@ayushporwal/coja 0.0.1

package/dist/cli.js

@@ -0,0 +1,99 @@
+import { parseArgs } from 'node:util';
+import { assertGitVersion } from './git/plumbing.js';
+import { openBrowser } from './open-browser.js';
+import { packageVersion, resolvePublicDir } from './paths.js';
+import { startServer } from './server.js';
+import { createServices } from './services.js';
+const DEFAULT_PORT = 4321;
+const DEFAULT_HOST = '127.0.0.1';
+const LOOPBACK_HOSTS = new Set(['127.0.0.1', 'localhost', '::1']);
+/**
+ * Unspecified addresses. The request guard compares every Host header against
+ * loopback and the `--host` value, and no header ever equals a wildcard, so a
+ * server bound this way would refuse every request. Refused at parse time.
+ */
+const WILDCARD_HOSTS = new Set(['0.0.0.0', '::', '[::]', '0:0:0:0:0:0:0:0', '']);
+const HELP = `coja — local code review for GitHub pull requests
+
+Usage: coja [options]
+
+Options:
+  -p, --port <n>   Port to listen on (default ${DEFAULT_PORT}; a free port is picked if it is taken)
+      --host <h>   Address to bind (default ${DEFAULT_HOST}; coja is meant to stay on loopback;
+                   wildcards such as 0.0.0.0 or :: are refused)
+      --no-open    Do not open the browser
+  -v, --version    Print the version and exit
+  -h, --help       Show this help and exit
+`;
+function parseCli(argv) {
+    const { values } = parseArgs({
+        args: argv,
+        allowNegative: true,
+        options: {
+            port: { type: 'string', short: 'p', default: String(DEFAULT_PORT) },
+            host: { type: 'string', default: DEFAULT_HOST },
+            open: { type: 'boolean', default: true },
+            version: { type: 'boolean', short: 'v', default: false },
+            help: { type: 'boolean', short: 'h', default: false },
+        },
+    });
+    const port = Number(values.port);
+    if (!Number.isInteger(port) || port < 0 || port > 65535) {
+        throw new Error(`invalid --port "${values.port}": expected an integer between 0 and 65535`);
+    }
+    const host = values.host.trim();
+    if (WILDCARD_HOSTS.has(host)) {
+        throw new Error(`--host "${values.host}" is a wildcard bind, which the request guard could never match (no Host header equals it): ` +
+            'bind to a concrete address, e.g. --host 192.168.1.5; coja is designed for loopback');
+    }
+    return { port, host, open: values.open, version: values.version, help: values.help };
+}
+async function main() {
+    let cli;
+    try {
+        cli = parseCli(process.argv.slice(2));
+    }
+    catch (err) {
+        console.error(`coja: ${err instanceof Error ? err.message : String(err)}\n`);
+        console.error(HELP);
+        process.exit(2);
+    }
+    if (cli.help) {
+        console.log(HELP);
+        return;
+    }
+    if (cli.version) {
+        console.log(packageVersion());
+        return;
+    }
+    if (!LOOPBACK_HOSTS.has(cli.host)) {
+        console.warn(`coja: binding to ${cli.host} exposes the server beyond this machine; use loopback unless you know why.`);
+    }
+    try {
+        await assertGitVersion();
+    }
+    catch (err) {
+        console.error(`coja: ${err instanceof Error ? err.message : String(err)}`);
+        process.exit(1);
+    }
+    const services = await createServices();
+    const server = await startServer({
+        port: cli.port,
+        host: cli.host,
+        publicDir: resolvePublicDir(),
+        services,
+        allowedHosts: LOOPBACK_HOSTS.has(cli.host) ? [] : [cli.host],
+    });
+    if (cli.port !== 0 && server.port !== cli.port) {
+        console.log(`coja: port ${cli.port} is in use, using ${server.port} instead`);
+    }
+    console.log(`coja v${packageVersion()} → ${server.url}`);
+    if (cli.open)
+        openBrowser(server.url);
+    const shutdown = () => {
+        server.close().finally(() => process.exit(0));
+    };
+    process.once('SIGINT', shutdown);
+    process.once('SIGTERM', shutdown);
+}
+await main();

package/dist/codex/connection.js

@@ -0,0 +1,293 @@
+import { settings } from '../db.js';
+import { CodexError } from './errors.js';
+import { fetchModelCatalog } from './models.js';
+import { extractMetadata, refreshAccessToken, startBrowserFlow, } from './oauth.js';
+import { CODEX_PROTOCOL } from './protocol.js';
+/**
+ * The single ChatGPT connection of this coja instance. Tokens live only in
+ * the SecretStore (OS keychain) under one key; the browser never receives
+ * anything but connection status (connected, email, plan). Refreshes are
+ * singleflight: concurrent turns join one in-flight refresh, and a terminal
+ * refresh failure marks the connection auth-expired so later calls fail fast
+ * without network until the user reconnects.
