) + } +} + +func TestResponsesConversationItemsDropOrphanOpaqueReasoning(t *testing.T) { + opaque := json.RawMessage(`{"type":"reasoning","id":"rs-orphan","summary":[],"encrypted_content":"cipher-orphan"}`) + extra := responsemeta.Extra([]json.RawMessage{opaque}) + + orphan, err := responsesConversationItems(&schema.Message{ + Role: schema.Assistant, Extra: extra, + }, false, NewModelImageBudget()) + if err != nil { + t.Fatal(err) + } + if len(orphan) != 0 { + t.Fatalf("orphan assistant items = %s, want none", orphan) + } + + withContent, err := responsesConversationItems(&schema.Message{ + Role: schema.Assistant, Content: "visible", Extra: extra, + }, false, NewModelImageBudget()) + if err != nil { + t.Fatal(err) + } + if len(withContent) != 2 || !strings.Contains(string(withContent[0]), "cipher-orphan") || + !strings.Contains(string(withContent[1]), "visible") { + t.Fatalf("assistant content items = %s", withContent) + } + + withToolCall, err := responsesConversationItems(&schema.Message{ + Role: schema.Assistant, + ToolCalls: []schema.ToolCall{{ + ID: "call-1", Function: schema.FunctionCall{Name: "lookup", Arguments: `{}`}, + }}, + Extra: extra, + }, false, NewModelImageBudget()) + if err != nil { + t.Fatal(err) + } + if len(withToolCall) != 2 || !strings.Contains(string(withToolCall[0]), "cipher-orphan") || + !strings.Contains(string(withToolCall[1]), `"type":"function_call"`) { + t.Fatalf("assistant tool-call items = %s", withToolCall) + } +} + +func TestDecodeResponsesSSEDeduplicatesDoneAndCompletedItems(t *testing.T) { + stream := "data: {\"type\":\"response.output_item.done\",\"item\":{\"type\":\"reasoning\",\"id\":\"rs\",\"summary\":[{\"type\":\"summary_text\",\"text\":\"why\"}],\"encrypted_content\":\"cipher\"}}\n\n" + + "data: {\"type\":\"response.output_item.done\",\"item\":{\"type\":\"message\",\"role\":\"assistant\",\"content\":[{\"type\":\"output_text\",\"text\":\"answer\"}]}}\n\n" + + "data: {\"type\":\"response.completed\",\"response\":{\"status\":\"completed\",\"output\":[{\"type\":\"reasoning\",\"id\":\"rs\",\"summary\":[{\"type\":\"summary_text\",\"text\":\"why\"}],\"encrypted_content\":\"cipher\"},{\"type\":\"message\",\"role\":\"assistant\",\"content\":[{\"type\":\"output_text\",\"text\":\"answer\"}]}]}}\n\n" + message := &schema.Message{Role: schema.Assistant} + _, err := decodeResponsesSSE(strings.NewReader(stream), func(chunk *schema.Message) error { + mergeResponsesMessage(message, chunk) + return nil + }) + if err != nil { + t.Fatal(err) + } + if message.Content != "answer" || message.ReasoningContent != "why" { + t.Fatalf("deduplicated message = %#v", message) + } + if items := responsemeta.FromExtra(message.Extra); len(items) != 1 { + t.Fatalf("opaque items = %s", items) + } +} + +func TestDecodeResponsesSSEPreservesOutputIndexesForParallelToolCalls(t *testing.T) { + stream := "data: {\"type\":\"response.output_item.done\",\"output_index\":2,\"item\":{\"type\":\"function_call\",\"call_id\":\"call-a\",\"name\":\"first\",\"arguments\":\"{}\"}}\n\n" + + "data: {\"type\":\"response.output_item.done\",\"output_index\":5,\"item\":{\"type\":\"function_call\",\"call_id\":\"call-b\",\"name\":\"second\",\"arguments\":\"{}\"}}\n\n" + + "data: {\"type\":\"response.completed\",\"response\":{\"status\":\"completed\",\"output\":[]}}\n\n" + var calls []schema.ToolCall + _, err := decodeResponsesSSE(strings.NewReader(stream), func(message *schema.Message) error { + calls = append(calls, message.ToolCalls...) + return nil + }) + if err != nil { + t.Fatal(err) + } + assertToolCallIndexes(t, calls, []int{2, 5}) +} + +func TestDecodeResponsesSSEAssignsOutputIndexesToCompletedFallbackToolCalls(t *testing.T) { + stream := "data: {\"type\":\"response.completed\",\"response\":{\"status\":\"completed\",\"output\":[" + + "{\"type\":\"message\",\"role\":\"assistant\",\"content\":[{\"type\":\"output_text\",\"text\":\"working\"}]}," + + "{\"type\":\"function_call\",\"call_id\":\"call-a\",\"name\":\"first\",\"arguments\":\"{}\"}," + + "{\"type\":\"function_call\",\"call_id\":\"call-b\",\"name\":\"second\",\"arguments\":\"{}\"}]}}\n\n" + var calls []schema.ToolCall + _, err := decodeResponsesSSE(strings.NewReader(stream), func(message *schema.Message) error { + calls = append(calls, message.ToolCalls...) + return nil + }) + if err != nil { + t.Fatal(err) + } + assertToolCallIndexes(t, calls, []int{1, 2}) +} + +func TestDecodeResponsesSSERejectsTruncatedStream(t *testing.T) { + stream := "data: {\"type\":\"response.output_text.delta\",\"delta\":\"partial\"}\n\n" + _, err := decodeResponsesSSE(strings.NewReader(stream), func(*schema.Message) error { return nil }) + if err == nil || !strings.Contains(err.Error(), "terminal event") { + t.Fatalf("error = %v, want missing terminal event", err) + } +} + +func TestDecodeResponsesSSEAcceptsCRLF(t *testing.T) { + stream := "data: {\"type\":\"response.output_text.delta\",\"delta\":\"ok\"}\r\n\r\n" + + "data: [DONE]\r\n\r\n" + var content string + _, err := decodeResponsesSSE(strings.NewReader(stream), func(message *schema.Message) error { + content += message.Content + return nil + }) + if err != nil || content != "ok" { + t.Fatalf("content=%q err=%v", content, err) + } +} + +func assertJSONField(t *testing.T, object map[string]json.RawMessage, key, want string) { + t.Helper() + got, ok := object[key] + if !ok { + t.Fatalf("missing JSON field %q in %#v", key, object) + } + if string(got) != want { + t.Fatalf("JSON field %q = %s, want %s", key, got, want) + } +} + +func assertToolCallIndexes(t *testing.T, calls []schema.ToolCall, want []int) { + t.Helper() + if len(calls) != len(want) { + t.Fatalf("tool calls = %#v, want %d calls", calls, len(want)) + } + for index, call := range calls { + if call.Index == nil || *call.Index != want[index] { + t.Fatalf("tool call %d index = %v, want %d", index, call.Index, want[index]) + } + } +} diff --git a/internal/providerauth/codex.go b/internal/providerauth/codex.go new file mode 100644 index 00000000..04bc2879 --- /dev/null +++ b/internal/providerauth/codex.go @@ -0,0 +1,241 @@ +package providerauth + +import ( + "context" + "errors" + "fmt" + "net/http" + "net/url" + "time" +) + +const ( + codexClientID = "app_EMoamEEZ73f0CkXaXp7hrann" + codexRedirectURI = "https://auth.openai.com/deviceauth/callback" + codexOriginator = "codex_cli_rs" + codexClientVersion = "0.144.1" + codexUserAgent = "jcode-codex-oauth" +) + +func (manager *Manager) startCodex(ctx context.Context) (*pendingFlow, error) { + if err := manager.validateVerificationURIs( + manager.endpoints.CodexVerification, "", "auth.openai.com", + ); err != nil { + return nil, err + } + status, value, err := manager.postJSON( + ctx, + manager.endpoints.CodexDeviceStart, + map[string]string{"client_id": codexClientID}, + map[string]string{"User-Agent": codexUserAgent}, + ) + if err != nil { + return nil, err + } + if status < http.StatusOK || status >= http.StatusMultipleChoices { + return nil, upstreamError("start ChatGPT device authorization", status, value) + } + deviceCode := stringField(value, "device_auth_id") + userCode := stringField(value, "user_code") + if deviceCode == "" || userCode == "" { + return nil, errors.New("ChatGPT device authorization response is missing required fields") + } + expiresIn := clampSeconds(intField(value, "expires_in", 900), 24*60*60) + interval := clampSeconds(intField(value, "interval", 5), 60) + 3 + now := manager.now() + return &pendingFlow{ + public: Flow{ + Method: MethodCodexOAuth, + State: FlowStatePending, + UserCode: userCode, + VerificationURI: manager.endpoints.CodexVerification, + ExpiresAt: now.Add(time.Duration(expiresIn) * time.Second), + IntervalSeconds: int(interval), + }, + deviceCode: deviceCode, + nextPollAt: now, + interval: time.Duration(interval) * time.Second, + }, nil +} + +func (manager *Manager) pollCodex(ctx context.Context, pending *pendingFlow) (Flow, error) { + status, value, err := manager.postJSON( + ctx, + manager.endpoints.CodexDevicePoll, + map[string]string{ + "device_auth_id": pending.deviceCode, + "user_code": pending.public.UserCode, + }, + map[string]string{"User-Agent": codexUserAgent}, + ) + if err != nil { + return Flow{}, err + } + switch status { + case http.StatusForbidden, http.StatusNotFound: + return pending.public, nil + case http.StatusGone: + return terminalFlow(pending.public, FlowStateExpired, ErrFlowExpired), nil + } + if status < http.StatusOK || status >= http.StatusMultipleChoices { + return Flow{}, upstreamError("poll ChatGPT device authorization", status, value) + } + code := stringField(value, "authorization_code") + verifier := stringField(value, "code_verifier") + if code == "" || verifier == "" { + return Flow{}, errors.New("ChatGPT device authorization poll response is missing required fields") + } + tokens, err := manager.exchangeCodexCode(ctx, code, verifier) + if err != nil { + return Flow{}, err + } + accountID, login := codexIdentity(tokens) + if accountID == "" { + return Flow{}, errors.New("ChatGPT token does not contain a stable account ID") + } + refresh := stringField(tokens, "refresh_token") + access := stringField(tokens, "access_token") + if refresh == "" || access == "" { + return Flow{}, errors.New("ChatGPT token response is missing a required token") + } + account := storedAccount{ + ID: accountID, Login: login, Secret: refresh, AuthenticatedAt: manager.now().UTC(), + } + if account.Login == "" { + account.Login = "ChatGPT (" + shortID(accountID) + ")" + } + if err := manager.commitFlowAccount(MethodCodexOAuth, pending, account); err != nil { + return Flow{}, err + } + manager.cache( + MethodCodexOAuth, + accountID, + access, + tokenExpiry(manager.now, intField(tokens, "expires_in", 3600)), + ) + flow := pending.public + flow.State = FlowStateAuthorized + public := account.public() + flow.Account = &public + return flow, nil +} + +func (manager *Manager) exchangeCodexCode( + ctx context.Context, + code string, + verifier string, +) (map[string]any, error) { + status, value, err := manager.postForm( + ctx, + manager.endpoints.CodexToken, + url.Values{ + "grant_type": {"authorization_code"}, + "code": {code}, + "redirect_uri": {codexRedirectURI}, + "client_id": {codexClientID}, + "code_verifier": {verifier}, + }, + map[string]string{"User-Agent": codexUserAgent}, + ) + if err != nil { + return nil, err + } + if status < http.StatusOK || status >= http.StatusMultipleChoices { + return nil, upstreamError("exchange ChatGPT authorization code", status, value) + } + return value, nil +} + +func codexIdentity(tokens map[string]any) (string, string) { + for _, token := range []string{stringField(tokens, "id_token"), stringField(tokens, "access_token")} { + payload := jwtPayload(token) + if payload == nil { + continue + } + accountID := stringField(payload, "chatgpt_account_id") + if accountID == "" { + accountID = nestedString(payload, "https://api.openai.com/auth", "chatgpt_account_id") + } + if accountID == "" { + if organizations, ok := payload["organizations"].([]any); ok && len(organizations) > 0 { + organization, _ := organizations[0].(map[string]any) + accountID = stringField(organization, "id") + } + } + if accountID != "" { + return accountID, stringField(payload, "email") + } + } + return "", "" +} + +func (manager *Manager) refreshCodex( + ctx context.Context, + account storedAccount, +) (string, error) { + status, value, err := manager.postForm( + ctx, + manager.endpoints.CodexToken, + url.Values{ + "grant_type": {"refresh_token"}, + "refresh_token": {account.Secret}, + "client_id": {codexClientID}, + "scope": {"openid profile email"}, + }, + map[string]string{"User-Agent": codexUserAgent}, + ) + if err != nil { + return "", err + } + code := oauthError(value) + if status == http.StatusUnauthorized || status == http.StatusForbidden || + (status == http.StatusBadRequest && len(value) == 0) || + code == "invalid_grant" || code == "invalid_token" { + if err := manager.markRequiresReauth(MethodCodexOAuth, account.ID, account.Secret); err != nil { + return "", err + } + return "", fmt.Errorf("%w: %s", ErrRequiresReauth, account.ID) + } + if status < http.StatusOK || status >= http.StatusMultipleChoices || code != "" { + return "", upstreamError("refresh ChatGPT access token", status, value) + } + access := stringField(value, "access_token") + if access == "" { + return "", errors.New("ChatGPT refresh response is missing access_token") + } + if err := manager.replaceSecret( + MethodCodexOAuth, account.ID, account.Secret, stringField(value, "refresh_token"), + ); err != nil { + return "", err + } + manager.cache( + MethodCodexOAuth, + account.ID, + access, + tokenExpiry(manager.now, intField(value, "expires_in", 3600)), + ) + return access, nil +} + +func clampSeconds(value, maximum int64) int64 { + if value < 1 { + return 1 + } + if value > maximum { + return maximum + } + return value +} + +func terminalFlow(flow Flow, state FlowState, err error) Flow { + flow.State = state + flow.Error = err.Error() + return flow +} + +func shortID(id string) string { + if len(id) <= 12 { + return id + } + return id[:12] +} diff --git a/internal/providerauth/copilot.go b/internal/providerauth/copilot.go new file mode 100644 index 00000000..4204a653 --- /dev/null +++ b/internal/providerauth/copilot.go @@ -0,0 +1,293 @@ +package providerauth + +import ( + "context" + "encoding/json" + "errors" + "fmt" + "net/http" + "net/url" + "strconv" + "strings" + "time" +) + +const ( + copilotGitHubClientID = "Iv1.b507a08c87ecfe98" + copilotEditorVersion = "vscode/1.110.1" + copilotPluginVersion = "copilot-chat/0.38.2" + copilotUserAgent = "GitHubCopilotChat/0.38.2" + copilotAPIVersion = "2025-10-01" + copilotIntegrationID = "vscode-chat" +) + +func (manager *Manager) startCopilot(ctx context.Context) (*pendingFlow, error) { + status, value, err := manager.postForm( + ctx, + manager.endpoints.CopilotDeviceStart, + url.Values{ + "client_id": {copilotGitHubClientID}, + "scope": {"read:user"}, + }, + copilotGitHubHeaders(), + ) + if err != nil { + return nil, err + } + if status < http.StatusOK || status >= http.StatusMultipleChoices { + return nil, upstreamError("start GitHub device authorization", status, value) + } + deviceCode := stringField(value, "device_code") + userCode := stringField(value, "user_code") + verificationURI := stringField(value, "verification_uri") + verificationComplete := stringField(value, "verification_uri_complete") + if deviceCode == "" || userCode == "" || verificationURI == "" { + return nil, errors.New("GitHub device authorization response is missing required fields") + } + if err := manager.validateVerificationURIs( + verificationURI, verificationComplete, "github.com", + ); err != nil { + return nil, err + } + expiresIn := clampSeconds(intField(value, "expires_in", 900), 24*60*60) + interval := clampSeconds(intField(value, "interval", 5), 60) + 3 + now := manager.now() + return &pendingFlow{ + public: Flow{ + Method: MethodGitHubCopilot, + State: FlowStatePending, + UserCode: userCode, + VerificationURI: verificationURI, + VerificationURIComplete: verificationComplete, + ExpiresAt: now.Add(time.Duration(expiresIn) * time.Second), + IntervalSeconds: int(interval), + }, + deviceCode: deviceCode, + nextPollAt: now, + interval: time.Duration(interval) * time.Second, + }, nil +} + +func (manager *Manager) pollCopilot(ctx context.Context, pending *pendingFlow) (Flow, error) { + status, value, err := manager.postForm( + ctx, + manager.endpoints.CopilotOAuthToken, + url.Values{ + "client_id": {copilotGitHubClientID}, + "device_code": {pending.deviceCode}, + "grant_type": {"urn:ietf:params:oauth:grant-type:device_code"}, + }, + copilotGitHubHeaders(), + ) + if err != nil { + return Flow{}, err + } + switch oauthError(value) { + case "authorization_pending": + return pending.public, nil + case "slow_down": + pending.interval = min(pending.interval+5*time.Second, 63*time.Second) + pending.public.IntervalSeconds = int(pending.interval / time.Second) + pending.nextPollAt = manager.now().Add(pending.interval) + return pending.public, nil + case "access_denied": + return terminalFlow(pending.public, FlowStateDenied, ErrAccessDenied), nil + case "expired_token": + return terminalFlow(pending.public, FlowStateExpired, ErrFlowExpired), nil + case "": + default: + return Flow{}, upstreamError("poll GitHub device authorization", status, value) + } + if status < http.StatusOK || status >= http.StatusMultipleChoices { + return Flow{}, upstreamError("poll GitHub device authorization", status, value) + } + githubToken := stringField(value, "access_token") + if githubToken == "" { + return Flow{}, errors.New("GitHub OAuth response is missing access_token") + } + accountID, login, err := manager.fetchGitHubUser(ctx, githubToken) + if err != nil { + return Flow{}, err + } + copilotToken, expiresAt, err := manager.exchangeCopilotToken(ctx, githubToken) + if err != nil { + return Flow{}, err + } + account := storedAccount{ + ID: accountID, Login: login, Secret: githubToken, AuthenticatedAt: manager.now().UTC(), + } + if err := manager.commitFlowAccount(MethodGitHubCopilot, pending, account); err != nil { + return Flow{}, err + } + manager.cache(MethodGitHubCopilot, accountID, copilotToken, expiresAt) + flow := pending.public + flow.State = FlowStateAuthorized + public := account.public() + flow.Account = &public + return flow, nil +} + +func copilotGitHubHeaders() map[string]string { + return map[string]string{ + "Accept": "application/json", + "User-Agent": copilotUserAgent, + "Editor-Version": copilotEditorVersion, + "Editor-Plugin-Version": copilotPluginVersion, + } +} + +func (manager *Manager) fetchGitHubUser( + ctx context.Context, + githubToken string, +) (string, string, error) { + headers := copilotGitHubHeaders() + headers["Authorization"] = "Bearer " + githubToken + status, value, err := manager.getJSON(ctx, manager.endpoints.CopilotUser, headers) + if err != nil { + return "", "", err + } + if status == http.StatusUnauthorized || status == http.StatusForbidden { + return "", "", errors.New("GitHub OAuth token was rejected") + } + if status < http.StatusOK || status >= http.StatusMultipleChoices { + return "", "", upstreamError("fetch GitHub account", status, value) + } + id := numericStringField(value, "id") + login := stringField(value, "login") + if id == "" || login == "" { + return "", "", errors.New("GitHub account response is missing id or login") + } + return id, login, nil +} + +func numericStringField(value map[string]any, name string) string { + switch raw := value[name].(type) { + case string: + return raw + case json.Number: + return raw.String() + case float64: + return strconv.FormatInt(int64(raw), 10) + default: + return "" + } +} + +func (manager *Manager) exchangeCopilotToken( + ctx context.Context, + githubToken string, +) (string, time.Time, error) { + headers := copilotGitHubHeaders() + headers["Authorization"] = "token " + githubToken + status, value, err := manager.getJSON(ctx, manager.endpoints.CopilotToken, headers) + if err != nil { + return "", time.Time{}, err + } + if status == http.StatusUnauthorized { + return "", time.Time{}, errors.New("GitHub OAuth token was rejected") + } + if status == http.StatusForbidden { + return "", time.Time{}, ErrNoCopilotSubscription + } + if status < http.StatusOK || status >= http.StatusMultipleChoices { + return "", time.Time{}, upstreamError("exchange GitHub Copilot token", status, value) + } + token := stringField(value, "token") + if token == "" { + return "", time.Time{}, errors.New("GitHub Copilot token response is missing token") + } + expiresAt := time.Unix(intField(value, "expires_at", manager.now().Add(time.Hour).Unix()), 0) + if !expiresAt.After(manager.now().Add(refreshBuffer)) { + return "", time.Time{}, errors.New("GitHub Copilot token response contains an expired token") + } + return token, expiresAt, nil +} + +func (manager *Manager) refreshCopilot( + ctx context.Context, + account storedAccount, +) (string, error) { + token, expiresAt, err := manager.exchangeCopilotToken(ctx, account.Secret) + if err != nil { + if errors.Is(err, ErrNoCopilotSubscription) { + return "", err + } + if strings.Contains(err.Error(), "OAuth token was rejected") { + if markErr := manager.markRequiresReauth( + MethodGitHubCopilot, account.ID, account.Secret, + ); markErr != nil { + return "", markErr + } + return "", fmt.Errorf("%w: %s", ErrRequiresReauth, account.ID) + } + return "", err + } + if err := manager.store.compareSecret(MethodGitHubCopilot, account.ID, account.Secret); err != nil { + return "", err + } + manager.cache(MethodGitHubCopilot, account.ID, token, expiresAt) + return token, nil +} + +func (manager *Manager) copilotEndpoint(ctx context.Context, account storedAccount) (string, error) { + key := accountKey(MethodGitHubCopilot, account.ID) + manager.mu.RLock() + endpoint := manager.copilotEndpoints[key] + manager.mu.RUnlock() + if endpoint != "" { + return endpoint, nil + } + lock := manager.endpointLock(MethodGitHubCopilot, account.ID) + lock.Lock() + defer lock.Unlock() + manager.mu.RLock() + endpoint = manager.copilotEndpoints[key] + manager.mu.RUnlock() + if endpoint != "" { + return endpoint, nil + } + headers := copilotGitHubHeaders() + headers["Authorization"] = "token " + account.Secret + status, value, err := manager.getJSON(ctx, manager.endpoints.CopilotUsage, headers) + if err != nil { + endpoint = manager.endpoints.CopilotRuntime + manager.mu.Lock() + manager.copilotEndpoints[key] = endpoint + manager.mu.Unlock() + return endpoint, nil + } + if status == http.StatusUnauthorized { + if markErr := manager.markRequiresReauth( + MethodGitHubCopilot, account.ID, account.Secret, + ); markErr != nil { + return "", markErr + } + return "", fmt.Errorf("%w: %s", ErrRequiresReauth, account.ID) + } + if status >= http.StatusOK && status < http.StatusMultipleChoices { + candidate := nestedString(value, "endpoints", "api") + if candidate != "" && manager.validCopilotRuntime(candidate) { + endpoint = candidate + } + } + if endpoint == "" { + endpoint = manager.endpoints.CopilotRuntime + } + manager.mu.Lock() + manager.copilotEndpoints[key] = endpoint + manager.mu.Unlock() + return endpoint, nil +} + +func (manager *Manager) validCopilotRuntime(endpoint string) bool { + parsed, err := url.Parse(endpoint) + if err != nil || parsed.User != nil { + return false + } + if manager.allowUnsafe { + return parsed.Scheme == "http" || parsed.Scheme == "https" + } + host := parsed.Hostname() + return parsed.Scheme == "https" && parsed.Port() == "" && + (host == "api.githubcopilot.com" || strings.HasSuffix(host, ".githubcopilot.com")) +} diff --git a/internal/providerauth/credential.go b/internal/providerauth/credential.go new file mode 100644 index 00000000..9a3f5ed2 --- /dev/null +++ b/internal/providerauth/credential.go @@ -0,0 +1,112 @@ +package providerauth + +import ( + "context" + "errors" + "fmt" +) + +// Credential resolves a fresh runtime token and the immutable managed runtime +// profile for a Provider binding. +func (manager *Manager) Credential(ctx context.Context, binding Binding) (Credential, error) { + if err := validateMethod(binding.Method); err != nil { + return Credential{}, err + } + account, err := manager.store.resolve(binding) + if err != nil { + return Credential{}, err + } + token, err := manager.tokenForAccount(ctx, binding.Method, account.ID) + if err != nil { + return Credential{}, err + } + credential := Credential{Token: token, AccountID: account.ID} + switch binding.Method { + case MethodCodexOAuth: + credential.BaseURL = manager.endpoints.CodexRuntime + credential.Protocol = ProtocolResponses + credential.Headers = map[string]string{ + "chatgpt-account-id": account.ID, + "originator": codexOriginator, + "version": codexClientVersion, + } + case MethodXAIOAuth: + credential.BaseURL = manager.endpoints.XAIRuntime + credential.Protocol = ProtocolResponses + case MethodGitHubCopilot: + latest, resolveErr := manager.store.resolve(Binding{ + Method: MethodGitHubCopilot, AccountID: account.ID, + }) + if resolveErr != nil { + return Credential{}, resolveErr + } + credential.BaseURL, err = manager.copilotEndpoint(ctx, latest) + if err != nil { + return Credential{}, err + } + credential.Protocol = ProtocolChatCompletions + requestID, randomErr := manager.randomUUID() + if randomErr != nil { + return Credential{}, randomErr + } + credential.Headers = copilotRuntimeHeaders(requestID) + default: + return Credential{}, fmt.Errorf("%w: %q", ErrUnsupportedMethod, binding.Method) + } + return credential, nil +} + +func (manager *Manager) tokenForAccount( + ctx context.Context, + method Method, + accountID string, +) (string, error) { + if token, ok := manager.cached(method, accountID); ok { + return token, nil + } + lock := manager.refreshLock(method, accountID) + lock.Lock() + defer lock.Unlock() + if token, ok := manager.cached(method, accountID); ok { + return token, nil + } + for attempt := 0; attempt < 2; attempt++ { + account, err := manager.store.resolve(Binding{Method: method, AccountID: accountID}) + if err != nil { + return "", err + } + var token string + switch method { + case MethodCodexOAuth: + token, err = manager.refreshCodex(ctx, account) + case MethodXAIOAuth: + token, err = manager.refreshXAI(ctx, account) + case MethodGitHubCopilot: + token, err = manager.refreshCopilot(ctx, account) + default: + return "", fmt.Errorf("%w: %q", ErrUnsupportedMethod, method) + } + if errors.Is(err, errSecretChanged) { + manager.invalidate(method, accountID) + continue + } + return token, err + } + return "", errors.New("provider auth secret changed repeatedly during refresh") +} + +func copilotRuntimeHeaders(requestID string) map[string]string { + return map[string]string{ + "editor-version": copilotEditorVersion, + "editor-plugin-version": copilotPluginVersion, + "copilot-integration-id": copilotIntegrationID, + "user-agent": copilotUserAgent, + "x-github-api-version": copilotAPIVersion, + "openai-intent": "conversation-agent", + "x-initiator": "user", + "x-interaction-type": "conversation-agent", + "x-vscode-user-agent-library-version": "electron-fetch", + "x-request-id": requestID, + "x-agent-task-id": requestID, + } +} diff --git a/internal/providerauth/filelock_unix.go b/internal/providerauth/filelock_unix.go new file mode 100644 index 00000000..e850325c --- /dev/null +++ b/internal/providerauth/filelock_unix.go @@ -0,0 +1,46 @@ +//go:build !windows + +package providerauth + +import ( + "os" + + "golang.org/x/sys/unix" +) + +type fileLock struct{ file *os.File } + +func acquireFileLock(path string) (*fileLock, error) { + file, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR, 0o600) + if err != nil { + return nil, err + } + if err := file.Chmod(0o600); err != nil { + _ = file.Close() + return nil, err + } + if err := unix.Flock(int(file.Fd()), unix.LOCK_EX); err != nil { + _ = file.Close() + return nil, err + } + return &fileLock{file: file}, nil +} + +func (lock *fileLock) release() error { + if lock == nil || lock.file == nil { + return nil + } + _ = unix.Flock(int(lock.file.Fd()), unix.LOCK_UN) + return lock.file.Close() +} + +func replaceFile(source, destination string) error { return os.Rename(source, destination) } + +func syncDirectory(path string) error { + dir, err := os.Open(path) + if err != nil { + return err + } + defer func() { _ = dir.Close() }() + return dir.Sync() +} diff --git a/internal/providerauth/filelock_windows.go b/internal/providerauth/filelock_windows.go new file mode 100644 index 00000000..c702a205 --- /dev/null +++ b/internal/providerauth/filelock_windows.go @@ -0,0 +1,52 @@ +//go:build windows + +package providerauth + +import ( + "os" + "syscall" + + "golang.org/x/sys/windows" +) + +type fileLock struct{ file *os.File } + +func acquireFileLock(path string) (*fileLock, error) { + file, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR, 0o600) + if err != nil { + return nil, err + } + overlapped := new(windows.Overlapped) + if err := windows.LockFileEx( + windows.Handle(file.Fd()), windows.LOCKFILE_EXCLUSIVE_LOCK, 0, 1, 0, overlapped, + ); err != nil { + _ = file.Close() + return nil, err + } + return &fileLock{file: file}, nil +} + +func (lock *fileLock) release() error { + if lock == nil || lock.file == nil { + return nil + } + overlapped := new(windows.Overlapped) + _ = windows.UnlockFileEx(windows.Handle(lock.file.Fd()), 0, 1, 0, overlapped) + return lock.file.Close() +} + +func replaceFile(source, destination string) error { + from, err := syscall.UTF16PtrFromString(source) + if err != nil { + return err + } + to, err := syscall.UTF16PtrFromString(destination) + if err != nil { + return err + } + return windows.MoveFileEx(from, to, windows.MOVEFILE_REPLACE_EXISTING|windows.MOVEFILE_WRITE_THROUGH) +} + +// Windows has no portable directory fsync equivalent; MoveFileEx with +// MOVEFILE_WRITE_THROUGH supplies the durability barrier for replacement. +func syncDirectory(string) error { return nil } diff --git a/internal/providerauth/http.go b/internal/providerauth/http.go new file mode 100644 index 00000000..5fb929d3 --- /dev/null +++ b/internal/providerauth/http.go @@ -0,0 +1,154 @@ +package providerauth + +import ( + "bytes" + "context" + "encoding/json" + "errors" + "fmt" + "io" + "net/http" + "net/url" + "strconv" + "strings" +) + +const maxOAuthResponseBytes = 64 << 10 + +func (manager *Manager) postJSON( + ctx context.Context, + endpoint string, + body any, + headers map[string]string, +) (int, map[string]any, error) { + encoded, err := json.Marshal(body) + if err != nil { + return 0, nil, fmt.Errorf("encode OAuth request: %w", err) + } + request, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, bytes.NewReader(encoded)) + if err != nil { + return 0, nil, fmt.Errorf("create OAuth request: %w", err) + } + request.Header.Set("Content-Type", "application/json") + for name, value := range headers { + request.Header.Set(name, value) + } + return manager.doJSON(request) +} + +func (manager *Manager) postForm( + ctx context.Context, + endpoint string, + form url.Values, + headers map[string]string, +) (int, map[string]any, error) { + request, err := http.NewRequestWithContext( + ctx, http.MethodPost, endpoint, strings.NewReader(form.Encode()), + ) + if err != nil { + return 0, nil, fmt.Errorf("create OAuth request: %w", err) + } + request.Header.Set("Content-Type", "application/x-www-form-urlencoded") + for name, value := range headers { + request.Header.Set(name, value) + } + return manager.doJSON(request) +} + +func (manager *Manager) getJSON( + ctx context.Context, + endpoint string, + headers map[string]string, +) (int, map[string]any, error) { + request, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil) + if err != nil { + return 0, nil, fmt.Errorf("create OAuth request: %w", err) + } + for name, value := range headers { + request.Header.Set(name, value) + } + return manager.doJSON(request) +} + +func (manager *Manager) doJSON(request *http.Request) (int, map[string]any, error) { + response, err := manager.client.Do(request) + if err != nil { + return 0, nil, fmt.Errorf("provider auth HTTP request: %w", err) + } + defer func() { _ = response.Body.Close() }() + if response.ContentLength > maxOAuthResponseBytes { + return response.StatusCode, nil, errorsResponseTooLarge() + } + reader := io.LimitReader(response.Body, maxOAuthResponseBytes+1) + body, err := io.ReadAll(reader) + if err != nil { + return response.StatusCode, nil, fmt.Errorf("read provider auth response: %w", err) + } + if len(body) > maxOAuthResponseBytes { + return response.StatusCode, nil, errorsResponseTooLarge() + } + value := make(map[string]any) + if len(bytes.TrimSpace(body)) == 0 { + return response.StatusCode, value, nil + } + decoder := json.NewDecoder(bytes.NewReader(body)) + decoder.UseNumber() + if err := decoder.Decode(&value); err != nil { + if response.StatusCode < http.StatusOK || response.StatusCode >= http.StatusMultipleChoices { + return response.StatusCode, value, nil + } + return response.StatusCode, nil, errors.New("provider auth response is not valid JSON") + } + return response.StatusCode, value, nil +} + +func errorsResponseTooLarge() error { + return errors.New("provider auth response exceeds 64 KiB limit") +} + +func stringField(value map[string]any, name string) string { + text, _ := value[name].(string) + return strings.TrimSpace(text) +} + +func intField(value map[string]any, name string, fallback int64) int64 { + switch raw := value[name].(type) { + case float64: + return int64(raw) + case json.Number: + parsed, err := raw.Int64() + if err == nil { + return parsed + } + case string: + parsed, err := strconv.ParseInt(raw, 10, 64) + if err == nil { + return parsed + } + } + return fallback +} + +func oauthError(value map[string]any) string { + raw := stringField(value, "error") + var builder strings.Builder + for _, character := range raw { + if (character >= 'a' && character <= 'z') || + (character >= 'A' && character <= 'Z') || + (character >= '0' && character <= '9') || strings.ContainsRune("_.-", character) { + builder.WriteRune(character) + if builder.Len() >= 64 { + break + } + } + } + return builder.String() +} + +func upstreamError(operation string, status int, value map[string]any) error { + code := oauthError(value) + if code != "" { + return fmt.Errorf("%s failed: HTTP %d (%s)", operation, status, code) + } + return fmt.Errorf("%s failed: HTTP %d", operation, status) +} diff --git a/internal/providerauth/jwt.go b/internal/providerauth/jwt.go new file mode 100644 index 00000000..82b39c1f --- /dev/null +++ b/internal/providerauth/jwt.go @@ -0,0 +1,42 @@ +package providerauth + +import ( + "encoding/base64" + "encoding/json" + "strings" + "time" +) + +func jwtPayload(token string) map[string]any { + parts := strings.Split(token, ".") + if len(parts) != 3 { + return nil + } + decoded, err := base64.RawURLEncoding.DecodeString(parts[1]) + if err != nil { + decoded, err = base64.URLEncoding.DecodeString(parts[1]) + } + if err != nil { + return nil + } + payload := make(map[string]any) + if json.Unmarshal(decoded, &payload) != nil { + return nil + } + return payload +} + +func nestedString(value map[string]any, objectName, fieldName string) string { + object, _ := value[objectName].(map[string]any) + return stringField(object, fieldName) +} + +func tokenExpiry(now func() time.Time, expiresIn int64) time.Time { + if expiresIn <= 0 { + expiresIn = 3600 + } + if expiresIn > int64((24 * time.Hour).Seconds()) { + expiresIn = int64((24 * time.Hour).Seconds()) + } + return now().Add(time.Duration(expiresIn) * time.Second) +} diff --git a/internal/providerauth/manager.go b/internal/providerauth/manager.go new file mode 100644 index 00000000..8687e2c6 --- /dev/null +++ b/internal/providerauth/manager.go @@ -0,0 +1,707 @@ +package providerauth + +import ( + "context" + cryptorand "crypto/rand" + "encoding/base64" + "errors" + "fmt" + "io" + "net/http" + "net/url" + "path/filepath" + "strings" + "sync" + "time" + + "github.com/google/uuid" +) + +const ( + maxPendingFlows = 128 + refreshBuffer = time.Minute +) + +var productionEndpoints = Endpoints{ + CodexDeviceStart: "https://auth.openai.com/api/accounts/deviceauth/usercode", + CodexDevicePoll: "https://auth.openai.com/api/accounts/deviceauth/token", + CodexToken: "https://auth.openai.com/oauth/token", + CodexVerification: "https://auth.openai.com/codex/device", + CodexRuntime: "https://chatgpt.com/backend-api/codex", + XAIDiscovery: "https://auth.x.ai/.well-known/openid-configuration", + XAIRuntime: "https://api.x.ai/v1", + CopilotDeviceStart: "https://github.com/login/device/code", + CopilotOAuthToken: "https://github.com/login/oauth/access_token", + CopilotUser: "https://api.github.com/user", + CopilotToken: "https://api.github.com/copilot_internal/v2/token", + CopilotUsage: "https://api.github.com/copilot_internal/user", + CopilotRuntime: "https://api.githubcopilot.com", +} + +type cachedToken struct { + token string + expiresAt time.Time +} + +func (token cachedToken) usable(now time.Time) bool { + return token.token != "" && token.expiresAt.After(now.Add(refreshBuffer)) +} + +type pendingFlow struct { + mu sync.Mutex + commitMu sync.RWMutex + cancelled bool + public Flow + deviceCode string + tokenEndpoint string + nextPollAt time.Time + interval time.Duration + generation uint64 +} + +// Manager coordinates device flows, durable accounts, token refresh and +// runtime credential resolution for all managed login methods. +type Manager struct { + store *fileStore + client *http.Client + now func() time.Time + rand io.Reader + endpoints Endpoints + allowUnsafe bool + + mu sync.RWMutex + flows map[string]*pendingFlow + flowReservations int + pendingFlowLimit int + accessTokens map[string]cachedToken + copilotEndpoints map[string]string + xaiEndpoints *xaiOAuthEndpoints + + flowLifecycleMu sync.RWMutex + randomMu sync.Mutex + refreshLocksMu sync.Mutex + refreshLocks map[string]*sync.Mutex + endpointLocks map[string]*sync.Mutex +} + +var defaultManagers struct { + sync.Mutex + byDir map[string]*Manager +} + +// Default returns a process-wide Manager keyed by absolute config directory. +func Default(configDir string) (*Manager, error) { + abs, err := filepath.Abs(configDir) + if err != nil { + return nil, fmt.Errorf("resolve provider auth config directory: %w", err) + } + key := filepath.Clean(abs) + defaultManagers.Lock() + defer defaultManagers.Unlock() + if manager := defaultManagers.byDir[key]; manager != nil { + return manager, nil + } + manager, err := NewManager(Options{ConfigDir: key}) + if err != nil { + return nil, err + } + if defaultManagers.byDir == nil { + defaultManagers.byDir = make(map[string]*Manager) + } + defaultManagers.byDir[key] = manager + return manager, nil +} + +// NewManager creates an isolated manager with injectable dependencies. +func NewManager(options Options) (*Manager, error) { + store, err := newFileStore(options.ConfigDir) + if err != nil { + return nil, err + } + if err := store.secureDirectory(); err != nil { + return nil, err + } + if err := store.secureExistingStore(); err != nil { + return nil, err + } + if _, err := store.read(); err != nil { + return nil, err + } + if options.Endpoints != (Endpoints{}) && !options.AllowInsecureTestEndpoints { + return nil, errors.New("provider auth endpoint overrides require test mode") + } + endpoints := mergeEndpoints(productionEndpoints, options.Endpoints) + client := cloneHTTPClient(options.HTTPClient) + now := options.Now + if now == nil { + now = time.Now + } + random := options.Rand + if random == nil { + random = cryptorand.Reader + } + return &Manager{ + store: store, + client: client, + now: now, + rand: random, + endpoints: endpoints, + allowUnsafe: options.AllowInsecureTestEndpoints, + flows: make(map[string]*pendingFlow), + pendingFlowLimit: maxPendingFlows, + accessTokens: make(map[string]cachedToken), + copilotEndpoints: make(map[string]string), + refreshLocks: make(map[string]*sync.Mutex), + endpointLocks: make(map[string]*sync.Mutex), + }, nil +} + +func cloneHTTPClient(source *http.Client) *http.Client { + if source == nil { + source = &http.Client{Timeout: 20 * time.Second} + } + clone := *source + if clone.Timeout == 0 { + clone.Timeout = 20 * time.Second + } + clone.CheckRedirect = func(*http.Request, []*http.Request) error { + return http.ErrUseLastResponse + } + return &clone +} + +func mergeEndpoints(base, overrides Endpoints) Endpoints { + result := base + fields := []*string{ + &result.CodexDeviceStart, &result.CodexDevicePoll, &result.CodexToken, + &result.CodexVerification, &result.CodexRuntime, &result.XAIDiscovery, + &result.XAIRuntime, &result.CopilotDeviceStart, &result.CopilotOAuthToken, + &result.CopilotUser, &result.CopilotToken, &result.CopilotUsage, + &result.CopilotRuntime, + } + values := []string{ + overrides.CodexDeviceStart, overrides.CodexDevicePoll, overrides.CodexToken, + overrides.CodexVerification, overrides.CodexRuntime, overrides.XAIDiscovery, + overrides.XAIRuntime, overrides.CopilotDeviceStart, overrides.CopilotOAuthToken, + overrides.CopilotUser, overrides.CopilotToken, overrides.CopilotUsage, + overrides.CopilotRuntime, + } + for index, value := range values { + if value != "" { + *fields[index] = value + } + } + return result +} + +func validateMethod(method Method) error { + switch method { + case MethodCodexOAuth, MethodXAIOAuth, MethodGitHubCopilot: + return nil + default: + return fmt.Errorf("%w: %q", ErrUnsupportedMethod, method) + } +} + +func (manager *Manager) validateVerificationURIs(primary, complete, expectedHost string) error { + if err := manager.validateVerificationURI(primary, expectedHost); err != nil { + return err + } + if complete != "" { + return manager.validateVerificationURI(complete, expectedHost) + } + return nil +} + +func (manager *Manager) validateVerificationURI(raw, expectedHost string) error { + parsed, err := url.Parse(raw) + if err != nil || parsed.Host == "" || parsed.User != nil { + return errors.New("provider authorization returned an untrusted verification URI") + } + if manager.allowUnsafe { + if parsed.Scheme == "http" || parsed.Scheme == "https" { + return nil + } + return errors.New("provider authorization returned an untrusted verification URI") + } + if parsed.Scheme != "https" || parsed.Port() != "" || + !strings.EqualFold(parsed.Hostname(), expectedHost) { + return errors.New("provider authorization returned an untrusted verification URI") + } + return nil +} + +// Start starts a provider device authorization flow. +func (manager *Manager) Start(ctx context.Context, method Method) (Flow, error) { + if err := validateMethod(method); err != nil { + return Flow{}, err + } + if !manager.reserveFlowSlot() { + return Flow{}, errors.New("too many pending provider auth flows") + } + reserved := true + defer func() { + if reserved { + manager.releaseFlowSlot() + } + }() + + manager.flowLifecycleMu.RLock() + generation, err := manager.store.generation(method) + manager.flowLifecycleMu.RUnlock() + if err != nil { + return Flow{}, err + } + + var pending *pendingFlow + switch method { + case MethodCodexOAuth: + pending, err = manager.startCodex(ctx) + case MethodXAIOAuth: + pending, err = manager.startXAI(ctx) + case MethodGitHubCopilot: + pending, err = manager.startCopilot(ctx) + } + if err != nil { + return Flow{}, err + } + pending.generation = generation + id, err := manager.randomID() + if err != nil { + return Flow{}, err + } + pending.public.ID = id + + // Logout holds the write side across its durable epoch bump and local-flow + // cancellation. Rechecking under the read side prevents a Start that was in + // flight during Logout from installing an already-invalid pending flow. + manager.flowLifecycleMu.RLock() + defer manager.flowLifecycleMu.RUnlock() + currentGeneration, err := manager.store.generation(method) + if err != nil { + return Flow{}, err + } + if currentGeneration != generation { + return Flow{}, ErrFlowNotFound + } + manager.mu.Lock() + if _, exists := manager.flows[id]; exists { + manager.mu.Unlock() + return Flow{}, errors.New("provider auth flow ID collision") + } + manager.flowReservations-- + manager.flows[id] = pending + reserved = false + manager.mu.Unlock() + return pending.public, nil +} + +// Poll advances a device authorization flow by one upstream poll. +func (manager *Manager) Poll(ctx context.Context, method Method, flowID string) (Flow, error) { + if err := validateMethod(method); err != nil { + return Flow{}, err + } + manager.mu.RLock() + pending := manager.flows[flowID] + if pending != nil && pending.public.Method != method { + pending = nil + } + manager.mu.RUnlock() + if pending == nil { + return Flow{}, ErrFlowNotFound + } + pending.mu.Lock() + defer pending.mu.Unlock() + if !manager.flowStillCurrent(method, flowID, pending) { + return Flow{}, ErrFlowNotFound + } + now := manager.now() + if !now.Before(pending.public.ExpiresAt) { + flow := pending.public + flow.State = FlowStateExpired + flow.Error = ErrFlowExpired.Error() + manager.deleteFlow(flowID, pending) + return flow, nil + } + if now.Before(pending.nextPollAt) { + return pending.public, nil + } + pending.nextPollAt = now.Add(pending.interval) + + var result Flow + var err error + switch method { + case MethodCodexOAuth: + result, err = manager.pollCodex(ctx, pending) + case MethodXAIOAuth: + result, err = manager.pollXAI(ctx, pending) + case MethodGitHubCopilot: + result, err = manager.pollCopilot(ctx, pending) + default: + err = fmt.Errorf("%w: %q", ErrUnsupportedMethod, pending.public.Method) + } + if err != nil { + if errors.Is(err, ErrFlowNotFound) { + manager.deleteFlow(flowID, pending) + } + return Flow{}, err + } + if result.State != FlowStatePending { + manager.deleteFlow(flowID, pending) + } + return result, nil +} + +// Cancel destroys an in-memory device authorization flow. +func (manager *Manager) Cancel(method Method, flowID string) error { + if err := validateMethod(method); err != nil { + return err + } + manager.mu.RLock() + pending := manager.flows[flowID] + if pending != nil && pending.public.Method != method { + pending = nil + } + manager.mu.RUnlock() + if pending == nil { + return ErrFlowNotFound + } + return manager.cancelPending(method, flowID, pending) +} + +func (manager *Manager) cancelPending(method Method, flowID string, pending *pendingFlow) error { + pending.commitMu.Lock() + defer pending.commitMu.Unlock() + manager.mu.Lock() + if manager.flows[flowID] != pending || pending.public.Method != method { + manager.mu.Unlock() + return ErrFlowNotFound + } + pending.cancelled = true + delete(manager.flows, flowID) + manager.mu.Unlock() + return nil +} + +// Status returns non-secret account information for one login method. +func (manager *Manager) Status(_ context.Context, method Method) (Status, error) { + if err := validateMethod(method); err != nil { + return Status{}, err + } + return manager.store.status(method) +} + +// SetDefault selects the default usable account for a login method. +func (manager *Manager) SetDefault(_ context.Context, method Method, accountID string) error { + if err := validateMethod(method); err != nil { + return err + } + if strings.TrimSpace(accountID) == "" { + return fmt.Errorf("%w: account_id is required", ErrInvalidBinding) + } + return manager.store.mutate(func(state *storedState) error { + entry := state.method(method) + account, ok := entry.Accounts[accountID] + if !ok { + return fmt.Errorf("%w: %s/%s", ErrAccountNotFound, method, accountID) + } + if account.RequiresReauth { + return fmt.Errorf("%w: %s/%s", ErrRequiresReauth, method, accountID) + } + entry.DefaultAccountID = accountID + return nil + }) +} + +// Remove removes one durable account without changing Provider bindings. +func (manager *Manager) Remove(_ context.Context, method Method, accountID string) error { + if err := validateMethod(method); err != nil { + return err + } + err := manager.store.mutate(func(state *storedState) error { + entry := state.method(method) + if _, ok := entry.Accounts[accountID]; !ok { + return fmt.Errorf("%w: %s/%s", ErrAccountNotFound, method, accountID) + } + delete(entry.Accounts, accountID) + if entry.DefaultAccountID == accountID { + entry.DefaultAccountID = fallbackDefault(entry.Accounts) + } + return nil + }) + if err == nil { + manager.invalidate(method, accountID) + } + return err +} + +// Logout removes all accounts and pending flows for a login method. +func (manager *Manager) Logout(_ context.Context, method Method) error { + if err := validateMethod(method); err != nil { + return err + } + manager.flowLifecycleMu.Lock() + defer manager.flowLifecycleMu.Unlock() + if err := manager.store.mutate(func(state *storedState) error { + entry := state.method(method) + if entry.Generation == ^uint64(0) { + return errors.New("provider auth logout generation exhausted") + } + entry.Generation++ + entry.Accounts = make(map[string]storedAccount) + entry.DefaultAccountID = "" + return nil + }); err != nil { + return err + } + manager.cancelFlowsForMethod(method) + manager.mu.Lock() + prefix := string(method) + "\x00" + for key := range manager.accessTokens { + if strings.HasPrefix(key, prefix) { + delete(manager.accessTokens, key) + } + } + for key := range manager.copilotEndpoints { + if strings.HasPrefix(key, prefix) { + delete(manager.copilotEndpoints, key) + } + } + manager.mu.Unlock() + return nil +} + +// ValidateBinding verifies that a binding resolves to a usable local account. +func (manager *Manager) ValidateBinding(_ context.Context, binding Binding) error { + if err := validateMethod(binding.Method); err != nil { + return err + } + _, err := manager.store.resolve(binding) + return err +} + +func (manager *Manager) upsertAccount(method Method, account storedAccount) error { + return manager.store.mutate(func(state *storedState) error { + entry := state.method(method) + entry.Accounts[account.ID] = account + if current, ok := entry.Accounts[entry.DefaultAccountID]; entry.DefaultAccountID == "" || + !ok || current.RequiresReauth { + entry.DefaultAccountID = account.ID + } + return nil + }) +} + +// commitFlowAccount makes cancellation and durable flow completion linearizable: +// Cancel can win while an upstream poll is in flight, while a commit that has +// already acquired the read side completes before Cancel returns. +func (manager *Manager) commitFlowAccount( + method Method, + pending *pendingFlow, + account storedAccount, +) error { + pending.commitMu.RLock() + defer pending.commitMu.RUnlock() + if pending.cancelled || !manager.flowStillCurrent(method, pending.public.ID, pending) { + return ErrFlowNotFound + } + return manager.store.mutate(func(state *storedState) error { + entry := state.method(method) + if entry.Generation != pending.generation { + return ErrFlowNotFound + } + entry.Accounts[account.ID] = account + if current, ok := entry.Accounts[entry.DefaultAccountID]; entry.DefaultAccountID == "" || + !ok || current.RequiresReauth { + entry.DefaultAccountID = account.ID + } + return nil + }) +} + +func (manager *Manager) replaceSecret( + method Method, + accountID string, + expected string, + replacement string, +) error { + if replacement == "" || replacement == expected { + return manager.store.compareSecret(method, accountID, expected) + } + return manager.store.mutate(func(state *storedState) error { + entry := state.method(method) + account, ok := entry.Accounts[accountID] + if !ok { + return fmt.Errorf("%w: %s/%s", ErrAccountNotFound, method, accountID) + } + if account.Secret != expected { + return errSecretChanged + } + account.Secret = replacement + account.RequiresReauth = false + entry.Accounts[accountID] = account + return nil + }) +} + +func (manager *Manager) markRequiresReauth(method Method, accountID, expected string) error { + err := manager.store.mutate(func(state *storedState) error { + entry := state.method(method) + account, ok := entry.Accounts[accountID] + if !ok { + return fmt.Errorf("%w: %s/%s", ErrAccountNotFound, method, accountID) + } + if account.Secret != expected { + return errSecretChanged + } + account.RequiresReauth = true + entry.Accounts[accountID] = account + if entry.DefaultAccountID == accountID { + entry.DefaultAccountID = fallbackDefault(entry.Accounts) + } + return nil + }) + if err == nil { + manager.invalidate(method, accountID) + } + return err +} + +func (manager *Manager) invalidate(method Method, accountID string) { + key := accountKey(method, accountID) + manager.mu.Lock() + delete(manager.accessTokens, key) + delete(manager.copilotEndpoints, key) + manager.mu.Unlock() +} + +func (manager *Manager) randomID() (string, error) { + bytes := make([]byte, 32) + manager.randomMu.Lock() + _, err := io.ReadFull(manager.rand, bytes) + manager.randomMu.Unlock() + if err != nil { + return "", fmt.Errorf("generate provider auth flow ID: %w", err) + } + return base64.RawURLEncoding.EncodeToString(bytes), nil +} + +func (manager *Manager) randomUUID() (string, error) { + manager.randomMu.Lock() + id, err := uuid.NewRandomFromReader(manager.rand) + manager.randomMu.Unlock() + if err != nil { + return "", fmt.Errorf("generate provider request ID: %w", err) + } + return id.String(), nil +} + +func (manager *Manager) reserveFlowSlot() bool { + manager.mu.Lock() + defer manager.mu.Unlock() + manager.cleanupFlowsLocked() + limit := manager.pendingFlowLimit + if limit <= 0 { + limit = maxPendingFlows + } + if len(manager.flows)+manager.flowReservations >= limit { + return false + } + manager.flowReservations++ + return true +} + +func (manager *Manager) releaseFlowSlot() { + manager.mu.Lock() + if manager.flowReservations > 0 { + manager.flowReservations-- + } + manager.mu.Unlock() +} + +func (manager *Manager) cleanupFlowsLocked() { + now := manager.now() + for id, flow := range manager.flows { + if !now.Before(flow.public.ExpiresAt) { + delete(manager.flows, id) + } + } +} + +func (manager *Manager) flowStillCurrent(method Method, id string, expected *pendingFlow) bool { + manager.mu.RLock() + defer manager.mu.RUnlock() + return manager.flows[id] == expected && expected.public.Method == method +} + +func (manager *Manager) cancelFlowsForMethod(method Method) { + type flowEntry struct { + id string + pending *pendingFlow + } + manager.mu.RLock() + flows := make([]flowEntry, 0) + for id, pending := range manager.flows { + if pending.public.Method == method { + flows = append(flows, flowEntry{id: id, pending: pending}) + } + } + manager.mu.RUnlock() + for _, flow := range flows { + _ = manager.cancelPending(method, flow.id, flow.pending) + } +} + +func (manager *Manager) deleteFlow(id string, expected *pendingFlow) { + manager.mu.Lock() + if manager.flows[id] == expected { + delete(manager.flows, id) + } + manager.mu.Unlock() +} + +func (manager *Manager) refreshLock(method Method, accountID string) *sync.Mutex { + key := accountKey(method, accountID) + manager.refreshLocksMu.Lock() + defer manager.refreshLocksMu.Unlock() + lock := manager.refreshLocks[key] + if lock == nil { + lock = new(sync.Mutex) + manager.refreshLocks[key] = lock + } + return lock +} + +func (manager *Manager) endpointLock(method Method, accountID string) *sync.Mutex { + key := accountKey(method, accountID) + manager.refreshLocksMu.Lock() + defer manager.refreshLocksMu.Unlock() + lock := manager.endpointLocks[key] + if lock == nil { + lock = new(sync.Mutex) + manager.endpointLocks[key] = lock + } + return lock +} + +func (manager *Manager) cached(method Method, accountID string) (string, bool) { + manager.mu.RLock() + token := manager.accessTokens[accountKey(method, accountID)] + manager.mu.RUnlock() + if token.usable(manager.now()) { + return token.token, true + } + return "", false +} + +func (manager *Manager) cache(method Method, accountID, token string, expiresAt time.Time) { + manager.mu.Lock() + manager.accessTokens[accountKey(method, accountID)] = cachedToken{ + token: token, expiresAt: expiresAt, + } + manager.mu.Unlock() +} + +func accountKey(method Method, accountID string) string { + return string(method) + "\x00" + accountID +} diff --git a/internal/providerauth/manager_test.go b/internal/providerauth/manager_test.go new file mode 100644 index 00000000..a99cfce0 --- /dev/null +++ b/internal/providerauth/manager_test.go @@ -0,0 +1,1047 @@ +package providerauth + +import ( + "context" + "encoding/base64" + "encoding/json" + "errors" + "fmt" + "net/http" + "net/http/httptest" + "os" + "path/filepath" + "strings" + "sync" + "sync/atomic" + "testing" + "time" +) + +type testClock struct { + mu sync.Mutex + now time.Time +} + +type authRoundTripFunc func(*http.Request) (*http.Response, error) + +func (function authRoundTripFunc) RoundTrip(request *http.Request) (*http.Response, error) { + return function(request) +} + +func newTestClock() *testClock { + return &testClock{now: time.Unix(1_900_000_000, 0).UTC()} +} + +func (clock *testClock) Now() time.Time { + clock.mu.Lock() + defer clock.mu.Unlock() + return clock.now +} + +func (clock *testClock) Advance(duration time.Duration) { + clock.mu.Lock() + clock.now = clock.now.Add(duration) + clock.mu.Unlock() +} + +func testJWT(t *testing.T, claims map[string]any) string { + t.Helper() + header := base64.RawURLEncoding.EncodeToString([]byte(`{"alg":"none"}`)) + payload, err := json.Marshal(claims) + if err != nil { + t.Fatal(err) + } + return header + "." + base64.RawURLEncoding.EncodeToString(payload) + "." +} + +func writeJSON(t *testing.T, writer http.ResponseWriter, status int, value any) { + t.Helper() + writer.Header().Set("Content-Type", "application/json") + writer.WriteHeader(status) + if err := json.NewEncoder(writer).Encode(value); err != nil { + t.Errorf("encode response: %v", err) + } +} + +func testEndpoints(serverURL string) Endpoints { + return Endpoints{ + CodexDeviceStart: serverURL + "/codex/device", + CodexDevicePoll: serverURL + "/codex/poll", + CodexToken: serverURL + "/codex/token", + CodexVerification: "https://auth.openai.com/codex/device", + CodexRuntime: serverURL + "/codex/runtime", + XAIDiscovery: serverURL + "/xai/discovery", + XAIRuntime: serverURL + "/xai/runtime", + CopilotDeviceStart: serverURL + "/copilot/device", + CopilotOAuthToken: serverURL + "/copilot/oauth", + CopilotUser: serverURL + "/github/user", + CopilotToken: serverURL + "/github/copilot-token", + CopilotUsage: serverURL + "/github/copilot-user", + CopilotRuntime: serverURL + "/copilot/fallback", + } +} + +func newTestManager( + t *testing.T, + dir string, + server *httptest.Server, + clock *testClock, +) *Manager { + t.Helper() + manager, err := NewManager(Options{ + ConfigDir: dir, + HTTPClient: server.Client(), + Now: clock.Now, + Endpoints: testEndpoints(server.URL), + AllowInsecureTestEndpoints: true, + }) + if err != nil { + t.Fatal(err) + } + return manager +} + +func TestCodexDeviceFlowPersistsOnlyDurableSecret(t *testing.T) { + t.Parallel() + clock := newTestClock() + var polls atomic.Int32 + var refreshes atomic.Int32 + idToken := testJWT(t, map[string]any{ + "chatgpt_account_id": "chatgpt-account-1", + "email": "alice@example.com", + }) + server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) { + switch request.URL.Path { + case "/codex/device": + writeJSON(t, writer, http.StatusOK, map[string]any{ + "device_auth_id": "upstream-device-secret", + "user_code": "ABCD-EFGH", + "expires_in": 900, + "interval": "1", + }) + case "/codex/poll": + if polls.Add(1) == 1 { + writer.WriteHeader(http.StatusForbidden) + return + } + writeJSON(t, writer, http.StatusOK, map[string]any{ + "authorization_code": "one-time-code", + "code_verifier": "server-pkce-verifier", + }) + case "/codex/token": + if err := request.ParseForm(); err != nil { + t.Errorf("parse form: %v", err) + } + if request.Form.Get("grant_type") == "refresh_token" { + refreshes.Add(1) + writeJSON(t, writer, http.StatusOK, map[string]any{ + "access_token": "codex-access-2", + "refresh_token": "codex-refresh-2", + "expires_in": 3600, + }) + return + } + writeJSON(t, writer, http.StatusOK, map[string]any{ + "access_token": "codex-access-1", + "refresh_token": "codex-refresh-1", + "id_token": idToken, + "expires_in": 3600, + }) + default: + http.NotFound(writer, request) + } + })) + defer server.Close() + + dir := t.TempDir() + manager := newTestManager(t, dir, server, clock) + flow, err := manager.Start(context.Background(), MethodCodexOAuth) + if err != nil { + t.Fatal(err) + } + if flow.State != FlowStatePending || flow.ID == "" || flow.ID == "upstream-device-secret" { + t.Fatalf("unexpected public flow: %+v", flow) + } + encoded, err := json.Marshal(flow) + if err != nil { + t.Fatal(err) + } + if strings.Contains(string(encoded), "upstream-device-secret") { + t.Fatal("public flow leaked upstream device token") + } + if result, err := manager.Poll(context.Background(), MethodCodexOAuth, flow.ID); err != nil || + result.State != FlowStatePending { + t.Fatalf("first poll = %+v, %v", result, err) + } + clock.Advance(5 * time.Second) + result, err := manager.Poll(context.Background(), MethodCodexOAuth, flow.ID) + if err != nil { + t.Fatal(err) + } + if result.State != FlowStateAuthorized || result.Account == nil || + result.Account.Login != "alice@example.com" { + t.Fatalf("authorization result = %+v", result) + } + + storeData, err := os.ReadFile(filepath.Join(dir, storeFileName)) + if err != nil { + t.Fatal(err) + } + stored := string(storeData) + if !strings.Contains(stored, "codex-refresh-1") { + t.Fatal("durable refresh token was not stored") + } + for _, forbidden := range []string{ + "codex-access-1", "upstream-device-secret", "one-time-code", "server-pkce-verifier", + } { + if strings.Contains(stored, forbidden) { + t.Fatalf("store leaked ephemeral secret %q", forbidden) + } + } + info, err := os.Stat(filepath.Join(dir, storeFileName)) + if err != nil { + t.Fatal(err) + } + if info.Mode().Perm() != 0o600 { + t.Fatalf("store mode = %o", info.Mode().Perm()) + } + dirInfo, err := os.Stat(dir) + if err != nil { + t.Fatal(err) + } + if dirInfo.Mode().Perm() != 0o700 { + t.Fatalf("directory mode = %o", dirInfo.Mode().Perm()) + } + + restarted := newTestManager(t, dir, server, clock) + credential, err := restarted.Credential(context.Background(), Binding{Method: MethodCodexOAuth}) + if err != nil { + t.Fatal(err) + } + if credential.Token != "codex-access-2" || credential.Protocol != ProtocolResponses || + credential.BaseURL != server.URL+"/codex/runtime" || + credential.Headers["chatgpt-account-id"] != "chatgpt-account-1" || + credential.Headers["originator"] == "" || credential.Headers["version"] == "" { + t.Fatalf("credential = %+v", credential) + } + if refreshes.Load() != 1 { + t.Fatalf("refreshes = %d", refreshes.Load()) + } + credentialJSON, err := json.Marshal(credential) + if err != nil { + t.Fatal(err) + } + if strings.Contains(string(credentialJSON), "codex-access-2") { + t.Fatal("credential JSON leaked access token") + } +} + +func TestXAIRefreshSingleflightRotationAndRequiresReauth(t *testing.T) { + t.Parallel() + clock := newTestClock() + idToken := testJWT(t, map[string]any{"sub": "xai-1", "email": "grok@example.com"}) + var refreshes atomic.Int32 + var rejectRefresh atomic.Bool + var serverURL string + server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) { + switch request.URL.Path { + case "/xai/discovery": + writeJSON(t, writer, http.StatusOK, map[string]any{ + "issuer": xaiIssuer, + "device_authorization_endpoint": serverURL + "/xai/device", + "token_endpoint": serverURL + "/xai/token", + }) + case "/xai/device": + writeJSON(t, writer, http.StatusOK, map[string]any{ + "device_code": "xai-device-secret", + "user_code": "GROK-CODE", + "verification_uri": "https://auth.x.ai/device", + "verification_uri_complete": "https://auth.x.ai/device?code=GROK-CODE", + "expires_in": 900, + "interval": 1, + }) + case "/xai/token": + if err := request.ParseForm(); err != nil { + t.Errorf("parse form: %v", err) + } + if request.Form.Get("grant_type") == "refresh_token" { + refreshes.Add(1) + if rejectRefresh.Load() { + // Invalid refresh credentials are sometimes reported as an + // empty/non-JSON 400. That still must fail closed as reauth. + writer.WriteHeader(http.StatusBadRequest) + return + } + time.Sleep(10 * time.Millisecond) + writeJSON(t, writer, http.StatusOK, map[string]any{ + "access_token": "xai-access-2", + "refresh_token": "xai-refresh-2", + "expires_in": 3600, + }) + return + } + writeJSON(t, writer, http.StatusOK, map[string]any{ + "access_token": "xai-access-1", + "refresh_token": "xai-refresh-1", + "id_token": idToken, + "expires_in": 3600, + }) + default: + http.NotFound(writer, request) + } + })) + serverURL = server.URL + defer server.Close() + + dir := t.TempDir() + manager := newTestManager(t, dir, server, clock) + flow, err := manager.Start(context.Background(), MethodXAIOAuth) + if err != nil { + t.Fatal(err) + } + result, err := manager.Poll(context.Background(), MethodXAIOAuth, flow.ID) + if err != nil || result.State != FlowStateAuthorized { + t.Fatalf("poll = %+v, %v", result, err) + } + clock.Advance(2 * time.Hour) + + const callers = 24 + var wait sync.WaitGroup + errorsSeen := make(chan error, callers) + for range callers { + wait.Add(1) + go func() { + defer wait.Done() + credential, credentialErr := manager.Credential( + context.Background(), Binding{Method: MethodXAIOAuth, AccountID: "xai-1"}, + ) + if credentialErr == nil && credential.Token != "xai-access-2" { + credentialErr = fmt.Errorf("unexpected token %q", credential.Token) + } + errorsSeen <- credentialErr + }() + } + wait.Wait() + close(errorsSeen) + for credentialErr := range errorsSeen { + if credentialErr != nil { + t.Fatal(credentialErr) + } + } + if refreshes.Load() != 1 { + t.Fatalf("refresh calls = %d, want 1", refreshes.Load()) + } + data, err := os.ReadFile(filepath.Join(dir, storeFileName)) + if err != nil { + t.Fatal(err) + } + if !strings.Contains(string(data), "xai-refresh-2") || + strings.Contains(string(data), "xai-access-2") { + t.Fatalf("unexpected durable state: %s", data) + } + + rejectRefresh.Store(true) + restarted := newTestManager(t, dir, server, clock) + _, err = restarted.Credential( + context.Background(), Binding{Method: MethodXAIOAuth, AccountID: "xai-1"}, + ) + if !errors.Is(err, ErrRequiresReauth) { + t.Fatalf("credential error = %v", err) + } + status, err := restarted.Status(context.Background(), MethodXAIOAuth) + if err != nil { + t.Fatal(err) + } + if len(status.Accounts) != 1 || !status.Accounts[0].RequiresReauth { + t.Fatalf("status = %+v", status) + } +} + +func TestCopilotFlowUsesGitHubTokenAndDynamicRuntime(t *testing.T) { + t.Parallel() + clock := newTestClock() + var serverURL string + var exchanges atomic.Int32 + server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) { + switch request.URL.Path { + case "/copilot/device": + writeJSON(t, writer, http.StatusOK, map[string]any{ + "device_code": "github-device-secret", + "user_code": "GITHUB-CODE", + "verification_uri": "https://github.com/login/device", + "expires_in": 900, + "interval": 1, + }) + case "/copilot/oauth": + writeJSON(t, writer, http.StatusOK, map[string]any{"access_token": "github-oauth-token"}) + case "/github/user": + if request.Header.Get("Authorization") != "Bearer github-oauth-token" { + t.Errorf("user authorization = %q", request.Header.Get("Authorization")) + } + writeJSON(t, writer, http.StatusOK, map[string]any{"id": 12345, "login": "octocat"}) + case "/github/copilot-token": + exchanges.Add(1) + if request.Header.Get("Authorization") != "token github-oauth-token" { + t.Errorf("token authorization = %q", request.Header.Get("Authorization")) + } + writeJSON(t, writer, http.StatusOK, map[string]any{ + "token": "short-lived-copilot-token", "expires_at": clock.Now().Add(time.Hour).Unix(), + }) + case "/github/copilot-user": + writeJSON(t, writer, http.StatusOK, map[string]any{ + "endpoints": map[string]any{"api": serverURL + "/copilot/dynamic"}, + }) + default: + http.NotFound(writer, request) + } + })) + serverURL = server.URL + defer server.Close() + + dir := t.TempDir() + manager := newTestManager(t, dir, server, clock) + flow, err := manager.Start(context.Background(), MethodGitHubCopilot) + if err != nil { + t.Fatal(err) + } + result, err := manager.Poll(context.Background(), MethodGitHubCopilot, flow.ID) + if err != nil || result.State != FlowStateAuthorized { + t.Fatalf("poll = %+v, %v", result, err) + } + credential, err := manager.Credential(context.Background(), Binding{Method: MethodGitHubCopilot}) + if err != nil { + t.Fatal(err) + } + if credential.Token != "short-lived-copilot-token" || + credential.BaseURL != server.URL+"/copilot/dynamic" || + credential.Protocol != ProtocolChatCompletions || + credential.Headers["editor-version"] == "" || + credential.Headers["openai-intent"] != "conversation-agent" { + t.Fatalf("credential = %+v", credential) + } + if exchanges.Load() != 1 { + t.Fatalf("Copilot token exchanges = %d", exchanges.Load()) + } + data, err := os.ReadFile(filepath.Join(dir, storeFileName)) + if err != nil { + t.Fatal(err) + } + if !strings.Contains(string(data), "github-oauth-token") || + strings.Contains(string(data), "short-lived-copilot-token") || + strings.Contains(string(data), "github-device-secret") { + t.Fatalf("unexpected durable Copilot state: %s", data) + } +} + +func TestCopilotEndpointFallbackIsStableAfterDiscoveryFailure(t *testing.T) { + t.Parallel() + clock := newTestClock() + var usageCalls atomic.Int32 + var server *httptest.Server + server = httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) { + switch request.URL.Path { + case "/github/copilot-token": + writeJSON(t, writer, http.StatusOK, map[string]any{ + "token": "short-lived-copilot-token", "expires_at": clock.Now().Add(time.Hour).Unix(), + }) + case "/github/copilot-user": + writeJSON(t, writer, http.StatusOK, map[string]any{ + "endpoints": map[string]any{"api": server.URL + "/copilot/dynamic"}, + }) + default: + http.NotFound(writer, request) + } + })) + defer server.Close() + + baseClient := server.Client() + baseTransport := baseClient.Transport + client := *baseClient + client.Transport = authRoundTripFunc(func(request *http.Request) (*http.Response, error) { + if request.URL.Path == "/github/copilot-user" && usageCalls.Add(1) == 1 { + return nil, errors.New("temporary endpoint discovery failure") + } + return baseTransport.RoundTrip(request) + }) + manager, err := NewManager(Options{ + ConfigDir: t.TempDir(), + HTTPClient: &client, + Now: clock.Now, + Endpoints: testEndpoints(server.URL), + AllowInsecureTestEndpoints: true, + }) + if err != nil { + t.Fatal(err) + } + if err := manager.upsertAccount(MethodGitHubCopilot, storedAccount{ + ID: "copilot-account", Login: "octocat", Secret: "github-oauth-token", + AuthenticatedAt: clock.Now(), + }); err != nil { + t.Fatal(err) + } + first, err := manager.Credential(context.Background(), Binding{ + Method: MethodGitHubCopilot, AccountID: "copilot-account", + }) + if err != nil { + t.Fatal(err) + } + second, err := manager.Credential(context.Background(), Binding{ + Method: MethodGitHubCopilot, AccountID: "copilot-account", + }) + if err != nil { + t.Fatal(err) + } + if first.BaseURL != server.URL+"/copilot/fallback" || second.BaseURL != first.BaseURL { + t.Fatalf("runtime profile drifted: first=%q second=%q", first.BaseURL, second.BaseURL) + } + if usageCalls.Load() != 1 { + t.Fatalf("usage discovery calls = %d, want one cached failure", usageCalls.Load()) + } +} + +func TestCancelWinsWhilePollIsInFlight(t *testing.T) { + t.Parallel() + clock := newTestClock() + idToken := testJWT(t, map[string]any{"chatgpt_account_id": "cancelled-account"}) + pollStarted := make(chan struct{}) + releasePoll := make(chan struct{}) + server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) { + switch request.URL.Path { + case "/codex/device": + writeJSON(t, writer, http.StatusOK, map[string]any{ + "device_auth_id": "cancel-device", "user_code": "CANCEL", "interval": 1, + }) + case "/codex/poll": + close(pollStarted) + <-releasePoll + writeJSON(t, writer, http.StatusOK, map[string]any{ + "authorization_code": "cancel-code", "code_verifier": "cancel-verifier", + }) + case "/codex/token": + writeJSON(t, writer, http.StatusOK, map[string]any{ + "access_token": "must-not-persist-access", "refresh_token": "must-not-persist-refresh", + "id_token": idToken, + }) + default: + http.NotFound(writer, request) + } + })) + defer server.Close() + manager := newTestManager(t, t.TempDir(), server, clock) + flow, err := manager.Start(context.Background(), MethodCodexOAuth) + if err != nil { + t.Fatal(err) + } + pollResult := make(chan error, 1) + go func() { + _, pollErr := manager.Poll(context.Background(), MethodCodexOAuth, flow.ID) + pollResult <- pollErr + }() + <-pollStarted + if err := manager.Cancel(MethodCodexOAuth, flow.ID); err != nil { + t.Fatal(err) + } + close(releasePoll) + if err := <-pollResult; !errors.Is(err, ErrFlowNotFound) { + t.Fatalf("poll error = %v", err) + } + status, err := manager.Status(context.Background(), MethodCodexOAuth) + if err != nil { + t.Fatal(err) + } + if len(status.Accounts) != 0 { + t.Fatalf("cancelled flow persisted account: %+v", status) + } +} + +func TestStoreReloadMutationAndRefreshCAS(t *testing.T) { + t.Parallel() + dir := t.TempDir() + first, err := NewManager(Options{ConfigDir: dir}) + if err != nil { + t.Fatal(err) + } + second, err := NewManager(Options{ConfigDir: dir}) + if err != nil { + t.Fatal(err) + } + now := time.Now().UTC() + if err := first.upsertAccount(MethodCodexOAuth, storedAccount{ + ID: "one", Login: "one@example.com", Secret: "refresh-old", AuthenticatedAt: now, + }); err != nil { + t.Fatal(err) + } + if err := second.upsertAccount(MethodXAIOAuth, storedAccount{ + ID: "two", Login: "two@example.com", Secret: "refresh-xai", AuthenticatedAt: now, + }); err != nil { + t.Fatal(err) + } + if err := first.replaceSecret(MethodCodexOAuth, "one", "refresh-old", "refresh-new"); err != nil { + t.Fatal(err) + } + if err := second.replaceSecret(MethodCodexOAuth, "one", "refresh-old", "refresh-stale"); !errors.Is(err, errSecretChanged) { + t.Fatalf("stale CAS error = %v", err) + } + const concurrentAccounts = 24 + start := make(chan struct{}) + var wait sync.WaitGroup + for index := range concurrentAccounts { + wait.Add(1) + go func() { + defer wait.Done() + <-start + manager := first + if index%2 == 1 { + manager = second + } + id := fmt.Sprintf("concurrent-%02d", index) + if upsertErr := manager.upsertAccount(MethodCodexOAuth, storedAccount{ + ID: id, Login: id, Secret: "refresh-" + id, AuthenticatedAt: now, + }); upsertErr != nil { + t.Errorf("upsert %s: %v", id, upsertErr) + } + }() + } + close(start) + wait.Wait() + state, err := first.store.read() + if err != nil { + t.Fatal(err) + } + if state.method(MethodCodexOAuth).Accounts["one"].Secret != "refresh-new" || + state.method(MethodXAIOAuth).Accounts["two"].Secret != "refresh-xai" { + t.Fatalf("reload-mutate lost state: %+v", state) + } + if got := len(state.method(MethodCodexOAuth).Accounts); got != concurrentAccounts+1 { + t.Fatalf("concurrent reload-mutate account count = %d", got) + } +} + +func TestXAISlowDownAndDeniedDestroyFlow(t *testing.T) { + t.Parallel() + clock := newTestClock() + var polls atomic.Int32 + var serverURL string + server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) { + switch request.URL.Path { + case "/xai/discovery": + writeJSON(t, writer, http.StatusOK, map[string]any{ + "issuer": xaiIssuer, + "device_authorization_endpoint": serverURL + "/xai/device", + "token_endpoint": serverURL + "/xai/token", + }) + case "/xai/device": + writeJSON(t, writer, http.StatusOK, map[string]any{ + "device_code": "device", "user_code": "CODE", + "verification_uri": "https://auth.x.ai/device", "interval": 1, + }) + case "/xai/token": + if polls.Add(1) == 1 { + writeJSON(t, writer, http.StatusBadRequest, map[string]any{"error": "slow_down"}) + return + } + writeJSON(t, writer, http.StatusBadRequest, map[string]any{"error": "access_denied"}) + default: + http.NotFound(writer, request) + } + })) + serverURL = server.URL + defer server.Close() + manager := newTestManager(t, t.TempDir(), server, clock) + flow, err := manager.Start(context.Background(), MethodXAIOAuth) + if err != nil { + t.Fatal(err) + } + result, err := manager.Poll(context.Background(), MethodXAIOAuth, flow.ID) + if err != nil || result.State != FlowStatePending || result.IntervalSeconds != 9 { + t.Fatalf("slow_down poll = %+v, %v", result, err) + } + clock.Advance(10 * time.Second) + result, err = manager.Poll(context.Background(), MethodXAIOAuth, flow.ID) + if err != nil || result.State != FlowStateDenied { + t.Fatalf("denied poll = %+v, %v", result, err) + } + if _, err := manager.Poll(context.Background(), MethodXAIOAuth, flow.ID); !errors.Is(err, ErrFlowNotFound) { + t.Fatalf("terminal flow remained in memory: %v", err) + } +} + +func TestHTTPGuardsAndDefaultSingleton(t *testing.T) { + t.Parallel() + clock := newTestClock() + var followed atomic.Bool + server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) { + switch request.URL.Path { + case "/redirect": + http.Redirect(writer, request, "/followed", http.StatusFound) + case "/followed": + followed.Store(true) + writeJSON(t, writer, http.StatusOK, map[string]any{}) + case "/oversized": + writer.Header().Set("Content-Type", "application/json") + _, _ = writer.Write([]byte(`{"padding":"` + strings.Repeat("x", maxOAuthResponseBytes) + `"}`)) + default: + http.NotFound(writer, request) + } + })) + defer server.Close() + + dir := t.TempDir() + _, err := NewManager(Options{ + ConfigDir: dir, + Endpoints: Endpoints{CodexDeviceStart: server.URL + "/redirect"}, + }) + if err == nil { + t.Fatal("endpoint override without explicit test mode succeeded") + } + manager, err := NewManager(Options{ + ConfigDir: dir, + HTTPClient: server.Client(), + Now: clock.Now, + Endpoints: Endpoints{CodexDeviceStart: server.URL + "/redirect"}, + AllowInsecureTestEndpoints: true, + }) + if err != nil { + t.Fatal(err) + } + if _, err := manager.Start(context.Background(), MethodCodexOAuth); err == nil { + t.Fatal("redirecting device endpoint succeeded") + } + if followed.Load() { + t.Fatal("OAuth HTTP client followed a redirect") + } + manager.endpoints.CodexDeviceStart = server.URL + "/oversized" + if _, err := manager.Start(context.Background(), MethodCodexOAuth); err == nil || + !strings.Contains(err.Error(), "64 KiB") { + t.Fatalf("oversized response error = %v", err) + } + + one, err := Default(t.TempDir()) + if err != nil { + t.Fatal(err) + } + two, err := Default(one.store.dir) + if err != nil { + t.Fatal(err) + } + if one != two { + t.Fatal("Default did not return config-directory singleton") + } +} + +func TestCopilotRuntimeHeadersUseOneCorrelatedRequestID(t *testing.T) { + headers := copilotRuntimeHeaders("8b0ff00d-6932-4e7c-b96e-459672620d7c") + if headers["x-request-id"] == "" { + t.Fatal("x-request-id is missing") + } + if headers["x-agent-task-id"] != headers["x-request-id"] { + t.Fatalf( + "x-agent-task-id = %q, want x-request-id %q", + headers["x-agent-task-id"], headers["x-request-id"], + ) + } +} + +func TestFlowMethodScopePrecedesPollAndCancelSideEffects(t *testing.T) { + t.Parallel() + clock := newTestClock() + var polls atomic.Int32 + server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) { + switch request.URL.Path { + case "/codex/device": + writeJSON(t, writer, http.StatusOK, map[string]any{ + "device_auth_id": "method-device", "user_code": "METHOD", "interval": 1, + }) + case "/codex/poll": + polls.Add(1) + writer.WriteHeader(http.StatusForbidden) + default: + http.NotFound(writer, request) + } + })) + defer server.Close() + + manager := newTestManager(t, t.TempDir(), server, clock) + flow, err := manager.Start(context.Background(), MethodCodexOAuth) + if err != nil { + t.Fatal(err) + } + if _, err := manager.Poll( + context.Background(), MethodXAIOAuth, flow.ID, + ); !errors.Is(err, ErrFlowNotFound) { + t.Fatalf("wrong-method poll error = %v", err) + } + if err := manager.Cancel(MethodXAIOAuth, flow.ID); !errors.Is(err, ErrFlowNotFound) { + t.Fatalf("wrong-method cancel error = %v", err) + } + if polls.Load() != 0 { + t.Fatalf("wrong-method operation reached upstream %d times", polls.Load()) + } + result, err := manager.Poll(context.Background(), MethodCodexOAuth, flow.ID) + if err != nil || result.State != FlowStatePending { + t.Fatalf("correct-method poll = %+v, %v", result, err) + } + if polls.Load() != 1 { + t.Fatalf("correct-method upstream polls = %d", polls.Load()) + } + if err := manager.Cancel(MethodCodexOAuth, flow.ID); err != nil { + t.Fatal(err) + } +} + +func TestLogoutInvalidatesInFlightPollAcrossManagers(t *testing.T) { + for _, test := range []struct { + name string + separateManager bool + }{ + {name: "single_manager"}, + {name: "two_managers", separateManager: true}, + } { + t.Run(test.name, func(t *testing.T) { + clock := newTestClock() + idToken := testJWT(t, map[string]any{ + "chatgpt_account_id": "logout-account", + "email": "logout@example.com", + }) + pollStarted := make(chan struct{}) + releasePoll := make(chan struct{}) + var releaseOnce sync.Once + release := func() { releaseOnce.Do(func() { close(releasePoll) }) } + defer release() + server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) { + switch request.URL.Path { + case "/codex/device": + writeJSON(t, writer, http.StatusOK, map[string]any{ + "device_auth_id": "logout-device", "user_code": "LOGOUT", "interval": 1, + }) + case "/codex/poll": + close(pollStarted) + <-releasePoll + writeJSON(t, writer, http.StatusOK, map[string]any{ + "authorization_code": "logout-code", "code_verifier": "logout-verifier", + }) + case "/codex/token": + writeJSON(t, writer, http.StatusOK, map[string]any{ + "access_token": "must-not-survive-access", "refresh_token": "must-not-survive-refresh", + "id_token": idToken, "expires_in": 3600, + }) + default: + http.NotFound(writer, request) + } + })) + defer server.Close() + + dir := t.TempDir() + flowManager := newTestManager(t, dir, server, clock) + logoutManager := flowManager + if test.separateManager { + logoutManager = newTestManager(t, dir, server, clock) + } + flow, err := flowManager.Start(context.Background(), MethodCodexOAuth) + if err != nil { + t.Fatal(err) + } + pollResult := make(chan error, 1) + go func() { + _, pollErr := flowManager.Poll( + context.Background(), MethodCodexOAuth, flow.ID, + ) + pollResult <- pollErr + }() + select { + case <-pollStarted: + case <-time.After(5 * time.Second): + t.Fatal("poll did not reach upstream") + } + + logoutResult := make(chan error, 1) + go func() { + logoutResult <- logoutManager.Logout(context.Background(), MethodCodexOAuth) + }() + select { + case err := <-logoutResult: + if err != nil { + t.Fatal(err) + } + case <-time.After(5 * time.Second): + release() + t.Fatal("logout blocked behind an in-flight upstream poll") + } + + state, err := logoutManager.store.read() + if err != nil { + t.Fatal(err) + } + entry := state.Methods[MethodCodexOAuth] + if entry == nil || entry.Generation != 1 || len(entry.Accounts) != 0 { + t.Fatalf("durable logout state = %+v", entry) + } + release() + select { + case err := <-pollResult: + if !errors.Is(err, ErrFlowNotFound) { + t.Fatalf("poll error after logout = %v", err) + } + case <-time.After(5 * time.Second): + t.Fatal("poll did not finish after release") + } + status, err := flowManager.Status(context.Background(), MethodCodexOAuth) + if err != nil { + t.Fatal(err) + } + if len(status.Accounts) != 0 { + t.Fatalf("logout flow revived an account: %+v", status) + } + data, err := os.ReadFile(filepath.Join(dir, storeFileName)) + if err != nil { + t.Fatal(err) + } + if strings.Contains(string(data), "must-not-survive") { + t.Fatalf("logout store contains poll credentials: %s", data) + } + if _, err := flowManager.Poll( + context.Background(), MethodCodexOAuth, flow.ID, + ); !errors.Is(err, ErrFlowNotFound) { + t.Fatalf("invalidated flow remained pollable: %v", err) + } + }) + } +} + +func TestPendingFlowLimitReservesBeforeUpstream(t *testing.T) { + t.Parallel() + clock := newTestClock() + const limit = 4 + const callers = 12 + entered := make(chan struct{}, callers) + releaseRequests := make(chan struct{}) + server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) { + if request.URL.Path != "/codex/device" { + http.NotFound(writer, request) + return + } + entered <- struct{}{} + <-releaseRequests + writeJSON(t, writer, http.StatusOK, map[string]any{ + "device_auth_id": "limit-device", "user_code": "LIMIT", "interval": 1, + }) + })) + defer server.Close() + + manager := newTestManager(t, t.TempDir(), server, clock) + manager.pendingFlowLimit = limit + type outcome struct { + flow Flow + err error + } + results := make(chan outcome, callers) + for range callers { + go func() { + flow, err := manager.Start(context.Background(), MethodCodexOAuth) + results <- outcome{flow: flow, err: err} + }() + } + for range limit { + select { + case <-entered: + case <-time.After(5 * time.Second): + close(releaseRequests) + t.Fatal("reserved flow did not reach upstream") + } + } + for range callers - limit { + select { + case result := <-results: + if result.err == nil || !strings.Contains(result.err.Error(), "too many pending") { + close(releaseRequests) + t.Fatalf("overflow Start result = %+v", result) + } + case <-time.After(5 * time.Second): + close(releaseRequests) + t.Fatal("overflow Start reached upstream or did not return") + } + } + select { + case <-entered: + close(releaseRequests) + t.Fatal("pending-flow overflow reached upstream") + default: + } + close(releaseRequests) + for range limit { + select { + case result := <-results: + if result.err != nil || result.flow.ID == "" { + t.Fatalf("reserved Start result = %+v", result) + } + if err := manager.Cancel(MethodCodexOAuth, result.flow.ID); err != nil { + t.Fatal(err) + } + case <-time.After(5 * time.Second): + t.Fatal("reserved Start did not finish") + } + } +} + +func TestVerificationURIPinningAndLocalTestOverride(t *testing.T) { + production := &Manager{} + for _, test := range []struct { + uri string + host string + }{ + {uri: "https://auth.openai.com/codex/device", host: "auth.openai.com"}, + {uri: "https://auth.x.ai/device?code=one", host: "auth.x.ai"}, + {uri: "https://github.com/login/device", host: "github.com"}, + } { + if err := production.validateVerificationURI(test.uri, test.host); err != nil { + t.Fatalf("valid verification URI %q: %v", test.uri, err) + } + } + for _, uri := range []string{ + "http://github.com/login/device", + "https://github.com.evil.example/login/device", + "https://sub.github.com/login/device", + "https://github.com:8443/login/device", + "https://user@github.com/login/device", + "file:///tmp/device", + } { + if err := production.validateVerificationURI(uri, "github.com"); err == nil { + t.Fatalf("untrusted verification URI %q succeeded", uri) + } + } + if err := production.validateVerificationURIs( + "https://github.com/login/device", + "https://evil.example/login/device?user_code=one", + "github.com", + ); err == nil { + t.Fatal("untrusted verification_uri_complete succeeded") + } + + clock := newTestClock() + var serverURL string + server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) { + if request.URL.Path != "/copilot/device" { + http.NotFound(writer, request) + return + } + writeJSON(t, writer, http.StatusOK, map[string]any{ + "device_code": "local-device", "user_code": "LOCAL", + "verification_uri": serverURL + "/verify", "interval": 1, + }) + })) + serverURL = server.URL + defer server.Close() + manager := newTestManager(t, t.TempDir(), server, clock) + flow, err := manager.Start(context.Background(), MethodGitHubCopilot) + if err != nil { + t.Fatalf("local test verification URI: %v", err) + } + if err := manager.Cancel(MethodGitHubCopilot, flow.ID); err != nil { + t.Fatal(err) + } + manager.allowUnsafe = false + if _, err := manager.Start(context.Background(), MethodGitHubCopilot); err == nil || + !strings.Contains(err.Error(), "untrusted verification URI") { + t.Fatalf("production verification URI error = %v", err) + } +} diff --git a/internal/providerauth/store.go b/internal/providerauth/store.go new file mode 100644 index 00000000..48065753 --- /dev/null +++ b/internal/providerauth/store.go @@ -0,0 +1,310 @@ +package providerauth + +import ( + "encoding/json" + "errors" + "fmt" + "io" + "os" + "path/filepath" + "sort" + "sync" + "time" +) + +const ( + storeFileName = "provider-auth.json" + lockFileName = "provider-auth.lock" + storeVersion = 1 +) + +var errSecretChanged = errors.New("provider auth durable secret changed") + +type storedAccount struct { + ID string `json:"id"` + Login string `json:"login"` + Secret string `json:"secret"` + AuthenticatedAt time.Time `json:"authenticated_at"` + RequiresReauth bool `json:"requires_reauth,omitempty"` +} + +func (account storedAccount) public() Account { + return Account{ + ID: account.ID, + Login: account.Login, + AuthenticatedAt: account.AuthenticatedAt, + RequiresReauth: account.RequiresReauth, + } +} + +type storedMethod struct { + Accounts map[string]storedAccount `json:"accounts"` + DefaultAccountID string `json:"default_account_id,omitempty"` + // Generation is a durable logout epoch. Device flows capture it at Start and + // may commit an account only while it still matches, preventing a flow in + // another process from restoring accounts after Logout has returned. + Generation uint64 `json:"generation,omitempty"` +} + +type storedState struct { + Version int `json:"version"` + Methods map[Method]*storedMethod `json:"methods"` +} + +func newStoredState() storedState { + return storedState{Version: storeVersion, Methods: make(map[Method]*storedMethod)} +} + +func (state *storedState) method(method Method) *storedMethod { + entry := state.Methods[method] + if entry == nil { + entry = &storedMethod{Accounts: make(map[string]storedAccount)} + state.Methods[method] = entry + } + if entry.Accounts == nil { + entry.Accounts = make(map[string]storedAccount) + } + return entry +} + +type fileStore struct { + dir string + path string + lockPath string + mutationMu sync.Mutex +} + +func newFileStore(configDir string) (*fileStore, error) { + if configDir == "" { + return nil, errors.New("provider auth config directory is required") + } + abs, err := filepath.Abs(configDir) + if err != nil { + return nil, fmt.Errorf("resolve provider auth config directory: %w", err) + } + return &fileStore{ + dir: filepath.Clean(abs), + path: filepath.Join(abs, storeFileName), + lockPath: filepath.Join(abs, lockFileName), + }, nil +} + +func (store *fileStore) secureDirectory() error { + if err := os.MkdirAll(store.dir, 0o700); err != nil { + return fmt.Errorf("create provider auth directory: %w", err) + } + if err := os.Chmod(store.dir, 0o700); err != nil { + return fmt.Errorf("secure provider auth directory: %w", err) + } + return nil +} + +func (store *fileStore) secureExistingStore() error { + info, err := os.Lstat(store.path) + if errors.Is(err, os.ErrNotExist) { + return nil + } + if err != nil { + return fmt.Errorf("inspect provider auth store: %w", err) + } + if !info.Mode().IsRegular() { + return errors.New("provider auth store must be a regular file") + } + if err := os.Chmod(store.path, 0o600); err != nil { + return fmt.Errorf("secure existing provider auth store: %w", err) + } + return nil +} + +func (store *fileStore) read() (storedState, error) { + state := newStoredState() + data, err := os.ReadFile(store.path) + if errors.Is(err, os.ErrNotExist) { + return state, nil + } + if err != nil { + return state, fmt.Errorf("read provider auth store: %w", err) + } + if err := json.Unmarshal(data, &state); err != nil { + return state, fmt.Errorf("decode provider auth store: %w", err) + } + if state.Version != storeVersion { + return state, fmt.Errorf("unsupported provider auth store version %d", state.Version) + } + if state.Methods == nil { + state.Methods = make(map[Method]*storedMethod) + } + return state, nil +} + +func (store *fileStore) mutate(fn func(*storedState) error) error { + store.mutationMu.Lock() + defer store.mutationMu.Unlock() + + if err := store.secureDirectory(); err != nil { + return err + } + lock, err := acquireFileLock(store.lockPath) + if err != nil { + return fmt.Errorf("lock provider auth store: %w", err) + } + defer func() { _ = lock.release() }() + + state, err := store.read() + if err != nil { + return err + } + if err := fn(&state); err != nil { + return err + } + return store.write(state) +} + +func (store *fileStore) compareSecret(method Method, accountID, expected string) error { + store.mutationMu.Lock() + defer store.mutationMu.Unlock() + if err := store.secureDirectory(); err != nil { + return err + } + lock, err := acquireFileLock(store.lockPath) + if err != nil { + return fmt.Errorf("lock provider auth store: %w", err) + } + defer func() { _ = lock.release() }() + state, err := store.read() + if err != nil { + return err + } + account, ok := state.method(method).Accounts[accountID] + if !ok { + return fmt.Errorf("%w: %s/%s", ErrAccountNotFound, method, accountID) + } + if account.RequiresReauth { + return fmt.Errorf("%w: %s/%s", ErrRequiresReauth, method, accountID) + } + if account.Secret != expected { + return errSecretChanged + } + return nil +} + +func (store *fileStore) generation(method Method) (uint64, error) { + state, err := store.read() + if err != nil { + return 0, err + } + entry := state.Methods[method] + if entry == nil { + return 0, nil + } + return entry.Generation, nil +} + +func (store *fileStore) write(state storedState) error { + data, err := json.MarshalIndent(state, "", " ") + if err != nil { + return fmt.Errorf("encode provider auth store: %w", err) + } + data = append(data, '\n') + + tmp, err := os.CreateTemp(store.dir, ".provider-auth.tmp-*") + if err != nil { + return fmt.Errorf("create provider auth temporary file: %w", err) + } + tmpPath := tmp.Name() + defer func() { + _ = tmp.Close() + _ = os.Remove(tmpPath) + }() + if err := tmp.Chmod(0o600); err != nil { + return fmt.Errorf("secure provider auth temporary file: %w", err) + } + if n, err := tmp.Write(data); err != nil { + return fmt.Errorf("write provider auth temporary file: %w", err) + } else if n != len(data) { + return fmt.Errorf("write provider auth temporary file: %w", io.ErrShortWrite) + } + if err := tmp.Sync(); err != nil { + return fmt.Errorf("sync provider auth temporary file: %w", err) + } + if err := tmp.Close(); err != nil { + return fmt.Errorf("close provider auth temporary file: %w", err) + } + if err := replaceFile(tmpPath, store.path); err != nil { + return fmt.Errorf("replace provider auth store: %w", err) + } + tmpPath = "" + if err := os.Chmod(store.path, 0o600); err != nil { + return fmt.Errorf("secure provider auth store: %w", err) + } + if err := syncDirectory(store.dir); err != nil { + return fmt.Errorf("sync provider auth directory: %w", err) + } + return nil +} + +func (store *fileStore) status(method Method) (Status, error) { + state, err := store.read() + if err != nil { + return Status{}, err + } + entry := state.method(method) + accounts := make([]Account, 0, len(entry.Accounts)) + for _, account := range entry.Accounts { + accounts = append(accounts, account.public()) + } + sort.Slice(accounts, func(i, j int) bool { + iDefault := accounts[i].ID == entry.DefaultAccountID + jDefault := accounts[j].ID == entry.DefaultAccountID + if iDefault != jDefault { + return iDefault + } + if accounts[i].RequiresReauth != accounts[j].RequiresReauth { + return !accounts[i].RequiresReauth + } + if !accounts[i].AuthenticatedAt.Equal(accounts[j].AuthenticatedAt) { + return accounts[i].AuthenticatedAt.After(accounts[j].AuthenticatedAt) + } + return accounts[i].ID < accounts[j].ID + }) + return Status{ + Method: method, + Accounts: accounts, + DefaultAccountID: entry.DefaultAccountID, + Authenticated: len(accounts) > 0, + }, nil +} + +func (store *fileStore) resolve(binding Binding) (storedAccount, error) { + state, err := store.read() + if err != nil { + return storedAccount{}, err + } + entry := state.method(binding.Method) + id := binding.AccountID + if id == "" { + id = entry.DefaultAccountID + } + account, ok := entry.Accounts[id] + if !ok || id == "" { + return storedAccount{}, fmt.Errorf("%w: %s/%s", ErrAccountNotFound, binding.Method, id) + } + if account.RequiresReauth { + return storedAccount{}, fmt.Errorf("%w: %s/%s", ErrRequiresReauth, binding.Method, id) + } + return account, nil +} + +func fallbackDefault(accounts map[string]storedAccount) string { + var best storedAccount + for _, candidate := range accounts { + if candidate.RequiresReauth { + continue + } + if best.ID == "" || candidate.AuthenticatedAt.After(best.AuthenticatedAt) || + (candidate.AuthenticatedAt.Equal(best.AuthenticatedAt) && candidate.ID < best.ID) { + best = candidate + } + } + return best.ID +} diff --git a/internal/providerauth/types.go b/internal/providerauth/types.go new file mode 100644 index 00000000..407e25c9 --- /dev/null +++ b/internal/providerauth/types.go @@ -0,0 +1,143 @@ +// Package providerauth manages OAuth-backed provider accounts without exposing +// durable secrets to provider configuration or UI/API callers. +package providerauth + +import ( + "context" + "errors" + "io" + "net/http" + "time" +) + +// Method identifies a managed provider login mechanism. +type Method string + +const ( + MethodCodexOAuth Method = "codex_oauth" + MethodXAIOAuth Method = "xai_oauth" + MethodGitHubCopilot Method = "github_copilot" +) + +// Protocol is the wire protocol required by a managed provider runtime. +type Protocol string + +const ( + ProtocolResponses Protocol = "responses" + ProtocolChatCompletions Protocol = "chat_completions" +) + +// FlowState is the public state of a device authorization flow. +type FlowState string + +const ( + FlowStatePending FlowState = "pending" + FlowStateAuthorized FlowState = "authorized" + FlowStateDenied FlowState = "denied" + FlowStateExpired FlowState = "expired" +) + +// Binding is the non-secret value stored on a Provider configuration. +type Binding struct { + Method Method `json:"method"` + AccountID string `json:"account_id,omitempty"` +} + +// Account is the non-secret account projection exposed to clients. +type Account struct { + ID string `json:"id"` + Login string `json:"login"` + AuthenticatedAt time.Time `json:"authenticated_at"` + RequiresReauth bool `json:"requires_reauth"` +} + +// Flow is the public device-flow projection. Upstream device tokens and PKCE +// material are deliberately absent and remain in process memory only. +type Flow struct { + ID string `json:"flow_id"` + Method Method `json:"method"` + State FlowState `json:"state"` + UserCode string `json:"user_code"` + VerificationURI string `json:"verification_uri"` + VerificationURIComplete string `json:"verification_uri_complete,omitempty"` + ExpiresAt time.Time `json:"expires_at"` + IntervalSeconds int `json:"interval_seconds,omitempty"` + Account *Account `json:"account,omitempty"` + Error string `json:"error,omitempty"` +} + +// Status describes all locally stored accounts for one login method. +type Status struct { + Method Method `json:"method"` + Accounts []Account `json:"accounts"` + DefaultAccountID string `json:"default_account_id,omitempty"` + Authenticated bool `json:"authenticated"` +} + +// Credential is resolved immediately before an upstream request. Token is +// intentionally excluded from JSON serialization to prevent accidental API or +// log exposure. +type Credential struct { + Token string `json:"-"` + AccountID string `json:"account_id"` + BaseURL string `json:"base_url"` + Protocol Protocol `json:"protocol"` + Headers map[string]string `json:"headers,omitempty"` +} + +var ( + ErrUnsupportedMethod = errors.New("unsupported provider auth method") + ErrUnsupportedGHES = errors.New("GitHub Enterprise Server is not supported") + ErrFlowNotFound = errors.New("provider auth flow not found") + ErrFlowExpired = errors.New("provider auth flow expired") + ErrAuthorizationPending = errors.New("provider authorization pending") + ErrAccessDenied = errors.New("provider authorization denied") + ErrAccountNotFound = errors.New("provider auth account not found") + ErrRequiresReauth = errors.New("provider auth account requires reauthentication") + ErrNoCopilotSubscription = errors.New("GitHub account has no Copilot subscription") + ErrInvalidBinding = errors.New("invalid provider auth binding") +) + +// Endpoints contains managed upstream endpoints. The zero value selects the +// production endpoints. Non-zero overrides are intended only for hermetic +// tests and require AllowInsecureTestEndpoints when they are not trusted HTTPS +// origins. +type Endpoints struct { + CodexDeviceStart string + CodexDevicePoll string + CodexToken string + CodexVerification string + CodexRuntime string + XAIDiscovery string + XAIRuntime string + CopilotDeviceStart string + CopilotOAuthToken string + CopilotUser string + CopilotToken string + CopilotUsage string + CopilotRuntime string +} + +// Options supplies dependencies for Manager. ConfigDir is required. HTTPClient, +// Now and Rand are injectable to keep tests deterministic and offline. +type Options struct { + ConfigDir string + HTTPClient *http.Client + Now func() time.Time + Rand io.Reader + Endpoints Endpoints + AllowInsecureTestEndpoints bool +} + +// Service is the consuming-package-friendly contract implemented by Manager. +type Service interface { + Start(context.Context, Method) (Flow, error) + Poll(context.Context, Method, string) (Flow, error) + Cancel(Method, string) error + Status(context.Context, Method) (Status, error) + SetDefault(context.Context, Method, string) error + Remove(context.Context, Method, string) error + Logout(context.Context, Method) error + ValidateBinding(context.Context, Binding) error + Credential(context.Context, Binding) (Credential, error) +} diff --git a/internal/providerauth/xai.go b/internal/providerauth/xai.go new file mode 100644 index 00000000..04f20596 --- /dev/null +++ b/internal/providerauth/xai.go @@ -0,0 +1,259 @@ +package providerauth + +import ( + "context" + "errors" + "fmt" + "net/http" + "net/url" + "strings" + "time" +) + +const ( + xaiIssuer = "https://auth.x.ai" + xaiClientID = "b1a00492-073a-47ea-816f-4c329264a828" + xaiScope = "openid profile email offline_access grok-cli:access api:access" + xaiUserAgent = "jcode-xai-oauth" +) + +type xaiOAuthEndpoints struct { + device string + token string +} + +func (manager *Manager) startXAI(ctx context.Context) (*pendingFlow, error) { + endpoints, err := manager.discoverXAI(ctx) + if err != nil { + return nil, err + } + status, value, err := manager.postForm( + ctx, + endpoints.device, + url.Values{"client_id": {xaiClientID}, "scope": {xaiScope}}, + map[string]string{"User-Agent": xaiUserAgent}, + ) + if err != nil { + return nil, err + } + if status < http.StatusOK || status >= http.StatusMultipleChoices { + return nil, upstreamError("start xAI device authorization", status, value) + } + deviceCode := stringField(value, "device_code") + userCode := stringField(value, "user_code") + verificationURI := stringField(value, "verification_uri") + verificationComplete := stringField(value, "verification_uri_complete") + if deviceCode == "" || userCode == "" || verificationURI == "" { + return nil, errors.New("xAI device authorization response is missing required fields") + } + if err := manager.validateVerificationURIs( + verificationURI, verificationComplete, "auth.x.ai", + ); err != nil { + return nil, err + } + expiresIn := clampSeconds(intField(value, "expires_in", 900), 24*60*60) + interval := clampSeconds(intField(value, "interval", 5), 60) + 3 + now := manager.now() + return &pendingFlow{ + public: Flow{ + Method: MethodXAIOAuth, + State: FlowStatePending, + UserCode: userCode, + VerificationURI: verificationURI, + VerificationURIComplete: verificationComplete, + ExpiresAt: now.Add(time.Duration(expiresIn) * time.Second), + IntervalSeconds: int(interval), + }, + deviceCode: deviceCode, + tokenEndpoint: endpoints.token, + nextPollAt: now, + interval: time.Duration(interval) * time.Second, + }, nil +} + +func (manager *Manager) discoverXAI(ctx context.Context) (xaiOAuthEndpoints, error) { + manager.mu.RLock() + cached := manager.xaiEndpoints + manager.mu.RUnlock() + if cached != nil { + return *cached, nil + } + status, value, err := manager.getJSON( + ctx, manager.endpoints.XAIDiscovery, map[string]string{"User-Agent": xaiUserAgent}, + ) + if err != nil { + return xaiOAuthEndpoints{}, err + } + if status < http.StatusOK || status >= http.StatusMultipleChoices { + return xaiOAuthEndpoints{}, upstreamError("discover xAI OAuth endpoints", status, value) + } + if strings.TrimSuffix(stringField(value, "issuer"), "/") != xaiIssuer { + return xaiOAuthEndpoints{}, errors.New("xAI discovery issuer does not match https://auth.x.ai") + } + endpoints := xaiOAuthEndpoints{ + device: stringField(value, "device_authorization_endpoint"), + token: stringField(value, "token_endpoint"), + } + if endpoints.device == "" || endpoints.token == "" { + return xaiOAuthEndpoints{}, errors.New("xAI discovery response is missing required endpoints") + } + if !manager.allowUnsafe { + if err := validateManagedAuthEndpoint(endpoints.device, "auth.x.ai"); err != nil { + return xaiOAuthEndpoints{}, err + } + if err := validateManagedAuthEndpoint(endpoints.token, "auth.x.ai"); err != nil { + return xaiOAuthEndpoints{}, err + } + } + manager.mu.Lock() + if manager.xaiEndpoints == nil { + copy := endpoints + manager.xaiEndpoints = © + } else { + endpoints = *manager.xaiEndpoints + } + manager.mu.Unlock() + return endpoints, nil +} + +func validateManagedAuthEndpoint(endpoint, host string) error { + parsed, err := url.Parse(endpoint) + if err != nil || parsed.Scheme != "https" || parsed.Hostname() != host || + parsed.Port() != "" || parsed.User != nil { + return errors.New("managed OAuth discovery returned an untrusted endpoint") + } + return nil +} + +func (manager *Manager) pollXAI(ctx context.Context, pending *pendingFlow) (Flow, error) { + status, value, err := manager.postForm( + ctx, + pending.tokenEndpoint, + url.Values{ + "grant_type": {"urn:ietf:params:oauth:grant-type:device_code"}, + "client_id": {xaiClientID}, + "device_code": {pending.deviceCode}, + }, + map[string]string{"User-Agent": xaiUserAgent}, + ) + if err != nil { + return Flow{}, err + } + switch oauthError(value) { + case "authorization_pending": + return pending.public, nil + case "slow_down": + pending.interval = min(pending.interval+5*time.Second, 63*time.Second) + pending.public.IntervalSeconds = int(pending.interval / time.Second) + pending.nextPollAt = manager.now().Add(pending.interval) + return pending.public, nil + case "access_denied": + return terminalFlow(pending.public, FlowStateDenied, ErrAccessDenied), nil + case "expired_token": + return terminalFlow(pending.public, FlowStateExpired, ErrFlowExpired), nil + case "": + default: + return Flow{}, upstreamError("poll xAI device authorization", status, value) + } + if status < http.StatusOK || status >= http.StatusMultipleChoices { + return Flow{}, upstreamError("poll xAI device authorization", status, value) + } + access := stringField(value, "access_token") + refresh := stringField(value, "refresh_token") + if access == "" || refresh == "" { + return Flow{}, errors.New("xAI token response is missing a required token") + } + accountID, login := xaiIdentity(value) + if accountID == "" { + return Flow{}, errors.New("xAI token does not contain a stable sub claim") + } + account := storedAccount{ + ID: accountID, Login: login, Secret: refresh, AuthenticatedAt: manager.now().UTC(), + } + if account.Login == "" { + account.Login = "xAI (" + shortID(accountID) + ")" + } + if err := manager.commitFlowAccount(MethodXAIOAuth, pending, account); err != nil { + return Flow{}, err + } + manager.cache( + MethodXAIOAuth, + accountID, + access, + tokenExpiry(manager.now, intField(value, "expires_in", 3600)), + ) + flow := pending.public + flow.State = FlowStateAuthorized + public := account.public() + flow.Account = &public + return flow, nil +} + +func xaiIdentity(tokens map[string]any) (string, string) { + for _, token := range []string{stringField(tokens, "id_token"), stringField(tokens, "access_token")} { + payload := jwtPayload(token) + if payload == nil { + continue + } + accountID := stringField(payload, "sub") + if accountID == "" { + continue + } + for _, field := range []string{"email", "preferred_username", "name"} { + if login := stringField(payload, field); login != "" { + return accountID, login + } + } + return accountID, "" + } + return "", "" +} + +func (manager *Manager) refreshXAI(ctx context.Context, account storedAccount) (string, error) { + endpoints, err := manager.discoverXAI(ctx) + if err != nil { + return "", err + } + status, value, err := manager.postForm( + ctx, + endpoints.token, + url.Values{ + "grant_type": {"refresh_token"}, + "client_id": {xaiClientID}, + "refresh_token": {account.Secret}, + "scope": {xaiScope}, + }, + map[string]string{"User-Agent": xaiUserAgent}, + ) + if err != nil { + return "", err + } + code := oauthError(value) + if status == http.StatusUnauthorized || status == http.StatusForbidden || + (status == http.StatusBadRequest && len(value) == 0) || + code == "invalid_grant" || code == "invalid_token" { + if err := manager.markRequiresReauth(MethodXAIOAuth, account.ID, account.Secret); err != nil { + return "", err + } + return "", fmt.Errorf("%w: %s", ErrRequiresReauth, account.ID) + } + if status < http.StatusOK || status >= http.StatusMultipleChoices || code != "" { + return "", upstreamError("refresh xAI access token", status, value) + } + access := stringField(value, "access_token") + if access == "" { + return "", errors.New("xAI refresh response is missing access_token") + } + if err := manager.replaceSecret( + MethodXAIOAuth, account.ID, account.Secret, stringField(value, "refresh_token"), + ); err != nil { + return "", err + } + manager.cache( + MethodXAIOAuth, + account.ID, + access, + tokenExpiry(manager.now, intField(value, "expires_in", 3600)), + ) + return access, nil +} diff --git a/internal/runner/responses_continuity_test.go b/internal/runner/responses_continuity_test.go new file mode 100644 index 00000000..92b33af7 --- /dev/null +++ b/internal/runner/responses_continuity_test.go @@ -0,0 +1,214 @@ +package runner + +import ( + "context" + "encoding/json" + "errors" + "strings" + "testing" + + "github.com/cloudwego/eino/adk" + einomodel "github.com/cloudwego/eino/components/model" + "github.com/cloudwego/eino/schema" + "github.com/cnjack/jcode/internal/model/responsemeta" + "github.com/cnjack/jcode/internal/session" +) + +type responsesContinuityModel struct{} + +type responsesFailedStreamModel struct { + content string + cancel context.CancelFunc +} + +func (m *responsesContinuityModel) WithTools([]*schema.ToolInfo) (einomodel.ToolCallingChatModel, error) { + return m, nil +} + +func (m *responsesContinuityModel) Generate( + context.Context, + []*schema.Message, + ...einomodel.Option, +) (*schema.Message, error) { + return nil, errors.New("Generate is not used: streaming is enabled") +} + +func (m *responsesContinuityModel) Stream( + context.Context, + []*schema.Message, + ...einomodel.Option, +) (*schema.StreamReader[*schema.Message], error) { + opaque := json.RawMessage(`{"type":"reasoning","id":"rs-runner","summary":[{"type":"summary_text","text":"clear-summary"}],"encrypted_content":"cipher-runner"}`) + return schema.StreamReaderFromArray([]*schema.Message{ + { + Role: schema.Assistant, ReasoningContent: "runtime-thought", + Extra: map[string]any{ + responsemeta.OpaqueItemsExtraKey: []json.RawMessage{opaque}, + "provider_meta": "kept-live", + }, + }, + {Role: schema.Assistant, Content: "answer"}, + }), nil +} + +func (m *responsesFailedStreamModel) WithTools([]*schema.ToolInfo) (einomodel.ToolCallingChatModel, error) { + return m, nil +} + +func (m *responsesFailedStreamModel) Generate( + context.Context, + []*schema.Message, + ...einomodel.Option, +) (*schema.Message, error) { + return nil, errors.New("Generate is not used: streaming is enabled") +} + +func (m *responsesFailedStreamModel) Stream( + ctx context.Context, + _ []*schema.Message, + _ ...einomodel.Option, +) (*schema.StreamReader[*schema.Message], error) { + reader, writer := schema.Pipe[*schema.Message](2) + go func() { + defer writer.Close() + opaque := json.RawMessage(`{"type":"reasoning","id":"rs-partial","summary":[{"type":"summary_text","text":"clear-partial"}],"encrypted_content":"cipher-partial"}`) + if writer.Send(&schema.Message{ + Role: schema.Assistant, Content: m.content, ReasoningContent: "runtime-partial", + Extra: responsemeta.Extra([]json.RawMessage{opaque}), + }, nil) { + return + } + if m.cancel != nil { + m.cancel() + writer.Send(nil, ctx.Err()) + return + } + writer.Send(nil, errors.New("provider stream failed")) + }() + return reader, nil +} + +func TestRunPreservesResponsesReasoningAndExtraWithoutPersistingCleartext(t *testing.T) { + t.Setenv("HOME", t.TempDir()) + ctx := context.Background() + agent, err := adk.NewChatModelAgent(ctx, &adk.ChatModelAgentConfig{ + Name: "responses-continuity", Description: "test", Instruction: "test", + Model: &responsesContinuityModel{}, MaxIterations: 2, + }) + if err != nil { + t.Fatal(err) + } + recorder, err := session.NewRecorder(t.TempDir(), "provider", "model") + if err != nil { + t.Fatal(err) + } + recorder.RecordUser("hello") + result := Run( + ctx, agent, []adk.Message{schema.UserMessage("hello")}, stubHandler{}, recorder, + nil, nil, nil, nil, + ) + recorder.Close() + if result.Err != nil || result.Response != "answer" || len(result.Messages) != 1 { + t.Fatalf("result = %#v", result) + } + live := result.Messages[0] + if live.ReasoningContent != "runtime-thought" || live.Extra["provider_meta"] != "kept-live" { + t.Fatalf("live message lost Responses metadata: %#v", live) + } + if items := responsemeta.FromExtra(live.Extra); len(items) != 1 || + !strings.Contains(string(items[0]), "cipher-runner") || strings.Contains(string(items[0]), "clear-summary") { + t.Fatalf("live opaque items = %s", items) + } + + entries, err := session.LoadSession(recorder.UUID()) + if err != nil { + t.Fatal(err) + } + replayed := session.ReconstructState(entries).History + if len(replayed) != 2 { + t.Fatalf("replayed history length = %d", len(replayed)) + } + assistant := replayed[1] + if assistant.Content != "answer" || assistant.ReasoningContent != "" { + t.Fatalf("replayed assistant = %#v", assistant) + } + if _, ok := assistant.Extra["provider_meta"]; ok { + t.Fatal("arbitrary provider metadata was persisted") + } + if items := responsemeta.FromExtra(assistant.Extra); len(items) != 1 || + !strings.Contains(string(items[0]), "cipher-runner") { + t.Fatalf("replayed opaque items = %s", items) + } +} + +func TestRunFailedResponsesStreamDoesNotPersistOrphanOpaqueReasoning(t *testing.T) { + tests := []struct { + name string + content string + cancel bool + wantAssistant bool + wantOpaqueItem bool + }{ + {name: "error without visible content"}, + {name: "cancel without visible content", cancel: true}, + {name: "error with visible content", content: "visible partial", wantAssistant: true, wantOpaqueItem: true}, + } + for _, test := range tests { + t.Run(test.name, func(t *testing.T) { + t.Setenv("HOME", t.TempDir()) + ctx := context.Background() + var cancel context.CancelFunc + if test.cancel { + ctx, cancel = context.WithCancel(ctx) + defer cancel() + } + model := &responsesFailedStreamModel{content: test.content, cancel: cancel} + agent, err := adk.NewChatModelAgent(ctx, &adk.ChatModelAgentConfig{ + Name: "responses-failed-stream", Description: "test", Instruction: "test", + Model: model, MaxIterations: 2, + }) + if err != nil { + t.Fatal(err) + } + recorder, err := session.NewRecorder(t.TempDir(), "provider", "model") + if err != nil { + t.Fatal(err) + } + recorder.RecordUser("hello") + result := Run( + ctx, agent, []adk.Message{schema.UserMessage("hello")}, stubHandler{}, recorder, + nil, nil, nil, nil, + ) + id := recorder.UUID() + recorder.Close() + if result.Err == nil { + t.Fatal("Run unexpectedly succeeded") + } + + entries, err := session.LoadSession(id) + if err != nil { + t.Fatal(err) + } + history := session.ReconstructState(entries).History + var assistant *schema.Message + for _, message := range history { + if message.Role == schema.Assistant { + assistant = message + } + } + if !test.wantAssistant { + if assistant != nil { + t.Fatalf("restart retained failed assistant turn: %#v", assistant) + } + return + } + if assistant == nil || assistant.Content != test.content { + t.Fatalf("restart assistant = %#v, want content %q", assistant, test.content) + } + items := responsemeta.FromExtra(assistant.Extra) + if test.wantOpaqueItem && (len(items) != 1 || !strings.Contains(string(items[0]), "cipher-partial")) { + t.Fatalf("restart opaque items = %s", items) + } + }) + } +} diff --git a/internal/runner/runner.go b/internal/runner/runner.go index 0ffe40a5..112e6be3 100644 --- a/internal/runner/runner.go +++ b/internal/runner/runner.go @@ -18,6 +18,7 @@ import ( "github.com/cnjack/jcode/internal/handler" "github.com/cnjack/jcode/internal/hooks" internalmodel "github.com/cnjack/jcode/internal/model" + "github.com/cnjack/jcode/internal/model/responsemeta" "github.com/cnjack/jcode/internal/session" "github.com/cnjack/jcode/internal/telemetry" "github.com/cnjack/jcode/internal/toolpolicy" @@ -54,6 +55,9 @@ func Run( tokenUsage *internalmodel.TokenUsage, ) (result RunResult) { ctx = toolpolicy.WithRunID(ctx, nextRunID(rec)) + if rec != nil && rec.UUID() != "" { + ctx = internalmodel.WithProviderSessionID(ctx, rec.UUID()) + } if tracer != nil { ctx = tracer.WithNewTrace(ctx, "coding_agent", messages) defer func() { @@ -589,6 +593,8 @@ func runInner( if mo.IsStreaming { var messageText strings.Builder + var reasoningText strings.Builder + var messageExtra map[string]any var streamErr error // Accumulate streaming tool call names, args, and IDs across chunks. type pendingTC struct { @@ -628,19 +634,27 @@ func runInner( responseText.WriteString(chunk.Content) h.OnAgentText(chunk.Content) } + if chunk.ReasoningContent != "" { + reasoningText.WriteString(chunk.ReasoningContent) + } + messageExtra = mergeAssistantExtra(messageExtra, chunk.Extra) } if streamErr != nil { // A failed stream may contain only a prefix of tool-call arguments. // Preserve text already shown to the user, but never persist or // expose incomplete calls as executable conversation history. - if messageText.Len() > 0 { - if rec != nil { - rec.RecordAssistant(messageText.String()) + if messageText.Len() > 0 || reasoningText.Len() > 0 || len(messageExtra) > 0 { + partial := &schema.Message{ + Role: schema.Assistant, Content: messageText.String(), + ReasoningContent: reasoningText.String(), Extra: messageExtra, + } + // Encrypted reasoning without visible output is not a complete + // assistant turn. Keep the live partial for diagnostics, but do + // not leave an orphan continuation item in the session journal. + if rec != nil && messageText.Len() > 0 { + rec.RecordAssistantMessage(partial) } - result.Messages = append(result.Messages, &schema.Message{ - Role: schema.Assistant, - Content: messageText.String(), - }) + result.Messages = append(result.Messages, partial) } if ctx.Err() != nil { config.Logger().Printf("[runner] assistant stream cancelled: %v", streamErr) @@ -659,13 +673,6 @@ func runInner( h.OnAgentDone(runErr) return finish(true, runErr) } - // Flush assistant text at the end of each assistant message so the - // session file preserves the true message/tool interleaving. Without - // this, the whole run accumulates into a single assistant entry and - // replay collapses all surrounding tool calls into one big group. - if rec != nil && messageText.Len() > 0 { - rec.RecordAssistant(messageText.String()) - } // Notify and record accumulated tool calls in index order. // All tool calls from this assistant message form one batch. indices := make([]int, 0, len(pending)) @@ -685,12 +692,22 @@ func runInner( Function: schema.FunctionCall{Name: p.name, Arguments: p.args.String()}, }) } - if messageText.Len() > 0 || len(toolCalls) > 0 { - result.Messages = append(result.Messages, &schema.Message{ - Role: schema.Assistant, - Content: messageText.String(), - ToolCalls: toolCalls, - }) + if messageText.Len() > 0 || reasoningText.Len() > 0 || len(toolCalls) > 0 || len(messageExtra) > 0 { + assistantMessage := &schema.Message{ + Role: schema.Assistant, + Content: messageText.String(), + ReasoningContent: reasoningText.String(), + ToolCalls: toolCalls, + Extra: messageExtra, + } + // Flush each complete assistant turn before its tool-call entries + // so replay preserves interleaving. Passing ToolCalls lets the + // recorder retain opaque reasoning for a tool-only turn while + // rejecting standalone opaque metadata. + if rec != nil { + rec.RecordAssistantMessage(assistantMessage) + } + result.Messages = append(result.Messages, assistantMessage) } if len(indices) > 0 { batchID := nextBatchID() @@ -716,15 +733,17 @@ func runInner( } } } else if mo.Message != nil { - if mo.Message.Content != "" || len(mo.Message.ToolCalls) > 0 { + if mo.Message.Content != "" || mo.Message.ReasoningContent != "" || len(mo.Message.ToolCalls) > 0 || len(mo.Message.Extra) > 0 { var toolCalls []schema.ToolCall if len(mo.Message.ToolCalls) > 0 { toolCalls = append(toolCalls, mo.Message.ToolCalls...) } result.Messages = append(result.Messages, &schema.Message{ - Role: schema.Assistant, - Content: mo.Message.Content, - ToolCalls: toolCalls, + Role: schema.Assistant, + Content: mo.Message.Content, + ReasoningContent: mo.Message.ReasoningContent, + ToolCalls: toolCalls, + Extra: mergeAssistantExtra(nil, mo.Message.Extra), }) } if len(mo.Message.ToolCalls) > 0 { @@ -756,8 +775,8 @@ func runInner( } // Flush non-streaming assistant text immediately so each assistant // message is a distinct session entry with its surrounding tool calls. - if rec != nil && mo.Message.Content != "" { - rec.RecordAssistant(mo.Message.Content) + if rec != nil && (mo.Message.Content != "" || len(mo.Message.Extra) > 0) { + rec.RecordAssistantMessage(mo.Message) } } } @@ -771,6 +790,32 @@ func runInner( return finish(false, nil) } +func mergeAssistantExtra(dst, src map[string]any) map[string]any { + if len(src) == 0 { + return dst + } + for key, value := range src { + // Eino attaches a per-dispatch correlation id to model messages. It is + // framework-ephemeral (and intentionally absent from session replay), so + // do not leak it into persistable conversation history. + if key == "_eino_msg_id" { + continue + } + if dst == nil { + dst = make(map[string]any, len(src)) + } + if key == responsemeta.OpaqueItemsExtraKey { + items := append(responsemeta.FromExtra(dst), responsemeta.FromExtra(src)...) + if normalized := responsemeta.Normalize(items); len(normalized) > 0 { + dst[key] = normalized + } + continue + } + dst[key] = value + } + return dst +} + func decorateToolCallEvent(event *handler.ToolCallEvent) { if event == nil || event.Name != "generate_image" { return diff --git a/internal/session/history.go b/internal/session/history.go index 62cd59ac..55016018 100644 --- a/internal/session/history.go +++ b/internal/session/history.go @@ -6,6 +6,7 @@ import ( "github.com/cloudwego/eino/adk" "github.com/cloudwego/eino/schema" + "github.com/cnjack/jcode/internal/model/responsemeta" ) // entryToUserMessage converts a session Entry into a schema.Message, @@ -168,16 +169,19 @@ func ReconstructState(entries []Entry) *SessionState { msgs = append(msgs, entryToUserMessage(e)) case EntryAssistant: - if e.Content != "" { + opaqueItems := responsemeta.Normalize(e.OpaqueResponseItems) + if e.Content != "" || len(opaqueItems) > 0 { + extra := responsemeta.Extra(opaqueItems) // Merge into preceding assistant message that has tool calls // but empty content (runner records text after tool calls). if n := len(msgs); n > 0 { if last := msgs[n-1]; last.Role == schema.Assistant && last.Content == "" && len(last.ToolCalls) > 0 { last.Content = e.Content + mergeOpaqueResponseExtra(last, extra) continue } } - msgs = append(msgs, &schema.Message{Role: schema.Assistant, Content: e.Content}) + msgs = append(msgs, &schema.Message{Role: schema.Assistant, Content: e.Content, Extra: extra}) } case EntryToolCall: @@ -277,10 +281,35 @@ func ReconstructState(entries []Entry) *SessionState { } } - state.History = repairDanglingToolCalls(msgs) + state.History = repairDanglingToolCalls(dropOrphanOpaqueAssistantMessages(msgs)) return state } +func dropOrphanOpaqueAssistantMessages(messages []adk.Message) []adk.Message { + filtered := make([]adk.Message, 0, len(messages)) + for _, message := range messages { + if message != nil && message.Role == schema.Assistant && message.Content == "" && + len(message.ToolCalls) == 0 && len(responsemeta.FromExtra(message.Extra)) > 0 { + continue + } + filtered = append(filtered, message) + } + return filtered +} + +func mergeOpaqueResponseExtra(message *schema.Message, extra map[string]any) { + if message == nil || len(extra) == 0 { + return + } + items := append(responsemeta.FromExtra(message.Extra), responsemeta.FromExtra(extra)...) + if normalized := responsemeta.Normalize(items); len(normalized) > 0 { + if message.Extra == nil { + message.Extra = make(map[string]any, 1) + } + message.Extra[responsemeta.OpaqueItemsExtraKey] = normalized + } +} + // InterruptedToolOutput is the placeholder content backfilled for tool calls // whose result never made it to disk (user stop, process kill, or a recording // gap). It tells the model what happened instead of fabricating an output. diff --git a/internal/session/responses_continuity_test.go b/internal/session/responses_continuity_test.go new file mode 100644 index 00000000..7a2b03c4 --- /dev/null +++ b/internal/session/responses_continuity_test.go @@ -0,0 +1,147 @@ +package session + +import ( + "encoding/json" + "os" + "path/filepath" + "strings" + "testing" + + "github.com/cloudwego/eino/schema" + "github.com/cnjack/jcode/internal/model/responsemeta" +) + +func TestRecordAssistantMessagePersistsOnlyEncryptedReasoningItem(t *testing.T) { + home := t.TempDir() + t.Setenv("HOME", home) + recorder, err := NewRecorder(t.TempDir(), "provider", "model") + if err != nil { + t.Fatal(err) + } + opaque := json.RawMessage(`{"type":"reasoning","id":"rs-1","summary":[{"type":"summary_text","text":"clear summary secret"}],"content":[{"type":"reasoning_text","text":"clear chain secret"}],"encrypted_content":"ciphertext-only"}`) + recorder.RecordAssistantMessage(&schema.Message{ + Role: schema.Assistant, + Content: "visible answer", + ReasoningContent: "runtime reasoning secret", + Extra: map[string]any{ + responsemeta.OpaqueItemsExtraKey: []json.RawMessage{opaque}, + "arbitrary_secret": "must not persist", + }, + }) + id := recorder.UUID() + recorder.Close() + + raw, err := os.ReadFile(filepath.Join(home, ".jcode", "sessions", id+".json")) + if err != nil { + t.Fatal(err) + } + text := string(raw) + for _, forbidden := range []string{ + "clear summary secret", "clear chain secret", "runtime reasoning secret", + "arbitrary_secret", "must not persist", + } { + if strings.Contains(text, forbidden) { + t.Fatalf("session persisted forbidden cleartext %q: %s", forbidden, text) + } + } + if !strings.Contains(text, "ciphertext-only") { + t.Fatalf("session did not persist encrypted continuation: %s", text) + } + + entries, err := LoadSession(id) + if err != nil { + t.Fatal(err) + } + state := ReconstructState(entries) + if len(state.History) != 1 { + t.Fatalf("history length = %d, want 1", len(state.History)) + } + message := state.History[0] + if message.Content != "visible answer" || message.ReasoningContent != "" { + t.Fatalf("replayed message = %#v", message) + } + items := responsemeta.FromExtra(message.Extra) + if len(items) != 1 || !strings.Contains(string(items[0]), "ciphertext-only") || + strings.Contains(string(items[0]), "clear summary secret") { + t.Fatalf("replayed opaque items = %s", items) + } +} + +func TestRecordAssistantMessageDropsOrphanOpaqueReasoningOnRestart(t *testing.T) { + home := t.TempDir() + t.Setenv("HOME", home) + recorder, err := NewRecorder(t.TempDir(), "provider", "model") + if err != nil { + t.Fatal(err) + } + recorder.RecordUser("before") + opaque := json.RawMessage(`{"type":"reasoning","id":"rs-orphan","summary":[],"encrypted_content":"cipher-orphan"}`) + recorder.RecordAssistantMessage(&schema.Message{ + Role: schema.Assistant, + Extra: responsemeta.Extra([]json.RawMessage{opaque}), + }) + id := recorder.UUID() + recorder.Close() + + raw, err := os.ReadFile(filepath.Join(home, ".jcode", "sessions", id+".json")) + if err != nil { + t.Fatal(err) + } + if strings.Contains(string(raw), "cipher-orphan") { + t.Fatalf("session persisted orphan continuation: %s", raw) + } + entries, err := LoadSession(id) + if err != nil { + t.Fatal(err) + } + if history := ReconstructState(entries).History; len(history) != 1 || history[0].Role != schema.User { + t.Fatalf("restarted history = %#v, want only the preceding user turn", history) + } +} + +func TestReconstructStateDropsLegacyOrphanAndKeepsFunctionCallContinuation(t *testing.T) { + orphan := json.RawMessage(`{"type":"reasoning","id":"rs-orphan","summary":[],"encrypted_content":"cipher-orphan"}`) + follower := json.RawMessage(`{"type":"reasoning","id":"rs-follower","summary":[],"encrypted_content":"cipher-follower"}`) + state := ReconstructState([]Entry{ + {Type: EntryAssistant, OpaqueResponseItems: []json.RawMessage{orphan}}, + {Type: EntryUser, Content: "separator"}, + {Type: EntryAssistant, OpaqueResponseItems: []json.RawMessage{follower}}, + {Type: EntryToolCall, Name: "lookup", Args: `{}`, ToolCallID: "call-1"}, + }) + + var toolTurn *schema.Message + for _, message := range state.History { + for _, item := range responsemeta.FromExtra(message.Extra) { + if strings.Contains(string(item), "cipher-orphan") { + t.Fatalf("restart retained orphan continuation: %#v", state.History) + } + } + if message.Role == schema.Assistant && len(message.ToolCalls) == 1 { + toolTurn = message + } + } + if toolTurn == nil { + t.Fatalf("restart lost function-call turn: %#v", state.History) + } + items := responsemeta.FromExtra(toolTurn.Extra) + if len(items) != 1 || !strings.Contains(string(items[0]), "cipher-follower") { + t.Fatalf("function-call continuation = %s", items) + } +} + +func TestReconstructStateBoundsOpaqueItemsAndKeepsLegacyAssistant(t *testing.T) { + items := make([]json.RawMessage, 0, responsemeta.MaxOpaqueItems+4) + for i := 0; i < responsemeta.MaxOpaqueItems+4; i++ { + items = append(items, json.RawMessage(`{"type":"reasoning","encrypted_content":"cipher"}`)) + } + state := ReconstructState([]Entry{ + {Type: EntryAssistant, Content: "legacy"}, + {Type: EntryAssistant, Content: "bounded", OpaqueResponseItems: items}, + }) + if len(state.History) != 2 || state.History[0].Content != "legacy" || state.History[0].Extra != nil { + t.Fatalf("legacy replay changed: %#v", state.History) + } + if got := len(responsemeta.FromExtra(state.History[1].Extra)); got != responsemeta.MaxOpaqueItems { + t.Fatalf("opaque items = %d, want %d", got, responsemeta.MaxOpaqueItems) + } +} diff --git a/internal/session/session.go b/internal/session/session.go index 1f139d7d..5279145f 100644 --- a/internal/session/session.go +++ b/internal/session/session.go @@ -11,10 +11,12 @@ import ( "sync" "time" + "github.com/cloudwego/eino/schema" "github.com/google/uuid" "github.com/cnjack/jcode/internal/artifact" "github.com/cnjack/jcode/internal/config" + "github.com/cnjack/jcode/internal/model/responsemeta" ) // EntryType identifies the kind of JSONL record. @@ -295,6 +297,11 @@ type Entry struct { // Images attached to a user message. Images []EntryImage `json:"images,omitempty"` + // OpaqueResponseItems carries only bounded encrypted Responses API + // reasoning items. Cleartext ReasoningContent is intentionally never + // persisted. Legacy JSONL files simply omit this additive field. + OpaqueResponseItems []json.RawMessage `json:"opaque_response_items,omitempty"` + // plan_update fields PlanStatus string `json:"plan_status,omitempty"` PlanTitle string `json:"plan_title,omitempty"` @@ -828,7 +835,31 @@ func (r *Recorder) SetTitleFor(id, title string) { // RecordAssistant appends an assistant message entry. func (r *Recorder) RecordAssistant(content string) { - _ = r.writeEntry(Entry{Type: EntryAssistant, Content: content}) + r.RecordAssistantMessage(&schema.Message{Role: schema.Assistant, Content: content}) +} + +// RecordAssistantMessage appends the persistable subset of an assistant +// message. Cleartext reasoning and arbitrary Extra fields are never written; +// only canonical encrypted Responses continuation items are retained. +func (r *Recorder) RecordAssistantMessage(message *schema.Message) { + if message == nil { + return + } + items := responsemeta.FromExtra(message.Extra) + // Opaque continuation data is meaningful only when the same assistant turn + // has visible content or function calls. In particular, never leave an + // encrypted-reasoning-only entry behind after a failed/cancelled stream. + if message.Content == "" && len(message.ToolCalls) == 0 { + items = nil + } + if message.Content == "" && len(items) == 0 { + return + } + _ = r.writeEntry(Entry{ + Type: EntryAssistant, + Content: message.Content, + OpaqueResponseItems: items, + }) } // RecordToolCall appends a tool-call entry. The batch fields group tool calls diff --git a/internal/team/manager.go b/internal/team/manager.go index 00df1d0c..0a64c19f 100644 --- a/internal/team/manager.go +++ b/internal/team/manager.go @@ -268,6 +268,7 @@ func (m *Manager) SpawnTeammate(ctx context.Context, cfg SpawnConfig) (string, e TeamName: m.teamName, Color: color, }) + childCtx = internalmodel.WithProviderSubagent(childCtx) state := &TeammateState{ Identity: TeammateIdentity{ @@ -689,6 +690,9 @@ func (m *Manager) runAgentTurn(ctx context.Context, state *TeammateState) (strin if state.TokenUsage != nil { ctx = internalmodel.WithTokenTracker(ctx, state.TokenUsage) } + if state.Recorder != nil && state.Recorder.UUID() != "" { + ctx = internalmodel.WithProviderSessionID(ctx, state.Recorder.UUID()) + } var result strings.Builder endTrace := func() { diff --git a/internal/tools/subagent.go b/internal/tools/subagent.go index 89e35de0..3244df38 100644 --- a/internal/tools/subagent.go +++ b/internal/tools/subagent.go @@ -295,6 +295,7 @@ func (s *subagentTool) InvokableRun(ctx context.Context, argumentsInJSON string, // Build the run function that creates and executes the agent. runFn := func(runCtx context.Context) (string, error) { + runCtx = internalmodel.WithProviderSubagent(runCtx) childEnv := s.env.CloneForSubagent() childTools := s.buildTools(childEnv, profile) prompt := subagentSystemPrompt(profile, s.env.Pwd(), s.env.platform) diff --git a/internal/web/provider_auth.go b/internal/web/provider_auth.go new file mode 100644 index 00000000..2c7cfeb1 --- /dev/null +++ b/internal/web/provider_auth.go @@ -0,0 +1,318 @@ +package web + +import ( + "context" + "encoding/json" + "errors" + "io" + "net/http" + "strings" + + "github.com/cnjack/jcode/internal/config" + "github.com/cnjack/jcode/internal/providerauth" +) + +const providerAuthAPIKeyMethod = "api_key" + +func providerAuthMethodsForID(s *Server, providerID string) []string { + if s != nil && s.registry != nil { + if provider := s.registry.GetProvider(providerID); provider != nil { + if len(provider.AuthMethods) > 0 { + return append([]string(nil), provider.AuthMethods...) + } + } + } + // Existing registry and custom providers predate AuthMethods and remain + // ordinary API-key providers unless explicitly declared otherwise. + return []string{providerAuthAPIKeyMethod} +} + +func containsProviderAuthMethod(methods []string, method string) bool { + for _, candidate := range methods { + if candidate == method { + return true + } + } + return false +} + +func (s *Server) validateProviderBinding( + ctx context.Context, + providerID string, + binding *config.ProviderAuthBinding, +) (*config.ProviderAuthBinding, error) { + methods := providerAuthMethodsForID(s, providerID) + if binding == nil { + if containsProviderAuthMethod(methods, providerAuthAPIKeyMethod) { + return nil, nil + } + return nil, newConfigMutationHTTPError( + http.StatusBadRequest, + "this provider requires account login", + ) + } + normalized := &config.ProviderAuthBinding{ + Method: strings.TrimSpace(binding.Method), + AccountID: strings.TrimSpace(binding.AccountID), + } + method, err := parseProviderAuthMethod(normalized.Method) + if err != nil || !containsProviderAuthMethod(methods, string(method)) { + return nil, newConfigMutationHTTPError( + http.StatusBadRequest, + "authentication method is not supported by this provider", + ) + } + service, err := s.providerAuthService() + if err != nil { + return nil, newConfigMutationHTTPError(http.StatusInternalServerError, err.Error()) + } + if err := service.ValidateBinding(ctx, providerauth.Binding{ + Method: method, AccountID: normalized.AccountID, + }); err != nil { + status := http.StatusBadRequest + if errors.Is(err, providerauth.ErrAccountNotFound) || + errors.Is(err, providerauth.ErrRequiresReauth) { + status = http.StatusConflict + } + return nil, newConfigMutationHTTPError(status, err.Error()) + } + return normalized, nil +} + +func (s *Server) providerAuthStatus( + ctx context.Context, + binding *config.ProviderAuthBinding, +) *providerauth.Status { + if binding == nil { + return nil + } + method, err := parseProviderAuthMethod(binding.Method) + if err != nil { + return nil + } + service, err := s.providerAuthService() + if err != nil { + config.Logger().Printf("[provider-auth] status unavailable for %s: %v", method, err) + return nil + } + status, err := service.Status(ctx, method) + if err != nil { + config.Logger().Printf("[provider-auth] status failed for %s: %v", method, err) + return nil + } + return &status +} + +func (s *Server) providerAuthService() (ProviderAuthService, error) { + s.providerAuthMu.Lock() + defer s.providerAuthMu.Unlock() + if s.providerAuth != nil || s.providerAuthErr != nil { + return s.providerAuth, s.providerAuthErr + } + s.providerAuth, s.providerAuthErr = providerauth.Default(config.ConfigDir()) + return s.providerAuth, s.providerAuthErr +} + +func parseProviderAuthMethod(raw string) (providerauth.Method, error) { + method := providerauth.Method(strings.TrimSpace(raw)) + switch method { + case providerauth.MethodCodexOAuth, providerauth.MethodXAIOAuth, + providerauth.MethodGitHubCopilot: + return method, nil + default: + return "", providerauth.ErrUnsupportedMethod + } +} + +func (s *Server) handleProviderAuthStatus(w http.ResponseWriter, r *http.Request) { + method, err := parseProviderAuthMethod(r.PathValue("method")) + if err != nil { + writeProviderAuthError(w, err) + return + } + service, err := s.providerAuthService() + if err != nil { + writeProviderAuthError(w, err) + return + } + status, err := service.Status(r.Context(), method) + if err != nil { + writeProviderAuthError(w, err) + return + } + writeJSON(w, http.StatusOK, status) +} + +func (s *Server) handleProviderAuthStart(w http.ResponseWriter, r *http.Request) { + method, err := parseProviderAuthMethod(r.PathValue("method")) + if err != nil { + writeProviderAuthError(w, err) + return + } + // Consume an optional empty object so clients may consistently POST JSON. + // No credential or endpoint input is accepted: driver policy is server-side. + if r.Body != nil { + var request map[string]json.RawMessage + err = json.NewDecoder(io.LimitReader(r.Body, 4<<10)).Decode(&request) + if err != nil && !errors.Is(err, io.EOF) { + writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid request"}) + return + } + if len(request) != 0 { + writeJSON(w, http.StatusBadRequest, map[string]string{"error": "managed login does not accept endpoint or token input"}) + return + } + } + service, err := s.providerAuthService() + if err != nil { + writeProviderAuthError(w, err) + return + } + flow, err := service.Start(r.Context(), method) + if err != nil { + writeProviderAuthError(w, err) + return + } + writeJSON(w, http.StatusOK, flow) +} + +func (s *Server) handleProviderAuthPoll(w http.ResponseWriter, r *http.Request) { + method, err := parseProviderAuthMethod(r.PathValue("method")) + if err != nil { + writeProviderAuthError(w, err) + return + } + flowID := strings.TrimSpace(r.PathValue("flow_id")) + if flowID == "" { + writeJSON(w, http.StatusBadRequest, map[string]string{"error": "flow_id is required"}) + return + } + service, err := s.providerAuthService() + if err != nil { + writeProviderAuthError(w, err) + return + } + flow, err := service.Poll(r.Context(), method, flowID) + if err != nil { + writeProviderAuthError(w, err) + return + } + if flow.Method != method { + writeProviderAuthError(w, providerauth.ErrFlowNotFound) + return + } + writeJSON(w, http.StatusOK, flow) +} + +func (s *Server) handleProviderAuthCancel(w http.ResponseWriter, r *http.Request) { + method, err := parseProviderAuthMethod(r.PathValue("method")) + if err != nil { + writeProviderAuthError(w, err) + return + } + service, err := s.providerAuthService() + if err != nil { + writeProviderAuthError(w, err) + return + } + if err := service.Cancel(method, strings.TrimSpace(r.PathValue("flow_id"))); err != nil { + writeProviderAuthError(w, err) + return + } + writeJSON(w, http.StatusOK, map[string]string{"status": "cancelled"}) +} + +func (s *Server) handleProviderAuthSetDefault(w http.ResponseWriter, r *http.Request) { + method, err := parseProviderAuthMethod(r.PathValue("method")) + if err != nil { + writeProviderAuthError(w, err) + return + } + var request struct { + AccountID string `json:"account_id"` + } + if err := json.NewDecoder(io.LimitReader(r.Body, 4<<10)).Decode(&request); err != nil || strings.TrimSpace(request.AccountID) == "" { + writeJSON(w, http.StatusBadRequest, map[string]string{"error": "account_id is required"}) + return + } + service, err := s.providerAuthService() + if err != nil { + writeProviderAuthError(w, err) + return + } + if err := service.SetDefault(r.Context(), method, request.AccountID); err != nil { + writeProviderAuthError(w, err) + return + } + status, err := service.Status(r.Context(), method) + if err != nil { + writeProviderAuthError(w, err) + return + } + writeJSON(w, http.StatusOK, status) +} + +func (s *Server) handleProviderAuthRemove(w http.ResponseWriter, r *http.Request) { + method, err := parseProviderAuthMethod(r.PathValue("method")) + if err != nil { + writeProviderAuthError(w, err) + return + } + service, err := s.providerAuthService() + if err != nil { + writeProviderAuthError(w, err) + return + } + if err := service.Remove(r.Context(), method, strings.TrimSpace(r.PathValue("account_id"))); err != nil { + writeProviderAuthError(w, err) + return + } + status, err := service.Status(r.Context(), method) + if err != nil { + writeProviderAuthError(w, err) + return + } + writeJSON(w, http.StatusOK, status) +} + +func (s *Server) handleProviderAuthLogout(w http.ResponseWriter, r *http.Request) { + method, err := parseProviderAuthMethod(r.PathValue("method")) + if err != nil { + writeProviderAuthError(w, err) + return + } + service, err := s.providerAuthService() + if err != nil { + writeProviderAuthError(w, err) + return + } + if err := service.Logout(r.Context(), method); err != nil { + writeProviderAuthError(w, err) + return + } + status, err := service.Status(r.Context(), method) + if err != nil { + writeProviderAuthError(w, err) + return + } + writeJSON(w, http.StatusOK, status) +} + +func writeProviderAuthError(w http.ResponseWriter, err error) { + status := http.StatusInternalServerError + switch { + case errors.Is(err, providerauth.ErrUnsupportedMethod), + errors.Is(err, providerauth.ErrUnsupportedGHES): + status = http.StatusBadRequest + case errors.Is(err, providerauth.ErrFlowNotFound), + errors.Is(err, providerauth.ErrAccountNotFound): + status = http.StatusNotFound + case errors.Is(err, providerauth.ErrFlowExpired), + errors.Is(err, providerauth.ErrAccessDenied), + errors.Is(err, providerauth.ErrRequiresReauth): + status = http.StatusConflict + case errors.Is(err, providerauth.ErrAuthorizationPending): + status = http.StatusTooEarly + } + writeJSON(w, status, map[string]string{"error": err.Error()}) +} diff --git a/internal/web/provider_auth_test.go b/internal/web/provider_auth_test.go new file mode 100644 index 00000000..268b8d4d --- /dev/null +++ b/internal/web/provider_auth_test.go @@ -0,0 +1,247 @@ +package web + +import ( + "context" + "encoding/json" + "errors" + "net/http" + "net/http/httptest" + "strings" + "testing" + "time" + + "github.com/cnjack/jcode/internal/config" + "github.com/cnjack/jcode/internal/model" + "github.com/cnjack/jcode/internal/providerauth" +) + +type fakeProviderAuthService struct { + status providerauth.Status + flow providerauth.Flow + validate error + cancelled string +} + +func (f *fakeProviderAuthService) Start(context.Context, providerauth.Method) (providerauth.Flow, error) { + return f.flow, nil +} + +func (f *fakeProviderAuthService) Poll(context.Context, providerauth.Method, string) (providerauth.Flow, error) { + return f.flow, nil +} + +func (f *fakeProviderAuthService) Cancel(_ providerauth.Method, flowID string) error { + f.cancelled = flowID + return nil +} + +func (f *fakeProviderAuthService) Status(context.Context, providerauth.Method) (providerauth.Status, error) { + return f.status, nil +} + +func (f *fakeProviderAuthService) SetDefault(context.Context, providerauth.Method, string) error { + return nil +} + +func (f *fakeProviderAuthService) Remove(context.Context, providerauth.Method, string) error { + return nil +} + +func (f *fakeProviderAuthService) Logout(context.Context, providerauth.Method) error { + return nil +} + +func (f *fakeProviderAuthService) ValidateBinding(context.Context, providerauth.Binding) error { + return f.validate +} + +func TestAddManagedProviderStoresOnlyBinding(t *testing.T) { + t.Setenv("HOME", t.TempDir()) + fake := &fakeProviderAuthService{} + s := &Server{ + cfg: &config.Config{}, + registry: model.NewModelRegistry(), + providerAuth: fake, + needsSetup: true, + } + body := `{ + "id":"xai", + "api_key":"must-not-survive", + "base_url":"https://attacker.example/v1", + "headers":{"Authorization":"must-not-survive"}, + "auth_binding":{"method":" xai_oauth ","account_id":" acct-x "} +}` + recorder := httptest.NewRecorder() + s.handleAddProvider(recorder, httptest.NewRequest(http.MethodPost, "/api/providers", strings.NewReader(body))) + if recorder.Code != http.StatusOK { + t.Fatalf("add status=%d body=%s", recorder.Code, recorder.Body.String()) + } + + loaded, err := config.LoadConfig() + if err != nil { + t.Fatalf("load config: %v", err) + } + provider := loaded.Providers["xai"] + if provider == nil || provider.Auth == nil || provider.Auth.Method != "xai_oauth" || provider.Auth.AccountID != "acct-x" { + t.Fatalf("stored provider auth = %#v", provider) + } + if provider.APIKey != "" || provider.BaseURL != "" || len(provider.Headers) != 0 { + t.Fatalf("managed provider retained override or secret: %#v", provider) + } +} + +func TestAddProviderRejectsIncompatibleManagedMethod(t *testing.T) { + t.Setenv("HOME", t.TempDir()) + s := &Server{ + cfg: &config.Config{}, + registry: model.NewModelRegistry(), + providerAuth: &fakeProviderAuthService{}, + needsSetup: true, + } + recorder := httptest.NewRecorder() + s.handleAddProvider(recorder, httptest.NewRequest( + http.MethodPost, + "/api/providers", + strings.NewReader(`{"id":"anthropic","auth_binding":{"method":"xai_oauth"}}`), + )) + if recorder.Code != http.StatusBadRequest { + t.Fatalf("status=%d body=%s", recorder.Code, recorder.Body.String()) + } +} + +func TestManagedProviderRejectsImageEndpointWithoutAPIKey(t *testing.T) { + t.Setenv("HOME", t.TempDir()) + s := &Server{ + cfg: &config.Config{}, + registry: model.NewModelRegistry(), + providerAuth: &fakeProviderAuthService{}, + needsSetup: true, + } + recorder := httptest.NewRecorder() + s.handleAddProvider(recorder, httptest.NewRequest( + http.MethodPost, + "/api/providers", + strings.NewReader(`{ + "id":"openai", + "auth_binding":{"method":"codex_oauth"}, + "image_endpoint":{"protocol":"openai_images","base_url":"https://images.example.test/v1","models":[{"id":"canvas"}]} + }`), + )) + if recorder.Code != http.StatusBadRequest || !strings.Contains(recorder.Body.String(), "image_endpoint") { + t.Fatalf("status=%d body=%s", recorder.Code, recorder.Body.String()) + } +} + +func TestSwitchingProviderToManagedAuthClearsImageEndpoint(t *testing.T) { + t.Setenv("HOME", t.TempDir()) + cfg := &config.Config{ + Model: "openai/gpt-5", + ImageModel: "openai/canvas", + Providers: map[string]*config.ProviderConfig{ + "openai": { + APIKey: "api-key", + ImageEndpoint: &config.ImageEndpointConfig{ + Protocol: "openai_images", BaseURL: "https://images.example.test/v1", + Models: []config.ImageModelConfig{{ID: "canvas"}}, + }, + }, + }, + } + if err := config.SaveConfig(cfg); err != nil { + t.Fatal(err) + } + s := &Server{ + cfg: cfg, registry: model.NewModelRegistryWithConfig(cfg), + providerAuth: &fakeProviderAuthService{}, needsSetup: true, + } + request := httptest.NewRequest( + http.MethodPut, + "/api/providers/openai", + strings.NewReader(`{"auth_binding":{"method":"codex_oauth"},"image_endpoint":null}`), + ) + request.SetPathValue("id", "openai") + recorder := httptest.NewRecorder() + s.handleUpdateProvider(recorder, request) + if recorder.Code != http.StatusOK { + t.Fatalf("status=%d body=%s", recorder.Code, recorder.Body.String()) + } + loaded, err := config.LoadConfig() + if err != nil { + t.Fatal(err) + } + provider := loaded.Providers["openai"] + if provider.Auth == nil || provider.ImageEndpoint != nil || provider.APIKey != "" { + t.Fatalf("managed provider retained image endpoint or key: %+v", provider) + } + if loaded.ImageModel != "" { + t.Fatalf("managed switch retained selected image model %q", loaded.ImageModel) + } +} + +func TestAddProviderStillRequiresAPIKeyInLegacyMode(t *testing.T) { + t.Setenv("HOME", t.TempDir()) + s := &Server{cfg: &config.Config{}, registry: model.NewModelRegistry(), needsSetup: true} + recorder := httptest.NewRecorder() + s.handleAddProvider(recorder, httptest.NewRequest( + http.MethodPost, + "/api/providers", + strings.NewReader(`{"id":"openai"}`), + )) + if recorder.Code != http.StatusBadRequest || !strings.Contains(recorder.Body.String(), "api_key") { + t.Fatalf("status=%d body=%s", recorder.Code, recorder.Body.String()) + } +} + +func TestProviderAuthStartReturnsOnlyPublicFlow(t *testing.T) { + expires := time.Now().Add(10 * time.Minute).UTC().Truncate(time.Second) + fake := &fakeProviderAuthService{flow: providerauth.Flow{ + ID: "public-flow-id", + Method: providerauth.MethodCodexOAuth, + State: providerauth.FlowStatePending, + UserCode: "ABCD-EFGH", + VerificationURI: "https://auth.example/device", + ExpiresAt: expires, + IntervalSeconds: 5, + }} + s := &Server{providerAuth: fake} + request := httptest.NewRequest(http.MethodPost, "/api/provider-auth/codex_oauth/start", strings.NewReader(`{}`)) + request.SetPathValue("method", "codex_oauth") + recorder := httptest.NewRecorder() + s.handleProviderAuthStart(recorder, request) + if recorder.Code != http.StatusOK { + t.Fatalf("status=%d body=%s", recorder.Code, recorder.Body.String()) + } + var body map[string]any + if err := json.Unmarshal(recorder.Body.Bytes(), &body); err != nil { + t.Fatalf("decode response: %v", err) + } + for _, forbidden := range []string{"device_code", "access_token", "refresh_token", "authorization_code", "code_verifier"} { + if _, exists := body[forbidden]; exists { + t.Fatalf("public flow exposed %s: %s", forbidden, recorder.Body.String()) + } + } + if body["flow_id"] != "public-flow-id" || body["user_code"] != "ABCD-EFGH" { + t.Fatalf("unexpected response: %s", recorder.Body.String()) + } +} + +func TestProviderBindingValidationFailureIsConflict(t *testing.T) { + t.Setenv("HOME", t.TempDir()) + s := &Server{ + cfg: &config.Config{}, + registry: model.NewModelRegistry(), + providerAuth: &fakeProviderAuthService{ + validate: errors.Join(providerauth.ErrRequiresReauth, errors.New("sign in again")), + }, + needsSetup: true, + } + recorder := httptest.NewRecorder() + s.handleAddProvider(recorder, httptest.NewRequest( + http.MethodPost, + "/api/providers", + strings.NewReader(`{"id":"openai","auth_binding":{"method":"codex_oauth"}}`), + )) + if recorder.Code != http.StatusConflict { + t.Fatalf("status=%d body=%s", recorder.Code, recorder.Body.String()) + } +} diff --git a/internal/web/providers.go b/internal/web/providers.go index e2a94ded..cc5d5c7e 100644 --- a/internal/web/providers.go +++ b/internal/web/providers.go @@ -14,6 +14,7 @@ import ( "github.com/cnjack/jcode/internal/config" "github.com/cnjack/jcode/internal/model" + "github.com/cnjack/jcode/internal/providerauth" "github.com/cnjack/jcode/internal/providertools" ) @@ -215,6 +216,30 @@ func decodeOptionalBool(raw json.RawMessage, field string) (present bool, value return true, &decoded, nil } +// decodeOptionalProviderAuthBinding preserves the update contract's three +// states: omitted keeps the current mode, null selects API-key authentication, +// and an object selects one managed login binding. +func decodeOptionalProviderAuthBinding( + raw json.RawMessage, +) (present bool, binding *config.ProviderAuthBinding, err error) { + if len(raw) == 0 { + return false, nil, nil + } + if bytes.Equal(bytes.TrimSpace(raw), []byte("null")) { + return true, nil, nil + } + var decoded config.ProviderAuthBinding + if err := json.Unmarshal(raw, &decoded); err != nil { + return true, nil, fmt.Errorf("invalid auth_binding") + } + decoded.Method = strings.TrimSpace(decoded.Method) + decoded.AccountID = strings.TrimSpace(decoded.AccountID) + if decoded.Method == "" { + return true, nil, fmt.Errorf("auth_binding.method is required") + } + return true, &decoded, nil +} + // handleProviderCatalog returns a provider's browsable model catalog for the // "browse directory" UI. For registry providers it lists the built-in models // (the official /models endpoint is not reliably complete); for custom @@ -437,6 +462,9 @@ func (s *Server) handleListProviders(w http.ResponseWriter, r *http.Request) { Custom bool `json:"custom,omitempty"` APIKeySet bool `json:"api_key_set"` APIKey string `json:"api_key,omitempty"` // masked + AuthBinding *config.ProviderAuthBinding `json:"auth_binding,omitempty"` + AuthStatus *providerauth.Status `json:"auth_status,omitempty"` + AuthMethods []string `json:"auth_methods,omitempty"` BaseURL string `json:"base_url,omitempty"` Headers map[string]string `json:"headers,omitempty"` // values masked CustomModels []customModelView `json:"custom_models,omitempty"` @@ -455,6 +483,9 @@ func (s *Server) handleListProviders(w http.ResponseWriter, r *http.Request) { ID: id, Name: pc.Name, APIKeySet: pc.APIKey != "", + AuthBinding: pc.Auth, + AuthStatus: s.providerAuthStatus(r.Context(), pc.Auth), + AuthMethods: providerAuthMethodsForID(s, id), BaseURL: pc.BaseURL, Vision: pc.Vision, Thinking: pc.Thinking, @@ -573,6 +604,7 @@ func (s *Server) handleAddProvider(w http.ResponseWriter, r *http.Request) { Protocol string `json:"protocol,omitempty"` ProviderTools map[string]config.ProviderToolPolicy `json:"provider_tools,omitempty"` ImageEndpoint *config.ImageEndpointConfig `json:"image_endpoint,omitempty"` + AuthBinding *config.ProviderAuthBinding `json:"auth_binding,omitempty"` } if err := json.NewDecoder(io.LimitReader(r.Body, 1<<16)).Decode(&req); err != nil { writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid request"}) @@ -581,10 +613,29 @@ func (s *Server) handleAddProvider(w http.ResponseWriter, r *http.Request) { req.ID = strings.TrimSpace(req.ID) req.BaseURL = strings.TrimSpace(req.BaseURL) req.Model = strings.TrimSpace(req.Model) - if req.ID == "" || req.APIKey == "" { - writeJSON(w, http.StatusBadRequest, map[string]string{"error": "id and api_key are required"}) + if req.ID == "" { + writeJSON(w, http.StatusBadRequest, map[string]string{"error": "id is required"}) + return + } + normalizedAuthBinding, err := s.validateProviderBinding(r.Context(), req.ID, req.AuthBinding) + if err != nil { + writeConfigMutationError(w, err) + return + } + req.AuthBinding = normalizedAuthBinding + if req.AuthBinding == nil && req.APIKey == "" { + writeJSON(w, http.StatusBadRequest, map[string]string{"error": "api_key is required for API-key authentication"}) return } + if req.AuthBinding != nil { + // Managed drivers own their endpoint and protected headers. Drop values + // from a stale API-key form instead of persisting dormant credentials or + // allowing the browser to redirect a bearer token. + req.APIKey = "" + req.BaseURL = "" + req.Headers = nil + req.Protocol = "" + } if !validReasoningEffort(req.ReasoningEffort) { writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid reasoning_effort"}) return @@ -599,6 +650,12 @@ func (s *Server) handleAddProvider(w http.ResponseWriter, r *http.Request) { writeJSON(w, http.StatusBadRequest, map[string]string{"error": err.Error()}) return } + if req.AuthBinding != nil && imageEndpoint != nil { + writeJSON(w, http.StatusBadRequest, map[string]string{ + "error": "image_endpoint requires API-key authentication", + }) + return + } // Serialize config RMW + live publish under cfgMu (see Server.cfgMu). s.cfgMu.Lock() @@ -626,6 +683,7 @@ func (s *Server) handleAddProvider(w http.ResponseWriter, r *http.Request) { pc := &config.ProviderConfig{ APIKey: req.APIKey, BaseURL: req.BaseURL, + Auth: req.AuthBinding, Name: req.Name, Headers: cleanHeaders(req.Headers), Vision: req.Vision, @@ -732,6 +790,7 @@ func (s *Server) handleUpdateProvider(w http.ResponseWriter, r *http.Request) { Protocol *string `json:"protocol,omitempty"` ProviderTools *map[string]config.ProviderToolPolicy `json:"provider_tools,omitempty"` ImageEndpoint json.RawMessage `json:"image_endpoint,omitempty"` + AuthBinding json.RawMessage `json:"auth_binding,omitempty"` } if err := json.NewDecoder(io.LimitReader(r.Body, 