+ */
+export const CHATGPT_AUTH_KEY = 'chatgpt-auth';
+/** Settings mirror of the last good model catalog (non-secret) for offline fallbacks. */
+export const CHATGPT_CATALOG_KEY = 'chatgpt-model-catalog';
+export const CATALOG_TTL_MS = 10 * 60 * 1000;
+export class ChatGptConnection {
+    secrets;
+    protocol;
+    fetchImpl;
+    openBrowser;
+    /** Read-through cache so chat turns do not hit the keychain on every call. */
+    cached;
+    refreshPromise = null;
+    flow = null;
+    catalog = null;
+    catalogExpiresAt = 0;
+    catalogPromise = null;
+    db;
+    catalogTtlMs;
+    authExpired = null;
+    connectError = null;
+    constructor(deps) {
+        this.secrets = deps.secrets;
+        this.db = deps.db;
+        this.catalogTtlMs = deps.catalogTtlMs ?? CATALOG_TTL_MS;
+        this.protocol = deps.protocol ?? CODEX_PROTOCOL;
+        this.fetchImpl = deps.fetchImpl ?? fetch;
+        this.openBrowser =
+            deps.openBrowser ??
+                ((url) => {
+                    void import('../open-browser.js').then((m) => m.openBrowser(url));
+                });
+    }
+    /** Status for the browser: never token material, just connection facts. */
+    async status() {
+        const signingIn = this.flow !== null;
+        const record = await this.load();
+        if (!record) {
+            return {
+                connected: false,
+                signingIn,
+                ...(this.connectError ? { connectError: this.connectError } : {}),
+            };
+        }
+        return {
+            connected: true,
+            signingIn,
+            ...(record.email ? { email: record.email } : {}),
+            ...(record.planType ? { plan: record.planType } : {}),
+            ...(this.authExpired ? { authExpired: true } : {}),
+        };
+    }
+    /**
+     * Start the browser authorization flow. Resolves fast with the URL the
+     * browser should open (the server also opens it); the flow completes in the
+     * background and `status()` turns connected once the user approves.
+     */
+    async connect() {
+        if (this.flow)
+            return { authUrl: this.flow.authUrl };
+        this.connectError = null;
+        let flow;
+        try {
+            flow = await startBrowserFlow({
+                protocol: this.protocol,
+                fetchImpl: this.fetchImpl,
+                openBrowser: this.openBrowser,
+            });
+        }
+        catch (err) {
+            this.connectError = err instanceof Error ? err.message : String(err);
+            throw err;
+        }
+        this.flow = flow;
+        flow.completion.then((tokens) => {
+            if (this.flow === flow)
+                this.flow = null;
+            return this.completeLogin(tokens);
+        }, (err) => {
+            if (this.flow === flow)
+                this.flow = null;
+            // A cancelled/timed-out login is a Setup-screen fact, not a chat error.
+            this.connectError = err instanceof Error ? err.message : String(err);
+        });
+        return { authUrl: flow.authUrl };
+    }
+    /** Forget tokens and any pending sign-in. There is no dependable upstream revoke. */
+    async disconnect() {
+        this.flow?.cancel('disconnected');
+        this.flow = null;
+        this.cached = null;
+        this.authExpired = null;
+        this.connectError = null;
+        this.refreshPromise = null;
+        await this.secrets.delete(CHATGPT_AUTH_KEY);
+    }
+    /**
+     * A fresh access token for a chat turn, refreshing inside the margin.
+     * Throws the typed `auth_expired` without network once the connection is
+     * marked expired.