1<<16)).Decode(&req); err != nil { writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid request"}) @@ -770,6 +829,18 @@ func (s *Server) handleUpdateProvider(w http.ResponseWriter, r *http.Request) { writeJSON(w, http.StatusBadRequest, map[string]string{"error": err.Error()}) return } + authBindingPresent, authBinding, err := decodeOptionalProviderAuthBinding(req.AuthBinding) + if err != nil { + writeJSON(w, http.StatusBadRequest, map[string]string{"error": err.Error()}) + return + } + if authBindingPresent { + authBinding, err = s.validateProviderBinding(r.Context(), id, authBinding) + if err != nil { + writeConfigMutationError(w, err) + return + } + } // Serialize config RMW + live publish under cfgMu (see Server.cfgMu). s.cfgMu.Lock() @@ -786,6 +857,16 @@ func (s *Server) handleUpdateProvider(w http.ResponseWriter, r *http.Request) { return newConfigMutationHTTPError(http.StatusNotFound, "provider not found") } mutationRegistry := model.NewModelRegistryWithConfig(cfg) + nextAuth := pc.Auth + if authBindingPresent { + nextAuth = authBinding + } + if nextAuth != nil && imageEndpointPresent && imageEndpoint != nil { + return newConfigMutationHTTPError( + http.StatusBadRequest, + "image_endpoint requires API-key authentication", + ) + } // Mutate in place so fields not exposed by this endpoint (display name, // custom models, deprecated lists) are preserved untouched. prevHeaders := cleanHeaders(pc.Headers) @@ -813,6 +894,15 @@ func (s *Server) handleUpdateProvider(w http.ResponseWriter, r *http.Request) { if imageEndpointPresent { pc.ImageEndpoint = imageEndpoint } + if authBindingPresent { + pc.Auth = authBinding + if authBinding != nil { + pc.APIKey = "" + pc.BaseURL = "" + pc.Headers = nil + pc.Protocol = "" + } + } if req.Name != "" { pc.Name = req.Name } @@ -841,6 +931,24 @@ func (s *Server) handleUpdateProvider(w http.ResponseWriter, r *http.Request) { } else { pc.Headers = prevHeaders } + // The generic secret merge above intentionally preserves omitted fields. + // Re-assert the managed-auth invariant after it so stale masked headers or + // an api_key submitted by an older UI cannot survive the mode switch. + if pc.Auth != nil { + pc.APIKey = "" + pc.BaseURL = "" + pc.Headers = nil + pc.Protocol = "" + // Image generation currently uses the Provider API key. Managed chat + // accounts deliberately do not expose or retain one, so keeping this + // endpoint would create a configuration that can never run. + pc.ImageEndpoint = nil + } else if pc.APIKey == "" { + return newConfigMutationHTTPError( + http.StatusBadRequest, + "api_key is required for API-key authentication", + ) + } // Replace the provider's custom models when the client sends the list (nil ⇒ // keep existing). Each model's stored Context is preserved by merging on id, diff --git a/internal/web/server.go b/internal/web/server.go index 270ebc21..2f80e43c 100644 --- a/internal/web/server.go +++ b/internal/web/server.go @@ -26,6 +26,7 @@ import ( "github.com/cnjack/jcode/internal/handler" "github.com/cnjack/jcode/internal/mode" "github.com/cnjack/jcode/internal/model" + "github.com/cnjack/jcode/internal/providerauth" "github.com/cnjack/jcode/internal/runner" "github.com/cnjack/jcode/internal/session" "github.com/cnjack/jcode/internal/skills" @@ -78,10 +79,13 @@ type Server struct { ctxPtr atomic.Pointer[context.Context] // Dependencies set during initialization. - tracer *telemetry.LangfuseTracer - cfg *config.Config - cfgMu sync.Mutex // serializes read-modify-write SaveConfig from concurrent handlers - registry *model.ModelRegistry + providerAuthMu sync.Mutex + providerAuth ProviderAuthService + providerAuthErr error + tracer *telemetry.LangfuseTracer + cfg *config.Config + cfgMu sync.Mutex // serializes read-modify-write SaveConfig from concurrent handlers + registry *model.ModelRegistry // newEngine builds a fresh, fully-isolated task engine (its own env, agent, // recorder, handler, approval state) at the given pwd/mode. This is how a new // concurrent task — or a "switch project" — gets its run state without @@ -196,6 +200,20 @@ type Server struct { type ArtifactOpener func(context.Context, string, bool) error +// ProviderAuthService is the Web-facing slice of the process-wide managed +// provider account manager. Keeping the interface here makes device-flow and +// provider mutation handlers testable without real OAuth endpoints. +type ProviderAuthService interface { + Start(context.Context, providerauth.Method) (providerauth.Flow, error) + Poll(context.Context, providerauth.Method, string) (providerauth.Flow, error) + Cancel(providerauth.Method, string) error + Status(context.Context, providerauth.Method) (providerauth.Status, error) + SetDefault(context.Context, providerauth.Method, string) error + Remove(context.Context, providerauth.Method, string) error + Logout(context.Context, providerauth.Method) error + ValidateBinding(context.Context, providerauth.Binding) error +} + // ArtifactSharePublisher is consumed by the local Web API and implemented by // cloud.ArtifactSharePublisher. Keeping the interface here makes task scoping // and login behavior independently testable without a Cloud deployment. @@ -287,6 +305,7 @@ type ServerConfig struct { ArtifactShares ArtifactSharePublisher // optional: encrypted Cloud artifact publisher CloudCredentials func() (*cloud.Credentials, error) // optional: injectable credential loader OpenArtifact ArtifactOpener // optional: Desktop open/reveal adapter + ProviderAuth ProviderAuthService // optional: managed provider login service } // NewServer creates a new web server. @@ -377,6 +396,7 @@ func NewServer(cfg *ServerConfig) *Server { artifactShares: artifactShares, loadCloudCredentials: loadCloudCredentials, openArtifact: openArtifact, + providerAuth: cfg.ProviderAuth, } // The bootstrap engine is registered (and its pump started) in Start, once // the root context exists. @@ -563,6 +583,15 @@ func (s *Server) Start(ctx context.Context) error { // built-in model list; for custom endpoints it queries the live /models // endpoint. Each entry is flagged added=true when already configured. mux.HandleFunc("GET /api/providers/{id}/models", s.handleProviderCatalog) + // Managed provider authentication. Device tokens and bearer credentials + // never cross this boundary; clients receive only flow/account summaries. + mux.HandleFunc("GET /api/provider-auth/{method}", s.handleProviderAuthStatus) + mux.HandleFunc("POST /api/provider-auth/{method}/start", s.handleProviderAuthStart) + mux.HandleFunc("POST /api/provider-auth/{method}/flows/{flow_id}/poll", s.handleProviderAuthPoll) + mux.HandleFunc("DELETE /api/provider-auth/{method}/flows/{flow_id}", s.handleProviderAuthCancel) + mux.HandleFunc("POST /api/provider-auth/{method}/default", s.handleProviderAuthSetDefault) + mux.HandleFunc("DELETE /api/provider-auth/{method}/accounts/{account_id}", s.handleProviderAuthRemove) + mux.HandleFunc("DELETE /api/provider-auth/{method}", s.handleProviderAuthLogout) // History management. mux.HandleFunc("POST /api/history/truncate", s.handleTruncateHistory) diff --git a/internal/web/setup.go b/internal/web/setup.go index a91597c6..091bd73d 100644 --- a/internal/web/setup.go +++ b/internal/web/setup.go @@ -70,13 +70,14 @@ func (s *Server) handleSetupProviders(w http.ResponseWriter, r *http.Request) { } type providerItem struct { - ID string `json:"id"` - Name string `json:"name"` - Doc string `json:"doc,omitempty"` - API string `json:"api,omitempty"` - Env []string `json:"env,omitempty"` - Configured bool `json:"configured"` - Tag string `json:"tag,omitempty"` // "recommended", "free", "local" + ID string `json:"id"` + Name string `json:"name"` + Doc string `json:"doc,omitempty"` + API string `json:"api,omitempty"` + Env []string `json:"env,omitempty"` + AuthMethods []string `json:"auth_methods,omitempty"` + Configured bool `json:"configured"` + Tag string `json:"tag,omitempty"` // "recommended", "free", "local" } providers := s.registry.ListProviders() @@ -90,21 +91,24 @@ func (s *Server) handleSetupProviders(w http.ResponseWriter, r *http.Request) { // Provider tags for recommendation. tags := map[string]string{ - "openai": "recommended", - "anthropic": "recommended", - "ollama": "local", + "openai": "recommended", + "xai": "recommended", + "github-copilot": "recommended", + "anthropic": "recommended", + "ollama": "local", } result := make([]providerItem, 0, len(providers)) for _, p := range providers { result = append(result, providerItem{ - ID: p.ID, - Name: p.Name, - Doc: p.Doc, - API: p.API, - Env: p.Env, - Configured: configured[p.ID], - Tag: tags[p.ID], + ID: p.ID, + Name: p.Name, + Doc: p.Doc, + API: p.API, + Env: p.Env, + AuthMethods: providerAuthMethodsForID(s, p.ID), + Configured: configured[p.ID], + Tag: tags[p.ID], }) } @@ -178,25 +182,41 @@ func (s *Server) handleSetupProviderModels(w http.ResponseWriter, r *http.Reques // a model explicitly since none can be inferred. func (s *Server) handleSetupComplete(w http.ResponseWriter, r *http.Request) { var req struct { - Provider string `json:"provider"` - Model string `json:"model,omitempty"` - ModelReasoning bool `json:"model_reasoning,omitempty"` - APIKey string `json:"api_key"` - BaseURL string `json:"base_url,omitempty"` - Name string `json:"name,omitempty"` // custom provider display name - Headers map[string]string `json:"headers,omitempty"` - Vision *bool `json:"vision,omitempty"` - Thinking *bool `json:"thinking,omitempty"` - ReasoningEffort string `json:"reasoning_effort,omitempty"` + Provider string `json:"provider"` + Model string `json:"model,omitempty"` + ModelReasoning bool `json:"model_reasoning,omitempty"` + APIKey string `json:"api_key"` + BaseURL string `json:"base_url,omitempty"` + Name string `json:"name,omitempty"` // custom provider display name + Headers map[string]string `json:"headers,omitempty"` + Vision *bool `json:"vision,omitempty"` + Thinking *bool `json:"thinking,omitempty"` + ReasoningEffort string `json:"reasoning_effort,omitempty"` + AuthBinding *config.ProviderAuthBinding `json:"auth_binding,omitempty"` } if err := json.NewDecoder(io.LimitReader(r.Body, 1<<16)).Decode(&req); err != nil { writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid request"}) return } - if req.Provider == "" || req.APIKey == "" { - writeJSON(w, http.StatusBadRequest, map[string]string{"error": "provider and api_key are required"}) + if req.Provider == "" { + writeJSON(w, http.StatusBadRequest, map[string]string{"error": "provider is required"}) return } + normalizedAuthBinding, err := s.validateProviderBinding(r.Context(), req.Provider, req.AuthBinding) + if err != nil { + writeConfigMutationError(w, err) + return + } + req.AuthBinding = normalizedAuthBinding + if req.AuthBinding == nil && req.APIKey == "" { + writeJSON(w, http.StatusBadRequest, map[string]string{"error": "api_key is required for API-key authentication"}) + return + } + if req.AuthBinding != nil { + req.APIKey = "" + req.BaseURL = "" + req.Headers = nil + } if !validReasoningEffort(req.ReasoningEffort) { writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid reasoning_effort"}) return @@ -231,7 +251,7 @@ func (s *Server) handleSetupComplete(w http.ResponseWriter, r *http.Request) { // Build or update config. var cfg *config.Config - cfg, err := config.LoadConfig() + cfg, err = config.LoadConfig() if err != nil { cfg, err = cloneConfigForSetup(s.cfg) if err != nil { @@ -250,6 +270,7 @@ func (s *Server) handleSetupComplete(w http.ResponseWriter, r *http.Request) { setupPC := &config.ProviderConfig{ APIKey: req.APIKey, BaseURL: req.BaseURL, + Auth: req.AuthBinding, Name: req.Name, Headers: cleanHeaders(req.Headers), Vision: req.Vision, diff --git a/site/docs/configuration.md b/site/docs/configuration.md index 8d404f4b..72f67563 100644 --- a/site/docs/configuration.md +++ b/site/docs/configuration.md @@ -145,12 +145,24 @@ Map of provider name to provider config. Each provider needs: | Field | Required | Description | |---|---|---| -| `api_key` | Yes | Your API key | -| `base_url` | No | Custom base URL (defaults to the provider's standard endpoint) | +| `api_key` | Conditional | API key for the legacy/default authentication path; required unless `auth` is set | +| `auth` | Conditional | Non-secret managed account binding: `{ "method": "codex_oauth" | "xai_oauth" | "github_copilot", "account_id"?: "..." }` | +| `base_url` | No | Custom base URL for API-key providers (defaults to the provider's standard endpoint) | + +Managed account credentials are not stored in this map. They live in +`~/.jcode/provider-auth.json`, which is written atomically with owner-only file +permissions. The Provider config stores only `auth.method` and an optional +`auth.account_id`; omitting the account ID follows that method's default usable +account. Managed transports ignore custom `base_url`, `headers`, `protocol`, and +`api_key` values and use their pinned runtime profile. Because custom image +endpoints currently reuse the Provider API key, `image_endpoint` is also +unavailable on a managed-login Provider; configure it under a separate API-key +Provider. These are **local Providers** and Desktop calls them directly. When Cloud -configuration sync is enabled, their secrets and custom headers are encrypted -on Desktop before upload. Cloud Providers use a separate server-side catalog and +configuration sync is enabled, API keys and custom headers are encrypted on +Desktop before upload. Managed account credentials remain device-local; only +their non-secret binding is part of Provider configuration. Cloud Providers use a separate server-side catalog and `cloud_proxy`; they are not written into this map. See [Cloud & configuration sync](/docs/cloud). diff --git a/site/docs/get-started.md b/site/docs/get-started.md index f1760878..5d143215 100644 --- a/site/docs/get-started.md +++ b/site/docs/get-started.md @@ -8,7 +8,7 @@ nav_order: 1 ## Prerequisites - **Go 1.22+** installed -- An **API key** from an OpenAI-compatible provider (OpenAI, Anthropic, Azure, etc.) +- Either an **API key** from an OpenAI-compatible provider or an eligible ChatGPT/Codex, Grok, or GitHub Copilot account ## Install @@ -30,7 +30,7 @@ cd jcode make install ``` -The `make install` command generates the model registry, builds the Vue 3 web frontend, and installs the Go binary to your `$GOPATH/bin`. +The `make install` command generates the model registry, builds the React web frontend, and installs the Go binary to your `$GOPATH/bin`. ### Update @@ -53,10 +53,19 @@ jcode On first launch, jcode runs a **setup wizard** that guides you through: -1. **Choose a provider** — Select your AI model provider (OpenAI, Anthropic, etc.) -2. **Enter your API key** — Your key is stored locally at `~/.jcode/config.json` +1. **Choose a provider** — Select your AI model provider (OpenAI, xAI, GitHub Copilot, etc.) +2. **Choose authentication** — Enter an API key, or sign in with ChatGPT, Grok, or GitHub using the displayed device code 3. **Pick a model** — Select the default model for your session +API keys remain in `~/.jcode/config.json`. Managed account credentials stay in +the owner-only local store `~/.jcode/provider-auth.json`; provider configuration +contains only a non-secret account binding. + +{: .note } +**Sign in with ChatGPT** uses the ChatGPT/Codex subscription channel. It is +separate from an OpenAI API key and does not turn ChatGPT subscription access +into OpenAI API credits. + That's it. You're ready to go. ## Verify Your Setup @@ -104,7 +113,7 @@ make build The `make build` command: 1. Generates the model registry from [models.dev](https://models.dev) -2. Builds the Vue 3 web frontend +2. Builds the React web frontend 3. Compiles the Go binary {: .note } diff --git a/site/docs/overview/models.md b/site/docs/overview/models.md index 2c41189e..f744423e 100644 --- a/site/docs/overview/models.md +++ b/site/docs/overview/models.md @@ -6,7 +6,7 @@ nav_order: 3 # Model Providers & Models -jcode works with any OpenAI-compatible API. Configure multiple providers and switch between models mid-session. +jcode works with OpenAI-compatible APIs and with managed account transports for ChatGPT/Codex, xAI/Grok, and GitHub Copilot. Configure multiple providers and switch between models mid-session. ## Supported Providers @@ -15,6 +15,9 @@ Any provider that implements the OpenAI chat completion API is supported. Common | Provider | Base URL | Notes | |---|---|---| | OpenAI | `https://api.openai.com/v1` | Default if no base URL specified | +| ChatGPT / Codex | Managed by jcode | Device-code sign-in; uses the ChatGPT Codex Responses transport | +| xAI / Grok | `https://api.x.ai/v1` | API key or Grok device-code sign-in | +| GitHub Copilot | Managed by jcode | GitHub.com device-code sign-in; Chat Completions transport | | Anthropic | Via compatible proxy | Use a provider that exposes OpenAI-compatible API | | Azure OpenAI | Your Azure endpoint | Set `base_url` to your Azure endpoint | | Local models | `http://localhost:PORT` | Ollama, LM Studio, vLLM, etc. | @@ -48,6 +51,62 @@ The `model` field uses the format `"provider/model"`. For example: {: .note } The model registry is auto-generated from [models.dev](https://models.dev) at build time. If your model isn't listed, you can still use it by specifying the provider and model name. +## Provider Authentication + +In Web or Desktop, open **Settings → Providers**, add or edit a supported +Provider, then choose its Authentication method: + +| Provider | Authentication choices | +|---|---| +| OpenAI | API key, or **Sign in with ChatGPT** | +| xAI | API key, or **Sign in with Grok** | +| GitHub Copilot | **Sign in with GitHub** | +| Custom OpenAI-compatible endpoint | API key | + +For managed sign-in, jcode shows a short-lived device code, opens the provider's +verification page, and polls until authorization finishes. You can keep +multiple accounts, choose a default, pin a Provider to a specific account, +remove one account, or sign out all accounts for that authentication method. +Providers that need reauthentication fail closed and show a reauthenticate +action instead of sending a stale token. + +Managed account bindings are non-secret and look like this in +`~/.jcode/config.json`: + +```json +{ + "providers": { + "openai": { + "auth": { "method": "codex_oauth" } + }, + "xai": { + "auth": { "method": "xai_oauth", "account_id": "optional-account-id" } + }, + "github-copilot": { + "auth": { "method": "github_copilot" } + } + } +} +``` + +An omitted `account_id` follows the current default account. Durable refresh or +GitHub credentials are stored separately in `~/.jcode/provider-auth.json` with +owner-only permissions. Access tokens are resolved immediately before each +request and are never returned to the UI. Managed transports also pin their +runtime URL, protocol, and protected headers, so custom base URLs and headers +cannot redirect or replace their authorization. + +{: .note } +**Sign in with ChatGPT** is the ChatGPT/Codex subscription transport, not a +general OpenAI API OAuth flow. API-key billing and ChatGPT subscription access +remain separate. GitHub Enterprise Server is not supported by the initial +GitHub Copilot integration. + +{: .note } +Custom image endpoints currently use their Provider's API key. A managed-login +Provider cannot also own an image endpoint; use a separate API-key Provider for +image generation. + ## Switch Models Mid-Session Press **Ctrl+L** in the TUI or type `/model` to open the model picker. You can switch models without restarting your session. @@ -137,7 +196,7 @@ Reasoning effort can also be chosen **per model** from the chat model picker. Th jcode includes a setup wizard. Run it from the TUI with `/setting` → "Add Model", or press Ctrl+L and select "Add new provider". -In the web UI, providers and models are managed from a card-based **Settings** view: each provider is a card showing its brand, name, base URL, and a catalog of its models (built-in registry models toggle show/hide; custom models are editable or removable). Editing a provider or authoring a custom model opens a dedicated dialog. A custom model's editor exposes its ID, display name, context window, image-input toggle, and a reasoning-effort tier editor — when a custom model is flagged as reasoning, the standard `minimal` / `low` / `medium` / `high` effort levels are offered, or you can define your own tiers. Models advertising effort levels then expose the per-model reasoning-effort control in the chat input. +In the web UI, providers and models are managed from a card-based **Settings** view: each provider is a card showing its brand, authentication status, name, endpoint, and a catalog of its models (built-in registry models toggle show/hide; custom models are editable or removable). Editing a provider keeps API-key and managed-account authentication in the same form. A custom model's editor exposes its ID, display name, context window, image-input toggle, and a reasoning-effort tier editor — when a custom model is flagged as reasoning, the standard `minimal` / `low` / `medium` / `high` effort levels are offered, or you can define your own tiers. Models advertising effort levels then expose the per-model reasoning-effort control in the chat input. ## Verify Model Connectivity diff --git a/site/docs/web-interface.md b/site/docs/web-interface.md index 1e0812ed..d300f7ad 100644 --- a/site/docs/web-interface.md +++ b/site/docs/web-interface.md @@ -49,7 +49,7 @@ List, view, and switch between sessions. Start a new session or resume a previou ### Model & Settings -Switch models, change the session mode (Ask for approval / Plan / Full access), and manage configuration — all from the web interface. +Switch models, change the session mode (Ask for approval / Plan / Full access), and manage configuration — all from the web interface. Provider forms support API keys plus device-code sign-in for ChatGPT/Codex, xAI/Grok, and GitHub Copilot, including multiple accounts, default-account selection, removal, sign-out, and reauthentication states. ### Theme / Dark Mode @@ -74,6 +74,13 @@ The web server exposes an HTTP API and a WebSocket stream for programmatic acces | `POST /api/sessions` | Create new session | | `GET /api/models` | List available models | | `POST /api/model` | Switch active model | +| `GET /api/provider-auth/{method}` | List non-secret account status for a managed authentication method | +| `POST /api/provider-auth/{method}/start` | Start a device-code login | +| `POST /api/provider-auth/{method}/flows/{flow_id}/poll` | Advance a device-code login | +| `DELETE /api/provider-auth/{method}/flows/{flow_id}` | Cancel a pending login | +| `POST /api/provider-auth/{method}/default` | Select the default managed account | +| `DELETE /api/provider-auth/{method}/accounts/{account_id}` | Remove one managed account | +| `DELETE /api/provider-auth/{method}` | Sign out all accounts for that method | | `POST /api/mode` | Switch session mode (`approval`, `plan`, or `full_access`) | | `GET /api/todos` | Get current todo items | | `GET /api/files` | Browse directory | diff --git a/web/src/components/SettingsView.test.tsx b/web/src/components/SettingsView.test.tsx index a96d8162..0f98677f 100644 --- a/web/src/components/SettingsView.test.tsx +++ b/web/src/components/SettingsView.test.tsx @@ -9,7 +9,7 @@ */ import { describe, it, expect, beforeEach, vi } from 'vitest' -import { cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react' +import { act, cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react' import { Provider } from 'react-redux' import { i18n } from '../i18n' import { store, uiActions } from '../app/store' @@ -24,6 +24,14 @@ function renderView() { ) } +function deferred() { + let resolve!: (value: T | PromiseLike) => void + const promise = new Promise((resolvePromise) => { + resolve = resolvePromise + }) + return { promise, resolve } +} + beforeEach(async () => { cleanup() vi.restoreAllMocks() @@ -207,4 +215,125 @@ describe('SettingsView', () => { expect(screen.queryByText('Current task')).toBeNull() expect(screen.queryByRole('switch', { name: 'Image generation tool' })).toBeNull() }) + + it('adds an OpenAI provider with a managed ChatGPT account and no API key', async () => { + vi.spyOn(api, 'listProviders').mockResolvedValue([]) + vi.spyOn(api, 'providerCatalog').mockResolvedValue([]) + vi.spyOn(api, 'setupProviders').mockResolvedValue([{ + id: 'openai', name: 'OpenAI', configured: false, auth_methods: ['api_key', 'codex_oauth'], + }]) + vi.spyOn(api, 'providerAuthStatus').mockResolvedValue({ + method: 'codex_oauth', + default_account_id: 'account-1', + accounts: [{ + id: 'account-1', login: 'jack@example.com', authenticated_at: '2026-08-09T08:00:00Z', requires_reauth: false, + }], + }) + vi.spyOn(api, 'models').mockResolvedValue({ + current: { provider: '', model: '' }, current_image: { provider: '', model: '' }, providers: [], + }) + const addResponse = deferred<{ status: string }>() + const add = vi.spyOn(api, 'addProvider').mockReturnValue(addResponse.promise) + + store.dispatch(uiActions.setSettingsTab('providers')) + renderView() + fireEvent.click(await screen.findByRole('button', { name: 'Add' })) + fireEvent.change(screen.getByRole('combobox'), { target: { value: 'openai' } }) + fireEvent.click(await screen.findByRole('button', { name: 'ChatGPT' })) + + await screen.findByText('jack@example.com') + expect(screen.queryByLabelText('API Key')).toBeNull() + fireEvent.click(screen.getByRole('button', { name: 'Advanced' })) + expect(screen.queryByText('Custom Endpoint')).toBeNull() + expect(screen.queryByText('Custom Headers')).toBeNull() + const reasoningSelect = screen.getByText('Reasoning effort').parentElement?.querySelector('select') + expect(reasoningSelect).toBeTruthy() + fireEvent.change(reasoningSelect!, { target: { value: 'high' } }) + expect(screen.queryByText('OpenAI-compatible image endpoint')).toBeNull() + const save = screen.getByRole('button', { name: 'Add' }) + await waitFor(() => expect(save.hasAttribute('disabled')).toBe(false)) + fireEvent.click(save) + + await waitFor(() => expect(add).toHaveBeenCalledTimes(1)) + expect(screen.getByRole('group', { name: 'Authentication' }).hasAttribute('disabled')).toBe(true) + expect(add.mock.calls[0][0]).toMatchObject({ + id: 'openai', + auth_binding: { method: 'codex_oauth' }, + reasoning_effort: 'high', + }) + expect(add.mock.calls[0][0].api_key).toBeUndefined() + expect(add.mock.calls[0][0]).not.toHaveProperty('base_url') + expect(add.mock.calls[0][0]).not.toHaveProperty('headers') + expect(add.mock.calls[0][0]).not.toHaveProperty('image_endpoint') + await act(async () => { + addResponse.resolve({ status: 'ok' }) + await Promise.resolve() + }) + }) + + it('clears an existing image endpoint when a provider uses managed authentication', async () => { + const connected = { + method: 'codex_oauth' as const, + default_account_id: 'account-1', + accounts: [{ + id: 'account-1', login: 'jack@example.com', authenticated_at: '2026-08-09T08:00:00Z', requires_reauth: false, + }], + } + vi.spyOn(api, 'listProviders').mockResolvedValue([{ + id: 'openai', name: 'OpenAI', api_key_set: false, + auth_methods: ['api_key', 'codex_oauth'], + auth_binding: { method: 'codex_oauth', account_id: 'account-1' }, + auth_status: connected, + image_endpoint: { + protocol: 'openai_images', base_url: 'https://images.example/v1', models: [{ id: 'paint-1' }], + }, + capabilities: [], + }]) + vi.spyOn(api, 'providerCatalog').mockResolvedValue([]) + vi.spyOn(api, 'setupProviders').mockResolvedValue([{ + id: 'openai', name: 'OpenAI', configured: true, auth_methods: ['api_key', 'codex_oauth'], + }]) + vi.spyOn(api, 'providerAuthStatus').mockResolvedValue(connected) + vi.spyOn(api, 'models').mockResolvedValue({ + current: { provider: '', model: '' }, current_image: { provider: '', model: '' }, providers: [], + }) + const update = vi.spyOn(api, 'updateProvider').mockResolvedValue({ status: 'ok' }) + + store.dispatch(uiActions.setSettingsTab('providers')) + renderView() + fireEvent.click(await screen.findByTitle('Edit provider')) + await screen.findByText('jack@example.com') + expect(screen.queryByText('OpenAI-compatible image endpoint')).toBeNull() + fireEvent.click(screen.getByRole('button', { name: 'Save' })) + + await waitFor(() => expect(update).toHaveBeenCalledTimes(1)) + const request = update.mock.calls[0][1] + expect(request.image_endpoint).toBeNull() + expect(request).not.toHaveProperty('base_url') + expect(request).not.toHaveProperty('headers') + }) + + it('surfaces a provider account that needs re-authentication', async () => { + vi.spyOn(api, 'listProviders').mockResolvedValue([{ + id: 'openai', name: 'OpenAI', api_key_set: false, + auth_binding: { method: 'codex_oauth', account_id: 'account-1' }, + auth_status: { + method: 'codex_oauth', default_account_id: 'account-1', accounts: [{ + id: 'account-1', login: 'jack@example.com', authenticated_at: '2026-08-09T08:00:00Z', requires_reauth: true, + }], + }, + capabilities: [], + }]) + vi.spyOn(api, 'providerCatalog').mockResolvedValue([]) + vi.spyOn(api, 'setupProviders').mockResolvedValue([]) + vi.spyOn(api, 'models').mockResolvedValue({ + current: { provider: '', model: '' }, current_image: { provider: '', model: '' }, providers: [], + }) + + store.dispatch(uiActions.setSettingsTab('providers')) + renderView() + + expect(await screen.findByText(/Needs re-authentication · jack@example.com · ChatGPT/)).toBeTruthy() + expect(screen.getByRole('button', { name: 'Re-authenticate' })).toBeTruthy() + }) }) diff --git a/web/src/components/SettingsView.tsx b/web/src/components/SettingsView.tsx index 9302f0d7..13e138f2 100644 --- a/web/src/components/SettingsView.tsx +++ b/web/src/components/SettingsView.tsx @@ -59,6 +59,12 @@ import { useAppDispatch, useAppSelector } from '../app/hooks' import { uiActions, modelActions, loadConfig, loadModels, type SettingsTab } from '../app/store' import { ProviderIcon } from './ProviderIcon' import { CloudTab } from './settings/CloudTab' +import { + ProviderAuthSection, + isProviderAuthReady, + providerCredentialMethods, + resolveProviderAuthAccount, +} from './settings/ProviderAuthSection' import { BTN_DANGER, BTN_GHOST, @@ -109,6 +115,9 @@ import type { SSHListResponse, UsageStats, SetupProvider, + ProviderAuthBinding, + ProviderAuthStatus, + ProviderCredentialMethod, } from '../lib/types' // ─── tab config ──────────────────────────────────────────────────────────── @@ -490,6 +499,19 @@ function ProvidersTab() { setAdding(false) } + async function onProviderAuthenticated(providerId: string) { + try { + setProviders(await api.listProviders()) + } catch { + // The account is already stored; keep the form usable if an older server + // cannot yet project managed-auth state onto provider details. + } + if (providers.some((provider) => provider.id === providerId)) { + await refreshCatalog(providerId) + } + await refreshModels() + } + async function deleteProvider(id: string) { try { await api.deleteProvider(id) @@ -620,6 +642,7 @@ function ProvidersTab() { setEditing(null) }} onSaved={onProviderSaved} + onAuthenticated={onProviderAuthenticated} /> ) } @@ -880,6 +903,26 @@ function ProviderCard({ const [search, setSearch] = useState('') const webSearchCapability = provider.capabilities?.find((capability) => capability.id === 'web_search') + const authAccount = resolveProviderAuthAccount(provider.auth_status, provider.auth_binding) + const authMethodLabel = provider.auth_binding + ? t(`settings.providers.auth.methods.${provider.auth_binding.method === 'codex_oauth' + ? 'chatgpt' + : provider.auth_binding.method === 'xai_oauth' + ? 'grok' + : 'copilot'}`) + : '' + const authNeedsReauth = !!provider.auth_binding && !!provider.auth_status + && (!!authAccount?.requires_reauth || (!!provider.auth_binding.account_id && !authAccount)) + const authNeedsSignIn = !!provider.auth_binding && !!provider.auth_status && !authAccount && !authNeedsReauth + const authSummary = provider.auth_binding + ? provider.auth_status + ? authAccount + ? `${authNeedsReauth ? t('settings.providers.auth.needsReauth') : t('settings.providers.auth.connected')} · ${authAccount.login} · ${authMethodLabel}` + : `${t('settings.providers.auth.signInRequired')} · ${authMethodLabel}` + : `${t('settings.providers.auth.configured')} · ${authMethodLabel}` + : provider.api_key_set + ? `${t('settings.providers.auth.configured')} · ${t('settings.providers.auth.methods.apiKey')}` + : t('settings.providers.auth.signInRequired') const addedCount = catalog.filter((m) => m.added).length const filtered = (() => { @@ -910,8 +953,21 @@ function ProviderCard({ {provider.custom && {t('settings.providers.custom')}} {selectedImageModel && {t('settings.providers.roles.imageSelectedBadge')}} -
- {provider.base_url || (provider.api_key_set ? t('settings.providers.apiKey') : '—')} +
+ + {authSummary} + {provider.base_url && ( + · {provider.base_url} + )}
@@ -942,6 +998,12 @@ function ProviderCard({ ) ) : ( <> + {(authNeedsReauth || authNeedsSignIn) && ( + + )} @@ -1133,20 +1195,34 @@ function ProviderForm({ configuredIds, onCancel, onSaved, + onAuthenticated, }: { editing: ProviderDetail | null setupList: SetupProvider[] configuredIds: string[] onCancel: () => void onSaved: () => void + onAuthenticated: (providerId: string, status: ProviderAuthStatus) => void | Promise }) { const { t } = useTranslation() const isEdit = !!editing + const initialAuthMethods = editing?.custom + ? ['api_key' as const] + : providerCredentialMethods( + setupList.find((provider) => provider.id === editing?.id)?.auth_methods ?? editing?.auth_methods, + editing?.auth_binding, + ) + const initialAuthMethod = editing?.auth_binding?.method ?? initialAuthMethods[0] const [mode, setMode] = useState<'registry' | 'custom'>(editing?.custom ? 'custom' : 'registry') const [selId, setSelId] = useState('') const [customId, setCustomId] = useState(editing?.id ?? '') const [name, setName] = useState(editing?.name ?? '') const [apiKey, setApiKey] = useState('') + const [authMethod, setAuthMethod] = useState(initialAuthMethod) + const [authBinding, setAuthBinding] = useState( + initialAuthMethod === 'api_key' ? null : editing?.auth_binding ?? { method: initialAuthMethod }, + ) + const [authStatus, setAuthStatus] = useState(editing?.auth_status) const [baseUrl, setBaseUrl] = useState(editing?.base_url ?? '') const [headers, setHeaders] = useState<{ key: string; value: string }[]>( Object.entries(editing?.headers ?? {}).map(([key, value]) => ({ key, value })), @@ -1187,6 +1263,25 @@ function ProviderForm({ // Custom (non-registry) providers get the enable_thinking knob; registry // providers derive everything from models.dev metadata. const isCustomProvider = isEdit ? !!editing?.custom : mode === 'custom' + const selectedSetup = setupList.find((provider) => provider.id === providerId) + const authMethods = isCustomProvider + ? ['api_key' as const] + : providerCredentialMethods(selectedSetup?.auth_methods ?? editing?.auth_methods, editing?.auth_binding) + const isManagedAuth = authMethod !== 'api_key' + const managedAuthReady = authMethod === 'api_key' || isProviderAuthReady(authStatus, authBinding) + + useEffect(() => { + if (isEdit) return + const setup = setupList.find((provider) => provider.id === selId) + const methods = mode === 'custom' + ? ['api_key' as const] + : providerCredentialMethods(setup?.auth_methods) + const next = methods.includes('api_key') ? 'api_key' : methods[0] + setAuthMethod(next) + setAuthBinding(next === 'api_key' ? null : { method: next }) + setAuthStatus(undefined) + setApiKey('') + }, [isEdit, mode, selId, setupList]) async function save(e: React.FormEvent) { e.preventDefault() @@ -1195,17 +1290,25 @@ function ProviderForm({ setError(t('settings.providers.customIdRequired')) return } - if (!isEdit && !apiKey.trim()) { + if (authMethod === 'api_key' && !apiKey.trim() && (!isEdit || !editing?.api_key_set)) { setError(t('settings.providers.enterApiKey')) return } + if (authMethod !== 'api_key' && !isProviderAuthReady(authStatus, authBinding)) { + setError(t('settings.providers.auth.signInRequired')) + return + } setSaving(true) try { - const builtHeaders = buildHeaders(headers) + const builtHeaders = isManagedAuth ? {} : buildHeaders(headers) let imageEndpoint: ImageEndpointConfig | null | undefined = buildImageEndpointConfig( imageEndpointEnabled, imageEndpointBaseURL, imageEndpointModels, imageAssetHosts, ) - if (!imageEndpointEnabled && isEdit && editing?.image_endpoint) imageEndpoint = null + if (isManagedAuth) { + imageEndpoint = isEdit && editing?.image_endpoint ? null : undefined + } else if (!imageEndpointEnabled && isEdit && editing?.image_endpoint) { + imageEndpoint = null + } // '' (Default) → undefined so the JSON omits the override entirely. // Vision is never sent: image support comes from model metadata, and // omitting the field clears any stale stored override on save. @@ -1213,24 +1316,32 @@ function ProviderForm({ if (isEdit) { const data: Parameters[1] = { name: name || undefined, - base_url: buildProviderBaseURLUpdate(editing?.base_url, baseUrl), - headers: Object.keys(builtHeaders).length ? builtHeaders : undefined, + ...(!isManagedAuth ? { + base_url: buildProviderBaseURLUpdate(editing?.base_url, baseUrl), + headers: Object.keys(builtHeaders).length ? builtHeaders : undefined, + } : {}), thinking: thinkingOverride, reasoning_effort: reasoningEffort || undefined, image_endpoint: imageEndpoint, + auth_binding: authMethod === 'api_key' + ? editing?.auth_binding ? null : undefined + : authBinding ?? { method: authMethod }, } - if (apiKey.trim()) data.api_key = apiKey.trim() + if (authMethod === 'api_key' && apiKey.trim()) data.api_key = apiKey.trim() await api.updateProvider(editing!.id, data) } else { await api.addProvider({ id: providerId, - api_key: apiKey.trim(), + api_key: authMethod === 'api_key' ? apiKey.trim() : undefined, + auth_binding: authMethod === 'api_key' ? undefined : authBinding ?? { method: authMethod }, name: name || undefined, thinking: thinkingOverride, reasoning_effort: reasoningEffort || undefined, - base_url: baseUrl.trim() || undefined, - headers: Object.keys(builtHeaders).length ? builtHeaders : undefined, - image_endpoint: imageEndpoint ?? undefined, + ...(!isManagedAuth ? { + base_url: baseUrl.trim() || undefined, + headers: Object.keys(builtHeaders).length ? builtHeaders : undefined, + image_endpoint: imageEndpoint ?? undefined, + } : {}), }) } onSaved() @@ -1293,15 +1404,27 @@ function ProviderForm({ )} - - setApiKey(e.target.value)} - type="password" - placeholder={isEdit ? t('settings.providers.apiKeyUnchanged') : 'sk-…'} - className={INPUT_MONO} - /> - + setApiKey(e.target.value)} + type="password" + aria-label={t('settings.providers.apiKey')} + placeholder={isEdit ? t('settings.providers.apiKeyUnchanged') : t('setup.apiKeyPlaceholder')} + className={INPUT_MONO} + /> + )} + onMethodChange={setAuthMethod} + onBindingChange={setAuthBinding} + onStatusChange={setAuthStatus} + onAuthenticated={(status) => onAuthenticated(providerId, status)} + /> {(mode === 'custom' || isEdit) && ( @@ -1320,66 +1443,72 @@ function ProviderForm({ type="button" onClick={() => setAdvancedOpen((v) => !v)} className="mb-3 flex items-center gap-1 text-[11px] font-medium text-[var(--color-muted-foreground)] hover:text-[var(--color-foreground)]" + aria-expanded={advancedOpen} + aria-controls="provider-advanced-fields" > {t('settings.providers.advanced')} {advancedOpen && ( -
- - setBaseUrl(e.target.value)} - type="text" - placeholder={t('settings.providers.endpointPlaceholder')} - className={INPUT_MONO} - /> - - -
-
- - -
- {headers.length === 0 && ( -
{t('settings.providers.headersHint')}
- )} - {headers.map((h, i) => ( -
- setHeaders((prev) => prev.map((x, j) => (j === i ? { ...x, key: e.target.value } : x)))} - type="text" - placeholder={t('settings.providers.headerKey')} - className={INPUT_MONO} - /> +
+ {!isManagedAuth && ( + <> + setHeaders((prev) => prev.map((x, j) => (j === i ? { ...x, value: e.target.value } : x)))} + value={baseUrl} + onChange={(e) => setBaseUrl(e.target.value)} type="text" - placeholder="value" + placeholder={t('settings.providers.endpointPlaceholder')} className={INPUT_MONO} /> - + + +
+
+ + +
+ {headers.length === 0 && ( +
{t('settings.providers.headersHint')}
+ )} + {headers.map((h, i) => ( +
+ setHeaders((prev) => prev.map((x, j) => (j === i ? { ...x, key: e.target.value } : x)))} + type="text" + placeholder={t('settings.providers.headerKey')} + className={INPUT_MONO} + /> + setHeaders((prev) => prev.map((x, j) => (j === i ? { ...x, value: e.target.value } : x)))} + type="text" + placeholder="value" + className={INPUT_MONO} + /> + +
+ ))}
- ))} -
+ + )}
@@ -1418,7 +1547,7 @@ function ProviderForm({
-
+ {!isManagedAuth &&
@@ -1510,7 +1639,7 @@ function ProviderForm({
)} -
+
}
)} @@ -1520,7 +1649,7 @@ function ProviderForm({ -
diff --git a/web/src/components/SetupView.test.tsx b/web/src/components/SetupView.test.tsx new file mode 100644 index 00000000..0b6f1b99 --- /dev/null +++ b/web/src/components/SetupView.test.tsx @@ -0,0 +1,105 @@ +import { act, cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react' +import { beforeEach, describe, expect, it, vi } from 'vitest' +import { Provider } from 'react-redux' +import { store } from '../app/store' +import { i18n } from '../i18n' +import { api } from '../lib/api' +import { SetupView } from './SetupView' + +beforeEach(async () => { + cleanup() + vi.restoreAllMocks() + await i18n.changeLanguage('en') +}) + +function deferred() { + let resolve!: (value: T | PromiseLike) => void + const promise = new Promise((resolvePromise) => { + resolve = resolvePromise + }) + return { promise, resolve } +} + +describe('SetupView managed provider authentication', () => { + it('completes first-run setup with an OAuth binding and no API key', async () => { + vi.spyOn(api, 'setupProviders').mockResolvedValue([{ + id: 'openai', + name: 'OpenAI', + configured: false, + auth_methods: ['codex_oauth'], + }]) + vi.spyOn(api, 'setupProviderModels').mockResolvedValue([]) + vi.spyOn(api, 'providerAuthStatus').mockResolvedValue({ + method: 'codex_oauth', + default_account_id: 'account-1', + accounts: [{ + id: 'account-1', + login: 'jack@example.com', + authenticated_at: '2026-08-09T08:00:00Z', + requires_reauth: false, + }], + }) + const complete = vi.spyOn(api, 'setupComplete').mockImplementation(() => new Promise(() => {})) + + render( + + + , + ) + + const provider = await screen.findByRole('combobox') + fireEvent.change(provider, { target: { value: 'openai' } }) + await screen.findByText('jack@example.com') + + expect(screen.queryByLabelText('API Key')).toBeNull() + const submit = screen.getByRole('button', { name: 'Complete Setup' }) + await waitFor(() => expect(submit.hasAttribute('disabled')).toBe(false)) + fireEvent.click(submit) + + await waitFor(() => expect(complete).toHaveBeenCalledTimes(1)) + expect(complete.mock.calls[0][0]).toMatchObject({ + provider: 'openai', + auth_binding: { method: 'codex_oauth' }, + }) + expect(complete.mock.calls[0][0].api_key).toBeUndefined() + expect(complete.mock.calls[0][0]).not.toHaveProperty('base_url') + expect(complete.mock.calls[0][0]).not.toHaveProperty('headers') + }) + + it('ignores a late model response from a previously selected provider', async () => { + const alphaModels = deferred>() + const betaModels = deferred>() + vi.spyOn(api, 'setupProviders').mockResolvedValue([ + { id: 'alpha', name: 'Alpha', configured: false, auth_methods: ['api_key'] }, + { id: 'beta', name: 'Beta', configured: false, auth_methods: ['api_key'] }, + ]) + vi.spyOn(api, 'setupProviderModels').mockImplementation((providerID) => ( + providerID === 'alpha' ? alphaModels.promise : betaModels.promise + )) + + render( + + + , + ) + + const provider = await screen.findByRole('combobox') + fireEvent.change(provider, { target: { value: 'alpha' } }) + await waitFor(() => expect(api.setupProviderModels).toHaveBeenCalledWith('alpha')) + fireEvent.change(provider, { target: { value: 'beta' } }) + await waitFor(() => expect(api.setupProviderModels).toHaveBeenCalledWith('beta')) + + await act(async () => { + betaModels.resolve([{ id: 'beta-model', name: 'Beta Model', tool_call: true }]) + await Promise.resolve() + }) + expect(await screen.findByRole('option', { name: 'Beta Model' })).toBeTruthy() + + await act(async () => { + alphaModels.resolve([{ id: 'alpha-model', name: 'Alpha Model', tool_call: true }]) + await Promise.resolve() + }) + expect(screen.queryByRole('option', { name: 'Alpha Model' })).toBeNull() + expect(screen.getByRole('option', { name: 'Beta Model' })).toBeTruthy() + }) +}) diff --git a/web/src/components/SetupView.tsx b/web/src/components/SetupView.tsx index 2de1a362..a8595fea 100644 --- a/web/src/components/SetupView.tsx +++ b/web/src/components/SetupView.tsx @@ -5,12 +5,24 @@ * users test the connection, then calls /api/setup/complete. */ -import { useEffect, useState } from 'react' +import { useEffect, useRef, useState } from 'react' import { useTranslation } from 'react-i18next' import { api } from '../lib/api' -import { normalizeMode, type SetupProvider, type SetupModel } from '../lib/types' +import { + normalizeMode, + type ProviderAuthBinding, + type ProviderAuthStatus, + type ProviderCredentialMethod, + type SetupProvider, + type SetupModel, +} from '../lib/types' import { useAppDispatch } from '../app/hooks' import { chatActions, loadWorkspaceState, modelActions, sessionActions, uiActions } from '../app/store' +import { + ProviderAuthSection, + isProviderAuthReady, + providerCredentialMethods, +} from './settings/ProviderAuthSection' export function SetupView() { const { t } = useTranslation() @@ -26,26 +38,66 @@ export function SetupView() { const [headersText, setHeadersText] = useState('') const [models, setModels] = useState([]) const [apiKey, setApiKey] = useState('') + const [authMethod, setAuthMethod] = useState('api_key') + const [authBinding, setAuthBinding] = useState(null) + const [authStatus, setAuthStatus] = useState() const [model, setModel] = useState('') const [submitting, setSubmitting] = useState(false) const [validating, setValidating] = useState(false) const [validation, setValidation] = useState<{ valid: boolean; error?: string } | null>(null) const [error, setError] = useState('') + const mountedRef = useRef(true) + const modelsRequestRef = useRef(0) + const selectedProviderRef = useRef(null) + selectedProviderRef.current = !custom ? selected?.id ?? null : null + + useEffect(() => { + mountedRef.current = true + return () => { + mountedRef.current = false + modelsRequestRef.current += 1 + } + }, []) + + async function loadProviderModels(providerID: string): Promise { + const requestID = modelsRequestRef.current + 1 + modelsRequestRef.current = requestID + let nextModels: SetupModel[] = [] + try { + nextModels = await api.setupProviderModels(providerID) + } catch { + nextModels = [] + } + if (!mountedRef.current + || modelsRequestRef.current !== requestID + || selectedProviderRef.current !== providerID) return + setModels(nextModels) + } useEffect(() => { api.setupProviders().then(setProviders).catch(() => {}) }, []) useEffect(() => { - if (!selected || custom) return + modelsRequestRef.current += 1 setModels([]) setModel('') - api.setupProviderModels(selected.id).then(setModels).catch(() => {}) + if (!selected || custom) return + void loadProviderModels(selected.id) }, [selected, custom]) useEffect(() => { setValidation(null) - }, [apiKey, selected, custom, baseUrl, customId, headersText]) + }, [apiKey, authMethod, authBinding, selected, custom, baseUrl, customId, headersText]) + + useEffect(() => { + const methods = custom ? ['api_key' as const] : providerCredentialMethods(selected?.auth_methods) + const next = methods.includes('api_key') ? 'api_key' : methods[0] + setAuthMethod(next) + setAuthBinding(next === 'api_key' ? null : { method: next }) + setAuthStatus(undefined) + setApiKey('') + }, [selected, custom]) function parseHeaders(): Record | undefined { const raw = headersText.trim() @@ -62,10 +114,6 @@ export function SetupView() { } function validateInputs(): boolean { - if (!apiKey.trim()) { - setError(t('setup.apiKeyRequired')) - return false - } if (custom) { if (!customId.trim()) { setError(t('setup.customIdRequired')) @@ -89,13 +137,21 @@ export function SetupView() { setError(t('setup.chooseProvider')) return false } + if (authMethod === 'api_key' && !apiKey.trim()) { + setError(t('setup.apiKeyRequired')) + return false + } + if (authMethod !== 'api_key' && !isProviderAuthReady(authStatus, authBinding)) { + setError(t('settings.providers.auth.signInRequired')) + return false + } return true } async function testConnection() { setError('') setValidation(null) - if (!validateInputs()) return + if (authMethod !== 'api_key' || !validateInputs()) return setValidating(true) try { const result = await api.setupValidate({ @@ -120,12 +176,15 @@ export function SetupView() { try { await api.setupComplete({ provider: providerId(), - api_key: apiKey.trim(), + api_key: authMethod === 'api_key' ? apiKey.trim() : undefined, + auth_binding: authMethod === 'api_key' ? undefined : authBinding ?? { method: authMethod }, model: custom ? customModel.trim() : model || undefined, model_reasoning: custom ? customReasoning : undefined, - base_url: baseUrl.trim() || undefined, name: custom ? customName.trim() || customId.trim() : undefined, - headers: parseHeaders(), + ...(authMethod === 'api_key' ? { + base_url: baseUrl.trim() || undefined, + headers: parseHeaders(), + } : {}), }) const h = await api.health() dispatch(modelActions.setProvider(h.provider)) @@ -146,12 +205,19 @@ export function SetupView() { } } + const authMethods = custom + ? ['api_key' as const] + : providerCredentialMethods(selected?.auth_methods) + const credentialsReady = authMethod === 'api_key' + ? !!apiKey.trim() + : isProviderAuthReady(authStatus, authBinding) + return ( -
+
)} - - setApiKey(e.target.value)} - placeholder={t('setup.apiKeyPlaceholder')} - className="mt-1 w-full rounded-[var(--radius-md)] border border-[var(--color-border)] bg-[var(--color-muted)] px-3 py-2 text-sm outline-none focus:border-[var(--color-primary)]" - /> + {(selected || custom) && ( +
+ setApiKey(e.target.value)} + aria-label={t('setup.apiKey')} + placeholder={t('setup.apiKeyPlaceholder')} + className="w-full rounded-[var(--radius-md)] border border-[var(--color-border)] bg-[var(--color-muted)] px-3 py-2 text-sm outline-none focus:border-[var(--color-primary)]" + /> + )} + onMethodChange={setAuthMethod} + onBindingChange={setAuthBinding} + onStatusChange={setAuthStatus} + onAuthenticated={async (status) => { + setAuthStatus(status) + const providerID = selectedProviderRef.current + if (providerID) await loadProviderModels(providerID) + }} + /> +
+ )} {custom && ( <> @@ -246,18 +333,20 @@ export function SetupView() {
)} {error &&
{error}
} -
- +
+ {authMethod === 'api_key' && ( + + )} + ) +} + +export function DeviceCodePanel({ + flow, + browserOpenFailed, + completing, + onOpen, + onCancel, +}: { + flow: ProviderAuthFlow + browserOpenFailed: boolean + completing: boolean + onOpen: () => void + onCancel: () => void +}) { + const { t } = useTranslation() + const panelRef = useRef(null) + const titleID = useId() + const hintID = useId() + const codeID = useId() + const verificationURL = flow.verification_uri_complete || flow.verification_uri + const expiresAt = new Date(flow.expires_at) + const expiryLabel = Number.isNaN(expiresAt.getTime()) + ? '' + : t('settings.providers.auth.expiresAt', { + time: expiresAt.toLocaleTimeString([], { hour: '2-digit', minute: '2-digit' }), + }) + + useEffect(() => { + panelRef.current?.focus() + }, []) + + return ( +
+
+
+ +
+
+

+ {t('settings.providers.auth.enterCodeTitle')} +

+
+ {t('settings.providers.auth.enterCodeHint')} +
+
+
+ +
+ + {flow.user_code} + + +
+ + + + {browserOpenFailed && ( +
+ {t('settings.providers.auth.browserOpenFailed')} +
+ )} + +
+
+ + {completing ? t('settings.providers.auth.finishing') : t('settings.providers.auth.waiting')} + {expiryLabel && · {expiryLabel}} +
+ +
+