+     */
+    async getFreshAccessToken() {
+        if (this.authExpired)
+            throw new CodexError('auth_expired', this.authExpired.reason);
+        const record = await this.requireRecord();
+        if (record.expiresAt - Date.now() >= this.protocol.refreshMarginMs) {
+            return this.fresh(record);
+        }
+        return this.singleflightRefresh(false);
+    }
+    /** Force a refresh (singleflight); used by the transport after a 401. */
+    async forceRefresh() {
+        if (this.authExpired)
+            throw new CodexError('auth_expired', this.authExpired.reason);
+        await this.requireRecord();
+        return this.singleflightRefresh(true);
+    }
+    /**
+     * The backend's model catalog for this account, cached for the TTL and
+     * mirrored (non-secret) in the settings DB: when the endpoint is unreachable
+     * the mirror keeps the picker alive. Shared singleflight so concurrent
+     * pickers do one fetch.
+     */
+    async listModels() {
+        if (this.catalog && this.catalogExpiresAt > Date.now())
+            return this.catalog;
+        if (!this.catalogPromise) {
+            this.catalogPromise = this.doFetchCatalog().finally(() => {
+                this.catalogPromise = null;
+            });
+        }
+        return this.catalogPromise;
+    }
+    /** The catalog's default effort for a model, from the cached catalog only (best effort). */
+    defaultReasoningEffortFor(modelId) {
+        return this.catalog?.find((m) => m.slug === modelId)?.defaultReasoningEffort;
+    }
+    /** Whether `effort` is in the model's catalog entry; fetches the catalog when stale. */
+    async supportsReasoningEffort(modelId, effort) {
+        const models = await this.listModels();
+        const entry = models.find((m) => m.slug === modelId);
+        return entry ? entry.reasoningEfforts.some((level) => level.effort === effort) : false;
+    }
+    async doFetchCatalog() {
+        try {
+            const models = await fetchModelCatalog({
+                fetchImpl: this.fetchImpl,
+                protocol: this.protocol,
+                getToken: () => this.getFreshAccessToken(),
+                forceRefresh: () => this.forceRefresh(),
+            });
+            this.catalog = models;
+            this.catalogExpiresAt = Date.now() + this.catalogTtlMs;
+            this.mirrorCatalog(models);
+            return models;
+        }
+        catch (err) {
+            const mirrored = this.mirroredCatalog();
+            if (mirrored) {
+                this.catalog = mirrored;
+                this.catalogExpiresAt = Date.now() + this.catalogTtlMs;
+                return mirrored;
+            }
+            throw err;
+        }
+    }
+    mirrorCatalog(models) {
+        if (!this.db)
+            return;
+        try {
+            settings.set(this.db, CHATGPT_CATALOG_KEY, JSON.stringify(models));
+        }
+        catch {
+            // A mirror write must never break the happy path.
+        }
+    }
+    mirroredCatalog() {
+        if (!this.db)
+            return null;
+        try {
+            const raw = settings.get(this.db, CHATGPT_CATALOG_KEY);
+            return raw ? JSON.parse(raw) : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    // -------------------------------------------------------------------------
+    fresh(record) {
+        return {
+            accessToken: record.accessToken,
+            ...(record.accountId ? { accountId: record.accountId } : {}),
+        };
+    }
+    async requireRecord() {
+        const record = await this.load();
+        if (!record) {
+            throw new CodexError('auth_expired', 'ChatGPT is not connected — connect it in Setup.');
+        }
+        return record;
+    }
+    singleflightRefresh(force) {
+        if (!this.refreshPromise) {
+            this.refreshPromise = this.doRefresh(force).finally(() => {
+                this.refreshPromise = null;
+            });
+        }
+        return this.refreshPromise;
+    }
+    /**
+     * The actual refresh. Reloads the record inside the promise (another turn
+     * may have refreshed while this caller waited) and skips the margin re-check
+     * only when the caller forces (a 401 retry). A forced refresh joins an
+     * in-flight regular one and vice versa — one HTTP call either way. The old
+     * refresh token is kept when the response omits one. Auth-expiry is marked
+     * only on terminal failures — OAuth `invalid_*` or a bare 401/403, which
+     * `tokenRequest` classifies; 429/5xx/network stay retryable.
+     */
+    async doRefresh(force) {
+        const current = await this.load();
+        if (!current) {
+            throw new CodexError('auth_expired', 'ChatGPT is not connected — connect it in Setup.');
+        }
+        if (!force && current.expiresAt - Date.now() >= this.protocol.refreshMarginMs) {
+            // Another refresh landed while this caller waited for the singleflight.