+ ) +} + +export interface ProviderAuthSectionProps { + methods: ProviderCredentialMethod[] + value: ProviderCredentialMethod + binding: ProviderAuthBinding | null + initialStatus?: ProviderAuthStatus + apiKeyField: React.ReactNode + disabled?: boolean + onMethodChange: (method: ProviderCredentialMethod) => void + onBindingChange: (binding: ProviderAuthBinding | null) => void + onStatusChange?: (status: ProviderAuthStatus) => void + onAuthenticated?: (status: ProviderAuthStatus) => void | Promise +} + +export function ProviderAuthSection({ + methods, + value, + binding, + initialStatus, + apiKeyField, + disabled = false, + onMethodChange, + onBindingChange, + onStatusChange, + onAuthenticated, +}: ProviderAuthSectionProps) { + const { t } = useTranslation() + const oauthMethod = value === 'api_key' ? null : value + const methodRef = useRef(oauthMethod) + const bindingRef = useRef(binding) + const initialStatusRef = useRef(initialStatus) + const onBindingChangeRef = useRef(onBindingChange) + const onStatusChangeRef = useRef(onStatusChange) + const onAuthenticatedRef = useRef(onAuthenticated) + const mountedRef = useRef(true) + const disabledRef = useRef(disabled) + const generationRef = useRef(0) + const statusRequestEpochRef = useRef(0) + const requestSequenceRef = useRef(0) + const startInFlightRef = useRef<{ requestID: number; generation: number } | null>(null) + const actionInFlightRef = useRef<{ requestID: number; generation: number } | null>(null) + const activeFlowRef = useRef<{ method: AuthMethod; flowID: string; generation: number } | null>(null) + const [status, setStatus] = useState( + initialStatus?.method === oauthMethod ? initialStatus : undefined, + ) + const statusRef = useRef(status) + const [statusLoading, setStatusLoading] = useState(false) + const [flow, setFlow] = useState(null) + const [starting, setStarting] = useState(false) + const [completingFlow, setCompletingFlow] = useState(false) + const [busyAction, setBusyAction] = useState('') + const [actionError, setActionError] = useState('') + const [postAuthError, setPostAuthError] = useState('') + const [terminal, setTerminal] = useState<{ state: TerminalState; message?: string } | null>(null) + const [browserOpenFailed, setBrowserOpenFailed] = useState(false) + const [manageOpen, setManageOpen] = useState(false) + const [confirmRemove, setConfirmRemove] = useState('') + const [confirmLogout, setConfirmLogout] = useState(false) + const accountSelectID = useId() + const accountsPanelID = useId() + const removeConfirmLabelID = useId() + const logoutConfirmLabelID = useId() + const removeConfirmButtonRef = useRef(null) + const logoutConfirmButtonRef = useRef(null) + + methodRef.current = oauthMethod + bindingRef.current = binding + disabledRef.current = disabled + initialStatusRef.current = initialStatus + onBindingChangeRef.current = onBindingChange + onStatusChangeRef.current = onStatusChange + onAuthenticatedRef.current = onAuthenticated + statusRef.current = status + + const normalizedMethods = useMemo( + () => [...new Set(methods.length ? methods : ['api_key' as const])], + [methods], + ) + + function isCurrent(method: AuthMethod, generation: number): boolean { + return mountedRef.current && methodRef.current === method && generationRef.current === generation + } + + function nextStatusRequest(): number { + statusRequestEpochRef.current += 1 + return statusRequestEpochRef.current + } + + function isStatusRequestCurrent(requestEpoch: number): boolean { + return statusRequestEpochRef.current === requestEpoch + } + + function cancelActiveFlow() { + const active = activeFlowRef.current + activeFlowRef.current = null + if (active) void api.cancelProviderAuthFlow(active.method, active.flowID).catch(() => {}) + return active + } + + useEffect(() => { + mountedRef.current = true + return () => { + mountedRef.current = false + generationRef.current += 1 + cancelActiveFlow() + } + }, []) + + useEffect(() => { + const generation = generationRef.current + 1 + generationRef.current = generation + const statusRequest = nextStatusRequest() + cancelActiveFlow() + setFlow(null) + setStarting(false) + setCompletingFlow(false) + setBusyAction('') + setPostAuthError('') + if (!oauthMethod) { + statusRef.current = undefined + setStatus(undefined) + setActionError('') + setTerminal(null) + return + } + let alive = true + const initial = initialStatusRef.current + const seeded = initial?.method === oauthMethod ? initial : undefined + statusRef.current = seeded + setStatus(seeded) + setStatusLoading(!seeded) + setActionError('') + setTerminal(null) + api.providerAuthStatus(oauthMethod) + .then((next) => { + if (!alive || !isCurrent(oauthMethod, generation) || !isStatusRequestCurrent(statusRequest)) return + statusRef.current = next + setStatus(next) + onStatusChangeRef.current?.(next) + }) + .catch((err) => { + if (!alive || !isCurrent(oauthMethod, generation) || !isStatusRequestCurrent(statusRequest)) return + setActionError(err instanceof Error ? err.message : String(err)) + }) + .finally(() => { + if (alive && isCurrent(oauthMethod, generation) && isStatusRequestCurrent(statusRequest)) { + setStatusLoading(false) + } + }) + return () => { + alive = false + } + }, [oauthMethod]) + + useEffect(() => { + if (confirmRemove) removeConfirmButtonRef.current?.focus() + }, [confirmRemove]) + + useEffect(() => { + if (confirmLogout) logoutConfirmButtonRef.current?.focus() + }, [confirmLogout]) + + useEffect(() => { + if (!flow) return + let stopped = false + let timer: number | null = null + const initialIntervalMS = Math.max(1, flow.interval_seconds ?? flow.interval ?? 5) * 1000 + async function poll() { + if (stopped) return + const expiry = Date.parse(flow!.expires_at) + if (Number.isFinite(expiry) && Date.now() >= expiry) { + if (!isCurrent(flow!.method, flow!.generation)) return + activeFlowRef.current = null + setFlow(null) + setCompletingFlow(false) + setTerminal({ state: 'expired' }) + return + } + try { + const result = await api.pollProviderAuthFlow(flow!.method, flow!.flow_id) + if (stopped || !isCurrent(flow!.method, flow!.generation)) return + if (result.state === 'pending') { + const nextIntervalMS = Math.max( + 1, + result.interval_seconds ?? result.interval ?? flow!.interval_seconds ?? flow!.interval ?? 5, + ) * 1000 + timer = window.setTimeout(() => void poll(), nextIntervalMS) + return + } + if (result.state !== 'authorized') { + activeFlowRef.current = null + setFlow(null) + setCompletingFlow(false) + setTerminal({ state: result.state, message: result.error }) + return + } + + setCompletingFlow(true) + const statusRequest = nextStatusRequest() + let next: ProviderAuthStatus | undefined + let refreshFailure = '' + try { + next = await api.providerAuthStatus(flow!.method) + } catch (err) { + refreshFailure = err instanceof Error ? err.message : String(err) + if (result.account) { + const previous = statusRef.current?.method === flow!.method ? statusRef.current : undefined + const accounts = previous?.accounts.filter((account) => account.id !== result.account!.id) ?? [] + accounts.push(result.account) + next = { + method: flow!.method, + accounts, + default_account_id: previous?.default_account_id || result.account.id, + } + } + } + if (stopped || !isCurrent(flow!.method, flow!.generation) + || !isStatusRequestCurrent(statusRequest)) return + if (!next) { + setPostAuthError(t('settings.providers.auth.postAuthRefreshFailed', { reason: refreshFailure })) + activeFlowRef.current = null + setFlow(null) + setCompletingFlow(false) + return + } + statusRef.current = next + setStatus(next) + setTerminal(null) + onStatusChangeRef.current?.(next) + if (flow!.bindOnAuthorize && result.account) { + onBindingChangeRef.current({ method: flow!.method, account_id: result.account.id }) + } + try { + await onAuthenticatedRef.current?.(next) + } catch (err) { + refreshFailure = err instanceof Error ? err.message : String(err) + } + if (stopped || !isCurrent(flow!.method, flow!.generation)) return + setPostAuthError(refreshFailure + ? t('settings.providers.auth.postAuthRefreshFailed', { reason: refreshFailure }) + : '') + activeFlowRef.current = null + setFlow(null) + setCompletingFlow(false) + } catch (err) { + if (stopped || !isCurrent(flow!.method, flow!.generation)) return + activeFlowRef.current = null + setFlow(null) + setCompletingFlow(false) + setTerminal({ state: 'error', message: err instanceof Error ? err.message : String(err) }) + } + } + + timer = window.setTimeout(() => void poll(), initialIntervalMS) + return () => { + stopped = true + if (timer !== null) window.clearTimeout(timer) + } + }, [flow]) + + function selectMethod(method: ProviderCredentialMethod) { + if (method === value || disabledRef.current) return + generationRef.current += 1 + nextStatusRequest() + cancelActiveFlow() + setFlow(null) + setStarting(false) + setCompletingFlow(false) + setBusyAction('') + setPostAuthError('') + onMethodChange(method) + onBindingChange(method === 'api_key' ? null : { method }) + } + + async function openVerification(uri: string, method: AuthMethod, generation: number) { + if (!isCurrent(method, generation)) return + try { + await openUrl(uri) + if (!isCurrent(method, generation)) return + setBrowserOpenFailed(false) + } catch { + if (!isCurrent(method, generation)) return + setBrowserOpenFailed(true) + } + } + + async function startLogin() { + const method = methodRef.current + if (!method || disabledRef.current) return + const generation = generationRef.current + if (startInFlightRef.current?.generation === generation) return + nextStatusRequest() + const requestID = requestSequenceRef.current + 1 + requestSequenceRef.current = requestID + startInFlightRef.current = { requestID, generation } + setStarting(true) + setActionError('') + setPostAuthError('') + setTerminal(null) + setBrowserOpenFailed(false) + try { + const started = await api.startProviderAuth(method) + if (!isCurrent(method, generation) + || startInFlightRef.current?.requestID !== requestID) { + void api.cancelProviderAuthFlow(method, started.flow_id).catch(() => {}) + return + } + const active: ActiveFlow = { + ...started, + method, + bindOnAuthorize: !isProviderAuthReady(statusRef.current, bindingRef.current), + generation, + } + activeFlowRef.current = { method, flowID: started.flow_id, generation } + setFlow(active) + void openVerification(started.verification_uri_complete || started.verification_uri, method, generation) + } catch (err) { + if (!isCurrent(method, generation) + || startInFlightRef.current?.requestID !== requestID) return + setActionError(err instanceof Error ? err.message : String(err)) + } finally { + if (startInFlightRef.current?.requestID === requestID) { + startInFlightRef.current = null + if (isCurrent(method, generation)) setStarting(false) + } + } + } + + async function cancelLogin() { + const active = activeFlowRef.current + activeFlowRef.current = null + setFlow(null) + setCompletingFlow(false) + if (!active) return + try { + await api.cancelProviderAuthFlow(active.method, active.flowID) + } catch { + // Cancellation is best-effort; the local flow is already closed. + } + } + + async function runStatusAction( + action: string, + method: AuthMethod, + request: () => Promise, + onCommit?: () => void, + ) { + if (disabledRef.current) return + const generation = generationRef.current + nextStatusRequest() + const requestID = requestSequenceRef.current + 1 + requestSequenceRef.current = requestID + actionInFlightRef.current = { requestID, generation } + setBusyAction(action) + setActionError('') + setPostAuthError('') + try { + const next = await request() + if (!isCurrent(method, generation) + || actionInFlightRef.current?.requestID !== requestID + || next.method !== method) return + statusRef.current = next + setStatus(next) + onStatusChangeRef.current?.(next) + onCommit?.() + try { + await onAuthenticatedRef.current?.(next) + } catch (err) { + if (isCurrent(method, generation)) { + const reason = err instanceof Error ? err.message : String(err) + setPostAuthError(t('settings.providers.auth.postAuthRefreshFailed', { reason })) + } + } + } catch (err) { + if (!isCurrent(method, generation) + || actionInFlightRef.current?.requestID !== requestID) return + setActionError(err instanceof Error ? err.message : String(err)) + } finally { + if (actionInFlightRef.current?.requestID === requestID) { + actionInFlightRef.current = null + if (isCurrent(method, generation)) setBusyAction('') + } + } + } + + async function makeDefault(accountID: string) { + if (!oauthMethod) return + await runStatusAction( + `default:${accountID}`, + oauthMethod, + () => api.setProviderAuthDefault(oauthMethod, accountID), + ) + } + + async function removeAccount(accountID: string) { + if (!oauthMethod) return + await runStatusAction( + `remove:${accountID}`, + oauthMethod, + () => api.removeProviderAuthAccount(oauthMethod, accountID), + () => setConfirmRemove(''), + ) + } + + async function logoutAll() { + if (!oauthMethod) return + await runStatusAction( + 'logout', + oauthMethod, + () => api.logoutProviderAuth(oauthMethod), + () => { + setConfirmLogout(false) + setManageOpen(false) + }, + ) + } + + const boundAccount = resolveProviderAuthAccount(status, binding) + const bindingMissing = !!status && !!binding?.account_id && !boundAccount + const effectiveDefault = status?.accounts.find((account) => account.id === status.default_account_id) + ?? (status?.accounts.length === 1 ? status.accounts[0] : undefined) + const isConnected = !!boundAccount && !boundAccount.requires_reauth + const methodLabel = oauthMethod ? t(METHOD_LABEL_KEY[oauthMethod]) : '' + const interactionDisabled = disabled || starting || !!busyAction || completingFlow + + return ( +
+ {t('settings.providers.auth.title')} + {normalizedMethods.length > 1 ? ( +
+ ({ value: method, label: t(METHOD_LABEL_KEY[method]) }))} + onChange={selectMethod} + /> +
+ ) : ( +
+ {t(METHOD_LABEL_KEY[normalizedMethods[0]])} +
+ )} + + {value === 'api_key' ? ( +
+ + {apiKeyField} +
+ ) : ( +
+
+
+ +
+
+
+ {methodLabel} + {isConnected && ( + + {t('settings.providers.auth.connected')} + + )} + {(boundAccount?.requires_reauth || bindingMissing) && ( + + {t('settings.providers.auth.needsReauth')} + + )} +
+
+ {t(`settings.providers.auth.descriptions.${value}`)} +
+
+
+ + {statusLoading ? ( +
+ + {t('settings.providers.auth.loadingAccounts')} +
+ ) : flow ? ( +
+ void openVerification( + flow.verification_uri_complete || flow.verification_uri, + flow.method, + flow.generation, + )} + onCancel={() => void cancelLogin()} + /> +
+ ) : terminal ? null : status?.accounts.length ? ( +
+ +
+ + +
+ + {boundAccount?.requires_reauth && ( +
+ {t('settings.providers.auth.reauthHint', { account: boundAccount.login })} + +
+ )} + + {!boundAccount && status.accounts.length > 0 && ( +
+ + {bindingMissing + ? t('settings.providers.auth.missingAccountHint') + : t('settings.providers.auth.chooseAccountHint')} + + {bindingMissing && ( + + )} +
+ )} + + + + {manageOpen && ( +
+ {status.accounts.map((account) => { + const isDefault = account.id === status.default_account_id + const isBound = binding?.method === value + && (binding.account_id === account.id || (!binding.account_id && effectiveDefault?.id === account.id)) + return ( +
+
+ +
+
{account.login}
+
+ {[account.email, account.domain].filter(Boolean).join(' · ') || t('settings.providers.auth.managedAccount')} +
+
+ {isDefault && {t('settings.providers.auth.defaultBadge')}} + {isBound && {t('settings.providers.auth.boundBadge')}} + {account.requires_reauth && ( + + {t('settings.providers.auth.needsReauth')} + + )} +
+
+ {!isDefault && !account.requires_reauth && ( + + )} + {confirmRemove === account.id ? ( +
+ + {t('settings.providers.auth.removeAccountConfirm')} + + + +
+ ) : ( + + )} +
+
+ ) + })} + +
+ {confirmLogout ? ( +
+ {t('settings.providers.auth.logoutAllConfirm')} + + +
+ ) : ( + + )} +
+
+ )} +
+ ) : ( +
+
+
{t('settings.providers.auth.notSignedIn')}
+
{t('settings.providers.auth.signInHint')}
+
+ +
+ )} + + {terminal && !flow && ( +
+ +
+ {terminal.message || t(`settings.providers.auth.flow.${terminal.state}`)} +
+ +
+ )} + + {actionError && ( +
+ + {actionError} +
+ )} + + {postAuthError && ( +
+ + {postAuthError} +
+ )} +
+ )} +
+ ) +} diff --git a/web/src/i18n/locales/en.ts b/web/src/i18n/locales/en.ts index b1f1f094..6209d753 100644 --- a/web/src/i18n/locales/en.ts +++ b/web/src/i18n/locales/en.ts @@ -533,6 +533,66 @@ export default { edit: 'Edit provider', editProvider: 'Edit Provider', apiKeyUnchanged: 'API Key (leave blank to keep)', + auth: { + title: 'Authentication', + methods: { + apiKey: 'API Key', + chatgpt: 'ChatGPT', + grok: 'Grok', + copilot: 'GitHub Copilot', + }, + descriptions: { + codex_oauth: 'Use your ChatGPT account for Codex models. JCode stores the account session locally.', + xai_oauth: 'Use your Grok account. JCode stores the account session locally.', + github_copilot: 'Use a GitHub account with Copilot access. JCode stores the account session locally.', + }, + signIn: { + chatgpt: 'Sign in with ChatGPT', + grok: 'Sign in with Grok', + github: 'Sign in with GitHub', + }, + configured: 'Configured', + connected: 'Connected', + signInRequired: 'Sign-in required', + signInAction: 'Sign in', + needsReauth: 'Needs re-authentication', + reauthenticate: 'Re-authenticate', + reauthHint: '{account} must sign in again before this provider can use it.', + notSignedIn: 'No account connected', + signInHint: 'JCode opens the provider authorization page in your browser.', + loadingAccounts: 'Loading accounts…', + account: 'Account used by this provider', + useDefaultAccount: 'Use default account ({account})', + noDefaultAccount: 'No default account', + chooseAccountHint: 'Choose an account before saving this provider.', + missingAccountOption: 'Saved account unavailable', + missingAccountHint: 'The account saved on this provider is no longer available. Choose another account or sign in again.', + addAccount: 'Add account', + manageAccounts: 'Manage accounts ({count})', + managedAccount: 'Managed account', + defaultBadge: 'Default', + boundBadge: 'In use', + setDefault: 'Set as default', + removeAccount: 'Remove account', + removeAccountConfirm: 'Remove this saved account?', + logoutAll: 'Sign out all', + logoutAllConfirm: 'Sign out every saved account for this login method?', + enterCodeTitle: 'Enter this code in your browser', + enterCodeHint: 'The authorization page has been opened. If it did not open, use the link below.', + copyCode: 'Copy code', + copied: 'Copied', + browserOpenFailed: 'JCode could not open the browser. Open the link manually.', + waiting: 'Waiting for authorization…', + finishing: 'Finishing sign-in…', + postAuthRefreshFailed: 'The account is connected, but related provider data could not be refreshed: {reason}', + expiresAt: 'expires at {time}', + retry: 'Retry', + flow: { + denied: 'Authorization was denied.', + expired: 'The code expired. Start again.', + error: 'Authentication failed. Try again.', + }, + }, advanced: 'Advanced', endpoint: 'Custom Endpoint', endpointPlaceholder: 'https://api.example.com/v1', diff --git a/web/src/i18n/locales/ja.ts b/web/src/i18n/locales/ja.ts index 26867f9b..b3ef4cdc 100644 --- a/web/src/i18n/locales/ja.ts +++ b/web/src/i18n/locales/ja.ts @@ -455,6 +455,66 @@ export default { edit: 'プロバイダーを編集', editProvider: 'プロバイダーを編集', apiKeyUnchanged: 'APIキー（変更しない場合は空欄）', + auth: { + title: '認証方法', + methods: { + apiKey: 'API Key', + chatgpt: 'ChatGPT', + grok: 'Grok', + copilot: 'GitHub Copilot', + }, + descriptions: { + codex_oauth: 'ChatGPT アカウントで Codex モデルを使用します。アカウントセッションはこの端末にのみ保存されます。', + xai_oauth: 'Grok アカウントでログインします。アカウントセッションはこの端末にのみ保存されます。', + github_copilot: 'Copilot を利用できる GitHub アカウントを使用します。アカウントセッションはこの端末にのみ保存されます。', + }, + signIn: { + chatgpt: 'ChatGPT でサインイン', + grok: 'Grok でサインイン', + github: 'GitHub でサインイン', + }, + configured: '設定済み', + connected: '接続済み', + signInRequired: 'サインインが必要です', + signInAction: 'サインイン', + needsReauth: '再認証が必要です', + reauthenticate: '再認証', + reauthHint: '{account} は、このプロバイダーで使用する前に再度サインインする必要があります。', + notSignedIn: '接続済みのアカウントはありません', + signInHint: 'JCode がプロバイダーの認証ページをブラウザーで開きます。', + loadingAccounts: 'アカウントを読み込み中…', + account: 'このプロバイダーで使用するアカウント', + useDefaultAccount: 'デフォルトのアカウントを使用（{account}）', + noDefaultAccount: 'デフォルトのアカウントがありません', + chooseAccountHint: 'このプロバイダーを保存する前にアカウントを選択してください。', + missingAccountOption: '保存済みアカウントは利用できません', + missingAccountHint: 'このプロバイダーに保存されたアカウントは利用できません。別のアカウントを選択するか、再度サインインしてください。', + addAccount: 'アカウントを追加', + manageAccounts: 'アカウントを管理（{count}）', + managedAccount: '管理対象アカウント', + defaultBadge: 'デフォルト', + boundBadge: '使用中', + setDefault: 'デフォルトに設定', + removeAccount: 'アカウントを削除', + removeAccountConfirm: '保存済みのこのアカウントを削除しますか？', + logoutAll: 'すべてサインアウト', + logoutAllConfirm: 'このログイン方法で保存したすべてのアカウントからサインアウトしますか？', + enterCodeTitle: 'ブラウザーでこのコードを入力', + enterCodeHint: '認証ページを開きました。開かなかった場合は、下のリンクを使用してください。', + copyCode: 'コードをコピー', + copied: 'コピー済み', + browserOpenFailed: 'ブラウザーを開けませんでした。リンクを手動で開いてください。', + waiting: '認証を待っています…', + finishing: 'サインインを完了しています…', + postAuthRefreshFailed: 'アカウントは接続されましたが、関連するプロバイダーデータを更新できませんでした: {reason}', + expiresAt: '{time} に期限切れ', + retry: '再試行', + flow: { + denied: '認証が拒否されました。', + expired: 'コードの期限が切れました。もう一度開始してください。', + error: '認証に失敗しました。もう一度お試しください。', + }, + }, advanced: '詳細設定', endpoint: 'カスタムエンドポイント', endpointPlaceholder: 'https://api.example.com/v1', diff --git a/web/src/i18n/locales/ko.ts b/web/src/i18n/locales/ko.ts index f46673bd..bbb49972 100644 --- a/web/src/i18n/locales/ko.ts +++ b/web/src/i18n/locales/ko.ts @@ -455,6 +455,66 @@ export default { edit: '프로바이더 편집', editProvider: '프로바이더 편집', apiKeyUnchanged: 'API 키 (비워두면 유지)', + auth: { + title: '인증 방법', + methods: { + apiKey: 'API Key', + chatgpt: 'ChatGPT', + grok: 'Grok', + copilot: 'GitHub Copilot', + }, + descriptions: { + codex_oauth: 'ChatGPT 계정으로 Codex 모델을 사용합니다. 계정 세션은 이 기기에만 저장됩니다.', + xai_oauth: 'Grok 계정으로 로그인합니다. 계정 세션은 이 기기에만 저장됩니다.', + github_copilot: 'Copilot 권한이 있는 GitHub 계정을 사용합니다. 계정 세션은 이 기기에만 저장됩니다.', + }, + signIn: { + chatgpt: 'ChatGPT로 로그인', + grok: 'Grok으로 로그인', + github: 'GitHub로 로그인', + }, + configured: '구성됨', + connected: '연결됨', + signInRequired: '로그인 필요', + signInAction: '로그인', + needsReauth: '재인증 필요', + reauthenticate: '재인증', + reauthHint: '{account} 계정을 이 프로바이더에서 사용하려면 다시 로그인해야 합니다.', + notSignedIn: '연결된 계정 없음', + signInHint: 'JCode가 브라우저에서 프로바이더 인증 페이지를 엽니다.', + loadingAccounts: '계정 불러오는 중…', + account: '이 프로바이더에서 사용할 계정', + useDefaultAccount: '기본 계정 사용 ({account})', + noDefaultAccount: '기본 계정 없음', + chooseAccountHint: '이 프로바이더를 저장하기 전에 계정을 선택하세요.', + missingAccountOption: '저장된 계정을 사용할 수 없음', + missingAccountHint: '이 프로바이더에 저장된 계정을 더 이상 사용할 수 없습니다. 다른 계정을 선택하거나 다시 로그인하세요.', + addAccount: '계정 추가', + manageAccounts: '계정 관리 ({count})', + managedAccount: '관리 계정', + defaultBadge: '기본값', + boundBadge: '사용 중', + setDefault: '기본값으로 설정', + removeAccount: '계정 제거', + removeAccountConfirm: '저장된 이 계정을 제거할까요?', + logoutAll: '모두 로그아웃', + logoutAllConfirm: '이 로그인 방식에 저장된 모든 계정에서 로그아웃할까요?', + enterCodeTitle: '브라우저에 이 코드 입력', + enterCodeHint: '인증 페이지를 열었습니다. 열리지 않았다면 아래 링크를 사용하세요.', + copyCode: '코드 복사', + copied: '복사됨', + browserOpenFailed: '브라우저를 열 수 없습니다. 링크를 직접 여세요.', + waiting: '인증 대기 중…', + finishing: '로그인을 완료하는 중…', + postAuthRefreshFailed: '계정은 연결되었지만 관련 공급자 데이터를 새로 고칠 수 없습니다: {reason}', + expiresAt: '{time} 만료', + retry: '다시 시도', + flow: { + denied: '인증이 거부되었습니다.', + expired: '코드가 만료되었습니다. 다시 시작하세요.', + error: '인증에 실패했습니다. 다시 시도하세요.', + }, + }, advanced: '고급', endpoint: '사용자 지정 엔드포인트', endpointPlaceholder: 'https://api.example.com/v1', diff --git a/web/src/i18n/locales/zh-Hans.ts b/web/src/i18n/locales/zh-Hans.ts index 727686f4..54616fe1 100644 --- a/web/src/i18n/locales/zh-Hans.ts +++ b/web/src/i18n/locales/zh-Hans.ts @@ -516,6 +516,66 @@ export default { edit: '编辑服务商', editProvider: '编辑服务商', apiKeyUnchanged: 'API 密钥（留空则保持不变）', + auth: { + title: '认证方式', + methods: { + apiKey: 'API Key', + chatgpt: 'ChatGPT', + grok: 'Grok', + copilot: 'GitHub Copilot', + }, + descriptions: { + codex_oauth: '使用 ChatGPT 账户访问 Codex 模型，账户会话仅保存在本机。', + xai_oauth: '使用 Grok 账户登录，账户会话仅保存在本机。', + github_copilot: '使用具有 Copilot 权限的 GitHub 账户，账户会话仅保存在本机。', + }, + signIn: { + chatgpt: '使用 ChatGPT 登录', + grok: '使用 Grok 登录', + github: '使用 GitHub 登录', + }, + configured: '已配置', + connected: '已连接', + signInRequired: '需要登录', + signInAction: '登录', + needsReauth: '需要重新认证', + reauthenticate: '重新认证', + reauthHint: '{account} 需要重新登录后，此服务商才能继续使用。', + notSignedIn: '尚未连接账户', + signInHint: 'JCode 会在浏览器中打开服务商的授权页面。', + loadingAccounts: '正在加载账户…', + account: '此服务商使用的账户', + useDefaultAccount: '使用默认账户（{account}）', + noDefaultAccount: '没有默认账户', + chooseAccountHint: '请先选择一个账户，再保存此服务商。', + missingAccountOption: '已保存的账户不可用', + missingAccountHint: '此服务商保存的账户已不可用，请选择其他账户或重新登录。', + addAccount: '添加账户', + manageAccounts: '管理账户（{count}）', + managedAccount: '托管账户', + defaultBadge: '默认', + boundBadge: '使用中', + setDefault: '设为默认', + removeAccount: '移除账户', + removeAccountConfirm: '移除此已保存账户？', + logoutAll: '全部退出', + logoutAllConfirm: '退出此登录方式下保存的全部账户？', + enterCodeTitle: '在浏览器中输入此验证码', + enterCodeHint: '授权页面已尝试打开；如果没有打开，请使用下方链接。', + copyCode: '复制验证码', + copied: '已复制', + browserOpenFailed: 'JCode 无法打开浏览器，请手动打开链接。', + waiting: '等待授权…', + finishing: '正在完成登录…', + postAuthRefreshFailed: '账户已连接，但相关服务商数据刷新失败：{reason}', + expiresAt: '{time} 过期', + retry: '重试', + flow: { + denied: '你拒绝了此次授权。', + expired: '验证码已过期，请重新开始。', + error: '认证失败，请重试。', + }, + }, advanced: '高级', endpoint: '自定义 Endpoint', endpointPlaceholder: 'https://api.example.com/v1', diff --git a/web/src/i18n/locales/zh-Hant.ts b/web/src/i18n/locales/zh-Hant.ts index f6b7c9d2..620106ac 100644 --- a/web/src/i18n/locales/zh-Hant.ts +++ b/web/src/i18n/locales/zh-Hant.ts @@ -456,6 +456,66 @@ export default { edit: '編輯服務商', editProvider: '編輯服務商', apiKeyUnchanged: 'API 金鑰（留空則保持不變）', + auth: { + title: '驗證方式', + methods: { + apiKey: 'API Key', + chatgpt: 'ChatGPT', + grok: 'Grok', + copilot: 'GitHub Copilot', + }, + descriptions: { + codex_oauth: '使用 ChatGPT 帳戶存取 Codex 模型，帳戶工作階段只保存在本機。', + xai_oauth: '使用 Grok 帳戶登入，帳戶工作階段只保存在本機。', + github_copilot: '使用具備 Copilot 權限的 GitHub 帳戶，帳戶工作階段只保存在本機。', + }, + signIn: { + chatgpt: '使用 ChatGPT 登入', + grok: '使用 Grok 登入', + github: '使用 GitHub 登入', + }, + configured: '已設定', + connected: '已連線', + signInRequired: '需要登入', + signInAction: '登入', + needsReauth: '需要重新驗證', + reauthenticate: '重新驗證', + reauthHint: '{account} 需要重新登入，此服務商才能繼續使用。', + notSignedIn: '尚未連接帳戶', + signInHint: 'JCode 會在瀏覽器中開啟服務商的授權頁面。', + loadingAccounts: '正在載入帳戶…', + account: '此服務商使用的帳戶', + useDefaultAccount: '使用預設帳戶（{account}）', + noDefaultAccount: '沒有預設帳戶', + chooseAccountHint: '請先選擇一個帳戶，再儲存此服務商。', + missingAccountOption: '已儲存的帳戶無法使用', + missingAccountHint: '此服務商儲存的帳戶已無法使用，請選擇其他帳戶或重新登入。', + addAccount: '新增帳戶', + manageAccounts: '管理帳戶（{count}）', + managedAccount: '受管理帳戶', + defaultBadge: '預設', + boundBadge: '使用中', + setDefault: '設為預設', + removeAccount: '移除帳戶', + removeAccountConfirm: '移除此已儲存帳戶？', + logoutAll: '全部登出', + logoutAllConfirm: '登出此登入方式下儲存的所有帳戶？', + enterCodeTitle: '在瀏覽器中輸入此驗證碼', + enterCodeHint: '已嘗試開啟授權頁面；若未開啟，請使用下方連結。', + copyCode: '複製驗證碼', + copied: '已複製', + browserOpenFailed: 'JCode 無法開啟瀏覽器，請手動開啟連結。', + waiting: '等待授權…', + finishing: '正在完成登入…', + postAuthRefreshFailed: '帳戶已連接，但相關服務商資料重新整理失敗：{reason}', + expiresAt: '{time} 到期', + retry: '重試', + flow: { + denied: '你拒絕了此次授權。', + expired: '驗證碼已過期，請重新開始。', + error: '驗證失敗，請重試。', + }, + }, advanced: '進階', endpoint: '自訂 Endpoint', endpointPlaceholder: 'https://api.example.com/v1', diff --git a/web/src/i18n/providerAuth.test.ts b/web/src/i18n/providerAuth.test.ts new file mode 100644 index 00000000..5d87b4af --- /dev/null +++ b/web/src/i18n/providerAuth.test.ts @@ -0,0 +1,22 @@ +import { describe, expect, it } from 'vitest' +import en from './locales/en' +import ja from './locales/ja' +import ko from './locales/ko' +import zhHans from './locales/zh-Hans' +import zhHant from './locales/zh-Hant' + +function leafKeys(value: unknown, prefix = ''): string[] { + if (!value || typeof value !== 'object') return [prefix] + return Object.entries(value as Record) + .flatMap(([key, child]) => leafKeys(child, prefix ? `${prefix}.${key}` : key)) + .sort() +} + +describe('provider managed-auth translations', () => { + it('keeps all five locale resources structurally complete', () => { + const expected = leafKeys(en.settings.providers.auth) + for (const resource of [zhHans, zhHant, ja, ko]) { + expect(leafKeys(resource.settings.providers.auth)).toEqual(expected) + } + }) +}) diff --git a/web/src/lib/api.ts b/web/src/lib/api.ts index 95480a24..fa19e06d 100644 --- a/web/src/lib/api.ts +++ b/web/src/lib/api.ts @@ -1,5 +1,6 @@ // API client for jcode backend — ported from web/src/composables/api.ts. import type { ModelsResponse, AgentMode, CustomAgentInfo, ExecResponse, DiffResponse, WorkspaceInfo, GitBranchesResponse, GitCheckoutResponse, TaskItem, TaskMetaPatch, ProjectInfo, MCPListResponse, MCPServerRequest, MCPLoginStatus, BrowseResponse, SSHListResponse, SkillInfo, SlashCommandInfo, TodoItem, Goal, SessionItem, SessionEntry, FileItem, SetupProvider, SetupModel, ProviderDetail, ProviderAdvanced, ProviderToolPolicy, ImageEndpointConfig, CustomModelDetail, ValidateResult, CatalogModel, ModelStateResponse, ChatImage, AskUserAnswer, AskUserRequestData, ApprovalRequestData, RemoteConnectRequest, RemoteConnectResponse, RemoteListDirResponse, RemoteBindResponse, DockerContainersResponse, UsageStats, TaskStats, TokenUpdateData, ApprovalReviewConfig, ApprovalReviewConfigResponse, ArtifactRecord, ArtifactShareResult, ArtifactShareSummary } from './types' +import type { AuthMethod, ProviderAuthBinding, ProviderAuthFlow, ProviderAuthPollResult, ProviderAuthStatus } from './types' import type { AutomationItem, AutomationRun, AutomationTemplate, AutomationCreate, Automation } from './automation' import { apiBase } from './apiBase' import { getAuthToken, notifyAuthExpired } from './authToken' @@ -375,7 +376,7 @@ export const api = { request('/api/setup/providers'), setupProviderModels: (providerId: string) => request(`/api/setup/providers/${encodeURIComponent(providerId)}/models`), - setupComplete: (data: { provider: string; api_key: string; model?: string; model_reasoning?: boolean; base_url?: string; name?: string; headers?: Record }) => + setupComplete: (data: { provider: string; api_key?: string; auth_binding?: ProviderAuthBinding; model?: string; model_reasoning?: boolean; base_url?: string; name?: string; headers?: Record }) => request<{ status: string; provider: string; model: string }>('/api/setup/complete', { method: 'POST', body: JSON.stringify(data), @@ -391,15 +392,44 @@ export const api = { // Provider management listProviders: () => request('/api/providers'), + providerAuthStatus: (method: AuthMethod) => + request(`/api/provider-auth/${encodeURIComponent(method)}`), + startProviderAuth: (method: AuthMethod) => + request(`/api/provider-auth/${encodeURIComponent(method)}/start`, { + method: 'POST', + body: JSON.stringify({}), + }), + pollProviderAuthFlow: (method: AuthMethod, flowId: string) => + request(`/api/provider-auth/${encodeURIComponent(method)}/flows/${encodeURIComponent(flowId)}/poll`, { + method: 'POST', + }), + cancelProviderAuthFlow: (method: AuthMethod, flowId: string) => + request<{ status: string }>(`/api/provider-auth/${encodeURIComponent(method)}/flows/${encodeURIComponent(flowId)}`, { + method: 'DELETE', + }), + setProviderAuthDefault: (method: AuthMethod, accountId: string) => + request(`/api/provider-auth/${encodeURIComponent(method)}/default`, { + method: 'POST', + body: JSON.stringify({ account_id: accountId }), + }), + removeProviderAuthAccount: (method: AuthMethod, accountId: string) => + request(`/api/provider-auth/${encodeURIComponent(method)}/accounts/${encodeURIComponent(accountId)}`, { + method: 'DELETE', + }), + logoutProviderAuth: (method: AuthMethod) => + request(`/api/provider-auth/${encodeURIComponent(method)}`, { + method: 'DELETE', + }), // vision is deliberately absent: image support is model metadata, and the // backend treats an omitted field as "clear the stored override". - addProvider: (data: { id: string; api_key: string; name?: string; model?: string; model_reasoning?: boolean; thinking?: boolean; reasoning_effort?: string; provider_tools?: Record; image_endpoint?: ImageEndpointConfig } & ProviderAdvanced) => + addProvider: (data: { id: string; api_key?: string; auth_binding?: ProviderAuthBinding; name?: string; model?: string; model_reasoning?: boolean; thinking?: boolean; reasoning_effort?: string; provider_tools?: Record; image_endpoint?: ImageEndpointConfig } & ProviderAdvanced) => request<{ status: string }>('/api/providers', { method: 'POST', body: JSON.stringify(data), }), updateProvider: (id: string, data: { api_key?: string + auth_binding?: ProviderAuthBinding | null name?: string custom_models?: CustomModelDetail[] vision?: boolean diff --git a/web/src/lib/providerIcons.ts b/web/src/lib/providerIcons.ts index 15e2c6b4..296e0edc 100644 --- a/web/src/lib/providerIcons.ts +++ b/web/src/lib/providerIcons.ts @@ -15,10 +15,14 @@ import siliconcloud from '@lobehub/icons-static-svg/icons/siliconcloud-color.svg import hunyuan from '@lobehub/icons-static-svg/icons/hunyuan-color.svg?raw' import xiaomi from '@lobehub/icons-static-svg/icons/xiaomimimo.svg?raw' import ollama from '@lobehub/icons-static-svg/icons/ollama.svg?raw' +import xai from '@lobehub/icons-static-svg/icons/xai.svg?raw' +import githubCopilot from '@lobehub/icons-static-svg/icons/githubcopilot.svg?raw' const RULES: ReadonlyArray = [ [/openrouter/, openrouter], [/openai/, openai], + [/xai|grok/, xai], + [/github.*copilot|copilot/, githubCopilot], [/anthropic|claude/, anthropic], [/gemini|google|vertex/, gemini], [/deepseek/, deepseek], diff --git a/web/src/lib/types.ts b/web/src/lib/types.ts index ca2ab56e..956e9271 100644 --- a/web/src/lib/types.ts +++ b/web/src/lib/types.ts @@ -761,6 +761,55 @@ export interface SetupProvider { env?: string[] configured: boolean tag?: string // "recommended", "local", etc. + // Omitted by older servers. Clients must fall back to API-key auth so an + // upgraded UI can still configure providers against an older sidecar. + auth_methods?: ProviderCredentialMethod[] +} + +export type AuthMethod = 'codex_oauth' | 'xai_oauth' | 'github_copilot' +export type ProviderCredentialMethod = 'api_key' | AuthMethod + +export interface ProviderAuthBinding { + method: AuthMethod + // Omission follows the managed-auth default account for this method. + account_id?: string +} + +export interface ProviderAuthAccount { + id: string + login: string + email?: string + domain?: string + authenticated_at: string + requires_reauth: boolean +} + +export interface ProviderAuthStatus { + method: AuthMethod + accounts: ProviderAuthAccount[] + default_account_id?: string +} + +export interface ProviderAuthFlow { + flow_id: string + user_code: string + verification_uri: string + verification_uri_complete?: string + expires_at: string + interval_seconds?: number + // Compatibility with the first POC contract; new servers use + // interval_seconds. + interval?: number +} + +export interface ProviderAuthPollResult { + state: 'pending' | 'authorized' | 'denied' | 'expired' | 'error' + // Device providers may raise the interval after a slow_down response. Always + // schedule the next poll from the latest response instead of the start flow. + interval_seconds?: number + interval?: number + account?: ProviderAuthAccount + error?: string } // ReasoningOption mirrors models.dev's reasoning_options: how a model exposes @@ -799,6 +848,9 @@ export interface ProviderDetail { name?: string // display name for custom (non-registry) providers custom?: boolean // true if this provider is not in the registry api_key_set: boolean + auth_binding?: ProviderAuthBinding + auth_status?: ProviderAuthStatus + auth_methods?: ProviderCredentialMethod[] api_key?: string base_url?: string headers?: Record // values masked From 5f4f5fc1396415685f8c4d9fa17ab18d0f1c5e9a Mon Sep 17 00:00:00 2001 From: jack Date: Sun, 9 Aug 2026 20:43:35 +0800 Subject: [PATCH 2/5] fix: accept xAI account verification URL --- internal/providerauth/manager_test.go | 19 +++++++++++++++---- internal/providerauth/xai.go | 16 +++++++++------- 2 files changed, 24 insertions(+), 11 deletions(-) diff --git a/internal/providerauth/manager_test.go b/internal/providerauth/manager_test.go index a99cfce0..0a77ad98 100644 --- a/internal/providerauth/manager_test.go +++ b/internal/providerauth/manager_test.go @@ -255,8 +255,8 @@ func TestXAIRefreshSingleflightRotationAndRequiresReauth(t *testing.T) { writeJSON(t, writer, http.StatusOK, map[string]any{ "device_code": "xai-device-secret", "user_code": "GROK-CODE", - "verification_uri": "https://auth.x.ai/device", - "verification_uri_complete": "https://auth.x.ai/device?code=GROK-CODE", + "verification_uri": "https://accounts.x.ai/oauth2/device", + "verification_uri_complete": "https://accounts.x.ai/oauth2/device?code=GROK-CODE", "expires_in": 900, "interval": 1, }) @@ -633,7 +633,7 @@ func TestXAISlowDownAndDeniedDestroyFlow(t *testing.T) { case "/xai/device": writeJSON(t, writer, http.StatusOK, map[string]any{ "device_code": "device", "user_code": "CODE", - "verification_uri": "https://auth.x.ai/device", "interval": 1, + "verification_uri": "https://accounts.x.ai/oauth2/device", "interval": 1, }) case "/xai/token": if polls.Add(1) == 1 { @@ -990,7 +990,7 @@ func TestVerificationURIPinningAndLocalTestOverride(t *testing.T) { host string }{ {uri: "https://auth.openai.com/codex/device", host: "auth.openai.com"}, - {uri: "https://auth.x.ai/device?code=one", host: "auth.x.ai"}, + {uri: "https://accounts.x.ai/oauth2/device?code=one", host: xaiVerificationHost}, {uri: "https://github.com/login/device", host: "github.com"}, } { if err := production.validateVerificationURI(test.uri, test.host); err != nil { @@ -1009,6 +1009,17 @@ func TestVerificationURIPinningAndLocalTestOverride(t *testing.T) { t.Fatalf("untrusted verification URI %q succeeded", uri) } } + for _, uri := range []string{ + "http://accounts.x.ai/oauth2/device", + "https://accounts.x.ai.evil.example/oauth2/device", + "https://sub.accounts.x.ai/oauth2/device", + "https://accounts.x.ai:8443/oauth2/device", + "https://user@accounts.x.ai/oauth2/device", + } { + if err := production.validateVerificationURI(uri, xaiVerificationHost); err == nil { + t.Fatalf("untrusted xAI verification URI %q succeeded", uri) + } + } if err := production.validateVerificationURIs( "https://github.com/login/device", "https://evil.example/login/device?user_code=one", diff --git a/internal/providerauth/xai.go b/internal/providerauth/xai.go index 04f20596..42e34888 100644 --- a/internal/providerauth/xai.go +++ b/internal/providerauth/xai.go @@ -11,10 +11,12 @@ import ( ) const ( - xaiIssuer = "https://auth.x.ai" - xaiClientID = "b1a00492-073a-47ea-816f-4c329264a828" - xaiScope = "openid profile email offline_access grok-cli:access api:access" - xaiUserAgent = "jcode-xai-oauth" + xaiIssuer = "https://auth.x.ai" + xaiAuthHost = "auth.x.ai" + xaiVerificationHost = "accounts.x.ai" + xaiClientID = "b1a00492-073a-47ea-816f-4c329264a828" + xaiScope = "openid profile email offline_access grok-cli:access api:access" + xaiUserAgent = "jcode-xai-oauth" ) type xaiOAuthEndpoints struct { @@ -47,7 +49,7 @@ func (manager *Manager) startXAI(ctx context.Context) (*pendingFlow, error) { return nil, errors.New("xAI device authorization response is missing required fields") } if err := manager.validateVerificationURIs( - verificationURI, verificationComplete, "auth.x.ai", + verificationURI, verificationComplete, xaiVerificationHost, ); err != nil { return nil, err } @@ -98,10 +100,10 @@ func (manager *Manager) discoverXAI(ctx context.Context) (xaiOAuthEndpoints, err return xaiOAuthEndpoints{}, errors.New("xAI discovery response is missing required endpoints") } if !manager.allowUnsafe { - if err := validateManagedAuthEndpoint(endpoints.device, "auth.x.ai"); err != nil { + if err := validateManagedAuthEndpoint(endpoints.device, xaiAuthHost); err != nil { return xaiOAuthEndpoints{}, err } - if err := validateManagedAuthEndpoint(endpoints.token, "auth.x.ai"); err != nil { + if err := validateManagedAuthEndpoint(endpoints.token, xaiAuthHost); err != nil { return xaiOAuthEndpoints{}, err } } From 0eeda9e66e1344dc79b0bfb51e62a02efad2a144 Mon Sep 17 00:00:00 2001 From: jack Date: Sun, 9 Aug 2026 21:34:43 +0800 Subject: [PATCH 3/5] fix: sync managed provider model catalogs --- CHANGELOG.md | 3 + internal-doc/provider-unified-auth-poc.md | 27 +- internal/command/image_generation.go | 33 ++- internal/command/image_generation_test.go | 44 ++++ internal/command/provider_runtime_verifier.go | 12 + internal/config/config.go | 8 + internal/imagegen/client.go | 31 ++- internal/imagegen/client_test.go | 58 ++++ internal/model/chatmodel.go | 21 +- internal/model/chatmodel_managed_auth_test.go | 25 ++ internal/model/registry.go | 2 +- internal/model/responses.go | 9 + internal/providerauth/models.go | 249 ++++++++++++++++++ internal/providerauth/models_test.go | 197 ++++++++++++++ internal/providerauth/types.go | 23 ++ internal/providertools/manifest.go | 45 +++- internal/providertools/manifest_test.go | 36 +++ internal/web/models.go | 119 ++++++++- internal/web/models_test.go | 180 +++++++++++++ internal/web/provider_auth_test.go | 47 ++++ internal/web/providers.go | 163 +++++++++++- internal/web/server.go | 1 + internal/web/setup.go | 166 ++++++++++-- site/docs/changelog.md | 5 + site/docs/configuration.md | 9 +- site/docs/overview/models.md | 32 ++- web/src/components/SettingsView.tsx | 13 +- web/src/components/SetupView.test.tsx | 5 + web/src/components/SetupView.tsx | 25 +- web/src/lib/api.ts | 9 +- 30 files changed, 1536 insertions(+), 61 deletions(-) create mode 100644 internal/providerauth/models.go create mode 100644 internal/providerauth/models_test.go diff --git a/CHANGELOG.md b/CHANGELOG.md index 515f295e..42e7e558 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,7 +10,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Added - **Unified Provider account sign-in.** Settings and first-run setup can now authenticate OpenAI through ChatGPT/Codex, xAI through Grok, and GitHub Copilot through one device-code account flow, while preserving API-key providers. Providers bind to a default or explicit local account and expose connected, reauthentication, and multi-account management states. - GitHub Copilot requests keep one stable session interaction while classifying tool continuations and delegated agents as agent-initiated, avoiding accidental extra premium interactions. +- Managed ChatGPT/Codex, xAI, and GitHub Copilot Providers now browse the selected account's live model catalog. Enabled account-scoped models survive restart, and Copilot routes OpenAI models through Responses while retaining Chat Completions for other advertised vendors. - **Provider-backed image generation.** Configure a global Image Model independently from the chat model, then use `generate_image` from normal-mode TUI, Web, Desktop, or ACP sessions. The first release supports OpenAI-compatible Images endpoints, BigModel CogView, and Alibaba Token Plan Wan 2.7 models. +- Grok account sign-in now exposes the official `grok-imagine-image` and `grok-imagine-image-quality` models through the Image Model role with dispatch-time OAuth credentials; xAI video entries are kept out of unsupported chat/image surfaces. - **Generated images as managed Artifacts.** Results are verified, stored outside the workspace under the session, persisted for replay, and shown as lifecycle-aware image cards in Web/Desktop. TUI reports the local path and metadata; ACP degrades to metadata, resource links, or bounded inline images according to negotiated capabilities. - **Provider capability routing.** Settings now distinguishes chat, image generation, vision input, and provider-bound tools using the exact provider profile, endpoint, protocol, and model. It includes an Image Model picker, provider capability status, a BigModel Search MCP preset, and provider Web Search policy. @@ -20,6 +22,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Fresh blank sessions hide task/session chrome until conversation work exists; loading and persisted sessions keep their controls. ### Fixed +- Grok device sign-in now accepts xAI's official `accounts.x.ai/oauth2/device` verification page while retaining strict HTTPS, host, port, and user-info checks. - Provider configuration writes are serialized as reload → mutate → atomic save, reject stale snapshots, preserve secrets, and rebuild provider tools after keys, endpoints, or models change. - Session replay now restores provider operations, managed Artifacts, tool lifecycle, session modes, and per-session tool overrides without trusting dropped WebSocket events. diff --git a/internal-doc/provider-unified-auth-poc.md b/internal-doc/provider-unified-auth-poc.md index f7a05c3c..1dc91969 100644 --- a/internal-doc/provider-unified-auth-poc.md +++ b/internal-doc/provider-unified-auth-poc.md @@ -13,7 +13,7 @@ login methods already implemented by cc-switch: | --- | --- | --- | | ChatGPT / Codex | `auth.openai.com/api/accounts/deviceauth/*`, then OAuth code exchange | OpenAI Responses at `chatgpt.com/backend-api/codex/responses` | | Grok / xAI | OIDC discovery plus OAuth 2.0 Device Authorization Grant | OpenAI Responses at `api.x.ai/v1/responses` | -| GitHub Copilot | GitHub device flow, then GitHub-to-Copilot token exchange | OpenAI-compatible `api.githubcopilot.com/chat/completions` | +| GitHub Copilot | GitHub device flow, then GitHub-to-Copilot token exchange | Account catalog selects `/v1/responses` for OpenAI models and `/chat/completions` for other vendors | API-key authentication remains supported and is the default for existing configuration. Managed login is opt-in and backward compatible. @@ -38,8 +38,8 @@ assumption: ## POC boundaries -The POC is executable through unit and HTTP-handler tests. It does not require -a developer account or send a live billable model request. +The automated POC is executable through unit and HTTP-handler tests without a +developer account and never sends a live billable model request. The test transport substitutes local servers for each fixed remote endpoint and proves: @@ -56,8 +56,9 @@ and proves: 6. a Provider binding contains only `method` and optional `account_id`; 7. model requests resolve a fresh credential and inject protected headers at dispatch time; -8. ChatGPT/xAI requests select Responses while Copilot selects Chat - Completions; +8. ChatGPT/xAI chat requests select Responses. Copilot resolves the live model + vendor per account, using Responses for OpenAI models and Chat Completions + for other advertised vendors; 9. public flow responses, Provider bindings, durable-state fixtures and runtime credential serialization expose no access token, refresh token, GitHub token, authorization code or device token; @@ -71,9 +72,19 @@ and proves: 13. Copilot user, tool-continuation, and subagent requests receive the correct initiator/interaction headers while one session keeps a stable opaque interaction ID. +14. managed model catalogs are fetched with the selected account credential, + bounded to 1 MiB, filtered by provider visibility, and never expose an + upstream response body on error. Explicitly enabled live chat models retain + their wire protocol across restart; +15. xAI image and video entries are separated from chat. The official managed + xAI image profile pins `api.x.ai/v1/images/generations`, resolves its token + only at dispatch, and reuses the billable-operation approval, journal, + quota, Artifact, and safe-download pipeline. ## Accepted result -The POC is accepted when the focused auth, model transport and provider API -tests pass without network access. Live login remains an explicit manual smoke -test because it opens a browser and changes an external account. +The POC is accepted when the focused auth, catalog, model transport and provider +API tests pass without network access. A manual account-scoped smoke test also +confirmed that xAI and GitHub Copilot return their live model catalogs, and that +the connected xAI account can read the official image-generation catalog. No +billable inference or image-generation request is part of that smoke test. diff --git a/internal/command/image_generation.go b/internal/command/image_generation.go index bbe682e9..4eda11bc 100644 --- a/internal/command/image_generation.go +++ b/internal/command/image_generation.go @@ -1,6 +1,7 @@ package command import ( + "context" "errors" "fmt" "os" @@ -12,6 +13,7 @@ import ( "github.com/cnjack/jcode/internal/config" "github.com/cnjack/jcode/internal/handler" "github.com/cnjack/jcode/internal/imagegen" + "github.com/cnjack/jcode/internal/providerauth" "github.com/cnjack/jcode/internal/providertools" "github.com/cnjack/jcode/internal/session" "github.com/cnjack/jcode/internal/toolpolicy" @@ -34,9 +36,36 @@ func configuredGenerateImageTool( if err != nil { return nil, err } + credentialKind := "api_key" + var credential imagegen.CredentialFunc + if runtime.AuthMethod != "" { + method := providerauth.Method(runtime.AuthMethod) + if method != providerauth.MethodXAIOAuth { + return nil, fmt.Errorf("unsupported managed image authentication method %q", runtime.AuthMethod) + } + manager, managerErr := providerauth.Default(config.ConfigDir()) + if managerErr != nil { + return nil, fmt.Errorf("configure managed image credential: %w", managerErr) + } + binding := providerauth.Binding{Method: method, AccountID: runtime.AccountID} + if validateErr := manager.ValidateBinding(context.Background(), binding); validateErr != nil { + return nil, fmt.Errorf("configure managed image credential: %w", validateErr) + } + credential = func(ctx context.Context) (string, map[string]string, error) { + resolved, resolveErr := manager.Credential(ctx, binding) + if resolveErr != nil { + return "", nil, resolveErr + } + if resolved.Protocol != providerauth.ProtocolResponses || resolved.BaseURL != runtime.BaseURL { + return "", nil, fmt.Errorf("managed image runtime profile changed") + } + return resolved.Token, resolved.Headers, nil + } + credentialKind = "managed_account" + } client, err := imagegen.NewGenerator(imagegen.ClientConfig{ Protocol: runtime.Protocol, BaseURL: runtime.BaseURL, APIKey: runtime.APIKey, - Headers: runtime.Headers, Model: runtime.Model, AssetHosts: runtime.AssetHosts, + Headers: runtime.Headers, Credential: credential, Model: runtime.Model, AssetHosts: runtime.AssetHosts, MaxImageSize: 20 << 20, }) if err != nil { @@ -53,7 +82,7 @@ func configuredGenerateImageTool( Generator: client, ArtifactService: service, Recorder: recorder, Ledger: ledger, Provider: runtime.Provider, Model: runtime.Model, EndpointProfile: "image:" + toolpolicy.StableID(string(runtime.Protocol), runtime.BaseURL), - CredentialKind: "api_key", CredentialFingerprint: runtime.CredentialFingerprint, + CredentialKind: credentialKind, CredentialFingerprint: runtime.CredentialFingerprint, ConfigEpoch: runtime.ConfigEpoch, DispatchPolicy: session.DispatchPolicy{ Tool: session.SessionToolImageGeneration, MaxPerSession: runtime.MaxCallsPerSession, diff --git a/internal/command/image_generation_test.go b/internal/command/image_generation_test.go index fc590dbc..2ddc4ac0 100644 --- a/internal/command/image_generation_test.go +++ b/internal/command/image_generation_test.go @@ -2,8 +2,10 @@ package command import ( "context" + "os" "path/filepath" "testing" + "time" "github.com/cloudwego/eino/components/tool" @@ -68,6 +70,48 @@ func TestConfiguredGenerateImageToolDependsOnlyOnIndependentImageRole(t *testing } } +func TestConfiguredGenerateImageToolAcceptsManagedXAIAccount(t *testing.T) { + home := t.TempDir() + t.Setenv("HOME", home) + configDir := filepath.Join(home, ".jcode") + if err := os.MkdirAll(configDir, 0o700); err != nil { + t.Fatal(err) + } + accountJSON := `{"version":1,"methods":{"xai_oauth":{"accounts":{"account-1":{"id":"account-1","login":"grok-user","secret":"refresh-token","authenticated_at":"` + + time.Now().UTC().Format(time.RFC3339Nano) + `"}},"default_account_id":"account-1"}}}` + if err := os.WriteFile(filepath.Join(configDir, "provider-auth.json"), []byte(accountJSON), 0o600); err != nil { + t.Fatal(err) + } + cfg := &config.Config{ + ImageModel: "xai/grok-imagine-image-quality", + Providers: map[string]*config.ProviderConfig{ + "xai": {Auth: &config.ProviderAuthBinding{Method: "xai_oauth", AccountID: "account-1"}}, + }, + } + recorder, err := session.NewRecorder(t.TempDir(), "xai", "grok-4.5") + if err != nil { + t.Fatal(err) + } + defer recorder.Close() + ledger, err := newImageUsageLedger(recorder) + if