+            return this.fresh(current);
+        }
+        try {
+            const tokens = await refreshAccessToken({ fetchImpl: this.fetchImpl, protocol: this.protocol }, current.refreshToken);
+            const next = {
+                ...current,
+                accessToken: tokens.access_token,
+                ...(tokens.refresh_token ? { refreshToken: tokens.refresh_token } : {}),
+                ...(tokens.id_token ? { idToken: tokens.id_token } : {}),
+                expiresAt: Date.now() + tokens.expires_in * 1000,
+                ...extractMetadata(tokens),
+            };
+            await this.save(next);
+            this.authExpired = null;
+            return this.fresh(next);
+        }
+        catch (err) {
+            if (err instanceof CodexError && err.code === 'auth_expired') {
+                this.authExpired = { reason: err.message };
+            }
+            throw err;
+        }
+    }
+    async completeLogin(tokens) {
+        const next = {
+            accessToken: tokens.access_token,
+            refreshToken: tokens.refresh_token ?? '',
+            ...(tokens.id_token ? { idToken: tokens.id_token } : {}),
+            expiresAt: Date.now() + tokens.expires_in * 1000,
+            ...extractMetadata(tokens),
+        };
+        await this.save(next);
+        this.authExpired = null;
+        this.connectError = null;
+    }
+    async load() {
+        if (this.cached !== undefined)
+            return this.cached;
+        const raw = await this.secrets.get(CHATGPT_AUTH_KEY);
+        if (!raw) {
+            this.cached = null;
+            return null;
+        }
+        try {
+            this.cached = JSON.parse(raw);
+        }
+        catch {
+            this.cached = null;
+        }
+        return this.cached;
+    }
+    async save(record) {
+        await this.secrets.set(CHATGPT_AUTH_KEY, JSON.stringify(record));
+        this.cached = record;
+    }
+}

package/dist/codex/errors.js

@@ -0,0 +1,52 @@
+import { CHATGPT_MARKER_PATTERN, CHATGPT_MARKER_PREFIX, markChatGptError, } from '../shared/api.js';
+/**
+ * Typed failures of the ChatGPT subscription path. Every error carries a
+ * stable `code` (classification is never done by matching message text), and
+ * its message is written for the reviewer — it may be shown in the chat panel
+ * verbatim, so it names what happened and what to do, never token material.
+ *
+ * The message self-marks with the `[coja:chatgpt:<code>]` marker: chat-turn
+ * errors reach the browser as bare strings (the AI SDK stream carries error
+ * text only), and the marker is how the chat panel recognises a subscription
+ * failure and offers reconnect / API-key actions without the chat handler
+ * knowing anything about billing paths.
+ */
+const HEADINGS = {
+    state_mismatch: 'The ChatGPT sign-in could not be verified. Start it again.',
+    auth_expired: 'Your ChatGPT sign-in has expired. Reconnect ChatGPT in Setup.',
+    quota: 'Your ChatGPT plan limit is reached.',
+    endpoint_changed: 'The ChatGPT subscription backend refused the request. Use your OpenAI API key, and check for a coja update if this keeps happening.',
+    transport: 'Could not reach the ChatGPT subscription backend.',
+};
+export class CodexError extends Error {
+    code;
+    extra;
+    constructor(code, detail, extra) {
+        const heading = HEADINGS[code];
+        super(markChatGptError(code, detail ? `${heading} (${detail})` : heading));
+        this.code = code;
+        this.extra = extra;
+        this.name = 'CodexError';
+    }
+}
+export { CHATGPT_MARKER_PATTERN, CHATGPT_MARKER_PREFIX };
+/**
+ * Redact token material before truncation (PROTOCOL.md §10): a bearer header
+ * or a JSON/form field carrying a token never survives into a thrown message
+ * or log line.
+ */
+export function redact(text) {
+    let out = text.replace(/Bearer\s+[A-Za-z0-9._~+/=-]+/gi, 'Bearer [REDACTED]');
+    for (const field of ['access_token', 'refresh_token', 'id_token', 'authorization']) {
+        out = redactFormValue(out, field);
+        out = redactJsonValue(out, field);
+    }
+    return out;
+}
+function redactFormValue(text, field) {
+    // `field=<value>` up to a `&` (form body) with optional URL encoding.
+    return text.replace(new RegExp(`${field}=[^&\\s"']*`, 'gi'), `${field}=[REDACTED]`);
+}
+function redactJsonValue(text, field) {
+    return text.replace(new RegExp(`"${field}"\\s*:\\s*"[^"]*"`, 'gi'), `"${field}":"[REDACTED]"`);
+}

package/dist/codex/models.js

@@ -0,0 +1,97 @@
+import { z } from 'zod';
+import { CodexError, redact } from './errors.js';
+const CatalogSchema = z.object({
+    models: z.array(z.object({
+        slug: z.string(),
+        display_name: z.string(),
+        description: z.string().nullish(),
+        visibility: z.string().nullish(),
+        context_window: z.number().nullish(),
+        supported_reasoning_levels: z
+            .array(z.object({
+            effort: z.string(),
+            description: z.string().nullish(),
+        }))
+            .nullish(),
+        default_reasoning_level: z.string().nullish(),
+    })),
+});
+export function parseModelCatalog(body) {
+    const parsed = CatalogSchema.parse(body);
+    const out = [];
+    for (const model of parsed.models) {
+        // `visibility: "hide"` marks internal plumbing (observed: `gpt-reserve`,
+        // `codex-auto-review`); only listed models are pickable.
+        if (model.visibility === 'hide')
+            continue;
+        out.push({
+            slug: model.slug,
+            displayName: model.display_name,
+            ...(model.description ? { description: model.description } : {}),
+            ...(model.context_window != null ? { contextWindow: model.context_window } : {}),
+            reasoningEfforts: (model.supported_reasoning_levels ?? []).map((level) => ({
+                effort: level.effort,
+                ...(level.description ? { description: level.description } : {}),
+            })),
+            ...(model.default_reasoning_level
+                ? { defaultReasoningEffort: model.default_reasoning_level }
+                : {}),
+        });
+    }
+    return out;
+}
+/** Fetch the catalog, retrying once on 401 through a forced token refresh. */
+export async function fetchModelCatalog(deps) {
+    const base = deps.protocol.responsesUrl.replace(/\/responses\/?$/, '');
+    const url = `${base}/models?client_version=${encodeURIComponent(deps.protocol.clientVersion)}`;
+    const issue = async (forceRefresh) => {
+        const token = forceRefresh ? await deps.forceRefresh() : await deps.getToken();
+        let res;
+        try {
+            res = await deps.fetchImpl(url, {
+                headers: {
+                    authorization: `Bearer ${token.accessToken}`,
+                    ...(token.accountId ? { 'chatgpt-account-id': token.accountId } : {}),
+                    'openai-beta': 'responses=experimental',
+                    originator: 'codex_cli_rs',
+                    'user-agent': `codex_cli_rs/${deps.protocol.clientVersion}`,
+                    accept: 'application/json',
+                },
+                signal: AbortSignal.timeout(15_000),
+            });
+        }
+        catch (err) {
+            throw new CodexError('transport', redact(err instanceof Error ? err.message : String(err)));
+        }
+        return res;
+    };
+    let res = await issue(false);
+    if (res.status === 401) {
+        res = await issue(true);
+        if (res.status === 401) {
+            throw new CodexError('auth_expired', 'the catalog request was rejected after a token refresh');
+        }
+    }
+    if (res.status === 429)
+        throw new CodexError('quota');
+    if (!res.ok) {
+        let text = '';
+        try {
+            text = redact(await res.text()).slice(0, 256);
+        }
+        catch {
+            // no body
+        }
+        throw new CodexError(res.status >= 500 ? 'transport' : 'endpoint_changed', `HTTP ${res.status}${text ? `: ${text}` : ''}`);
+    }
+    const body = await res.json().catch(() => undefined);
+    if (body === undefined)
+        throw new CodexError('transport', 'the catalog endpoint returned a non-JSON body');
+    try {
+        return parseModelCatalog(body);
+    }
+    catch (err) {
+        // The backend changed its shape: say so instead of losing the detail.
+        throw new CodexError('endpoint_changed', `unexpected catalog shape (${err instanceof Error ? err.message.slice(0, 160) : String(err)})`);
+    }
+}