err != nil { + t.Fatal(err) + } + service := artifact.NewServiceWithManagedRoot( + session.LoadArtifactRecords, nil, filepath.Join(t.TempDir(), "managed"), + ) + imageTool, err := configuredGenerateImageTool( + cfg, service, recorder, ledger, testProviderRuntimeConfigLoader(cfg), nil, nil, + ) + if err != nil { + t.Fatal(err) + } + info, err := imageTool.Info(context.Background()) + if err != nil || info == nil || info.Name != "generate_image" { + t.Fatalf("tool info=%#v err=%v", info, err) + } +} + func TestGenerateImageCatalogIsNormalModeOnlyAcrossTransports(t *testing.T) { for _, transport := range []string{"tui", "acp", "web"} { normal, err := buildCommandToolPlan( diff --git a/internal/command/provider_runtime_verifier.go b/internal/command/provider_runtime_verifier.go index 01e74487..803e7128 100644 --- a/internal/command/provider_runtime_verifier.go +++ b/internal/command/provider_runtime_verifier.go @@ -5,6 +5,7 @@ import ( "fmt" "github.com/cnjack/jcode/internal/config" + "github.com/cnjack/jcode/internal/providerauth" "github.com/cnjack/jcode/internal/providertools" ) @@ -85,6 +86,17 @@ func imageRuntimeVerifier( current.ConfigEpoch != expected.ConfigEpoch { return fmt.Errorf("image runtime changed after approval") } + if expected.AuthMethod != "" { + manager, managerErr := providerauth.Default(config.ConfigDir()) + if managerErr != nil { + return fmt.Errorf("validate managed image account: %w", managerErr) + } + if validateErr := manager.ValidateBinding(ctx, providerauth.Binding{ + Method: providerauth.Method(expected.AuthMethod), AccountID: expected.AccountID, + }); validateErr != nil { + return fmt.Errorf("validate managed image account: %w", validateErr) + } + } return nil } } diff --git a/internal/config/config.go b/internal/config/config.go index 7875ac35..f9cc08ba 100644 --- a/internal/config/config.go +++ b/internal/config/config.go @@ -126,6 +126,14 @@ type CustomModelConfig struct { // and this is non-empty, it overrides the default standard effort options; // when empty the standard set (minimal/low/medium/high) is used. EffortTiers []string `json:"effort_tiers,omitempty"` + // Managed marks account-scoped models discovered from a managed provider. + // These entries make an explicitly enabled live model available after a + // restart, but remain read-only in the custom-model editor. + Managed bool `json:"managed,omitempty"` + // Protocol records a managed model's provider-declared wire format. It is + // ignored for API-key custom models and never accepted from the browser form. + Protocol string `json:"protocol,omitempty"` + Vendor string `json:"vendor,omitempty"` } // SSHAlias represents a saved SSH connection alias diff --git a/internal/imagegen/client.go b/internal/imagegen/client.go index 333e409b..4ee58913 100644 --- a/internal/imagegen/client.go +++ b/internal/imagegen/client.go @@ -50,7 +50,11 @@ type ClientConfig struct { BaseURL string APIKey string Headers map[string]string - Model string + // Credential resolves a managed bearer token immediately before dispatch. + // When set, an empty token fails closed and protected headers are applied + // after configured headers. + Credential CredentialFunc + Model string // AssetHosts explicitly allows temporary image URL hosts in addition to the // provider API host. Values are exact hosts or "*.example.com" wildcards. AssetHosts []string @@ -63,6 +67,10 @@ type ClientConfig struct { AllowInsecureHTTP bool } +// CredentialFunc resolves request-scoped managed authorization without +// exposing bearer tokens to image runtime configuration or session records. +type CredentialFunc func(context.Context) (token string, headers map[string]string, err error) + // Request is the provider-neutral subset supported by the POC protocol. // Empty optional values are omitted so older OpenAI-compatible gateways do not // reject newer fields they do not understand. @@ -103,6 +111,7 @@ type Client struct { endpoint *url.URL apiKey string headers map[string]string + credential CredentialFunc model string httpClient *http.Client maxImageBytes int64 @@ -158,7 +167,7 @@ func NewClient(cfg ClientConfig) (*Client, error) { headers[name] = value } return &Client{ - endpoint: endpoint, apiKey: cfg.APIKey, headers: headers, + endpoint: endpoint, apiKey: cfg.APIKey, headers: headers, credential: cfg.Credential, model: strings.TrimSpace(cfg.Model), httpClient: httpClient, maxImageBytes: maxImageBytes, allowHTTP: cfg.AllowInsecureHTTP, assetHosts: assetHosts, @@ -220,6 +229,24 @@ func (c *Client) Generate(ctx context.Context, input Request) (Result, error) { } req.Header.Set(name, value) } + if c.credential != nil { + token, protectedHeaders, credentialErr := c.credential(ctx) + if credentialErr != nil { + return Result{}, fmt.Errorf("resolve managed image credential: %w", credentialErr) + } + if strings.TrimSpace(token) == "" { + return Result{}, fmt.Errorf("resolve managed image credential: empty token") + } + for name, value := range protectedHeaders { + if forbiddenProviderHeader(name) || strings.ContainsAny(value, "\r\n") { + return Result{}, fmt.Errorf("managed image credential returned an invalid header") + } + req.Header.Set(name, value) + } + // Apply Authorization last so neither static nor managed headers can + // replace the request-scoped bearer token. + req.Header.Set("Authorization", "Bearer "+token) + } resp, err := c.httpClient.Do(req) if err != nil { diff --git a/internal/imagegen/client_test.go b/internal/imagegen/client_test.go index 03b21230..693ab470 100644 --- a/internal/imagegen/client_test.go +++ b/internal/imagegen/client_test.go @@ -61,6 +61,64 @@ func TestOpenAIImagesBase64RoundTrip(t *testing.T) { } } +func TestOpenAIImagesManagedCredentialOverridesStaticAuthorization(t *testing.T) { + pixels := pngBytes(t, 1, 1) + var credentialCalls int + httpClient := stubHTTPClient(t, func(r *http.Request) *http.Response { + if got := r.Header.Get("Authorization"); got != "Bearer fresh-managed-token" { + t.Fatalf("Authorization = %q", got) + } + if got := r.Header.Get("X-Managed-Account"); got != "account-1" { + t.Fatalf("managed account header = %q", got) + } + return jsonResponse(http.StatusOK, map[string]any{"data": []map[string]string{{ + "b64_json": base64.StdEncoding.EncodeToString(pixels), + }}}) + }) + client, err := NewClient(ClientConfig{ + Protocol: ProtocolOpenAIImages, BaseURL: "https://api.x.ai/v1", APIKey: "stale-static-token", + Model: "grok-imagine-image-quality", HTTPClient: httpClient, + Credential: func(context.Context) (string, map[string]string, error) { + credentialCalls++ + return "fresh-managed-token", map[string]string{"X-Managed-Account": "account-1"}, nil + }, + }) + if err != nil { + t.Fatal(err) + } + if _, err := client.Generate(context.Background(), Request{Prompt: "pixel"}); err != nil { + t.Fatal(err) + } + if credentialCalls != 1 { + t.Fatalf("credential calls = %d", credentialCalls) + } +} + +func TestOpenAIImagesManagedCredentialFailsClosed(t *testing.T) { + var dispatched bool + httpClient := stubHTTPClient(t, func(_ *http.Request) *http.Response { + dispatched = true + return jsonResponse(http.StatusOK, map[string]any{}) + }) + client, err := NewClient(ClientConfig{ + Protocol: ProtocolOpenAIImages, BaseURL: "https://api.x.ai/v1", + Model: "grok-imagine-image", HTTPClient: httpClient, + Credential: func(context.Context) (string, map[string]string, error) { + return " ", nil, nil + }, + }) + if err != nil { + t.Fatal(err) + } + if _, err := client.Generate(context.Background(), Request{Prompt: "pixel"}); err == nil || + !strings.Contains(err.Error(), "empty token") { + t.Fatalf("error = %v", err) + } + if dispatched { + t.Fatal("request dispatched with an empty managed token") + } +} + func TestOpenAIImagesURLRoundTripDoesNotForwardSecrets(t *testing.T) { pixels := pngBytes(t, 1, 1) var downloadAuth, downloadCustom string diff --git a/internal/model/chatmodel.go b/internal/model/chatmodel.go index acc51f96..9df5a2f7 100644 --- a/internal/model/chatmodel.go +++ b/internal/model/chatmodel.go @@ -476,16 +476,31 @@ func newManagedChatModel( return nil, fmt.Errorf("resolve managed provider account: %w", err) } credential := managedCredential(auth, binding, initial) + runtimeProtocol := initial.Protocol + runtimeBaseURL := initial.BaseURL + if binding.Method == providerauth.MethodGitHubCopilot { + for _, configured := range pc.CustomModels { + if configured.ID != modelName || !configured.Managed { + continue + } + if providerauth.Protocol(configured.Protocol) == providerauth.ProtocolResponses { + runtimeProtocol = providerauth.ProtocolResponses + runtimeBaseURL = strings.TrimRight(initial.BaseURL, "/") + "/v1" + } + break + } + } - switch initial.Protocol { + switch runtimeProtocol { case providerauth.ProtocolResponses: return NewResponsesModel(ctx, &ResponsesModelConfig{ Model: modelName, - BaseURL: initial.BaseURL, + BaseURL: runtimeBaseURL, ReasoningEffort: pc.ReasoningEffort, Vision: vision, Credential: credential, Codex: binding.Method == providerauth.MethodCodexOAuth, + Copilot: binding.Method == providerauth.MethodGitHubCopilot, }) case providerauth.ProtocolChatCompletions: return NewChatModel(ctx, &ChatModelConfig{ @@ -500,7 +515,7 @@ func newManagedChatModel( default: return nil, fmt.Errorf( "managed provider %s/%s returned unsupported protocol %q", - provider, modelName, initial.Protocol, + provider, modelName, runtimeProtocol, ) } } diff --git a/internal/model/chatmodel_managed_auth_test.go b/internal/model/chatmodel_managed_auth_test.go index 279ac0e8..ff356ee4 100644 --- a/internal/model/chatmodel_managed_auth_test.go +++ b/internal/model/chatmodel_managed_auth_test.go @@ -120,6 +120,31 @@ func TestManagedChatCompletionsIgnoreConfiguredSecrets(t *testing.T) { } } +func TestManagedCopilotOpenAIModelUsesResponsesRuntime(t *testing.T) { + resolver := &fakeCredentialResolver{credentials: []providerauth.Credential{{ + Token: "token", BaseURL: "https://api.githubcopilot.com", Protocol: providerauth.ProtocolChatCompletions, + }}} + providerConfig := &config.ProviderConfig{ + Auth: &config.ProviderAuthBinding{Method: string(providerauth.MethodGitHubCopilot)}, + CustomModels: []config.CustomModelConfig{{ + ID: "gpt-5.6", Managed: true, Protocol: string(providerauth.ProtocolResponses), Vendor: "openai", + }}, + } + created, err := newManagedChatModel( + context.Background(), "github-copilot", "gpt-5.6", providerConfig, true, resolver, + ) + if err != nil { + t.Fatalf("create managed Copilot Responses model: %v", err) + } + managed, ok := created.(*responsesModel) + if !ok { + t.Fatalf("model type = %T, want *responsesModel", created) + } + if managed.endpoint != "https://api.githubcopilot.com/v1/responses" || !managed.copilot || managed.codex { + t.Fatalf("managed Copilot Responses runtime = %#v", managed) + } +} + func TestManagedResponsesSelectsPinnedTransport(t *testing.T) { resolver := &fakeCredentialResolver{credentials: []providerauth.Credential{{ Token: "token", BaseURL: "https://api.x.ai/v1", Protocol: providerauth.ProtocolResponses, diff --git a/internal/model/registry.go b/internal/model/registry.go index b779b7d5..53c90eed 100644 --- a/internal/model/registry.go +++ b/internal/model/registry.go @@ -254,7 +254,7 @@ func (r *ModelRegistry) MergeConfigProviders(providers map[string]*config.Provid ToolCall: cm.ToolCall, Reasoning: cm.Reasoning, Attachment: cm.Attachment, - DefaultEnabled: true, + DefaultEnabled: !cm.Managed, } // A custom model flagged as reasoning gets the standard OpenAI-compatible // effort levels, so the chat picker's effort control can render for it. diff --git a/internal/model/responses.go b/internal/model/responses.go index e3059a08..2a1efb2e 100644 --- a/internal/model/responses.go +++ b/internal/model/responses.go @@ -33,6 +33,7 @@ type ResponsesModelConfig struct { Vision bool Credential ResponsesCredentialFunc Codex bool + Copilot bool HTTPClient *http.Client } @@ -44,6 +45,7 @@ type responsesModel struct { vision bool credential ResponsesCredentialFunc codex bool + copilot bool client *http.Client tools []*schema.ToolInfo } @@ -94,6 +96,7 @@ func NewResponsesModel(_ context.Context, cfg *ResponsesModelConfig) (einomodel. vision: cfg.Vision, credential: cfg.Credential, codex: cfg.Codex, + copilot: cfg.Copilot, client: client, }, nil } @@ -225,6 +228,9 @@ func (m *responsesModel) Generate( input []*schema.Message, opts ...einomodel.Option, ) (*schema.Message, error) { + if m.copilot { + ctx = withCopilotModelRequest(ctx, input) + } if m.codex { stream, err := m.Stream(ctx, input, opts...) if err != nil { @@ -259,6 +265,9 @@ func (m *responsesModel) Stream( input []*schema.Message, opts ...einomodel.Option, ) (*schema.StreamReader[*schema.Message], error) { + if m.copilot { + ctx = withCopilotModelRequest(ctx, input) + } req, err := m.buildRequest(input, true, opts...) if err != nil { return nil, err diff --git a/internal/providerauth/models.go b/internal/providerauth/models.go new file mode 100644 index 00000000..ea9efb2a --- /dev/null +++ b/internal/providerauth/models.go @@ -0,0 +1,249 @@ +package providerauth + +import ( + "bytes" + "context" + "encoding/json" + "errors" + "fmt" + "io" + "net/http" + "net/url" + "sort" + "strings" +) + +const maxModelCatalogResponseBytes = 1 << 20 + +// Models returns the live, account-scoped model catalog for a managed login. +// Credentials are resolved immediately before the request and never included +// in the returned projection or an error body. +func (manager *Manager) Models(ctx context.Context, binding Binding) ([]Model, error) { + credential, err := manager.Credential(ctx, binding) + if err != nil { + return nil, err + } + if strings.TrimSpace(credential.Token) == "" { + return nil, errors.New("managed provider model catalog requires a token") + } + + endpoint, headers, err := modelCatalogRequest(binding.Method, credential) + if err != nil { + return nil, err + } + request, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil) + if err != nil { + return nil, fmt.Errorf("create managed provider model request: %w", err) + } + for name, value := range headers { + request.Header.Set(name, value) + } + request.Header.Set("Authorization", "Bearer "+credential.Token) + status, payload, err := manager.doModelCatalogJSON(request) + if err != nil { + return nil, err + } + if status < http.StatusOK || status >= http.StatusMultipleChoices { + return nil, fmt.Errorf("managed provider model catalog failed: HTTP %d", status) + } + + models := parseManagedModels(binding.Method, payload) + if len(models) == 0 { + return nil, errors.New("managed provider returned an empty model catalog") + } + return models, nil +} + +func modelCatalogRequest(method Method, credential Credential) (string, map[string]string, error) { + base, err := url.Parse(strings.TrimRight(credential.BaseURL, "/")) + if err != nil || base.Scheme == "" || base.Host == "" { + return "", nil, errors.New("managed provider returned an invalid model catalog endpoint") + } + base.Path = strings.TrimRight(base.Path, "/") + "/models" + base.RawQuery = "" + base.Fragment = "" + + headers := make(map[string]string, len(credential.Headers)+1) + for name, value := range credential.Headers { + headers[name] = value + } + switch method { + case MethodCodexOAuth: + query := base.Query() + query.Set("client_version", codexClientVersion) + base.RawQuery = query.Encode() + case MethodXAIOAuth: + // Standard Responses provider catalog; no extra headers required. + case MethodGitHubCopilot: + headers["Content-Type"] = "application/json" + default: + return "", nil, fmt.Errorf("%w: %q", ErrUnsupportedMethod, method) + } + return base.String(), headers, nil +} + +func (manager *Manager) doModelCatalogJSON(request *http.Request) (int, any, error) { + response, err := manager.client.Do(request) + if err != nil { + return 0, nil, fmt.Errorf("managed provider model request: %w", err) + } + defer func() { _ = response.Body.Close() }() + if response.ContentLength > maxModelCatalogResponseBytes { + return response.StatusCode, nil, errors.New("managed provider model response exceeds 1 MiB limit") + } + body, err := io.ReadAll(io.LimitReader(response.Body, maxModelCatalogResponseBytes+1)) + if err != nil { + return response.StatusCode, nil, fmt.Errorf("read managed provider model response: %w", err) + } + if len(body) > maxModelCatalogResponseBytes { + return response.StatusCode, nil, errors.New("managed provider model response exceeds 1 MiB limit") + } + if response.StatusCode < http.StatusOK || response.StatusCode >= http.StatusMultipleChoices { + return response.StatusCode, nil, nil + } + var payload any + decoder := json.NewDecoder(bytes.NewReader(body)) + decoder.UseNumber() + if err := decoder.Decode(&payload); err != nil { + return response.StatusCode, nil, errors.New("managed provider model response is not valid JSON") + } + return response.StatusCode, payload, nil +} + +func parseManagedModels(method Method, payload any) []Model { + entries := modelEntries(payload) + models := make([]Model, 0, len(entries)) + seen := make(map[string]struct{}, len(entries)) + for _, entry := range entries { + model, ok := parseManagedModel(method, entry.value, entry.fallbackID) + if !ok { + continue + } + if _, duplicate := seen[model.ID]; duplicate { + continue + } + seen[model.ID] = struct{}{} + models = append(models, model) + } + sort.Slice(models, func(i, j int) bool { return models[i].ID < models[j].ID }) + return models +} + +type modelEntry struct { + value any + fallbackID string +} + +func modelEntries(payload any) []modelEntry { + if list, ok := payload.([]any); ok { + return wrapModelEntries(list) + } + object, ok := payload.(map[string]any) + if !ok { + return nil + } + for _, key := range []string{"data", "items"} { + if list, ok := object[key].([]any); ok { + return wrapModelEntries(list) + } + } + if list, ok := object["models"].([]any); ok { + return wrapModelEntries(list) + } + if modelMap, ok := object["models"].(map[string]any); ok { + entries := make([]modelEntry, 0, len(modelMap)) + for id, value := range modelMap { + entries = append(entries, modelEntry{value: value, fallbackID: id}) + } + return entries + } + return nil +} + +func wrapModelEntries(input []any) []modelEntry { + entries := make([]modelEntry, 0, len(input)) + for _, value := range input { + entries = append(entries, modelEntry{value: value}) + } + return entries +} + +func parseManagedModel(method Method, value any, fallbackID string) (Model, bool) { + if id, ok := value.(string); ok { + id = strings.TrimSpace(id) + if id == "" { + return Model{}, false + } + return Model{ID: id, Name: id, Protocol: protocolForManagedModel(method, ""), Kind: kindForManagedModel(method, id)}, true + } + object, ok := value.(map[string]any) + if !ok { + if strings.TrimSpace(fallbackID) == "" { + return Model{}, false + } + id := strings.TrimSpace(fallbackID) + return Model{ID: id, Name: id, Protocol: protocolForManagedModel(method, ""), Kind: kindForManagedModel(method, id)}, true + } + if method == MethodGitHubCopilot { + if enabled, exists := object["model_picker_enabled"].(bool); exists && !enabled { + return Model{}, false + } + } + id := firstModelString(object, "slug", "id", "model") + if id == "" { + id = strings.TrimSpace(fallbackID) + } + if id == "" { + id = firstModelString(object, "name") + } + if id == "" { + return Model{}, false + } + name := firstModelString(object, "name", "display_name", "displayName") + if name == "" { + name = id + } + vendor := firstModelString(object, "vendor", "owned_by", "ownedBy", "provider", "owner") + return Model{ + ID: id, + Name: name, + Vendor: vendor, + Protocol: protocolForManagedModel(method, vendor), + Kind: kindForManagedModel(method, id), + }, true +} + +func firstModelString(object map[string]any, keys ...string) string { + for _, key := range keys { + if value, ok := object[key].(string); ok && strings.TrimSpace(value) != "" { + return strings.TrimSpace(value) + } + } + return "" +} + +func protocolForManagedModel(method Method, vendor string) Protocol { + switch method { + case MethodCodexOAuth, MethodXAIOAuth: + return ProtocolResponses + case MethodGitHubCopilot: + if strings.EqualFold(strings.TrimSpace(vendor), "openai") { + return ProtocolResponses + } + return ProtocolChatCompletions + default: + return "" + } +} + +func kindForManagedModel(method Method, modelID string) ModelKind { + if method == MethodXAIOAuth { + switch { + case strings.HasPrefix(modelID, "grok-imagine-image"): + return ModelKindImage + case strings.HasPrefix(modelID, "grok-imagine-video"): + return ModelKindVideo + } + } + return ModelKindChat +} diff --git a/internal/providerauth/models_test.go b/internal/providerauth/models_test.go new file mode 100644 index 00000000..60087f48 --- /dev/null +++ b/internal/providerauth/models_test.go @@ -0,0 +1,197 @@ +package providerauth + +import ( + "context" + "io" + "net/http" + "reflect" + "strings" + "testing" + "time" +) + +func TestManagedModelParsersCoverProviderShapes(t *testing.T) { + t.Parallel() + tests := []struct { + name string + method Method + payload any + want []Model + }{ + { + name: "xai openai data", + method: MethodXAIOAuth, + payload: map[string]any{"data": []any{ + map[string]any{"id": "grok-4.5", "owned_by": "xai"}, + map[string]any{"id": "grok-2-image", "owned_by": "xai"}, + }}, + want: []Model{ + {ID: "grok-2-image", Name: "grok-2-image", Vendor: "xai", Protocol: ProtocolResponses, Kind: ModelKindChat}, + {ID: "grok-4.5", Name: "grok-4.5", Vendor: "xai", Protocol: ProtocolResponses, Kind: ModelKindChat}, + }, + }, + { + name: "codex model map", + method: MethodCodexOAuth, + payload: map[string]any{"models": map[string]any{ + "gpt-5.4": map[string]any{"display_name": "GPT-5.4", "owned_by": "openai"}, + "gpt-5.4-mini": "gpt-5.4-mini", + }}, + want: []Model{ + {ID: "gpt-5.4", Name: "GPT-5.4", Vendor: "openai", Protocol: ProtocolResponses, Kind: ModelKindChat}, + {ID: "gpt-5.4-mini", Name: "gpt-5.4-mini", Protocol: ProtocolResponses, Kind: ModelKindChat}, + }, + }, + { + name: "copilot picker and protocol", + method: MethodGitHubCopilot, + payload: map[string]any{"data": []any{ + map[string]any{"id": "gpt-5.6", "name": "GPT-5.6 Terra", "vendor": "openai", "model_picker_enabled": true}, + map[string]any{"id": "claude-sonnet-5", "name": "Claude Sonnet 5", "vendor": "anthropic", "model_picker_enabled": true}, + map[string]any{"id": "hidden", "name": "Hidden", "vendor": "openai", "model_picker_enabled": false}, + }}, + want: []Model{ + {ID: "claude-sonnet-5", Name: "Claude Sonnet 5", Vendor: "anthropic", Protocol: ProtocolChatCompletions, Kind: ModelKindChat}, + {ID: "gpt-5.6", Name: "GPT-5.6 Terra", Vendor: "openai", Protocol: ProtocolResponses, Kind: ModelKindChat}, + }, + }, + } + for _, test := range tests { + test := test + t.Run(test.name, func(t *testing.T) { + t.Parallel() + if got := parseManagedModels(test.method, test.payload); !reflect.DeepEqual(got, test.want) { + t.Fatalf("models = %#v, want %#v", got, test.want) + } + }) + } +} + +func TestXAIModelKindsSeparateChatImageAndVideo(t *testing.T) { + models := parseManagedModels(MethodXAIOAuth, map[string]any{"data": []any{ + map[string]any{"id": "grok-4.5"}, + map[string]any{"id": "grok-imagine-image-quality"}, + map[string]any{"id": "grok-imagine-video-1.5"}, + }}) + if len(models) != 3 || models[0].Kind != ModelKindChat || + models[1].Kind != ModelKindImage || models[2].Kind != ModelKindVideo { + t.Fatalf("xAI model kinds = %#v", models) + } +} + +func TestManagedModelsUseAccountCredentialAndPinnedRuntime(t *testing.T) { + t.Parallel() + clock := newTestClock() + seen := make(chan string, 3) + baseURL := "https://provider-models.example.test" + client := &http.Client{Transport: authRoundTripFunc(func(request *http.Request) (*http.Response, error) { + if got := request.Header.Get("Authorization"); got != "Bearer access-token" { + t.Errorf("authorization = %q", got) + } + status := http.StatusOK + body := "" + switch request.URL.Path { + case "/codex/runtime/models": + if request.URL.Query().Get("client_version") != codexClientVersion || + request.Header.Get("chatgpt-account-id") != "codex-account" || + request.Header.Get("originator") == "" { + t.Errorf("codex request missing required metadata: %s %#v", request.URL.String(), request.Header) + } + seen <- "codex" + body = `{"models":[{"slug":"gpt-5.4"}]}` + case "/xai/runtime/models": + seen <- "xai" + body = `{"data":[{"id":"grok-4.5"}]}` + case "/copilot/runtime/models": + if request.Header.Get("copilot-integration-id") != copilotIntegrationID || + request.Header.Get("editor-version") != copilotEditorVersion { + t.Errorf("copilot request missing required metadata: %#v", request.Header) + } + seen <- "copilot" + body = `{"data":[{"id":"gpt-5.6","vendor":"openai","model_picker_enabled":true}]}` + default: + status = http.StatusNotFound + } + return &http.Response{ + StatusCode: status, + Header: make(http.Header), + Body: io.NopCloser(strings.NewReader(body)), + Request: request, + }, nil + })} + + manager, err := NewManager(Options{ + ConfigDir: t.TempDir(), HTTPClient: client, Now: clock.Now, + Endpoints: testEndpoints(baseURL), AllowInsecureTestEndpoints: true, + }) + if err != nil { + t.Fatal(err) + } + bindings := []Binding{ + {Method: MethodCodexOAuth, AccountID: "codex-account"}, + {Method: MethodXAIOAuth, AccountID: "xai-account"}, + {Method: MethodGitHubCopilot, AccountID: "copilot-account"}, + } + for _, binding := range bindings { + if err := manager.upsertAccount(binding.Method, storedAccount{ + ID: binding.AccountID, Login: binding.AccountID, Secret: "durable-secret", AuthenticatedAt: clock.Now(), + }); err != nil { + t.Fatal(err) + } + manager.cache(binding.Method, binding.AccountID, "access-token", clock.Now().Add(2*time.Hour)) + } + manager.mu.Lock() + manager.copilotEndpoints[accountKey(MethodGitHubCopilot, "copilot-account")] = baseURL + "/copilot/runtime" + manager.mu.Unlock() + + for _, binding := range bindings { + models, err := manager.Models(context.Background(), binding) + if err != nil { + t.Fatalf("%s models: %v", binding.Method, err) + } + if len(models) != 1 { + t.Fatalf("%s models = %#v", binding.Method, models) + } + } + close(seen) + got := make(map[string]bool) + for provider := range seen { + got[provider] = true + } + for _, provider := range []string{"codex", "xai", "copilot"} { + if !got[provider] { + t.Errorf("missing %s catalog request", provider) + } + } +} + +func TestManagedModelsDoNotExposeUpstreamErrorBody(t *testing.T) { + t.Parallel() + clock := newTestClock() + baseURL := "https://provider-error.example.test" + client := &http.Client{Transport: authRoundTripFunc(func(request *http.Request) (*http.Response, error) { + return &http.Response{ + StatusCode: http.StatusUnauthorized, + Header: make(http.Header), + Body: io.NopCloser(strings.NewReader(`{"error":"token access-token device-code"}`)), + Request: request, + }, nil + })} + manager, err := NewManager(Options{ + ConfigDir: t.TempDir(), HTTPClient: client, Now: clock.Now, + Endpoints: testEndpoints(baseURL), AllowInsecureTestEndpoints: true, + }) + if err != nil { + t.Fatal(err) + } + if err := manager.upsertAccount(MethodXAIOAuth, storedAccount{ + ID: "xai-account", Login: "xai", Secret: "durable-secret", AuthenticatedAt: clock.Now(), + }); err != nil { + t.Fatal(err) + } + manager.cache(MethodXAIOAuth, "xai-account", "access-token", clock.Now().Add(2*time.Hour)) + _, err = manager.Models(context.Background(), Binding{Method: MethodXAIOAuth, AccountID: "xai-account"}) + if err == nil || strings.Contains(err.Error(), "access-token") || strings.Contains(err.Error(), "device-code") { + t.Fatalf("unsafe error = %v", err) + } +} diff --git a/internal/providerauth/types.go b/internal/providerauth/types.go index 407e25c9..3963cd7a 100644 --- a/internal/providerauth/types.go +++ b/internal/providerauth/types.go @@ -85,6 +85,28 @@ type Credential struct { Headers map[string]string `json:"headers,omitempty"` } +// Model is a non-secret model projection returned by a managed provider's +// account-scoped catalog. Protocol is the wire format required by that model; +// Copilot may mix OpenAI Responses models with chat-completions models in one +// account catalog. +type Model struct { + ID string `json:"id"` + Name string `json:"name,omitempty"` + Vendor string `json:"vendor,omitempty"` + Protocol Protocol `json:"protocol"` + Kind ModelKind `json:"kind"` +} + +// ModelKind separates inference catalogs that share /models but require +// different product surfaces and wire protocols. +type ModelKind string + +const ( + ModelKindChat ModelKind = "chat" + ModelKindImage ModelKind = "image" + ModelKindVideo ModelKind = "video" +) + var ( ErrUnsupportedMethod = errors.New("unsupported provider auth method") ErrUnsupportedGHES = errors.New("GitHub Enterprise Server is not supported") @@ -140,4 +162,5 @@ type Service interface { Logout(context.Context, Method) error ValidateBinding(context.Context, Binding) error Credential(context.Context, Binding) (Credential, error) + Models(context.Context, Binding) ([]Model, error) } diff --git a/internal/providertools/manifest.go b/internal/providertools/manifest.go index f22aa30e..a10ba14d 100644 --- a/internal/providertools/manifest.go +++ b/internal/providertools/manifest.go @@ -51,6 +51,8 @@ type ImageRuntime struct { Protocol imagegen.Protocol BaseURL string APIKey string + AuthMethod string + AccountID string Headers map[string]string AssetHosts []string CredentialFingerprint string @@ -232,6 +234,19 @@ func ImageModels(cfg *config.Config) []ImageModel { } } } + if isManagedXAIProfile(providerID, provider) { + result = append(result, []ImageModel{ + { + Provider: providerID, ID: "grok-imagine-image", Name: "Grok Imagine Image", + Protocol: string(imagegen.ProtocolOpenAIImages), Builtin: true, Supported: true, + }, + { + Provider: providerID, ID: "grok-imagine-image-quality", Name: "Grok Imagine Image Quality", + Protocol: string(imagegen.ProtocolOpenAIImages), Builtin: true, Supported: true, + }, + }...) + continue + } if provider.ImageEndpoint == nil { continue } @@ -274,7 +289,8 @@ func ResolveImageRuntime(cfg *config.Config) (ImageRuntime, error) { return ImageRuntime{}, fmt.Errorf("image_model must use provider/model format") } provider := cfg.GetProviders()[providerID] - if provider == nil || strings.TrimSpace(provider.APIKey) == "" { + managedXAI := isManagedXAIProfile(providerID, provider) + if provider == nil || (strings.TrimSpace(provider.APIKey) == "" && !managedXAI) { return ImageRuntime{}, fmt.Errorf("image provider is not configured") } policy, ok := provider.ProviderTools[ToolImageGeneration] @@ -296,15 +312,33 @@ func ResolveImageRuntime(cfg *config.Config) (ImageRuntime, error) { MaxCallsPerTurn: policy.MaxCallsPerTurn, MaxCallsPerSession: policy.MaxCallsPerSession, } + if managedXAI { + // Managed xAI policy owns the endpoint and protected headers. Ignore any + // stale hand-edited endpoint/header fields instead of forwarding the OAuth + // bearer token to configuration-controlled destinations. + runtime.Headers = nil + runtime.AuthMethod = provider.Auth.Method + runtime.AccountID = provider.Auth.AccountID + runtime.CredentialFingerprint = shortFingerprintFields( + "managed_account", runtime.AuthMethod, runtime.AccountID, + ) + } if runtime.MaxCallsPerTurn <= 0 { runtime.MaxCallsPerTurn = 1 } if runtime.MaxCallsPerSession <= 0 { runtime.MaxCallsPerSession = 20 } + if managedXAI && !isXAIImageModel(modelID) { + return ImageRuntime{}, fmt.Errorf("selected image model is not declared by the managed xAI profile") + } endpoint := provider.ImageEndpoint switch { + case managedXAI && isXAIImageModel(modelID): + runtime.Protocol = imagegen.ProtocolOpenAIImages + runtime.BaseURL = "https://api.x.ai/v1" + runtime.AssetHosts = []string{"*.x.ai"} case endpoint != nil && configuredImageModel(endpoint.Models, modelID): runtime.Protocol = imagegen.Protocol(strings.TrimSpace(endpoint.Protocol)) if !supportedImageProtocol(string(runtime.Protocol)) { @@ -340,6 +374,15 @@ func ResolveImageRuntime(cfg *config.Config) (ImageRuntime, error) { return runtime, nil } +func isManagedXAIProfile(providerID string, provider *config.ProviderConfig) bool { + return providerID == "xai" && provider != nil && provider.Auth != nil && + provider.Auth.Method == "xai_oauth" +} + +func isXAIImageModel(modelID string) bool { + return modelID == "grok-imagine-image" || modelID == "grok-imagine-image-quality" +} + // ImageEndpointProfile is an opaque, Settings-safe identifier for the final // resolved endpoint. The endpoint URL itself is never returned by capability // metadata or written to session records. diff --git a/internal/providertools/manifest_test.go b/internal/providertools/manifest_test.go index cc2fb898..c3f0c2bb 100644 --- a/internal/providertools/manifest_test.go +++ b/internal/providertools/manifest_test.go @@ -430,3 +430,39 @@ func TestImageModelsMergesBuiltinAndExplicitWithoutDuplicates(t *testing.T) { t.Fatalf("explicit endpoint did not override builtin model route: %#v", runtime) } } + +func TestManagedXAIImageModelsAndRuntimeArePinned(t *testing.T) { + cfg := &config.Config{ + ImageModel: "xai/grok-imagine-image-quality", + Providers: map[string]*config.ProviderConfig{ + "xai": { + Auth: &config.ProviderAuthBinding{Method: "xai_oauth", AccountID: "account-1"}, + // Stale hand-edited values must never receive the managed token. + BaseURL: "https://attacker.example/v1", + Headers: map[string]string{"X-Stale": "value"}, + ImageEndpoint: &config.ImageEndpointConfig{ + Protocol: string(imagegen.ProtocolOpenAIImages), + BaseURL: "https://attacker.example/v1", + Models: []config.ImageModelConfig{{ID: "attacker-model"}}, + }, + }, + }, + } + models := ImageModels(cfg) + if len(models) != 2 || models[0].ID != "grok-imagine-image" || models[1].ID != "grok-imagine-image-quality" { + t.Fatalf("managed xAI image models = %#v", models) + } + runtime, err := ResolveImageRuntime(cfg) + if err != nil { + t.Fatal(err) + } + if runtime.BaseURL != "https://api.x.ai/v1" || runtime.Protocol != imagegen.ProtocolOpenAIImages || + runtime.APIKey != "" || runtime.AuthMethod != "xai_oauth" || runtime.AccountID != "account-1" || + len(runtime.Headers) != 0 || len(runtime.AssetHosts) != 1 || runtime.AssetHosts[0] != "*.x.ai" { + t.Fatalf("managed xAI runtime = %#v", runtime) + } + cfg.ImageModel = "xai/attacker-model" + if _, err := ResolveImageRuntime(cfg); err == nil { + t.Fatal("managed xAI accepted a configuration-controlled image model") + } +} diff --git a/internal/web/models.go b/internal/web/models.go index c2506ec8..9f8048fd 100644 --- a/internal/web/models.go +++ b/internal/web/models.go @@ -3,8 +3,11 @@ package web import ( "context" "encoding/json" + "errors" + "fmt" "io" "net/http" + "reflect" "strings" "time" @@ -13,6 +16,7 @@ import ( "github.com/cnjack/jcode/internal/config" "github.com/cnjack/jcode/internal/mode" "github.com/cnjack/jcode/internal/model" + "github.com/cnjack/jcode/internal/providerauth" "github.com/cnjack/jcode/internal/providertools" ) @@ -58,7 +62,9 @@ func splitModelReference(ref string) (provider, modelID string) { } func configuredImageAvailability(pc *config.ProviderConfig, imageModel providertools.ImageModel) string { - if pc == nil || pc.APIKey == "" { + managedXAI := pc != nil && pc.Auth != nil && pc.Auth.Method == string(providerauth.MethodXAIOAuth) && + imageModel.Provider == "xai" + if pc == nil || (pc.APIKey == "" && !managedXAI) { return "unsupported" } if !imageModel.Supported { @@ -659,6 +665,15 @@ func (s *Server) handleToggleModelEnabled(w http.ResponseWriter, r *http.Request writeJSON(w, http.StatusBadRequest, map[string]string{"error": "provider and model are required"}) return } + managedConfigChanged := false + if req.Enabled { + var err error + managedConfigChanged, err = s.ensureManagedModelConfigured(r.Context(), req.Provider, req.Model) + if err != nil { + writeJSON(w, http.StatusBadGateway, map[string]string{"error": err.Error()}) + return + } + } state, err := config.LoadModelState() if err != nil { @@ -669,6 +684,12 @@ func (s *Server) handleToggleModelEnabled(w http.ResponseWriter, r *http.Request writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "failed to save"}) return } + if managedConfigChanged { + if err := s.rebuildProviderDependents(req.Provider, "enable managed model"); err != nil { + writeSavedButNotApplied(w, "managed provider model") + return + } + } s.syncProviderConfigsBestEffort() writeJSON(w, http.StatusOK, map[string]any{ @@ -676,6 +697,102 @@ func (s *Server) handleToggleModelEnabled(w http.ResponseWriter, r *http.Request }) } +func (s *Server) ensureManagedModelConfigured( + ctx context.Context, + providerID string, + modelID string, +) (bool, error) { + cfg, err := config.LoadConfig() + if err != nil { + return false, err + } + provider := cfg.GetProviders()[providerID] + if provider == nil || provider.Auth == nil { + return false, nil + } + existingManaged := false + for _, existing := range provider.CustomModels { + if existing.ID == modelID { + if !existing.Managed { + return false, nil + } + existingManaged = true + break + } + } + // A provider-native static model needs only a model-state override; it is + // already available to the runtime registry without a managed metadata row. + if !existingManaged && s.registry != nil { + if registryProvider := s.registry.GetProvider(providerID); registryProvider != nil && + registryProvider.Models[modelID] != nil { + return false, nil + } + } + method, err := parseProviderAuthMethod(provider.Auth.Method) + if err != nil { + return false, err + } + service, err := s.providerAuthService() + if err != nil { + return false, err + } + liveModels, err := service.Models(ctx, providerauth.Binding{ + Method: method, AccountID: provider.Auth.AccountID, + }) + if err != nil { + return false, err + } + var discovered *providerauth.Model + for i := range liveModels { + if liveModels[i].Kind == providerauth.ModelKindChat && liveModels[i].ID == modelID { + discovered = &liveModels[i] + break + } + } + if discovered == nil { + return false, fmt.Errorf("model %q is no longer available for this account", modelID) + } + metadata := managedModelConfigFromLive(s.registry, providerID, *discovered) + configChanged := false + + s.cfgMu.Lock() + configLocked := true + defer func() { + if configLocked { + s.cfgMu.Unlock() + } + }() + latest, err := config.MutateConfig(func(current *config.Config) error { + pc := current.GetProviders()[providerID] + if pc == nil || pc.Auth == nil || pc.Auth.Method != string(method) || + pc.Auth.AccountID != provider.Auth.AccountID { + return errors.New("managed provider authentication changed while enabling model") + } + for index, existing := range pc.CustomModels { + if existing.ID == modelID { + if !existing.Managed { + return nil + } + if !reflect.DeepEqual(existing, metadata) { + pc.CustomModels[index] = metadata + configChanged = true + } + return nil + } + } + pc.CustomModels = append(pc.CustomModels, metadata) + configChanged = true + return nil + }) + if err != nil { + return false, err + } + s.publishConfigSnapshotLocked(latest) + s.cfgMu.Unlock() + configLocked = false + return configChanged, nil +} + // handleSetModelEffort records the user's reasoning-effort choice for a single // model (set from the chat model picker). An empty effort clears the override, // restoring the provider-level default. The agent is rebuilt so the change diff --git a/internal/web/models_test.go b/internal/web/models_test.go index 574e0718..fa0aec2a 100644 --- a/internal/web/models_test.go +++ b/internal/web/models_test.go @@ -13,6 +13,7 @@ import ( "github.com/cloudwego/eino/adk" "github.com/cnjack/jcode/internal/config" "github.com/cnjack/jcode/internal/model" + "github.com/cnjack/jcode/internal/providerauth" ) func TestWebSwitchModelSameValueIsNoOp(t *testing.T) { @@ -97,6 +98,138 @@ func TestProviderCatalogUsesPersistedModelVisibility(t *testing.T) { } } +func TestManagedProviderCatalogUsesLiveAccountModels(t *testing.T) { + t.Setenv("HOME", t.TempDir()) + err := config.SaveConfig(&config.Config{ + Providers: map[string]*config.ProviderConfig{ + "github-copilot": { + Auth: &config.ProviderAuthBinding{Method: string(providerauth.MethodGitHubCopilot), AccountID: "account-1"}, + }, + }, + }) + if err != nil { + t.Fatal(err) + } + s := &Server{ + registry: model.NewModelRegistry(), + providerAuth: &fakeProviderAuthService{models: []providerauth.Model{ + {ID: "claude-sonnet-5", Name: "Claude Sonnet 5", Vendor: "anthropic", Protocol: providerauth.ProtocolChatCompletions, Kind: providerauth.ModelKindChat}, + {ID: "gpt-5.6", Name: "GPT-5.6 Terra", Vendor: "openai", Protocol: providerauth.ProtocolResponses, Kind: providerauth.ModelKindChat}, + }}, + } + req := httptest.NewRequest(http.MethodGet, "/api/providers/github-copilot/models", nil) + req.SetPathValue("id", "github-copilot") + rec := httptest.NewRecorder() + s.handleProviderCatalog(rec, req) + if rec.Code != http.StatusOK { + t.Fatalf("catalog: code=%d body=%s", rec.Code, rec.Body.String()) + } + var got []struct { + ID string `json:"id"` + Name string `json:"name"` + Added bool `json:"added"` + } + if err := json.Unmarshal(rec.Body.Bytes(), &got); err != nil { + t.Fatal(err) + } + if len(got) != 2 || got[0].ID != "claude-sonnet-5" || got[1].ID != "gpt-5.6" || + got[0].Name != "Claude Sonnet 5" || got[1].Name != "GPT-5.6 Terra" { + t.Fatalf("live catalog = %#v", got) + } +} + +func TestEnableManagedModelPersistsRuntimeMetadata(t *testing.T) { + t.Setenv("HOME", t.TempDir()) + err := config.SaveConfig(&config.Config{ + Providers: map[string]*config.ProviderConfig{ + "github-copilot": { + Auth: &config.ProviderAuthBinding{Method: string(providerauth.MethodGitHubCopilot), AccountID: "account-1"}, + }, + }, + }) + if err != nil { + t.Fatal(err) + } + s := &Server{ + cfg: &config.Config{}, + registry: model.NewModelRegistry(), + needsSetup: true, + providerAuth: &fakeProviderAuthService{models: []providerauth.Model{ + {ID: "gpt-5.6", Name: "GPT-5.6 Terra", Vendor: "openai", Protocol: providerauth.ProtocolResponses, Kind: providerauth.ModelKindChat}, + }}, + } + recorder := httptest.NewRecorder() + s.handleToggleModelEnabled(recorder, httptest.NewRequest( + http.MethodPost, "/api/model-state/enabled", + strings.NewReader(`{"provider":"github-copilot","model":"gpt-5.6","enabled":true}`), + )) + if recorder.Code != http.StatusOK { + t.Fatalf("enable model: status=%d body=%s", recorder.Code, recorder.Body.String()) + } + loaded, err := config.LoadConfig() + if err != nil { + t.Fatal(err) + } + models := loaded.Providers["github-copilot"].CustomModels + if len(models) != 1 || !models[0].Managed || models[0].Protocol != string(providerauth.ProtocolResponses) || + models[0].Vendor != "openai" || models[0].Name != "GPT-5.6 Terra" { + t.Fatalf("stored managed model = %#v", models) + } + if _, _, ok := s.registry.LookupModel("github-copilot", "gpt-5.6"); !ok { + t.Fatal("live registry was not rebuilt with enabled managed model") + } + state, err := config.LoadModelState() + if err != nil { + t.Fatal(err) + } + if !state.IsModelEnabled(config.ModelRef{Provider: "github-copilot", Model: "gpt-5.6"}, false) { + t.Fatal("enabled managed model was not persisted in model state") + } +} + +func TestEnsureManagedModelRefreshesProviderRouting(t *testing.T) { + t.Setenv("HOME", t.TempDir()) + err := config.SaveConfig(&config.Config{ + Providers: map[string]*config.ProviderConfig{ + "github-copilot": { + Auth: &config.ProviderAuthBinding{ + Method: string(providerauth.MethodGitHubCopilot), AccountID: "account-1", + }, + CustomModels: []config.CustomModelConfig{{ + ID: "gpt-5.6", Name: "Old name", Managed: true, + Protocol: string(providerauth.ProtocolChatCompletions), Vendor: "azure openai", + }}, + }, + }, + }) + if err != nil { + t.Fatal(err) + } + s := &Server{ + registry: model.NewModelRegistry(), + providerAuth: &fakeProviderAuthService{models: []providerauth.Model{{ + ID: "gpt-5.6", Name: "GPT-5.6 Terra", Vendor: "openai", + Protocol: providerauth.ProtocolResponses, Kind: providerauth.ModelKindChat, + }}}, + } + changed, err := s.ensureManagedModelConfigured(t.Context(), "github-copilot", "gpt-5.6") + if err != nil { + t.Fatal(err) + } + if !changed { + t.Fatal("stale managed model routing was not refreshed") + } + loaded, err := config.LoadConfig() + if err != nil { + t.Fatal(err) + } + got := loaded.Providers["github-copilot"].CustomModels + if len(got) != 1 || got[0].Protocol != string(providerauth.ProtocolResponses) || + got[0].Vendor != "openai" || got[0].Name != "GPT-5.6 Terra" { + t.Fatalf("refreshed managed model = %#v", got) + } +} + func TestListModelsExposesModalitiesAndExplicitImageCatalog(t *testing.T) { t.Setenv("HOME", t.TempDir()) cfg := &config.Config{ @@ -174,6 +307,53 @@ func TestListModelsExposesModalitiesAndExplicitImageCatalog(t *testing.T) { } } +func TestListModelsExposesManagedXAIImageRole(t *testing.T) { + t.Setenv("HOME", t.TempDir()) + cfg := &config.Config{ + Model: "xai/grok-4.5", + ImageModel: "xai/grok-imagine-image-quality", + Providers: map[string]*config.ProviderConfig{ + "xai": {Auth: &config.ProviderAuthBinding{Method: string(providerauth.MethodXAIOAuth), AccountID: "account-1"}}, + }, + } + s := &Server{cfg: cfg} + rec := httptest.NewRecorder() + s.handleListModels(rec, httptest.NewRequest(http.MethodGet, "/api/models", nil)) + if rec.Code != http.StatusOK { + t.Fatalf("status=%d body=%s", rec.Code, rec.Body.String()) + } + var response struct { + Providers []struct { + ID string `json:"id"` + Models []struct { + ID string `json:"id"` + Output []string `json:"output_modalities"` + Availability string `json:"capability_availability"` + } `json:"models"` + } `json:"providers"` + } + if err := json.Unmarshal(rec.Body.Bytes(), &response); err != nil { + t.Fatal(err) + } + var imageIDs []string + for _, provider := range response.Providers { + if provider.ID != "xai" { + continue + } + for _, candidate := range provider.Models { + if len(candidate.Output) == 1 && candidate.Output[0] == "image" { + if candidate.Availability != "supported" { + t.Fatalf("image model %s availability = %q", candidate.ID, candidate.Availability) + } + imageIDs = append(imageIDs, candidate.ID) + } + } + } + if len(imageIDs) != 2 || imageIDs[0] != "grok-imagine-image" || imageIDs[1] != "grok-imagine-image-quality" { + t.Fatalf("managed xAI image models = %#v", imageIDs) + } +} + func TestSetImageModelPersistsIndependentRole(t *testing.T) { t.Setenv("HOME", t.TempDir()) cfg := &config.Config{ diff --git a/internal/web/provider_auth_test.go b/internal/web/provider_auth_test.go index 268b8d4d..aca02885 100644 --- a/internal/web/provider_auth_test.go +++ b/internal/web/provider_auth_test.go @@ -18,6 +18,8 @@ import ( type fakeProviderAuthService struct { status providerauth.Status flow providerauth.Flow + models []providerauth.Model + modelsErr error validate error cancelled string } @@ -55,6 +57,51 @@ func (f *fakeProviderAuthService) ValidateBinding(context.Context, providerauth. return f.validate } +func (f *fakeProviderAuthService) Models(context.Context, providerauth.Binding) ([]providerauth.Model, error) { + return append([]providerauth.Model(nil), f.models...), f.modelsErr +} + +func TestSetupManagedProviderUsesAccountModelCatalog(t *testing.T) { + t.Setenv("HOME", t.TempDir()) + s := newSetupTestServer() + s.registry = model.NewModelRegistry() + s.providerAuth = &fakeProviderAuthService{models: []providerauth.Model{ + {ID: "gpt-5.6", Name: "GPT-5.6 Terra", Vendor: "openai", Protocol: providerauth.ProtocolResponses, Kind: providerauth.ModelKindChat}, + {ID: "image-model", Name: "Image", Protocol: providerauth.ProtocolResponses, Kind: providerauth.ModelKindImage}, + }} + req := httptest.NewRequest( + http.MethodGet, + "/api/setup/providers/github-copilot/models?auth_method=github_copilot&account_id=account-1", + nil, + ) + req.SetPathValue("id", "github-copilot") + recorder := httptest.NewRecorder() + s.handleSetupProviderModels(recorder, req) + if recorder.Code != http.StatusOK || !strings.Contains(recorder.Body.String(), `"id":"gpt-5.6"`) || + strings.Contains(recorder.Body.String(), "image-model") { + t.Fatalf("setup live catalog: status=%d body=%s", recorder.Code, recorder.Body.String()) + } + + complete := httptest.NewRecorder() + s.handleSetupComplete(complete, httptest.NewRequest( + http.MethodPost, + "/api/setup/complete", + strings.NewReader(`{"provider":"github-copilot","model":"gpt-5.6","auth_binding":{"method":"github_copilot","account_id":"account-1"}}`), + )) + if complete.Code != http.StatusOK { + t.Fatalf("complete managed setup: status=%d body=%s", complete.Code, complete.Body.String()) + } + loaded, err := config.LoadConfig() + if err != nil { + t.Fatal(err) + } + models := loaded.Providers["github-copilot"].CustomModels + if loaded.Model != "github-copilot/gpt-5.6" || len(models) != 1 || + !models[0].Managed || models[0].Protocol != string(providerauth.ProtocolResponses) { + t.Fatalf("managed setup config: model=%q models=%#v", loaded.Model, models) + } +} + func TestAddManagedProviderStoresOnlyBinding(t *testing.T) { t.Setenv("HOME", t.TempDir()) fake := &fakeProviderAuthService{} diff --git a/internal/web/providers.go b/internal/web/providers.go index cc5d5c7e..b538a8a4 100644 --- a/internal/web/providers.go +++ b/internal/web/providers.go @@ -275,9 +275,11 @@ func (s *Server) handleProviderCatalog(w http.ResponseWriter, r *http.Request) { customSet := make(map[string]*config.CustomModelConfig) // user-defined models by id var apiKey, baseURL string var headers map[string]string + var providerConfig *config.ProviderConfig cfg, _ := config.LoadConfig() if cfg != nil { if pc := cfg.GetProviders()[providerID]; pc != nil { + providerConfig = pc apiKey, baseURL, headers = pc.APIKey, pc.BaseURL, pc.Headers for _, m := range pc.CustomModels { configured[m.ID] = true @@ -298,6 +300,12 @@ func (s *Server) handleProviderCatalog(w http.ResponseWriter, r *http.Request) { e.Reasoning = m.Reasoning e.Attachment = m.Attachment e.EffortTiers = m.EffortTiers + e.Custom = !m.Managed + if m.Managed { + e.Added = modelState.IsModelEnabled( + config.ModelRef{Provider: providerID, Model: id}, false, + ) + } } return e } @@ -333,6 +341,69 @@ func (s *Server) handleProviderCatalog(w http.ResponseWriter, r *http.Request) { registryID = hint } } + + // Managed account providers expose an account- and entitlement-specific + // catalog. Prefer that live source over the conservative built-in fallback; + // it is how Copilot and subscription-backed Codex/xAI accounts advertise the + // models this particular login may actually use. + if providerConfig != nil && providerConfig.Auth != nil { + method, parseErr := parseProviderAuthMethod(providerConfig.Auth.Method) + service, serviceErr := s.providerAuthService() + if parseErr == nil && serviceErr == nil { + liveModels, liveErr := service.Models(r.Context(), providerauth.Binding{ + Method: method, AccountID: providerConfig.Auth.AccountID, + }) + if liveErr == nil && len(liveModels) > 0 { + result := make([]catalogEntry, 0, len(liveModels)+len(configured)) + seen := make(map[string]bool, len(liveModels)) + for _, live := range liveModels { + if live.Kind != providerauth.ModelKindChat || live.ID == "" || seen[live.ID] { + continue + } + seen[live.ID] = true + metadata := managedModelConfigFromLive(s.registry, providerID, live) + defaultEnabled := configured[live.ID] + if persisted := customSet[live.ID]; persisted != nil && persisted.Managed { + defaultEnabled = false + } + if s.registry != nil { + if native := s.registry.GetProvider(providerID); native != nil { + if static := native.Models[live.ID]; static != nil { + defaultEnabled = static.DefaultEnabled + } + } + } + result = append(result, catalogEntry{ + ID: live.ID, + Name: metadata.Name, + Added: modelState.IsModelEnabled(config.ModelRef{Provider: providerID, Model: live.ID}, defaultEnabled), + Context: metadata.Context, + Reasoning: metadata.Reasoning, + Attachment: metadata.Attachment, + EffortTiers: metadata.EffortTiers, + Custom: false, + }) + } + // Keep previously enabled managed models visible during upstream + // catalog rollouts so users can disable them or diagnose entitlement + // changes without hand-editing config. + for id := range configured { + if !seen[id] { + result = append(result, customEntry(id)) + } + } + sort.Slice(result, func(i, j int) bool { return result[i].ID < result[j].ID }) + writeJSON(w, http.StatusOK, result) + return + } + if liveErr != nil { + config.Logger().Printf( + "[provider-auth] live model catalog unavailable for %s (error_type=%T); using fallback", + method, liveErr, + ) + } + } + } if s.registry != nil && s.registry.HasProvider(registryID) { models := s.registry.ListProviderModels(registryID, true) result := make([]catalogEntry, 0, len(models)) @@ -343,15 +414,21 @@ func (s *Server) handleProviderCatalog(w http.ResponseWriter, r *http.Request) { // user-set name/context/tiers) rather than the derived registry view — // otherwise effort tiers and other authored fields are lost. if cm := customSet[m.ID]; cm != nil { + added := true + if cm.Managed { + added = modelState.IsModelEnabled( + config.ModelRef{Provider: providerID, Model: m.ID}, false, + ) + } result = append(result, catalogEntry{ ID: m.ID, Name: cm.Name, - Added: true, + Added: added, Context: cm.Context, Reasoning: cm.Reasoning, Attachment: cm.Attachment, EffortTiers: cm.EffortTiers, - Custom: true, + Custom: !cm.Managed, }) continue } @@ -423,6 +500,67 @@ func (s *Server) handleProviderCatalog(w http.ResponseWriter, r *http.Request) { writeJSON(w, http.StatusOK, result) } +func managedModelConfigFromLive( + registry *model.ModelRegistry, + providerID string, + live providerauth.Model, +) config.CustomModelConfig { + result := config.CustomModelConfig{ + ID: live.ID, Name: live.Name, ToolCall: true, Managed: true, + Protocol: string(live.Protocol), Vendor: live.Vendor, + } + if result.Name == "" { + result.Name = live.ID + } + metadata := findManagedModelMetadata(registry, providerID, live.Vendor, live.ID) + if metadata == nil { + return result + } + if result.Name == live.ID && metadata.Name != "" { + result.Name = metadata.Name + } + result.ToolCall = metadata.ToolCall + result.Reasoning = metadata.Reasoning + result.Attachment = metadata.Attachment + if metadata.Limit != nil { + result.Context = metadata.Limit.Context + } + for _, option := range metadata.ReasoningOptions { + if option.Type == "effort" && len(option.Values) > 0 { + result.EffortTiers = append([]string(nil), option.Values...) + break + } + } + return result +} + +func findManagedModelMetadata( + registry *model.ModelRegistry, + providerID string, + vendor string, + modelID string, +) *model.RegistryModel { + if registry == nil { + return nil + } + for _, candidate := range []string{providerID, strings.ToLower(strings.TrimSpace(vendor))} { + if candidate == "" { + continue + } + if provider := registry.GetProvider(candidate); provider != nil { + if metadata := provider.Models[modelID]; metadata != nil { + return metadata + } + } + } + for _, provider := range registry.ListProviders() { + if metadata := provider.Models[modelID]; metadata != nil { + return metadata + } + } + return nil +} + // maskSecret hides a secret for display: first 4 and last 4 chars for longer // values, "****" for short ones. Used for API keys and header values so the // list endpoint never returns plaintext credentials. @@ -477,6 +615,7 @@ func (s *Server) handleListProviders(w http.ResponseWriter, r *http.Request) { Capabilities []providertools.ProviderCapability `json:"capabilities"` } + modelState, _ := config.LoadModelState() result := make([]providerDetail, 0) for id, pc := range cfg.GetProviders() { detail := providerDetail{ @@ -536,7 +675,7 @@ func (s *Server) handleListProviders(w http.ResponseWriter, r *http.Request) { } if !detail.Custom && s.registry != nil && s.registry.HasProvider(id) { for _, m := range s.registry.ListProviderModels(id, true) { - if !m.DefaultEnabled { + if !modelState.IsModelEnabled(config.ModelRef{Provider: id, Model: m.ID}, m.DefaultEnabled) { continue } if customIDs[m.ID] { @@ -561,6 +700,9 @@ func (s *Server) handleListProviders(w http.ResponseWriter, r *http.Request) { } } for _, m := range pc.CustomModels { + if m.Managed && !modelState.IsModelEnabled(config.ModelRef{Provider: id, Model: m.ID}, false) { + continue + } if seen[m.ID] { continue } @@ -572,7 +714,7 @@ func (s *Server) handleListProviders(w http.ResponseWriter, r *http.Request) { Context: m.Context, Attachment: m.Attachment, EffortTiers: m.EffortTiers, - Custom: true, + Custom: !m.Managed, }) } if len(cms) > 0 { @@ -959,8 +1101,17 @@ func (s *Server) handleUpdateProvider(w http.ResponseWriter, r *http.Request) { for _, m := range pc.CustomModels { prev[m.ID] = m } - next := make([]config.CustomModelConfig, 0, len(*req.CustomModels)) - seen := make(map[string]bool, len(*req.CustomModels)) + next := make([]config.CustomModelConfig, 0, len(pc.CustomModels)+len(*req.CustomModels)) + seen := make(map[string]bool, len(pc.CustomModels)+len(*req.CustomModels)) + // Account-scoped live models are backend-owned metadata. The custom + // model editor sends only user-authored rows, so preserve managed rows + // across an unrelated provider edit instead of silently deleting them. + for _, existing := range pc.CustomModels { + if existing.Managed && existing.ID != "" && !seen[existing.ID] { + seen[existing.ID] = true + next = append(next, existing) + } + } for _, m := range *req.CustomModels { mid := strings.TrimSpace(m.ID) if mid == "" || seen[mid] { diff --git a/internal/web/server.go b/internal/web/server.go index 2f80e43c..025ee6f4 100644 --- a/internal/web/server.go +++ b/internal/web/server.go @@ -212,6 +212,7 @@ type ProviderAuthService interface { Remove(context.Context, providerauth.Method, string) error Logout(context.Context, providerauth.Method) error ValidateBinding(context.Context, providerauth.Binding) error + Models(context.Context, providerauth.Binding) ([]providerauth.Model, error) } // ArtifactSharePublisher is consumed by the local Web API and implemented by diff --git a/internal/web/setup.go b/internal/web/setup.go index 091bd73d..1bb34ee5 100644 --- a/internal/web/setup.go +++ b/internal/web/setup.go @@ -8,10 +8,21 @@ import ( "github.com/cnjack/jcode/internal/config" "github.com/cnjack/jcode/internal/model" + "github.com/cnjack/jcode/internal/providerauth" ) // --- Setup & Provider Management Handlers --- +type setupModelItem struct { + ID string `json:"id"` + Name string `json:"name"` + ToolCall bool `json:"tool_call"` + ContextLimit int `json:"context_limit,omitempty"` + Reasoning bool `json:"reasoning,omitempty"` + Attachment bool `json:"attachment,omitempty"` + ReasoningOptions []model.ReasoningOption `json:"reasoning_options,omitempty"` +} + // handleSetupStatus returns whether the server is in setup mode. func (s *Server) handleSetupStatus(w http.ResponseWriter, r *http.Request) { writeJSON(w, http.StatusOK, map[string]any{ @@ -138,42 +149,109 @@ func (s *Server) handleSetupProviderModels(w http.ResponseWriter, r *http.Reques return } + toModelItem := func(id, name string, toolCall bool, contextLimit int, reasoning, attachment bool, options []model.ReasoningOption) setupModelItem { + return setupModelItem{ + ID: id, Name: name, ToolCall: toolCall, ContextLimit: contextLimit, + Reasoning: reasoning, Attachment: attachment, ReasoningOptions: options, + } + } + + authMethod := r.URL.Query().Get("auth_method") + accountID := r.URL.Query().Get("account_id") + if authMethod == "" && accountID != "" { + writeJSON(w, http.StatusBadRequest, map[string]string{"error": "auth_method is required with account_id"}) + return + } + if authMethod != "" { + binding, err := s.validateProviderBinding(r.Context(), providerID, &config.ProviderAuthBinding{ + Method: authMethod, AccountID: accountID, + }) + if err != nil { + writeConfigMutationError(w, err) + return + } + method, err := parseProviderAuthMethod(binding.Method) + if err != nil { + writeProviderAuthError(w, err) + return + } + service, err := s.providerAuthService() + if err != nil { + writeProviderAuthError(w, err) + return + } + liveModels, err := service.Models(r.Context(), providerauth.Binding{ + Method: method, AccountID: binding.AccountID, + }) + if err != nil { + writeProviderAuthError(w, err) + return + } + result := make([]setupModelItem, 0, len(liveModels)) + for _, live := range liveModels { + if live.Kind != providerauth.ModelKindChat { + continue + } + metadata := managedModelConfigFromLive(s.registry, providerID, live) + result = append(result, toModelItem( + live.ID, metadata.Name, metadata.ToolCall, metadata.Context, + metadata.Reasoning, metadata.Attachment, reasoningOptionsFromTiers(metadata.EffortTiers), + )) + } + if len(result) == 0 { + writeJSON(w, http.StatusBadGateway, map[string]string{"error": "managed provider returned no chat models"}) + return + } + prioritizeDefaultSetupModels(s.registry, providerID, result) + writeJSON(w, http.StatusOK, result) + return + } + if s.registry == nil { writeJSON(w, http.StatusOK, []any{}) return } models := s.registry.ListProviderModels(providerID, true) - type modelItem struct { - ID string `json:"id"` - Name string `json:"name"` - ToolCall bool `json:"tool_call"` - ContextLimit int `json:"context_limit,omitempty"` - Reasoning bool `json:"reasoning,omitempty"` - Attachment bool `json:"attachment,omitempty"` - ReasoningOptions []model.ReasoningOption `json:"reasoning_options,omitempty"` - } - result := make([]modelItem, 0, len(models)) + result := make([]setupModelItem, 0, len(models)) for _, m := range models { ctx := 0 if m.Limit != nil { ctx = m.Limit.Context } - result = append(result, modelItem{ - ID: m.ID, - Name: m.Name, - ToolCall: m.ToolCall, - ContextLimit: ctx, - Reasoning: m.Reasoning, - Attachment: m.Attachment, - ReasoningOptions: m.ReasoningOptions, - }) + result = append(result, toModelItem( + m.ID, m.Name, m.ToolCall, ctx, m.Reasoning, m.Attachment, m.ReasoningOptions, + )) } writeJSON(w, http.StatusOK, result) } +func reasoningOptionsFromTiers(tiers []string) []model.ReasoningOption { + if len(tiers) == 0 { + return nil + } + return []model.ReasoningOption{{Type: "effort", Values: append([]string(nil), tiers...)}} +} + +func prioritizeDefaultSetupModels(registry *model.ModelRegistry, providerID string, models []setupModelItem) { + if registry == nil || len(models) < 2 { + return + } + provider := registry.GetProvider(providerID) + if provider == nil { + return + } + sort.SliceStable(models, func(i, j int) bool { + left := provider.Models[models[i].ID] + right := provider.Models[models[j].ID] + leftDefault := left != nil && left.DefaultEnabled + rightDefault := right != nil && right.DefaultEnabled + return leftDefault && !rightDefault + }) +} + // It saves the provider config and creates the agent. // // The wizard no longer forces a model selection: for registry providers, a @@ -222,6 +300,53 @@ func (s *Server) handleSetupComplete(w http.ResponseWriter, r *http.Request) { return } + var managedModel *config.CustomModelConfig + if req.AuthBinding != nil { + method, parseErr := parseProviderAuthMethod(req.AuthBinding.Method) + if parseErr != nil { + writeProviderAuthError(w, parseErr) + return + } + service, serviceErr := s.providerAuthService() + if serviceErr != nil { + writeProviderAuthError(w, serviceErr) + return + } + liveModels, modelsErr := service.Models(r.Context(), providerauth.Binding{ + Method: method, AccountID: req.AuthBinding.AccountID, + }) + if modelsErr != nil { + writeProviderAuthError(w, modelsErr) + return + } + requestedModel := req.Model + if requestedModel == "" && s.registry != nil { + preferred := s.registry.PickDefaultModel(req.Provider) + for _, candidate := range liveModels { + if candidate.Kind == providerauth.ModelKindChat && candidate.ID == preferred { + requestedModel = preferred + break + } + } + } + for _, candidate := range liveModels { + if candidate.Kind != providerauth.ModelKindChat || + (requestedModel != "" && candidate.ID != requestedModel) { + continue + } + metadata := managedModelConfigFromLive(s.registry, req.Provider, candidate) + managedModel = &metadata + req.Model = candidate.ID + break + } + if managedModel == nil { + writeJSON(w, http.StatusBadRequest, map[string]string{ + "error": "selected model is not available for this managed account", + }) + return + } + } + // Serialize the complete load/merge/save/publish transaction with every // Settings writer. In setup mode the on-disk config may not yet pass normal // validation, so fall back to a detached copy of the live config rather than @@ -277,6 +402,9 @@ func (s *Server) handleSetupComplete(w http.ResponseWriter, r *http.Request) { Thinking: req.Thinking, ReasoningEffort: req.ReasoningEffort, } + if managedModel != nil { + setupPC.CustomModels = []config.CustomModelConfig{*managedModel} + } // For a custom provider, persist the model as a custom model so it survives // a model switch (otherwise it exists only as the active-model string and // vanishes from the picker once changed). diff --git a/site/docs/changelog.md b/site/docs/changelog.md index a0cf015e..9662aa17 100644 --- a/site/docs/changelog.md +++ b/site/docs/changelog.md @@ -12,13 +12,18 @@ For implementation-level detail, see the repository's full [CHANGELOG.md](https: ## Unreleased #### Added +- **Live managed model catalogs.** ChatGPT/Codex, Grok, and GitHub Copilot now load the models available to the selected account. Enabled models remain available after restart, and Copilot preserves each model's required Responses or Chat Completions transport. - **Provider-backed image generation.** jcode can discover image-capable providers, verify their runtime capabilities, configure image models, and invoke managed provider tools from the same agent workflow used for coding tasks. +- **Grok Imagine with account sign-in.** Connected xAI accounts can select `grok-imagine-image` or `grok-imagine-image-quality` as the independent Image Model without copying an API key. - **Durable generated-image artifacts.** Generated images appear as first-class timeline cards and artifacts, with revision and lifecycle state that survives session replay across Web, Desktop, TUI, ACP, and Cloud transport. #### Changed - **Focused Ask User flow.** Pending questions now open in a bottom dock with paging, keyboard-friendly choices, custom answers, skip, submit locking, and retryable errors. Completed answers stay in the conversation as compact receipts instead of collapsing into generic tool activity. - **Cleaner new sessions.** A brand-new empty task hides task-specific titlebar controls until the conversation actually contains content. +#### Fixed +- Grok device sign-in accepts xAI's official account verification page without weakening verification-URL origin checks. + #### Security - Billable provider operations require an explicit approval choice before execution. Session and configuration persistence also gains file locking, directory synchronization, security journaling, and secret-safe MCP updates. diff --git a/site/docs/configuration.md b/site/docs/configuration.md index 72f67563..5fc68732 100644 --- a/site/docs/configuration.md +++ b/site/docs/configuration.md @@ -155,9 +155,11 @@ permissions. The Provider config stores only `auth.method` and an optional `auth.account_id`; omitting the account ID follows that method's default usable account. Managed transports ignore custom `base_url`, `headers`, `protocol`, and `api_key` values and use their pinned runtime profile. Because custom image -endpoints currently reuse the Provider API key, `image_endpoint` is also -unavailable on a managed-login Provider; configure it under a separate API-key -Provider. +endpoints currently reuse the Provider API key, `image_endpoint` is unavailable +on a managed-login Provider; configure it under a separate API-key Provider. +The built-in xAI managed profile is the exception: `image_model` may select +`xai/grok-imagine-image` or `xai/grok-imagine-image-quality`, which use the +pinned official xAI Images endpoint and a dispatch-time managed credential. These are **local Providers** and Desktop calls them directly. When Cloud configuration sync is enabled, API keys and custom headers are encrypted on @@ -174,6 +176,7 @@ Active model in `"provider/model"` format. |---|---| | `model` | Primary model for all interactions | | `small_model` | Optional lightweight model. Powers the subagent `"small"` model alias (cheap delegated subtasks) and LLM session-title generation. Unset → subagents use the parent model and titles stay truncated first messages | +| `image_model` | Optional independent image-generation role in `"provider/model"` format. Generated calls remain externally billable and follow the configured approval policy | | `max_iterations` | Maximum agent iterations per turn (default: 1000) | ### context_limits diff --git a/site/docs/overview/models.md b/site/docs/overview/models.md index f744423e..828f664c 100644 --- a/site/docs/overview/models.md +++ b/site/docs/overview/models.md @@ -17,7 +17,7 @@ Any provider that implements the OpenAI chat completion API is supported. Common | OpenAI | `https://api.openai.com/v1` | Default if no base URL specified | | ChatGPT / Codex | Managed by jcode | Device-code sign-in; uses the ChatGPT Codex Responses transport | | xAI / Grok | `https://api.x.ai/v1` | API key or Grok device-code sign-in | -| GitHub Copilot | Managed by jcode | GitHub.com device-code sign-in; Chat Completions transport | +| GitHub Copilot | Managed by jcode | GitHub.com device-code sign-in; account-scoped catalog with model-specific Responses or Chat Completions transport | | Anthropic | Via compatible proxy | Use a provider that exposes OpenAI-compatible API | | Azure OpenAI | Your Azure endpoint | Set `base_url` to your Azure endpoint | | Local models | `http://localhost:PORT` | Ollama, LM Studio, vLLM, etc. | @@ -96,6 +96,14 @@ request and are never returned to the UI. Managed transports also pin their runtime URL, protocol, and protected headers, so custom base URLs and headers cannot redirect or replace their authorization. +Managed Providers load the model catalog for the selected account instead of +assuming that every subscription exposes the same models. In Settings, use the +refresh action to reload that catalog, then enable the models you want in the +chat picker. Enabled live models are retained locally for restart continuity. +GitHub Copilot may expose OpenAI, Google, Microsoft, and other vendor models in +one account; jcode preserves the wire protocol advertised for each enabled +model. + {: .note } **Sign in with ChatGPT** is the ChatGPT/Codex subscription transport, not a general OpenAI API OAuth flow. API-key billing and ChatGPT subscription access @@ -103,9 +111,13 @@ remain separate. GitHub Enterprise Server is not supported by the initial GitHub Copilot integration. {: .note } -Custom image endpoints currently use their Provider's API key. A managed-login -Provider cannot also own an image endpoint; use a separate API-key Provider for -image generation. +Custom image endpoints still use their Provider's API key and cannot be attached +to an arbitrary managed-login Provider. Grok login is the explicit exception: +the official xAI profile exposes `grok-imagine-image` and +`grok-imagine-image-quality` as Image Model choices, pins the xAI Images API, +and resolves the selected account token only when a generation request is +dispatched. Video models are recognized but are not yet exposed because jcode +does not yet implement the asynchronous video workflow. ## Switch Models Mid-Session @@ -121,22 +133,24 @@ Press **Ctrl+L** in the TUI or type `/model` to open the model picker. You can s ## Special Model Roles -jcode supports two model roles: +jcode supports three model roles: | Role | Config Key | Purpose | |---|---|---| | **Primary** | `model` | Main model for agent interactions, compaction, and memory distillation | | **Small** | `small_model` | Optional lightweight model for cheap side work | +| **Image** | `image_model` | Optional image-generation model used by the billable `generate_image` tool | ```json { "model": "openai/gpt-4o", - "small_model": "openai/gpt-4o-mini" + "small_model": "openai/gpt-4o-mini", + "image_model": "xai/grok-imagine-image-quality" } ``` -In the web UI and desktop app, set the small model from **Settings → Providers → -Model roles** — changes apply immediately, no restart needed. +In the web UI and desktop app, set the small and image models from **Settings → +Providers → Model roles** — changes apply immediately, no restart needed. When `small_model` is set, it powers: @@ -196,7 +210,7 @@ Reasoning effort can also be chosen **per model** from the chat model picker. Th jcode includes a setup wizard. Run it from the TUI with `/setting` → "Add Model", or press Ctrl+L and select "Add new provider". -In the web UI, providers and models are managed from a card-based **Settings** view: each provider is a card showing its brand, authentication status, name, endpoint, and a catalog of its models (built-in registry models toggle show/hide; custom models are editable or removable). Editing a provider keeps API-key and managed-account authentication in the same form. A custom model's editor exposes its ID, display name, context window, image-input toggle, and a reasoning-effort tier editor — when a custom model is flagged as reasoning, the standard `minimal` / `low` / `medium` / `high` effort levels are offered, or you can define your own tiers. Models advertising effort levels then expose the per-model reasoning-effort control in the chat input. +In the web UI, providers and models are managed from a card-based **Settings** view: each provider is a card showing its brand, authentication status, name, endpoint, and a catalog of its models (built-in and account-scoped models toggle show/hide; custom models are editable or removable). Refresh reloads the selected managed account's live catalog. Editing a provider keeps API-key and managed-account authentication in the same form. A custom model's editor exposes its ID, display name, context window, image-input toggle, and a reasoning-effort tier editor — when a custom model is flagged as reasoning, the standard `minimal` / `low` / `medium` / `high` effort levels are offered, or you can define your own tiers. Models advertising effort levels then expose the per-model reasoning-effort control in the chat input. ## Verify Model Connectivity diff --git a/web/src/components/SettingsView.tsx b/web/src/components/SettingsView.tsx index 13e138f2..019d94bb 100644 --- a/web/src/components/SettingsView.tsx +++ b/web/src/components/SettingsView.tsx @@ -493,7 +493,18 @@ function ProvidersTab() { } async function onProviderSaved() { - setProviders(await api.listProviders()) + const nextProviders = await api.listProviders() + setProviders(nextProviders) + const refreshedCatalogs = await Promise.all( + nextProviders.map(async (provider) => { + try { + return [provider.id, await api.providerCatalog(provider.id)] as const + } catch { + return [provider.id, []] as const + } + }), + ) + setCatalogs((current) => ({ ...current, ...Object.fromEntries(refreshedCatalogs) })) await refreshModels() setEditing(null) setAdding(false) diff --git a/web/src/components/SetupView.test.tsx b/web/src/components/SetupView.test.tsx index 0b6f1b99..7e93a70e 100644 --- a/web/src/components/SetupView.test.tsx +++ b/web/src/components/SetupView.test.tsx @@ -51,6 +51,11 @@ describe('SetupView managed provider authentication', () => { fireEvent.change(provider, { target: { value: 'openai' } }) await screen.findByText('jack@example.com') + await waitFor(() => expect(api.setupProviderModels).toHaveBeenCalledWith('openai', { + method: 'codex_oauth', + account_id: 'account-1', + })) + expect(screen.queryByLabelText('API Key')).toBeNull() const submit = screen.getByRole('button', { name: 'Complete Setup' }) await waitFor(() => expect(submit.hasAttribute('disabled')).toBe(false)) diff --git a/web/src/components/SetupView.tsx b/web/src/components/SetupView.tsx index a8595fea..2ef1ec90 100644 --- a/web/src/components/SetupView.tsx +++ b/web/src/components/SetupView.tsx @@ -59,12 +59,14 @@ export function SetupView() { } }, []) - async function loadProviderModels(providerID: string): Promise { + async function loadProviderModels(providerID: string, binding?: ProviderAuthBinding): Promise { const requestID = modelsRequestRef.current + 1 modelsRequestRef.current = requestID let nextModels: SetupModel[] = [] try { - nextModels = await api.setupProviderModels(providerID) + nextModels = binding + ? await api.setupProviderModels(providerID, binding) + : await api.setupProviderModels(providerID) } catch { nextModels = [] } @@ -72,6 +74,7 @@ export function SetupView() { || modelsRequestRef.current !== requestID || selectedProviderRef.current !== providerID) return setModels(nextModels) + if (binding) setModel(nextModels[0]?.id ?? '') } useEffect(() => { @@ -86,6 +89,16 @@ export function SetupView() { void loadProviderModels(selected.id) }, [selected, custom]) + useEffect(() => { + if (!selected || custom || authMethod === 'api_key' || + !isProviderAuthReady(authStatus, authBinding)) return + const accountID = authBinding?.account_id || authStatus?.default_account_id + void loadProviderModels(selected.id, { + method: authMethod, + account_id: accountID || undefined, + }) + }, [selected, custom, authMethod, authBinding, authStatus]) + useEffect(() => { setValidation(null) }, [apiKey, authMethod, authBinding, selected, custom, baseUrl, customId, headersText]) @@ -282,7 +295,13 @@ export function SetupView() { onAuthenticated={async (status) => { setAuthStatus(status) const providerID = selectedProviderRef.current - if (providerID) await loadProviderModels(providerID) + if (providerID) { + const accountID = authBinding?.account_id || status.default_account_id + await loadProviderModels(providerID, { + method: status.method, + account_id: accountID || undefined, + }) + } }} />
diff --git a/web/src/lib/api.ts b/web/src/lib/api.ts index fa19e06d..e87e1ad3 100644 --- a/web/src/lib/api.ts +++ b/web/src/lib/api.ts @@ -374,8 +374,13 @@ export const api = { // Setup API setupProviders: () => request('/api/setup/providers'), - setupProviderModels: (providerId: string) => - request(`/api/setup/providers/${encodeURIComponent(providerId)}/models`), + setupProviderModels: (providerId: string, binding?: ProviderAuthBinding) => { + const query = new URLSearchParams() + if (binding?.method) query.set('auth_method', binding.method) + if (binding?.account_id) query.set('account_id', binding.account_id) + const suffix = query.size > 0 ? `?${query.toString()}` : '' + return request(`/api/setup/providers/${encodeURIComponent(providerId)}/models${suffix}`) + }, setupComplete: (data: { provider: string; api_key?: string; auth_binding?: ProviderAuthBinding; model?: string; model_reasoning?: boolean; base_url?: string; name?: string; headers?: Record }) => request<{ status: string; provider: string; model: string }>('/api/setup/complete', { method: 'POST', From c1338d3e6c7abe69a59c9083754c513611fe1bf1 Mon Sep 17 00:00:00 2001 From: jack Date: Sun, 9 Aug 2026 22:17:18 +0800 Subject: [PATCH 4/5] fix: cache managed catalogs and expose xAI image tool --- CHANGELOG.md | 2 + internal-doc/provider-unified-auth-poc.md | 6 +- internal/command/web_tool_overrides.go | 5 +- internal/command/web_tool_overrides_test.go | 19 ++++ site/docs/changelog.md | 2 + site/docs/overview/models.md | 11 ++- web/src/components/SettingsView.test.tsx | 80 +++++++++++++++++ web/src/components/SettingsView.tsx | 96 +++++++++++++-------- web/src/lib/providerCatalogCache.ts | 94 ++++++++++++++++++++ 9 files changed, 273 insertions(+), 42 deletions(-) create mode 100644 web/src/lib/providerCatalogCache.ts diff --git a/CHANGELOG.md b/CHANGELOG.md index 42e7e558..aabc65ef 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -23,6 +23,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Fixed - Grok device sign-in now accepts xAI's official `accounts.x.ai/oauth2/device` verification page while retaining strict HTTPS, host, port, and user-info checks. +- Provider Settings now shows the last successful account-scoped model catalog immediately when reopened, revalidates it in the background, and preserves it through transient refresh failures without allowing an older account request to overwrite newer results. +- Managed Grok Image Models now pass the image-tool availability check without requiring an API key, so selecting a supported Grok Imagine model exposes `generate_image` to active normal-mode agents. - Provider configuration writes are serialized as reload → mutate → atomic save, reject stale snapshots, preserve secrets, and rebuild provider tools after keys, endpoints, or models change. - Session replay now restores provider operations, managed Artifacts, tool lifecycle, session modes, and per-session tool overrides without trusting dropped WebSocket events. diff --git a/internal-doc/provider-unified-auth-poc.md b/internal-doc/provider-unified-auth-poc.md index 1dc91969..28dcf984 100644 --- a/internal-doc/provider-unified-auth-poc.md +++ b/internal-doc/provider-unified-auth-poc.md @@ -79,7 +79,11 @@ and proves: 15. xAI image and video entries are separated from chat. The official managed xAI image profile pins `api.x.ai/v1/images/generations`, resolves its token only at dispatch, and reuses the billable-operation approval, journal, - quota, Artifact, and safe-download pipeline. + quota, Artifact, and safe-download pipeline; +16. the Web/Desktop Provider catalog uses a token-free, account-aware local + stale-while-revalidate cache. It renders the last successful list before + the live request completes, retains it on transient failure, and rejects + stale responses from an earlier account or refresh generation. ## Accepted result diff --git a/internal/command/web_tool_overrides.go b/internal/command/web_tool_overrides.go index 8059d7da..d19e0524 100644 --- a/internal/command/web_tool_overrides.go +++ b/internal/command/web_tool_overrides.go @@ -7,6 +7,7 @@ import ( "github.com/cloudwego/eino/components/tool" "github.com/cnjack/jcode/internal/config" + "github.com/cnjack/jcode/internal/providerauth" "github.com/cnjack/jcode/internal/providertools" "github.com/cnjack/jcode/internal/session" "github.com/cnjack/jcode/internal/toolpolicy" @@ -86,7 +87,9 @@ func evaluateImageGenerationAvailability(cfg *config.Config) (bool, string) { return false, web.SessionToolDisabledNoModel } provider := cfg.GetProviders()[providerID] - if provider == nil || strings.TrimSpace(provider.APIKey) == "" { + managedXAI := providerID == "xai" && provider != nil && provider.Auth != nil && + provider.Auth.Method == string(providerauth.MethodXAIOAuth) + if provider == nil || (strings.TrimSpace(provider.APIKey) == "" && !managedXAI) { return false, web.SessionToolDisabledProviderDisabled } if _, err := providertools.ResolveImageRuntime(cfg); err != nil { diff --git a/internal/command/web_tool_overrides_test.go b/internal/command/web_tool_overrides_test.go index f0bfd018..6bcf15c0 100644 --- a/internal/command/web_tool_overrides_test.go +++ b/internal/command/web_tool_overrides_test.go @@ -8,6 +8,7 @@ import ( "github.com/cloudwego/eino/schema" "github.com/cnjack/jcode/internal/config" + "github.com/cnjack/jcode/internal/providerauth" "github.com/cnjack/jcode/internal/providertools" "github.com/cnjack/jcode/internal/session" "github.com/cnjack/jcode/internal/toolpolicy" @@ -179,6 +180,24 @@ func TestRemoteWebTaskAllowsOnlyLocalManagedImageGeneration(t *testing.T) { } } +func TestManagedXAIImageGenerationPassesAvailabilityGate(t *testing.T) { + cfg := &config.Config{ + ImageModel: "xai/grok-imagine-image-quality", + Providers: map[string]*config.ProviderConfig{ + "xai": {Auth: &config.ProviderAuthBinding{ + Method: string(providerauth.MethodXAIOAuth), AccountID: "account-1", + }}, + }, + } + available, reason := evaluateImageGenerationAvailability(cfg) + if !available || reason != "" { + t.Fatalf("managed xAI image availability = %v, %q", available, reason) + } + if !imageGenerationEnabled(cfg, false, true) { + t.Fatal("managed xAI image model was filtered before tool construction") + } +} + func webSearchTestConfigAndCatalog(t *testing.T) (*config.Config, *providerSearchMCPCatalog) { t.Helper() cfg := providerSearchCommandConfig(2, 10) diff --git a/site/docs/changelog.md b/site/docs/changelog.md index 9662aa17..521a5f4c 100644 --- a/site/docs/changelog.md +++ b/site/docs/changelog.md @@ -23,6 +23,8 @@ For implementation-level detail, see the repository's full [CHANGELOG.md](https: #### Fixed - Grok device sign-in accepts xAI's official account verification page without weakening verification-URL origin checks. +- Reopening Provider Settings renders the last successful account model catalog immediately, refreshes it in the background, and keeps the cached list if the provider is temporarily unavailable. +- A selected Grok Imagine model now correctly enables the agent's image-generation tool when the Provider uses Grok account sign-in instead of an API key. #### Security - Billable provider operations require an explicit approval choice before execution. Session and configuration persistence also gains file locking, directory synchronization, security journaling, and secret-safe MCP updates. diff --git a/site/docs/overview/models.md b/site/docs/overview/models.md index 828f664c..260a4106 100644 --- a/site/docs/overview/models.md +++ b/site/docs/overview/models.md @@ -99,10 +99,13 @@ cannot redirect or replace their authorization. Managed Providers load the model catalog for the selected account instead of assuming that every subscription exposes the same models. In Settings, use the refresh action to reload that catalog, then enable the models you want in the -chat picker. Enabled live models are retained locally for restart continuity. -GitHub Copilot may expose OpenAI, Google, Microsoft, and other vendor models in -one account; jcode preserves the wire protocol advertised for each enabled -model. +chat picker. After the first successful load, Settings keeps an account-scoped +local catalog cache: reopening the page shows it immediately while a background +request fetches newer results. A transient refresh failure leaves the cached +list visible, and changing the bound/default account uses a separate cache. +Enabled live models are retained locally for restart continuity. GitHub Copilot +may expose OpenAI, Google, Microsoft, and other vendor models in one account; +jcode preserves the wire protocol advertised for each enabled model. {: .note } **Sign in with ChatGPT** is the ChatGPT/Codex subscription transport, not a diff --git a/web/src/components/SettingsView.test.tsx b/web/src/components/SettingsView.test.tsx index 0f98677f..cd654710 100644 --- a/web/src/components/SettingsView.test.tsx +++ b/web/src/components/SettingsView.test.tsx @@ -15,6 +15,10 @@ import { i18n } from '../i18n' import { store, uiActions } from '../app/store' import { buildImageEndpointConfig, buildProviderBaseURLUpdate, SettingsView } from './SettingsView' import { api } from '../lib/api' +import { + removeProviderCatalogCache, + writeProviderCatalogCache, +} from '../lib/providerCatalogCache' function renderView() { return render( @@ -154,6 +158,82 @@ describe('SettingsView', () => { expect(toggle.getAttribute('aria-checked')).toBe('true') }) + it('renders a cached provider catalog before background revalidation completes', async () => { + const provider = { + id: 'cached-copilot', name: 'Cached Copilot', api_key_set: false, + auth_binding: { method: 'github_copilot' as const, account_id: 'account-cache' }, + auth_status: { + method: 'github_copilot' as const, + default_account_id: 'account-cache', + accounts: [{ + id: 'account-cache', login: 'cached-user', authenticated_at: '2026-08-09T08:00:00Z', requires_reauth: false, + }], + }, + capabilities: [], + } + removeProviderCatalogCache(provider.id) + writeProviderCatalogCache(provider, [{ id: 'cached-model', name: 'Cached Model', added: true }]) + const liveCatalog = deferred>() + vi.spyOn(api, 'listProviders').mockResolvedValue([provider]) + vi.spyOn(api, 'providerCatalog').mockReturnValue(liveCatalog.promise) + vi.spyOn(api, 'setupProviders').mockResolvedValue([]) + vi.spyOn(api, 'models').mockResolvedValue({ + current: { provider: '', model: '' }, current_image: { provider: '', model: '' }, providers: [], + }) + + store.dispatch(uiActions.setSettingsTab('providers')) + renderView() + expect(await screen.findByText('Cached Model')).toBeTruthy() + expect(api.providerCatalog).toHaveBeenCalledWith(provider.id) + + await act(async () => { + liveCatalog.resolve([{ id: 'fresh-model', name: 'Fresh Model', added: true }]) + await Promise.resolve() + }) + expect(await screen.findByText('Fresh Model')).toBeTruthy() + expect(screen.queryByText('Cached Model')).toBeNull() + removeProviderCatalogCache(provider.id) + }) + + it('does not let an older catalog request overwrite a newer refresh', async () => { + const provider = { + id: 'racing-copilot', name: 'Racing Copilot', api_key_set: false, + auth_binding: { method: 'github_copilot' as const, account_id: 'account-race' }, + capabilities: [], + } + removeProviderCatalogCache(provider.id) + const initialRequest = deferred>() + const refreshRequest = deferred>() + vi.spyOn(api, 'listProviders').mockResolvedValue([provider]) + vi.spyOn(api, 'providerCatalog') + .mockReturnValueOnce(initialRequest.promise) + .mockReturnValueOnce(refreshRequest.promise) + vi.spyOn(api, 'setupProviders').mockResolvedValue([]) + vi.spyOn(api, 'models').mockResolvedValue({ + current: { provider: '', model: '' }, current_image: { provider: '', model: '' }, providers: [], + }) + + store.dispatch(uiActions.setSettingsTab('providers')) + renderView() + await screen.findByText('Racing Copilot') + fireEvent.click(screen.getByTitle('Refresh catalog')) + expect(api.providerCatalog).toHaveBeenCalledTimes(2) + + await act(async () => { + refreshRequest.resolve([{ id: 'new-model', name: 'New Model', added: true }]) + await Promise.resolve() + }) + expect(await screen.findByText('New Model')).toBeTruthy() + + await act(async () => { + initialRequest.resolve([{ id: 'old-model', name: 'Old Model', added: true }]) + await Promise.resolve() + }) + expect(screen.queryByText('Old Model')).toBeNull() + expect(screen.getByText('New Model')).toBeTruthy() + removeProviderCatalogCache(provider.id) + }) + it('sends base_url null when Settings clears a BigModel proxy without resending the API key', async () => { vi.spyOn(api, 'listProviders').mockResolvedValue([{ id: 'zhipuai-coding-plan', name: 'BigModel Coding Plan', api_key_set: true, diff --git a/web/src/components/SettingsView.tsx b/web/src/components/SettingsView.tsx index 019d94bb..6004f9ee 100644 --- a/web/src/components/SettingsView.tsx +++ b/web/src/components/SettingsView.tsx @@ -87,6 +87,11 @@ import { TEXTAREA, } from './settings/atoms' import { api } from '../lib/api' +import { + readProviderCatalogCache, + removeProviderCatalogCache, + writeProviderCatalogCache, +} from '../lib/providerCatalogCache' import { openRemoteConnect } from '../lib/remote' import { openUrl } from '../lib/useDesktop' import { LOCALE_LABELS, SUPPORTED_LOCALES, setLocale, type SupportedLocale } from '../i18n' @@ -327,6 +332,7 @@ function ProvidersTab() { const [setupList, setSetupList] = useState([]) const [catalogs, setCatalogs] = useState>({}) const [catalogLoading, setCatalogLoading] = useState('') + const catalogRequestEpochs = useRef(new Map()) const [adding, setAdding] = useState(false) const [editing, setEditing] = useState(null) const [modelForm, setModelForm] = useState<{ providerId: string; target: CustomModelDetail | null } | null>(null) @@ -360,29 +366,51 @@ function ProvidersTab() { } } + function beginCatalogRequest(providerId: string): number { + const epoch = (catalogRequestEpochs.current.get(providerId) ?? 0) + 1 + catalogRequestEpochs.current.set(providerId, epoch) + return epoch + } + + function catalogRequestIsCurrent(providerId: string, epoch: number): boolean { + return catalogRequestEpochs.current.get(providerId) === epoch + } + + async function revalidateCatalog(provider: ProviderDetail, showLoading = false): Promise { + const epoch = beginCatalogRequest(provider.id) + if (showLoading) setCatalogLoading(provider.id) + try { + const catalog = await api.providerCatalog(provider.id) + if (!catalogRequestIsCurrent(provider.id, epoch)) return + writeProviderCatalogCache(provider, catalog) + setCatalogs((current) => ({ ...current, [provider.id]: catalog })) + } catch { + // Keep the last successful cache. A transient provider outage must not + // make known models disappear when reopening Settings. + } finally { + if (showLoading && catalogRequestIsCurrent(provider.id, epoch)) { + setCatalogLoading('') + } + } + } + async function load() { setLoading(true) try { const list = await api.listProviders() setProviders(list) - // Pre-fetch each provider's catalog so the browse panel shows models - // immediately (the card's catalog is open by default). - await Promise.all( - list.map(async (p) => { - if (!catalogs[p.id]) { - try { - const cat = await api.providerCatalog(p.id) - setCatalogs((prev) => ({ ...prev, [p.id]: cat })) - } catch { - setCatalogs((prev) => ({ ...prev, [p.id]: [] })) - } - } - }), - ) + setCatalogs(Object.fromEntries(list.map((provider) => [ + provider.id, + readProviderCatalogCache(provider) ?? [], + ]))) + // Stale-while-revalidate: cards render the last successful account-aware + // catalog immediately, then replace it only after the live request wins. + setLoading(false) + void Promise.all(list.map((provider) => revalidateCatalog(provider))) } catch { /* ignore */ + setLoading(false) } - setLoading(false) } useEffect(() => { @@ -482,43 +510,37 @@ function ProvidersTab() { } async function refreshCatalog(providerId: string) { - setCatalogLoading(providerId) - try { - const cat = await api.providerCatalog(providerId) - setCatalogs((prev) => ({ ...prev, [providerId]: cat })) - } catch { - setCatalogs((prev) => ({ ...prev, [providerId]: [] })) - } - setCatalogLoading('') + const provider = providers.find((candidate) => candidate.id === providerId) + if (provider) await revalidateCatalog(provider, true) } async function onProviderSaved() { const nextProviders = await api.listProviders() setProviders(nextProviders) - const refreshedCatalogs = await Promise.all( - nextProviders.map(async (provider) => { - try { - return [provider.id, await api.providerCatalog(provider.id)] as const - } catch { - return [provider.id, []] as const - } - }), - ) - setCatalogs((current) => ({ ...current, ...Object.fromEntries(refreshedCatalogs) })) + setCatalogs(Object.fromEntries(nextProviders.map((provider) => [ + provider.id, + readProviderCatalogCache(provider) ?? [], + ]))) + await Promise.all(nextProviders.map((provider) => revalidateCatalog(provider))) await refreshModels() setEditing(null) setAdding(false) } async function onProviderAuthenticated(providerId: string) { + let refreshedProvider: ProviderDetail | undefined try { - setProviders(await api.listProviders()) + const nextProviders = await api.listProviders() + refreshedProvider = nextProviders.find((provider) => provider.id === providerId) + setProviders(nextProviders) } catch { // The account is already stored; keep the form usable if an older server // cannot yet project managed-auth state onto provider details. } - if (providers.some((provider) => provider.id === providerId)) { - await refreshCatalog(providerId) + if (refreshedProvider) { + const cached = readProviderCatalogCache(refreshedProvider) + setCatalogs((current) => ({ ...current, [providerId]: cached ?? [] })) + await revalidateCatalog(refreshedProvider, true) } await refreshModels() } @@ -526,6 +548,8 @@ function ProvidersTab() { async function deleteProvider(id: string) { try { await api.deleteProvider(id) + beginCatalogRequest(id) + removeProviderCatalogCache(id) setProviders((prev) => prev.filter((p) => p.id !== id)) await refreshModels() } catch (err) { diff --git a/web/src/lib/providerCatalogCache.ts b/web/src/lib/providerCatalogCache.ts new file mode 100644 index 00000000..a476240c --- /dev/null +++ b/web/src/lib/providerCatalogCache.ts @@ -0,0 +1,94 @@ +import type { CatalogModel, ProviderDetail } from './types' + +const STORAGE_KEY = 'jcode.providerCatalogCache.v1' +const MAX_AGE_MS = 30 * 24 * 60 * 60 * 1000 +const MAX_ENTRIES = 64 + +interface CatalogCacheEntry { + provider_id: string + updated_at: number + models: CatalogModel[] +} + +const memoryCache = new Map() +let hydrated = false + +function cacheKey(provider: ProviderDetail): string { + const accountID = provider.auth_binding?.account_id + || provider.auth_status?.default_account_id + || '' + return [ + provider.id, + provider.auth_binding?.method || 'api_key', + accountID, + provider.base_url || '', + ].join('\u001f') +} + +function cloneModels(models: CatalogModel[]): CatalogModel[] { + return models.map((model) => ({ + ...model, + effort_tiers: model.effort_tiers ? [...model.effort_tiers] : undefined, + })) +} + +function hydrate(): void { + if (hydrated) return + hydrated = true + try { + const raw = window.localStorage.getItem(STORAGE_KEY) + if (!raw) return + const parsed = JSON.parse(raw) as Record + const now = Date.now() + for (const [key, entry] of Object.entries(parsed)) { + if (!entry || typeof entry.provider_id !== 'string' + || typeof entry.updated_at !== 'number' || !Array.isArray(entry.models) + || now - entry.updated_at > MAX_AGE_MS) continue + memoryCache.set(key, { + provider_id: entry.provider_id, + updated_at: entry.updated_at, + models: cloneModels(entry.models), + }) + } + } catch { + // Cache corruption or unavailable storage must never block Settings. + } +} + +function persist(): void { + try { + const entries = [...memoryCache.entries()] + .sort((left, right) => right[1].updated_at - left[1].updated_at) + .slice(0, MAX_ENTRIES) + memoryCache.clear() + for (const [key, entry] of entries) memoryCache.set(key, entry) + window.localStorage.setItem(STORAGE_KEY, JSON.stringify(Object.fromEntries(entries))) + } catch { + // The in-memory cache remains usable when storage is disabled or full. + } +} + +export function readProviderCatalogCache(provider: ProviderDetail): CatalogModel[] | undefined { + hydrate() + const entry = memoryCache.get(cacheKey(provider)) + if (!entry || Date.now() - entry.updated_at > MAX_AGE_MS) return undefined + return cloneModels(entry.models) +} + +export function writeProviderCatalogCache(provider: ProviderDetail, models: CatalogModel[]): void { + hydrate() + memoryCache.set(cacheKey(provider), { + provider_id: provider.id, + updated_at: Date.now(), + models: cloneModels(models), + }) + persist() +} + +export function removeProviderCatalogCache(providerID: string): void { + hydrate() + for (const [key, entry] of memoryCache) { + if (entry.provider_id === providerID) memoryCache.delete(key) + } + persist() +} From 0bb1db3e6ac464a422948fffa7a750d2f3ccaf4c Mon Sep 17 00:00:00 2001 From: jack Date: Mon, 10 Aug 2026 10:51:36 +0800 Subject: [PATCH 5/5] fix xAI image geometry controls --- CHANGELOG.md | 1 + internal-doc/image-generation-architecture.md | 2 +- .../provider-tools-image-generation-prd.md | 2 + internal-doc/provider-unified-auth-poc.md | 12 +- internal/command/image_generation.go | 14 +- internal/command/image_generation_test.go | 11 ++ internal/handler/acp.go | 2 + internal/handler/acp_test.go | 9 +- internal/handler/handler.go | 8 ++ internal/handler/web_test.go | 7 +- internal/imagegen/client.go | 121 ++++++++++++++++-- internal/imagegen/client_test.go | 94 ++++++++++++++ internal/imagegen/token_plan_multimodal.go | 3 +- internal/providertools/manifest.go | 44 +++++-- internal/providertools/manifest_test.go | 43 ++++++- internal/runner/approval.go | 4 + internal/runner/approval_test.go | 11 ++ internal/tools/generate_image.go | 116 ++++++++++++++--- internal/tools/generate_image_test.go | 99 +++++++++++++- internal/web/models.go | 16 +++ internal/web/models_test.go | 37 +++++- packages/jcode-ui-core/CHANGELOG.md | 3 +- packages/jcode-ui-core/src/types/index.ts | 2 + packages/jcode-ui/CHANGELOG.md | 2 +- .../src/components/ApprovalBanner.test.tsx | 17 +++ .../src/components/ApprovalBanner.tsx | 5 +- packages/jcode-ui/src/product/types.ts | 2 + site/docs/changelog.md | 1 + site/docs/overview/models.md | 4 +- web/src/lib/types.ts | 2 + 30 files changed, 628 insertions(+), 66 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index aabc65ef..28c4745f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -17,6 +17,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - **Provider capability routing.** Settings now distinguishes chat, image generation, vision input, and provider-bound tools using the exact provider profile, endpoint, protocol, and model. It includes an Image Model picker, provider capability status, a BigModel Search MCP preset, and provider Web Search policy. ### Changed +- Grok Imagine generation now uses xAI-native `aspect_ratio` and `resolution` controls (`1k`/`2k`) instead of forwarding OpenAI-style `size`; older common JCode sizes are normalized into the equivalent native controls before approval and dispatch. - **Ask User is now a bottom interaction dock.** Pending questions replace the composer and are presented one at a time with paging, recommended and multi-select options, custom answers, skip, submission progress, and retryable errors. Once answered, a compact receipt remains in the conversation timeline. - Pending Ask User calls no longer merge into activity groups, and both pending and resolved question surfaces align with the conversation gutter. - Fresh blank sessions hide task/session chrome until conversation work exists; loading and persisted sessions keep their controls. diff --git a/internal-doc/image-generation-architecture.md b/internal-doc/image-generation-architecture.md index 2ed77767..ddd2bc82 100644 --- a/internal-doc/image-generation-architecture.md +++ b/internal-doc/image-generation-architecture.md @@ -26,7 +26,7 @@ - BigModel `cogview-3-flash` 精确 capability rule； - Alibaba Token Plan `wan2.7-image` / `wan2.7-image-pro` 精确 rule 与专属同步 `token_plan_multimodal` adapter； - 全局 Image Model； -- 条件注册的 `generate_image(prompt, size?)`，P0 严格单图且请求 schema 不暴露 `count`； +- 根据所选 adapter 条件注册 `generate_image` 参数：通用端点使用 `size?`，xAI 使用 `aspect_ratio?` / `resolution?`；P0 严格单图且请求 schema 不暴露 `count`； - provider URL/base64 同步结果； - managed Artifact v2、本地回放、Web/Desktop 图片卡、TUI 路径、ACP 文本/resource-link 降级； - BigModel Search MCP preset，先完成 MCP secret mask/merge； diff --git a/internal-doc/provider-tools-image-generation-prd.md b/internal-doc/provider-tools-image-generation-prd.md index 65e30883..056dc0b1 100644 --- a/internal-doc/provider-tools-image-generation-prd.md +++ b/internal-doc/provider-tools-image-generation-prd.md @@ -442,6 +442,7 @@ provider 返回 URL、base64 或 async task 时，adapter 统一产出受限 byt { "prompt": "required string", "aspect_ratio": "optional provider-neutral enum", + "resolution": "optional provider-native validated value", "size": "optional validated value", "quality": "optional enum" } @@ -454,6 +455,7 @@ provider 返回 URL、base64 或 async task 时，adapter 统一产出受限 byt - 属于 approval class `billable_external`，不加入 `noApprovalNeeded`。Ask for approval 与 Auto 不得静默批准；Full access 在 runner 校验 typed intent 与工具身份后直接放行，不产生 ApprovalRequest； - 需要审批时，每次审批只对应一次 `(provider profile, endpoint profile, model, normalized args, idempotency key)` 请求，选项只有“仅本次/拒绝”；不提供独立的图片 session grant，Full access 是统一会话模式； - P0 schema 不暴露 `count`，请求固定 1，provider 结果必须恰好 1 张；返回 0 或多张均 fail closed； +- schema 由所选 Image Model 的 capability 构造：xAI 只向 Agent 暴露原生 `aspect_ratio` / `resolution`，通用 OpenAI Images 与 Token Plan 继续暴露 `size`。旧版 xAI `size` 输入必须在审批前显式规范化，不得把两套几何字段同时发送； - 不默认暴露给 subagent，防止同一 prompt 并发重复计费； - 不自动跨 provider/model fallback； - 一个批准动作只生成一个 idempotency key。provider 已接受请求后，网络不确定性不得自动重复提交；只允许用同一个 key 查询/恢复既有 task； diff --git a/internal-doc/provider-unified-auth-poc.md b/internal-doc/provider-unified-auth-poc.md index 28dcf984..6de3fad3 100644 --- a/internal-doc/provider-unified-auth-poc.md +++ b/internal-doc/provider-unified-auth-poc.md @@ -79,7 +79,9 @@ and proves: 15. xAI image and video entries are separated from chat. The official managed xAI image profile pins `api.x.ai/v1/images/generations`, resolves its token only at dispatch, and reuses the billable-operation approval, journal, - quota, Artifact, and safe-download pipeline; + quota, Artifact, and safe-download pipeline. Its adapter emits native + `aspect_ratio` and `resolution` fields and never mixes them with OpenAI + `size` controls; 16. the Web/Desktop Provider catalog uses a token-free, account-aware local stale-while-revalidate cache. It renders the last successful list before the live request completes, retains it on transient failure, and rejects @@ -90,5 +92,9 @@ and proves: The POC is accepted when the focused auth, catalog, model transport and provider API tests pass without network access. A manual account-scoped smoke test also confirmed that xAI and GitHub Copilot return their live model catalogs, and that -the connected xAI account can read the official image-generation catalog. No -billable inference or image-generation request is part of that smoke test. +the connected xAI account can read the official image-generation catalog. A +later, explicitly user-authorized one-shot smoke test also confirmed that the +managed xAI OAuth credential can generate one image without a separate API key; +the generated asset and credentials were not committed. That billable smoke +used `grok-imagine-image`; the quality variant is covered by the same local wire +contract but was not invoked live to avoid a second provider charge. diff --git a/internal/command/image_generation.go b/internal/command/image_generation.go index 4eda11bc..3ff1ea72 100644 --- a/internal/command/image_generation.go +++ b/internal/command/image_generation.go @@ -76,7 +76,7 @@ func configuredGenerateImageTool( return nil, fmt.Errorf("configure image epoch: %w", err) } _ = epoch // parsed here so invalid epochs keep the tool out of the catalog - sizes := imageModelSizes(cfg, runtime.Provider, runtime.Model) + sizes, aspectRatios, resolutions := imageModelCapabilities(cfg, runtime.Provider, runtime.Model) ledger.SetLimits(runtime.MaxCallsPerTurn, runtime.MaxCallsPerSession) return tools.NewGenerateImageTool(&tools.GenerateImageDeps{ Generator: client, ArtifactService: service, Recorder: recorder, Ledger: ledger, @@ -88,6 +88,7 @@ func configuredGenerateImageTool( Tool: session.SessionToolImageGeneration, MaxPerSession: runtime.MaxCallsPerSession, }, VerifyRuntime: imageRuntimeVerifier(runtime, runtimeLoader), SupportedSizes: sizes, + SupportedAspectRatios: aspectRatios, SupportedResolutions: resolutions, Progress: func(event handler.ToolProgressEvent) { handler.EmitToolProgress(eventHandler, event) }, @@ -132,11 +133,16 @@ func dispatchedImageOperationCount(sessionID string) (int, error) { return dispatched, nil } -func imageModelSizes(cfg *config.Config, providerID, modelID string) []string { +func imageModelCapabilities( + cfg *config.Config, + providerID, modelID string, +) (sizes, aspectRatios, resolutions []string) { for _, model := range providertools.ImageModels(cfg) { if model.Provider == providerID && model.ID == modelID { - return append([]string(nil), model.Sizes...) + return append([]string(nil), model.Sizes...), + append([]string(nil), model.AspectRatios...), + append([]string(nil), model.Resolutions...) } } - return nil + return nil, nil, nil } diff --git a/internal/command/image_generation_test.go b/internal/command/image_generation_test.go index 2ddc4ac0..8ee3edb3 100644 --- a/internal/command/image_generation_test.go +++ b/internal/command/image_generation_test.go @@ -2,8 +2,10 @@ package command import ( "context" + "encoding/json" "os" "path/filepath" + "strings" "testing" "time" @@ -110,6 +112,15 @@ func TestConfiguredGenerateImageToolAcceptsManagedXAIAccount(t *testing.T) { if err != nil || info == nil || info.Name != "generate_image" { t.Fatalf("tool info=%#v err=%v", info, err) } + encoded, err := json.Marshal(info) + if err != nil { + t.Fatal(err) + } + if strings.Contains(string(encoded), `"size"`) || + !strings.Contains(string(encoded), `"aspect_ratio"`) || + !strings.Contains(string(encoded), `"resolution"`) { + t.Fatalf("managed xAI tool schema = %s", encoded) + } } func TestGenerateImageCatalogIsNormalModeOnlyAcrossTransports(t *testing.T) { diff --git a/internal/handler/acp.go b/internal/handler/acp.go index 9051e822..31ba6820 100644 --- a/internal/handler/acp.go +++ b/internal/handler/acp.go @@ -161,6 +161,8 @@ func billableACPPresentation(summary *BillableApprovalSummary) acpToolPresentati "provider": summary.Provider, "model": summary.Model, "size": summary.Size, + "aspect_ratio": summary.AspectRatio, + "resolution": summary.Resolution, "count": summary.Count, "billable": summary.Billable, "has_reference": summary.HasReference, diff --git a/internal/handler/acp_test.go b/internal/handler/acp_test.go index ee9c74d2..bb4c67e9 100644 --- a/internal/handler/acp_test.go +++ b/internal/handler/acp_test.go @@ -150,15 +150,16 @@ func TestACPToolPresentationSearchAndExecute(t *testing.T) { func TestBillableACPPresentationContainsOnlyBoundedSummary(t *testing.T) { summary := &BillableApprovalSummary{ - Capability: "image.generate", Provider: "bigmodel", Model: "cogview", - Size: "1024x1024", Count: 1, Billable: true, + Capability: "image.generate", Provider: "xai", Model: "grok-imagine-image", + AspectRatio: "9:16", Resolution: "2k", Count: 1, Billable: true, } presentation := billableACPPresentation(summary) - if presentation.Title != "Generate image with bigmodel / cogview" { + if presentation.Title != "Generate image with xai / grok-imagine-image" { t.Fatalf("title = %q", presentation.Title) } input, ok := presentation.RawInput.(map[string]any) - if !ok || input["capability"] != "image.generate" || input["provider"] != "bigmodel" { + if !ok || input["capability"] != "image.generate" || input["provider"] != "xai" || + input["aspect_ratio"] != "9:16" || input["resolution"] != "2k" { t.Fatalf("raw input = %#v", presentation.RawInput) } encoded, err := json.Marshal(input) diff --git a/internal/handler/handler.go b/internal/handler/handler.go index d708f7a3..671346ae 100644 --- a/internal/handler/handler.go +++ b/internal/handler/handler.go @@ -239,6 +239,8 @@ type BillableApprovalSummary struct { Provider string `json:"provider,omitempty"` Model string `json:"model,omitempty"` Size string `json:"size,omitempty"` + AspectRatio string `json:"aspect_ratio,omitempty"` + Resolution string `json:"resolution,omitempty"` Count int `json:"count,omitempty"` Billable bool `json:"billable,omitempty"` HasReference bool `json:"has_reference,omitempty"` @@ -261,6 +263,12 @@ func formatBillableApprovalSummary(summary *BillableApprovalSummary) string { if summary.Size != "" { parts = append(parts, "Size: "+summary.Size) } + if summary.AspectRatio != "" { + parts = append(parts, "Aspect ratio: "+summary.AspectRatio) + } + if summary.Resolution != "" { + parts = append(parts, "Resolution: "+summary.Resolution) + } if summary.HasReference { parts = append(parts, "Reference image: yes") } diff --git a/internal/handler/web_test.go b/internal/handler/web_test.go index 01c07954..ba370219 100644 --- a/internal/handler/web_test.go +++ b/internal/handler/web_test.go @@ -71,13 +71,13 @@ func TestWebHandlerBillableApprovalRequiresOpaqueOneTimeOption(t *testing.T) { responseCh := make(chan ApprovalResponse, 1) go func() { response, err := h.RequestApproval(ctx, ApprovalRequest{ - ToolName: "generate_image", ToolArgs: `{"prompt":"private prompt","size":"1024x1024"}`, + ToolName: "generate_image", ToolArgs: `{"prompt":"private prompt","aspect_ratio":"9:16","resolution":"2k"}`, ToolCallID: "call-image-1", ApprovalClass: "billable_external", AllowApproveAll: false, Options: issuedOptions, BillableSummary: &BillableApprovalSummary{ Capability: "image.generate", Provider: "provider", Model: "image-model", - Size: "1024x1024", Count: 1, Billable: true, + AspectRatio: "9:16", Resolution: "2k", Count: 1, Billable: true, }, }) if err != nil { @@ -96,6 +96,9 @@ func TestWebHandlerBillableApprovalRequiresOpaqueOneTimeOption(t *testing.T) { request.Options[0].ID == request.Options[1].ID || request.BillableSummary == nil { t.Fatalf("billable request = %#v", request) } + if request.BillableSummary.AspectRatio != "9:16" || request.BillableSummary.Resolution != "2k" { + t.Fatalf("billable native geometry = %#v", request.BillableSummary) + } if request.Options[0].ID != issuedOptions[0].ID || request.Options[1].ID != issuedOptions[1].ID { t.Fatalf("web transport replaced runner option ids: %#v", request.Options) } diff --git a/internal/imagegen/client.go b/internal/imagegen/client.go index 4ee58913..d99547de 100644 --- a/internal/imagegen/client.go +++ b/internal/imagegen/client.go @@ -29,6 +29,25 @@ const ( maxPromptBytes = 64 << 10 ) +var ( + xaiImageAspectRatios = []string{ + "1:1", "16:9", "9:16", "4:3", "3:4", "3:2", "2:3", "2:1", "1:2", + "19.5:9", "9:19.5", "20:9", "9:20", "auto", + } + xaiImageResolutions = []string{"1k", "2k"} +) + +// XAIImageAspectRatios returns the supported xAI image geometry values without +// exposing mutable package state to capability consumers. +func XAIImageAspectRatios() []string { + return append([]string(nil), xaiImageAspectRatios...) +} + +// XAIImageResolutions returns the supported xAI resolution values. +func XAIImageResolutions() []string { + return append([]string(nil), xaiImageResolutions...) +} + // Protocol identifies the upstream image-generation wire protocol. type Protocol string @@ -36,6 +55,10 @@ const ( // ProtocolOpenAIImages is the POST /images/generations JSON protocol used // by OpenAI and compatible providers such as BigModel. ProtocolOpenAIImages Protocol = "openai_images" + // ProtocolXAIImages is xAI's image-generation protocol. Although it shares + // the OpenAI Images endpoint shape, its native output controls are + // aspect_ratio and resolution rather than size. + ProtocolXAIImages Protocol = "xai_images" // ProtocolTokenPlanMultimodal is the synchronous multimodal-generation // protocol exposed by Alibaba Token Plan. It is deliberately distinct from // both OpenAI Images and the general DashScope asynchronous task API. @@ -77,6 +100,8 @@ type CredentialFunc func(context.Context) (token string, headers map[string]stri type Request struct { Prompt string Size string + AspectRatio string + Resolution string Quality string Background string OutputFormat string @@ -106,8 +131,10 @@ type Generator interface { Generate(context.Context, Request) (Result, error) } -// Client implements the OpenAI-compatible image generation protocol. +// Client implements the shared synchronous Images transport with a +// protocol-specific request encoder. type Client struct { + protocol Protocol endpoint *url.URL apiKey string headers map[string]string @@ -126,6 +153,8 @@ func NewGenerator(cfg ClientConfig) (Generator, error) { switch cfg.Protocol { case ProtocolOpenAIImages: return NewClient(cfg) + case ProtocolXAIImages: + return NewXAIImagesClient(cfg) case ProtocolTokenPlanMultimodal: return NewTokenPlanMultimodalClient(cfg) default: @@ -139,6 +168,20 @@ func NewClient(cfg ClientConfig) (*Client, error) { if cfg.Protocol != ProtocolOpenAIImages { return nil, fmt.Errorf("unsupported image protocol %q", cfg.Protocol) } + return newClient(cfg) +} + +// NewXAIImagesClient constructs the xAI-native image adapter. Keeping this +// protocol separate prevents OpenAI-only fields from crossing the managed xAI +// boundary and makes the approved request match the dispatched payload. +func NewXAIImagesClient(cfg ClientConfig) (*Client, error) { + if cfg.Protocol != ProtocolXAIImages { + return nil, fmt.Errorf("unsupported image protocol %q", cfg.Protocol) + } + return newClient(cfg) +} + +func newClient(cfg ClientConfig) (*Client, error) { if strings.TrimSpace(cfg.Model) == "" { return nil, fmt.Errorf("image model is required") } @@ -167,7 +210,8 @@ func NewClient(cfg ClientConfig) (*Client, error) { headers[name] = value } return &Client{ - endpoint: endpoint, apiKey: cfg.APIKey, headers: headers, credential: cfg.Credential, + protocol: cfg.Protocol, endpoint: endpoint, apiKey: cfg.APIKey, + headers: headers, credential: cfg.Credential, model: strings.TrimSpace(cfg.Model), httpClient: httpClient, maxImageBytes: maxImageBytes, allowHTTP: cfg.AllowInsecureHTTP, assetHosts: assetHosts, @@ -185,6 +229,14 @@ type openAIRequest struct { N int `json:"n,omitempty"` } +type xAIRequest struct { + Model string `json:"model"` + Prompt string `json:"prompt"` + AspectRatio string `json:"aspect_ratio,omitempty"` + Resolution string `json:"resolution,omitempty"` + N int `json:"n,omitempty"` +} + type openAIResponse struct { Data []struct { URL string `json:"url"` @@ -205,12 +257,7 @@ func (c *Client) Generate(ctx context.Context, input Request) (Result, error) { if input.Count != 0 && input.Count != 1 { return Result{}, fmt.Errorf("P0 image generation supports exactly one image") } - body, err := json.Marshal(openAIRequest{ - Model: c.model, Prompt: prompt, Size: strings.TrimSpace(input.Size), - Quality: strings.TrimSpace(input.Quality), Background: strings.TrimSpace(input.Background), - OutputFormat: strings.TrimSpace(input.OutputFormat), ResponseFormat: strings.TrimSpace(input.ResponseFormat), - N: 1, - }) + body, err := c.encodeRequest(prompt, input) if err != nil { return Result{}, fmt.Errorf("encode image request: %w", err) } @@ -286,6 +333,64 @@ func (c *Client) Generate(ctx context.Context, input Request) (Result, error) { return result, nil } +func (c *Client) encodeRequest(prompt string, input Request) ([]byte, error) { + switch c.protocol { + case ProtocolOpenAIImages: + if strings.TrimSpace(input.AspectRatio) != "" || strings.TrimSpace(input.Resolution) != "" { + return nil, fmt.Errorf("image request contains options unsupported by OpenAI Images") + } + return json.Marshal(openAIRequest{ + Model: c.model, Prompt: prompt, Size: strings.TrimSpace(input.Size), + Quality: strings.TrimSpace(input.Quality), Background: strings.TrimSpace(input.Background), + OutputFormat: strings.TrimSpace(input.OutputFormat), ResponseFormat: strings.TrimSpace(input.ResponseFormat), + N: 1, + }) + case ProtocolXAIImages: + if strings.TrimSpace(input.Size) != "" || strings.TrimSpace(input.Quality) != "" || + strings.TrimSpace(input.Background) != "" || strings.TrimSpace(input.OutputFormat) != "" || + strings.TrimSpace(input.ResponseFormat) != "" { + return nil, fmt.Errorf("image request contains options unsupported by xAI Images") + } + aspectRatio := strings.TrimSpace(input.AspectRatio) + if !validXAIAspectRatio(aspectRatio) { + return nil, fmt.Errorf("unsupported xAI image aspect ratio %q", aspectRatio) + } + resolution := strings.ToLower(strings.TrimSpace(input.Resolution)) + if !validXAIResolution(resolution) { + return nil, fmt.Errorf("unsupported xAI image resolution %q", resolution) + } + return json.Marshal(xAIRequest{ + Model: c.model, Prompt: prompt, AspectRatio: aspectRatio, Resolution: resolution, N: 1, + }) + default: + return nil, fmt.Errorf("unsupported image protocol %q", c.protocol) + } +} + +func validXAIAspectRatio(value string) bool { + if value == "" { + return true + } + for _, supported := range xaiImageAspectRatios { + if value == supported { + return true + } + } + return false +} + +func validXAIResolution(value string) bool { + if value == "" { + return true + } + for _, supported := range xaiImageResolutions { + if value == supported { + return true + } + } + return false +} + func (c *Client) resolveImage(ctx context.Context, rawURL, encoded string) (Image, error) { var data []byte var err error diff --git a/internal/imagegen/client_test.go b/internal/imagegen/client_test.go index 693ab470..ebfcd89a 100644 --- a/internal/imagegen/client_test.go +++ b/internal/imagegen/client_test.go @@ -119,6 +119,100 @@ func TestOpenAIImagesManagedCredentialFailsClosed(t *testing.T) { } } +func TestXAIImagesUsesNativeGeometryWithoutOpenAIFields(t *testing.T) { + pixels := pngBytes(t, 16, 9) + var request map[string]any + httpClient := stubHTTPClient(t, func(r *http.Request) *http.Response { + if err := json.NewDecoder(r.Body).Decode(&request); err != nil { + t.Fatal(err) + } + return jsonResponse(http.StatusOK, map[string]any{"data": []map[string]string{{ + "b64_json": base64.StdEncoding.EncodeToString(pixels), + }}}) + }) + client, err := NewXAIImagesClient(ClientConfig{ + Protocol: ProtocolXAIImages, BaseURL: "https://api.x.ai/v1", Model: "grok-imagine-image", + HTTPClient: httpClient, + }) + if err != nil { + t.Fatal(err) + } + result, err := client.Generate(context.Background(), Request{ + Prompt: "wide orange circle", AspectRatio: "16:9", Resolution: "2K", Count: 1, + }) + if err != nil { + t.Fatal(err) + } + if len(result.Images) != 1 || result.Images[0].Width != 16 || result.Images[0].Height != 9 { + t.Fatalf("result = %#v", result) + } + if request["aspect_ratio"] != "16:9" || request["resolution"] != "2k" || request["n"] != float64(1) { + t.Fatalf("xAI request = %#v", request) + } + for _, forbidden := range []string{"size", "quality", "background", "output_format", "response_format"} { + if _, ok := request[forbidden]; ok { + t.Fatalf("xAI request contains %q: %#v", forbidden, request) + } + } +} + +func TestXAIImagesRejectsForeignAndUnknownGeometryBeforeDispatch(t *testing.T) { + var dispatched bool + client, err := NewXAIImagesClient(ClientConfig{ + Protocol: ProtocolXAIImages, BaseURL: "https://api.x.ai/v1", Model: "grok-imagine-image", + HTTPClient: stubHTTPClient(t, func(_ *http.Request) *http.Response { + dispatched = true + return jsonResponse(http.StatusOK, map[string]any{}) + }), + }) + if err != nil { + t.Fatal(err) + } + for _, input := range []Request{ + {Prompt: "pixel", Size: "1024x1024"}, + {Prompt: "pixel", AspectRatio: "7:5"}, + {Prompt: "pixel", Resolution: "4k"}, + } { + if _, err := client.Generate(context.Background(), input); err == nil { + t.Fatalf("Generate(%+v) succeeded", input) + } + } + if dispatched { + t.Fatal("invalid xAI request reached the provider") + } +} + +func TestXAIImagesQualityModelOmitsOptionalGeometry(t *testing.T) { + pixels := pngBytes(t, 1, 1) + var request map[string]any + client, err := NewXAIImagesClient(ClientConfig{ + Protocol: ProtocolXAIImages, BaseURL: "https://api.x.ai/v1", + Model: "grok-imagine-image-quality", + HTTPClient: stubHTTPClient(t, func(r *http.Request) *http.Response { + if err := json.NewDecoder(r.Body).Decode(&request); err != nil { + t.Fatal(err) + } + return jsonResponse(http.StatusOK, map[string]any{"data": []map[string]string{{ + "b64_json": base64.StdEncoding.EncodeToString(pixels), + }}}) + }), + }) + if err != nil { + t.Fatal(err) + } + if _, err := client.Generate(context.Background(), Request{Prompt: "provider defaults"}); err != nil { + t.Fatal(err) + } + if request["model"] != "grok-imagine-image-quality" { + t.Fatalf("xAI quality request = %#v", request) + } + for _, optional := range []string{"aspect_ratio", "resolution", "size"} { + if _, ok := request[optional]; ok { + t.Fatalf("xAI default request contains %q: %#v", optional, request) + } + } +} + func TestOpenAIImagesURLRoundTripDoesNotForwardSecrets(t *testing.T) { pixels := pngBytes(t, 1, 1) var downloadAuth, downloadCustom string diff --git a/internal/imagegen/token_plan_multimodal.go b/internal/imagegen/token_plan_multimodal.go index 8a599aa7..962d4d6c 100644 --- a/internal/imagegen/token_plan_multimodal.go +++ b/internal/imagegen/token_plan_multimodal.go @@ -121,7 +121,8 @@ func (c *TokenPlanMultimodalClient) Generate(ctx context.Context, input Request) return Result{}, fmt.Errorf("P0 image generation supports exactly one image") } if strings.TrimSpace(input.Quality) != "" || strings.TrimSpace(input.Background) != "" || - strings.TrimSpace(input.OutputFormat) != "" || strings.TrimSpace(input.ResponseFormat) != "" { + strings.TrimSpace(input.OutputFormat) != "" || strings.TrimSpace(input.ResponseFormat) != "" || + strings.TrimSpace(input.AspectRatio) != "" || strings.TrimSpace(input.Resolution) != "" { return Result{}, fmt.Errorf("image request contains options unsupported by Token Plan") } size, err := normalizeTokenPlanSize(input.Size) diff --git a/internal/providertools/manifest.go b/internal/providertools/manifest.go index a10ba14d..7fbcb8d2 100644 --- a/internal/providertools/manifest.go +++ b/internal/providertools/manifest.go @@ -36,13 +36,15 @@ func IsProviderSearchMCPServer(name string) bool { } type ImageModel struct { - Provider string `json:"provider"` - ID string `json:"id"` - Name string `json:"name"` - Protocol string `json:"protocol"` - Sizes []string `json:"sizes,omitempty"` - Builtin bool `json:"builtin"` - Supported bool `json:"supported"` + Provider string `json:"provider"` + ID string `json:"id"` + Name string `json:"name"` + Protocol string `json:"protocol"` + Sizes []string `json:"sizes,omitempty"` + AspectRatios []string `json:"aspect_ratios,omitempty"` + Resolutions []string `json:"resolutions,omitempty"` + Builtin bool `json:"builtin"` + Supported bool `json:"supported"` } type ImageRuntime struct { @@ -235,14 +237,20 @@ func ImageModels(cfg *config.Config) []ImageModel { } } if isManagedXAIProfile(providerID, provider) { + aspectRatios := imagegen.XAIImageAspectRatios() + resolutions := imagegen.XAIImageResolutions() result = append(result, []ImageModel{ { Provider: providerID, ID: "grok-imagine-image", Name: "Grok Imagine Image", - Protocol: string(imagegen.ProtocolOpenAIImages), Builtin: true, Supported: true, + Protocol: string(imagegen.ProtocolXAIImages), + AspectRatios: append([]string(nil), aspectRatios...), + Resolutions: append([]string(nil), resolutions...), Builtin: true, Supported: true, }, { Provider: providerID, ID: "grok-imagine-image-quality", Name: "Grok Imagine Image Quality", - Protocol: string(imagegen.ProtocolOpenAIImages), Builtin: true, Supported: true, + Protocol: string(imagegen.ProtocolXAIImages), + AspectRatios: append([]string(nil), aspectRatios...), + Resolutions: append([]string(nil), resolutions...), Builtin: true, Supported: true, }, }...) continue @@ -336,7 +344,7 @@ func ResolveImageRuntime(cfg *config.Config) (ImageRuntime, error) { endpoint := provider.ImageEndpoint switch { case managedXAI && isXAIImageModel(modelID): - runtime.Protocol = imagegen.ProtocolOpenAIImages + runtime.Protocol = imagegen.ProtocolXAIImages runtime.BaseURL = "https://api.x.ai/v1" runtime.AssetHosts = []string{"*.x.ai"} case endpoint != nil && configuredImageModel(endpoint.Models, modelID): @@ -366,14 +374,28 @@ func ResolveImageRuntime(cfg *config.Config) (ImageRuntime, error) { return ImageRuntime{}, fmt.Errorf("image endpoint base URL is required") } assetHostsDigest := canonicalStringSetDigest(runtime.AssetHosts) + capabilityDigest := imageModelCapabilityDigest(cfg, providerID, modelID) runtime.ConfigEpoch = shortFingerprintFields( providerID, modelID, string(runtime.Protocol), runtime.BaseURL, - runtime.CredentialFingerprint, headerDigest, assetHostsDigest, + runtime.CredentialFingerprint, headerDigest, assetHostsDigest, capabilityDigest, strconv.Itoa(runtime.MaxCallsPerTurn), strconv.Itoa(runtime.MaxCallsPerSession), ) return runtime, nil } +func imageModelCapabilityDigest(cfg *config.Config, providerID, modelID string) string { + for _, candidate := range ImageModels(cfg) { + if candidate.Provider == providerID && candidate.ID == modelID { + return shortFingerprintFields( + canonicalStringSetDigest(candidate.Sizes), + canonicalStringSetDigest(candidate.AspectRatios), + canonicalStringSetDigest(candidate.Resolutions), + ) + } + } + return shortFingerprintFields("missing-image-capability") +} + func isManagedXAIProfile(providerID string, provider *config.ProviderConfig) bool { return providerID == "xai" && provider != nil && provider.Auth != nil && provider.Auth.Method == "xai_oauth" diff --git a/internal/providertools/manifest_test.go b/internal/providertools/manifest_test.go index c3f0c2bb..fb629202 100644 --- a/internal/providertools/manifest_test.go +++ b/internal/providertools/manifest_test.go @@ -274,7 +274,10 @@ func TestResolveImageRuntimeBindsCanonicalHeadersAndRequestConfig(t *testing.T) }, ImageEndpoint: &config.ImageEndpointConfig{ Protocol: string(imagegen.ProtocolOpenAIImages), BaseURL: "https://images.example/v1", - Models: []config.ImageModelConfig{{ID: "canvas-1"}, {ID: "canvas-2"}}, + Models: []config.ImageModelConfig{ + {ID: "canvas-1", Sizes: []string{"1024x1024"}}, + {ID: "canvas-2", Sizes: []string{"1024x1024"}}, + }, AssetHosts: []string{"CDN.Example.", "*.media.example"}, }, } @@ -356,6 +359,14 @@ func TestResolveImageRuntimeBindsCanonicalHeadersAndRequestConfig(t *testing.T) if limitsChanged.ConfigEpoch == assetsChanged.ConfigEpoch { t.Fatal("limit change did not advance config epoch") } + provider.ImageEndpoint.Models[1].Sizes = []string{"1024x1536"} + capabilityChanged, err := ResolveImageRuntime(cfg) + if err != nil { + t.Fatal(err) + } + if capabilityChanged.ConfigEpoch == limitsChanged.ConfigEpoch { + t.Fatal("image capability change did not advance config epoch") + } provider.Headers["x-api-key"] = "conflicting-case-variant" if _, err := ResolveImageRuntime(cfg); err == nil || !strings.Contains(err.Error(), "conflicting image provider header") { @@ -456,13 +467,41 @@ func TestManagedXAIImageModelsAndRuntimeArePinned(t *testing.T) { if err != nil { t.Fatal(err) } - if runtime.BaseURL != "https://api.x.ai/v1" || runtime.Protocol != imagegen.ProtocolOpenAIImages || + if runtime.BaseURL != "https://api.x.ai/v1" || runtime.Protocol != imagegen.ProtocolXAIImages || runtime.APIKey != "" || runtime.AuthMethod != "xai_oauth" || runtime.AccountID != "account-1" || len(runtime.Headers) != 0 || len(runtime.AssetHosts) != 1 || runtime.AssetHosts[0] != "*.x.ai" { t.Fatalf("managed xAI runtime = %#v", runtime) } + for _, model := range models { + if model.Protocol != string(imagegen.ProtocolXAIImages) || len(model.AspectRatios) != 14 || + len(model.Resolutions) != 2 || model.Resolutions[0] != "1k" || model.Resolutions[1] != "2k" { + t.Fatalf("managed xAI geometry capabilities = %#v", model) + } + } cfg.ImageModel = "xai/attacker-model" if _, err := ResolveImageRuntime(cfg); err == nil { t.Fatal("managed xAI accepted a configuration-controlled image model") } } + +func TestCustomXAIImageProtocolIsNotExposedWithoutManagedProfile(t *testing.T) { + cfg := &config.Config{ + ImageModel: "custom/grok-imagine-image", + Providers: map[string]*config.ProviderConfig{ + "custom": { + APIKey: "secret", + ImageEndpoint: &config.ImageEndpointConfig{ + Protocol: string(imagegen.ProtocolXAIImages), BaseURL: "https://api.x.ai/v1", + Models: []config.ImageModelConfig{{ID: "grok-imagine-image"}}, + }, + }, + }, + } + models := ImageModels(cfg) + if len(models) != 1 || models[0].Supported { + t.Fatalf("custom xAI protocol unexpectedly supported: %#v", models) + } + if _, err := ResolveImageRuntime(cfg); err == nil { + t.Fatal("custom xAI protocol bypassed the managed profile gate") + } +} diff --git a/internal/runner/approval.go b/internal/runner/approval.go index f1044bb4..6a4775b2 100644 --- a/internal/runner/approval.go +++ b/internal/runner/approval.go @@ -802,10 +802,14 @@ func billableApprovalSummary(intent toolpolicy.BillableIntent) *handler.Billable } var args struct { Size string `json:"size"` + AspectRatio string `json:"aspect_ratio"` + Resolution string `json:"resolution"` ReferenceImage string `json:"reference_image"` } if json.Unmarshal([]byte(intent.NormalizedArgs), &args) == nil { summary.Size = strings.TrimSpace(args.Size) + summary.AspectRatio = strings.TrimSpace(args.AspectRatio) + summary.Resolution = strings.TrimSpace(args.Resolution) summary.HasReference = strings.TrimSpace(args.ReferenceImage) != "" } return summary diff --git a/internal/runner/approval_test.go b/internal/runner/approval_test.go index 3425e98c..71b1bfd7 100644 --- a/internal/runner/approval_test.go +++ b/internal/runner/approval_test.go @@ -357,6 +357,17 @@ func TestBillableApprovalAutoModeStillPrompts(t *testing.T) { } } +func TestBillableApprovalSummaryIncludesNativeImageGeometry(t *testing.T) { + summary := billableApprovalSummary(toolpolicy.BillableIntent{ + CapabilityKey: toolpolicy.CapabilityImageGenerate, + Provider: "xai", Model: "grok-imagine-image-quality", Count: 1, + NormalizedArgs: `{"prompt":"private","aspect_ratio":"9:16","resolution":"2k"}`, + }) + if summary.AspectRatio != "9:16" || summary.Resolution != "2k" || summary.Size != "" { + t.Fatalf("billable native geometry = %#v", summary) + } +} + func TestBillableApprovalRejectsBareBooleanAndReplayedOption(t *testing.T) { intent := toolpolicy.BillableIntent{ OperationID: "host-operation-opaque", ToolCallID: "model-call-opaque", diff --git a/internal/tools/generate_image.go b/internal/tools/generate_image.go index 092dafc3..b1c3a698 100644 --- a/internal/tools/generate_image.go +++ b/internal/tools/generate_image.go @@ -41,13 +41,17 @@ type GenerateImageDeps struct { DispatchPolicy session.DispatchPolicy VerifyRuntime func(context.Context) error SupportedSizes []string + SupportedAspectRatios []string + SupportedResolutions []string Progress func(toolstate.ProgressEvent) EmitArtifact func(artifact.Record) } type GenerateImageInput struct { - Prompt string `json:"prompt"` - Size string `json:"size,omitempty"` + Prompt string `json:"prompt"` + Size string `json:"size,omitempty"` + AspectRatio string `json:"aspect_ratio,omitempty"` + Resolution string `json:"resolution,omitempty"` } type GenerateImageOutput struct { @@ -66,19 +70,36 @@ type generateImageTool struct { } func NewGenerateImageTool(deps *GenerateImageDeps) tool.InvokableTool { + params := map[string]*schema.ParameterInfo{ + "prompt": { + Type: schema.String, Required: true, + Desc: "A concrete visual description of the single image to generate.", + }, + } + nativeGeometry := deps != nil && + (len(deps.SupportedAspectRatios) > 0 || len(deps.SupportedResolutions) > 0) + if !nativeGeometry { + params["size"] = &schema.ParameterInfo{ + Type: schema.String, + Desc: "Optional supported image size such as 1024x1024. Defaults to the provider profile's first size.", + } + } + if deps != nil && len(deps.SupportedAspectRatios) > 0 { + params["aspect_ratio"] = &schema.ParameterInfo{ + Type: schema.String, Enum: append([]string(nil), deps.SupportedAspectRatios...), + Desc: "Optional output aspect ratio supported by the configured image provider.", + } + } + if deps != nil && len(deps.SupportedResolutions) > 0 { + params["resolution"] = &schema.ParameterInfo{ + Type: schema.String, Enum: append([]string(nil), deps.SupportedResolutions...), + Desc: "Optional output resolution supported by the configured image provider.", + } + } return &generateImageTool{deps: deps, info: &schema.ToolInfo{ - Name: "generate_image", - Desc: `Generate exactly one new image with the configured image model and save it as a managed JCode Artifact. This is an externally billable operation: Ask for approval and Auto require one-time approval, while Full access runs without a prompt. Do not use it to inspect or edit an existing image.`, - ParamsOneOf: schema.NewParamsOneOfByParams(map[string]*schema.ParameterInfo{ - "prompt": { - Type: schema.String, Required: true, - Desc: "A concrete visual description of the single image to generate.", - }, - "size": { - Type: schema.String, - Desc: "Optional supported image size such as 1024x1024. Defaults to the provider profile's first size.", - }, - }), + Name: "generate_image", + Desc: `Generate exactly one new image with the configured image model and save it as a managed JCode Artifact. This is an externally billable operation: Ask for approval and Auto require one-time approval, while Full access runs without a prompt. Do not use it to inspect or edit an existing image.`, + ParamsOneOf: schema.NewParamsOneOfByParams(params), }} } @@ -177,7 +198,8 @@ func (t *generateImageTool) InvokableRun( t.progress(intent, toolstate.PhaseGenerating, "", nil) result, generateErr := t.deps.Generator.Generate(ctx, imagegen.Request{ - Prompt: input.Prompt, Size: input.Size, Count: 1, + Prompt: input.Prompt, Size: input.Size, AspectRatio: input.AspectRatio, + Resolution: input.Resolution, Count: 1, }) if generateErr != nil { outcome, phase, code := classifyGenerationError(generateErr) @@ -270,15 +292,43 @@ func (t *generateImageTool) parseInput(raw string) (GenerateImageInput, string, } input.Prompt = strings.TrimSpace(input.Prompt) input.Size = strings.TrimSpace(input.Size) + input.AspectRatio = strings.TrimSpace(input.AspectRatio) + input.Resolution = strings.ToLower(strings.TrimSpace(input.Resolution)) if input.Prompt == "" { return input, "", fmt.Errorf("prompt is required") } - if input.Size == "" && len(t.deps.SupportedSizes) > 0 { - input.Size = t.deps.SupportedSizes[0] - } - if input.Size != "" && !containsString(t.deps.SupportedSizes, input.Size) && - len(t.deps.SupportedSizes) > 0 { - return input, "", fmt.Errorf("unsupported image size %q", input.Size) + nativeGeometry := len(t.deps.SupportedAspectRatios) > 0 || len(t.deps.SupportedResolutions) > 0 + if nativeGeometry { + if input.Size != "" { + if input.AspectRatio != "" || input.Resolution != "" { + return input, "", fmt.Errorf("size cannot be combined with aspect_ratio or resolution") + } + aspectRatio, resolution, ok := legacyXAIImageSize(input.Size) + if !ok || !containsString(t.deps.SupportedAspectRatios, aspectRatio) || + !containsString(t.deps.SupportedResolutions, resolution) { + return input, "", fmt.Errorf("unsupported legacy image size %q", input.Size) + } + input.Size = "" + input.AspectRatio = aspectRatio + input.Resolution = resolution + } + if input.AspectRatio != "" && !containsString(t.deps.SupportedAspectRatios, input.AspectRatio) { + return input, "", fmt.Errorf("unsupported image aspect ratio %q", input.AspectRatio) + } + if input.Resolution != "" && !containsString(t.deps.SupportedResolutions, input.Resolution) { + return input, "", fmt.Errorf("unsupported image resolution %q", input.Resolution) + } + } else { + if input.AspectRatio != "" || input.Resolution != "" { + return input, "", fmt.Errorf("image provider does not support aspect_ratio or resolution") + } + if input.Size == "" && len(t.deps.SupportedSizes) > 0 { + input.Size = t.deps.SupportedSizes[0] + } + if input.Size != "" && !containsString(t.deps.SupportedSizes, input.Size) && + len(t.deps.SupportedSizes) > 0 { + return input, "", fmt.Errorf("unsupported image size %q", input.Size) + } } encoded, err := json.Marshal(input) if err != nil { @@ -287,6 +337,30 @@ func (t *generateImageTool) parseInput(raw string) (GenerateImageInput, string, return input, string(encoded), nil } +// legacyXAIImageSize preserves requests produced by older JCode builds while +// ensuring the normalized approval intent contains xAI-native controls. The +// conversion is deliberately explicit: unknown dimensions fail instead of +// being silently rounded to a different billable output shape. +func legacyXAIImageSize(size string) (aspectRatio, resolution string, ok bool) { + legacy := map[string][2]string{ + "1024x1024": {"1:1", "1k"}, + "1792x1024": {"16:9", "1k"}, + "1024x1792": {"9:16", "1k"}, + "1536x1024": {"3:2", "1k"}, + "1024x1536": {"2:3", "1k"}, + "2048x2048": {"1:1", "2k"}, + "3584x2048": {"16:9", "2k"}, + "2048x3584": {"9:16", "2k"}, + "3072x2048": {"3:2", "2k"}, + "2048x3072": {"2:3", "2k"}, + } + converted, ok := legacy[strings.ToLower(strings.TrimSpace(size))] + if !ok { + return "", "", false + } + return converted[0], converted[1], true +} + func (t *generateImageTool) startOperation(intent toolpolicy.BillableIntent) (session.GenerationOperation, error) { epoch, err := strconv.ParseUint(intent.ConfigEpoch, 16, 64) if err != nil { diff --git a/internal/tools/generate_image_test.go b/internal/tools/generate_image_test.go index 8f9b4f78..276de87c 100644 --- a/internal/tools/generate_image_test.go +++ b/internal/tools/generate_image_test.go @@ -24,10 +24,12 @@ type stubImageGenerator struct { result imagegen.Result err error calls int + input imagegen.Request } -func (g *stubImageGenerator) Generate(context.Context, imagegen.Request) (imagegen.Result, error) { +func (g *stubImageGenerator) Generate(_ context.Context, input imagegen.Request) (imagegen.Result, error) { g.calls++ + g.input = input return g.result, g.err } @@ -360,6 +362,101 @@ func TestGenerateImageSchemaHasNoCount(t *testing.T) { } } +func TestGenerateImageXAINativeSchemaAndLegacySizeNormalization(t *testing.T) { + deps := &GenerateImageDeps{ + SupportedAspectRatios: []string{"1:1", "16:9", "9:16", "3:2", "2:3", "auto"}, + SupportedResolutions: []string{"1k", "2k"}, + } + imageTool := NewGenerateImageTool(deps) + info, err := imageTool.Info(context.Background()) + if err != nil { + t.Fatal(err) + } + encoded, err := json.Marshal(info) + if err != nil { + t.Fatal(err) + } + if bytes.Contains(encoded, []byte(`"size"`)) || + !bytes.Contains(encoded, []byte(`"aspect_ratio"`)) || + !bytes.Contains(encoded, []byte(`"resolution"`)) { + t.Fatalf("xAI schema = %s", encoded) + } + parsed, normalized, err := imageTool.(*generateImageTool).parseInput( + `{"prompt":" portrait ","size":"1024x1792"}`, + ) + if err != nil { + t.Fatal(err) + } + if parsed.Prompt != "portrait" || parsed.Size != "" || parsed.AspectRatio != "9:16" || + parsed.Resolution != "1k" { + t.Fatalf("parsed = %#v", parsed) + } + if normalized != `{"prompt":"portrait","aspect_ratio":"9:16","resolution":"1k"}` { + t.Fatalf("normalized = %s", normalized) + } +} + +func TestGenerateImageRejectsAmbiguousOrUnsupportedNativeGeometry(t *testing.T) { + imageTool := NewGenerateImageTool(&GenerateImageDeps{ + SupportedAspectRatios: []string{"1:1", "16:9"}, + SupportedResolutions: []string{"1k", "2k"}, + }).(*generateImageTool) + for _, raw := range []string{ + `{"prompt":"x","size":"1024x1024","aspect_ratio":"1:1"}`, + `{"prompt":"x","aspect_ratio":"9:16"}`, + `{"prompt":"x","resolution":"4k"}`, + `{"prompt":"x","size":"800x600"}`, + } { + if _, _, err := imageTool.parseInput(raw); err == nil { + t.Fatalf("parseInput(%s) succeeded", raw) + } + } +} + +func TestGenerateImageLegacySizeDispatchesApprovedNativeGeometry(t *testing.T) { + t.Setenv("HOME", t.TempDir()) + recorder, err := session.NewRecorder(t.TempDir(), "xai", "grok-4.5") + if err != nil { + t.Fatal(err) + } + defer recorder.Close() + recorder.RecordUser("generate a portrait") + generator := &stubImageGenerator{result: imagegen.Result{Images: []imagegen.Image{{ + Data: generatedPNG(t, 2, 3), MIMEType: "image/png", Width: 2, Height: 3, + }}}} + imageTool := NewGenerateImageTool(&GenerateImageDeps{ + Generator: generator, + ArtifactService: artifact.NewServiceWithManagedRoot( + session.LoadArtifactRecords, nil, filepath.Join(t.TempDir(), "managed"), + ), + Recorder: recorder, Ledger: toolpolicy.NewUsageLedger(1, 20, 0), + Provider: "xai", Model: "grok-imagine-image", EndpointProfile: "xai-images", + CredentialKind: "managed_account", CredentialFingerprint: "account-1", + ConfigEpoch: "0000000000000001", DispatchPolicy: imageDispatchPolicy(), + VerifyRuntime: allowImageRuntime, + SupportedAspectRatios: []string{"1:1", "9:16"}, + SupportedResolutions: []string{"1k", "2k"}, + }) + rawArgs := `{"prompt":"portrait","size":"1024x1792"}` + intent, err := imageTool.(toolpolicy.BillableIntentPreparer).PrepareBillableIntent( + context.Background(), rawArgs, "legacy-size-call", + ) + if err != nil { + t.Fatal(err) + } + if intent.NormalizedArgs != `{"prompt":"portrait","aspect_ratio":"9:16","resolution":"1k"}` { + t.Fatalf("approved args = %s", intent.NormalizedArgs) + } + ctx := toolpolicy.WithBillableIntent(context.Background(), intent) + if _, err := imageTool.InvokableRun(ctx, rawArgs); err != nil { + t.Fatal(err) + } + if generator.calls != 1 || generator.input.Size != "" || generator.input.AspectRatio != "9:16" || + generator.input.Resolution != "1k" { + t.Fatalf("provider request calls=%d input=%#v", generator.calls, generator.input) + } +} + type atomicImageGenerator struct { result imagegen.Result calls atomic.Int64 diff --git a/internal/web/models.go b/internal/web/models.go index 9f8048fd..6c5f00ac 100644 --- a/internal/web/models.go +++ b/internal/web/models.go @@ -67,6 +67,14 @@ func configuredImageAvailability(pc *config.ProviderConfig, imageModel providert if pc == nil || (pc.APIKey == "" && !managedXAI) { return "unsupported" } + if managedXAI { + manager, err := providerauth.Default(config.ConfigDir()) + if err != nil || manager.ValidateBinding(context.Background(), providerauth.Binding{ + Method: providerauth.MethodXAIOAuth, AccountID: pc.Auth.AccountID, + }) != nil { + return "unsupported" + } + } if !imageModel.Supported { return "unknown" } @@ -126,6 +134,8 @@ func (s *Server) handleListModels(w http.ResponseWriter, r *http.Request) { OutputModalities []string `json:"output_modalities"` CapabilityAvailability string `json:"capability_availability"` ImageSizes []string `json:"image_sizes,omitempty"` + ImageAspectRatios []string `json:"image_aspect_ratios,omitempty"` + ImageResolutions []string `json:"image_resolutions,omitempty"` } type providerInfo struct { ID string `json:"id"` @@ -202,6 +212,8 @@ func (s *Server) handleListModels(w http.ResponseWriter, r *http.Request) { entry.OutputModalities = appendModality(entry.OutputModalities, "image") entry.CapabilityAvailability = availability entry.ImageSizes = append([]string(nil), imageModel.Sizes...) + entry.ImageAspectRatios = append([]string(nil), imageModel.AspectRatios...) + entry.ImageResolutions = append([]string(nil), imageModel.Resolutions...) continue } pi.Models = append(pi.Models, modelInfo{ @@ -209,6 +221,8 @@ func (s *Server) handleListModels(w http.ResponseWriter, r *http.Request) { InputModalities: []string{"text"}, OutputModalities: []string{"image"}, CapabilityAvailability: availability, ImageSizes: append([]string(nil), imageModel.Sizes...), + ImageAspectRatios: append([]string(nil), imageModel.AspectRatios...), + ImageResolutions: append([]string(nil), imageModel.Resolutions...), }) } } @@ -233,6 +247,8 @@ func (s *Server) handleListModels(w http.ResponseWriter, r *http.Request) { InputModalities: []string{"text"}, OutputModalities: []string{"image"}, CapabilityAvailability: configuredImageAvailability(pc, imageModel), ImageSizes: append([]string(nil), imageModel.Sizes...), + ImageAspectRatios: append([]string(nil), imageModel.AspectRatios...), + ImageResolutions: append([]string(nil), imageModel.Resolutions...), }) } result = append(result, pi) diff --git a/internal/web/models_test.go b/internal/web/models_test.go index fa0aec2a..0dbe250a 100644 --- a/internal/web/models_test.go +++ b/internal/web/models_test.go @@ -14,6 +14,7 @@ import ( "github.com/cnjack/jcode/internal/config" "github.com/cnjack/jcode/internal/model" "github.com/cnjack/jcode/internal/providerauth" + "github.com/cnjack/jcode/internal/providertools" ) func TestWebSwitchModelSameValueIsNoOp(t *testing.T) { @@ -308,7 +309,16 @@ func TestListModelsExposesModalitiesAndExplicitImageCatalog(t *testing.T) { } func TestListModelsExposesManagedXAIImageRole(t *testing.T) { - t.Setenv("HOME", t.TempDir()) + home := t.TempDir() + t.Setenv("HOME", home) + configDir := filepath.Join(home, ".jcode") + if err := os.MkdirAll(configDir, 0o700); err != nil { + t.Fatal(err) + } + accountJSON := `{"version":1,"methods":{"xai_oauth":{"accounts":{"account-1":{"id":"account-1","login":"grok-user","secret":"refresh-token","authenticated_at":"2026-08-10T00:00:00Z"}},"default_account_id":"account-1"}}}` + if err := os.WriteFile(filepath.Join(configDir, "provider-auth.json"), []byte(accountJSON), 0o600); err != nil { + t.Fatal(err) + } cfg := &config.Config{ Model: "xai/grok-4.5", ImageModel: "xai/grok-imagine-image-quality", @@ -326,9 +336,11 @@ func TestListModelsExposesManagedXAIImageRole(t *testing.T) { Providers []struct { ID string `json:"id"` Models []struct { - ID string `json:"id"` - Output []string `json:"output_modalities"` - Availability string `json:"capability_availability"` + ID string `json:"id"` + Output []string `json:"output_modalities"` + Availability string `json:"capability_availability"` + AspectRatios []string `json:"image_aspect_ratios"` + ImageResolutions []string `json:"image_resolutions"` } `json:"models"` } `json:"providers"` } @@ -345,6 +357,11 @@ func TestListModelsExposesManagedXAIImageRole(t *testing.T) { if candidate.Availability != "supported" { t.Fatalf("image model %s availability = %q", candidate.ID, candidate.Availability) } + if len(candidate.AspectRatios) != 14 || len(candidate.ImageResolutions) != 2 || + candidate.ImageResolutions[0] != "1k" || candidate.ImageResolutions[1] != "2k" { + t.Fatalf("image model %s geometry = ratios:%v resolutions:%v", candidate.ID, + candidate.AspectRatios, candidate.ImageResolutions) + } imageIDs = append(imageIDs, candidate.ID) } } @@ -354,6 +371,18 @@ func TestListModelsExposesManagedXAIImageRole(t *testing.T) { } } +func TestConfiguredImageAvailabilityRejectsMissingManagedAccount(t *testing.T) { + t.Setenv("HOME", t.TempDir()) + availability := configuredImageAvailability(&config.ProviderConfig{ + Auth: &config.ProviderAuthBinding{Method: string(providerauth.MethodXAIOAuth), AccountID: "missing"}, + }, providertools.ImageModel{ + Provider: "xai", ID: "grok-imagine-image", Builtin: true, Supported: true, + }) + if availability != "unsupported" { + t.Fatalf("missing managed account availability = %q", availability) + } +} + func TestSetImageModelPersistsIndependentRole(t *testing.T) { t.Setenv("HOME", t.TempDir()) cfg := &config.Config{ diff --git a/packages/jcode-ui-core/CHANGELOG.md b/packages/jcode-ui-core/CHANGELOG.md index c0b68476..3d44db4b 100644 --- a/packages/jcode-ui-core/CHANGELOG.md +++ b/packages/jcode-ui-core/CHANGELOG.md @@ -17,7 +17,8 @@ generic and standalone tool surfaces. - **Structured billable approvals.** New `BillableApprovalSummary` plus `Approval.approvalClass` / `Approval.billableSummary` carry a bounded, - non-secret summary for external image/search decisions. Pending renderers can + non-secret summary for external image/search decisions, including native + image aspect-ratio and resolution controls. Pending renderers can inspect `ApprovalDecisionActions.canResolveOptions` before returning opaque option ids. - **Paged Ask User controls.** `AskUserControls` gains `activeIndex`, diff --git a/packages/jcode-ui-core/src/types/index.ts b/packages/jcode-ui-core/src/types/index.ts index d2d9a282..f1737be5 100644 --- a/packages/jcode-ui-core/src/types/index.ts +++ b/packages/jcode-ui-core/src/types/index.ts @@ -312,6 +312,8 @@ export interface BillableApprovalSummary { provider?: string model?: string size?: string + aspect_ratio?: string + resolution?: string count?: number billable?: boolean has_reference?: boolean diff --git a/packages/jcode-ui/CHANGELOG.md b/packages/jcode-ui/CHANGELOG.md index 80936229..595924f7 100644 --- a/packages/jcode-ui/CHANGELOG.md +++ b/packages/jcode-ui/CHANGELOG.md @@ -20,7 +20,7 @@ transcript. - **Billable approval presentation.** `ApprovalBanner` recognizes `approvalClass: 'billable_external'` and presents the bounded provider, - model, size, count, and capability summary with explicit deny/allow-once + model, size or native aspect-ratio/resolution, count, and capability summary with explicit deny/allow-once actions. Image generation and provider web search receive distinct copy and icons without exposing the full prompt or raw tool arguments. - Re-exported the new core media contracts — `ArtifactRef`, `ToolPhase`, diff --git a/packages/jcode-ui/src/components/ApprovalBanner.test.tsx b/packages/jcode-ui/src/components/ApprovalBanner.test.tsx index edb97c55..ed9e8daa 100644 --- a/packages/jcode-ui/src/components/ApprovalBanner.test.tsx +++ b/packages/jcode-ui/src/components/ApprovalBanner.test.tsx @@ -81,6 +81,23 @@ describe('ApprovalBanner billable approvals', () => { expect(screen.queryByRole('button', { name: /allow/i })).toBeNull() }) + it('shows native aspect ratio and resolution before a billable image decision', () => { + renderApproval({ + ...BASE_APPROVAL, + billableSummary: { + capability: 'image.generate', + provider: 'xai', + model: 'grok-imagine-image-quality', + aspect_ratio: '9:16', + resolution: '2k', + count: 1, + billable: true, + }, + }) + + expect(screen.getByText(/xai · grok-imagine-image-quality · 9:16 · 2k · 1 image/)).toBeTruthy() + }) + it('hides allow when a host cannot return opaque option ids', () => { const base = createMockRuntime() const { resolveApprovalOption: _resolveApprovalOption, ...actions } = base.actions diff --git a/packages/jcode-ui/src/components/ApprovalBanner.tsx b/packages/jcode-ui/src/components/ApprovalBanner.tsx index ffe6334b..bff00b53 100644 --- a/packages/jcode-ui/src/components/ApprovalBanner.tsx +++ b/packages/jcode-ui/src/components/ApprovalBanner.tsx @@ -182,7 +182,10 @@ function BillablePendingCard({ approval, actions }: { approval: Approval; action : isSearch ? `${count} web search${count === 1 ? '' : 'es'}` : `${count} provider request${count === 1 ? '' : 's'}` - const details = [route, isImage ? summary?.size : undefined, unit].filter(Boolean).join(' · ') + const geometry = isImage + ? summary?.size || [summary?.aspect_ratio, summary?.resolution].filter(Boolean).join(' · ') + : undefined + const details = [route, geometry, unit].filter(Boolean).join(' · ') const label = isImage ? 'External image generation' : isSearch ? 'External web search' : 'External provider action' const question = isImage ? `Generate ${unit}?` : isSearch ? `Run ${unit}?` : `Send ${unit}?` diff --git a/packages/jcode-ui/src/product/types.ts b/packages/jcode-ui/src/product/types.ts index 3525e1d8..6d1ff05a 100644 --- a/packages/jcode-ui/src/product/types.ts +++ b/packages/jcode-ui/src/product/types.ts @@ -35,6 +35,8 @@ export interface ModelInfo { output_modalities?: string[] capability_availability?: 'supported' | 'unsupported' | 'unknown' image_sizes?: string[] + image_aspect_ratios?: string[] + image_resolutions?: string[] /** How this model exposes its reasoning/thinking controls. */ reasoning_options?: ReasoningOption[] } diff --git a/site/docs/changelog.md b/site/docs/changelog.md index 521a5f4c..7835676c 100644 --- a/site/docs/changelog.md +++ b/site/docs/changelog.md @@ -15,6 +15,7 @@ For implementation-level detail, see the repository's full [CHANGELOG.md](https: - **Live managed model catalogs.** ChatGPT/Codex, Grok, and GitHub Copilot now load the models available to the selected account. Enabled models remain available after restart, and Copilot preserves each model's required Responses or Chat Completions transport. - **Provider-backed image generation.** jcode can discover image-capable providers, verify their runtime capabilities, configure image models, and invoke managed provider tools from the same agent workflow used for coding tasks. - **Grok Imagine with account sign-in.** Connected xAI accounts can select `grok-imagine-image` or `grok-imagine-image-quality` as the independent Image Model without copying an API key. +- **Native Grok image geometry.** `generate_image` exposes xAI's supported aspect ratios and `1k`/`2k` resolutions, while older common `size` requests are safely normalized before approval and dispatch. - **Durable generated-image artifacts.** Generated images appear as first-class timeline cards and artifacts, with revision and lifecycle state that survives session replay across Web, Desktop, TUI, ACP, and Cloud transport. #### Changed diff --git a/site/docs/overview/models.md b/site/docs/overview/models.md index 260a4106..b55ed714 100644 --- a/site/docs/overview/models.md +++ b/site/docs/overview/models.md @@ -119,7 +119,9 @@ to an arbitrary managed-login Provider. Grok login is the explicit exception: the official xAI profile exposes `grok-imagine-image` and `grok-imagine-image-quality` as Image Model choices, pins the xAI Images API, and resolves the selected account token only when a generation request is -dispatched. Video models are recognized but are not yet exposed because jcode +dispatched. For these models, `generate_image` exposes xAI-native +`aspect_ratio` values plus `resolution` (`1k` or `2k`) instead of sending the +OpenAI-style `size` field. Video models are recognized but are not yet exposed because jcode does not yet implement the asynchronous video workflow. ## Switch Models Mid-Session diff --git a/web/src/lib/types.ts b/web/src/lib/types.ts index 956e9271..b4cf4c59 100644 --- a/web/src/lib/types.ts +++ b/web/src/lib/types.ts @@ -210,6 +210,8 @@ export interface ModelInfo { output_modalities?: string[] capability_availability?: 'supported' | 'unsupported' | 'unknown' image_sizes?: string[] + image_aspect_ratios?: string[] + image_resolutions?: string[] // How this model exposes its reasoning/thinking controls (from models.dev). // Absent/empty ⇒ no reasoning controls to render. reasoning_options?: ReasoningOption[]