@bivy/bivy 0.16.18-staging.2 → 0.16.18-staging.3

package/dist/runtime/oauth/model-oauth-providers.js

@@ -7,8 +7,8 @@
 // not guesses. Owning these lets Bivy run the OAuth login + token refresh itself,
 // so no credential operation depends on Pi.
 //
-// Covered (fully Bivy-owned): Anthropic (Claude Pro/Max), OpenAI Codex (ChatGPT),
-// xAI (Grok). GitHub Copilot (two-stage token + dynamic base URL entangled with
+// Covered (fully Bivy-owned): Anthropic (Claude Pro/Max), OpenAI Codex (ChatGPT;
+// device-code), xAI (Grok). GitHub Copilot (two-stage token + dynamic base URL entangled with
 // Pi's request layer) and Radius (self-describing gateway) are intentionally not
 // reimplemented here.
 /** Anthropic uses a JSON token body; OpenAI/xAI use form-encoded. */
@@ -17,12 +17,16 @@ export const MODEL_OAUTH_PROVIDERS = {
         id: "anthropic",
         displayName: "Anthropic (Claude Pro/Max)",
         clientId: "9d1c250a-e61b-44d9-88ed-5944d1962f5e",
-        scopes: "org:create_api_key user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload",
+        // Claude Code's `setup-token` flow avoids localhost entirely: Anthropic hosts
+        // the callback page and shows a code the user can paste back into Bivy. The
+        // resulting long-lived token is inference-only, which is exactly what agent
+        // model requests need and works well from a remote PWA/headless node.
+        scopes: "user:inference",
         flow: "auth_code",
         tokenEncoding: "json",
-        authorizeUrl: "https://claude.ai/oauth/authorize",
+        authorizeUrl: "https://claude.com/cai/oauth/authorize",
         tokenUrl: "https://platform.claude.com/v1/oauth/token",
-        callback: { port: 53692, path: "/callback", redirectHost: "localhost" },
+        redirectUri: "https://platform.claude.com/oauth/code/callback",
         authorizeParams: { code: "true" },
         stateIsVerifier: true,
         refreshSkewMs: 5 * 60 * 1000,
@@ -33,11 +37,13 @@ export const MODEL_OAUTH_PROVIDERS = {
         displayName: "OpenAI (ChatGPT Plus/Pro)",
         clientId: "app_EMoamEEZ73f0CkXaXp7hrann",
         scopes: "openid profile email offline_access",
-        flow: "auth_code",
+        flow: "openai_codex_device_code",
         tokenEncoding: "form",
         authorizeUrl: "https://auth.openai.com/oauth/authorize",
         tokenUrl: "https://auth.openai.com/oauth/token",
         callback: { port: 1455, path: "/auth/callback", redirectHost: "localhost" },
+        deviceAuthUrl: "https://auth.openai.com/api/accounts/deviceauth/usercode",
+        deviceTokenUrl: "https://auth.openai.com/api/accounts/deviceauth/token",
         authorizeParams: {
             id_token_add_organizations: "true",
             codex_cli_simplified_flow: "true",

package/dist/runtime/oauth/model-oauth.js

@@ -199,7 +199,7 @@ function startCallbackServer(host, port, pathName, expectedState, signal) {
 async function loginAuthCode(provider, interaction) {
     const { verifier, challenge } = createPkce();
     const state = provider.stateIsVerifier ? verifier : randomBytes(16).toString("hex");
-    const redirectUri = `http://${provider.callback.redirectHost}:${provider.callback.port}${provider.callback.path}`;
+    const redirectUri = provider.redirectUri ?? `http://${provider.callback.redirectHost}:${provider.callback.port}${provider.callback.path}`;
     const authorizeUrl = buildAuthorizeUrl(provider, { challenge, state, redirectUri });
     interaction.notify({
         type: "auth_url",
@@ -300,6 +300,88 @@ async function loginDeviceCode(provider, interaction) {
         return tokensFrom(provider, payload);
     }
 }
+async function postJsonObject(url, body, signal) {
+    const res = await fetch(url, {
+        method: "POST",
+        headers: { "content-type": "application/json", accept: "application/json" },
+        body: JSON.stringify(body),
+        signal,
+    });
+    const text = await res.text();
+    let payload = {};
+    try {
+        payload = JSON.parse(text);
+    }
+    catch { /* non-JSON error body */ }
+    return { status: res.status, ok: res.ok, payload, text };
+}
+function nestedOAuthErrorCode(payload) {
+    const error = payload.error;
+    if (typeof error === "string")
+        return error;
+    if (error && typeof error === "object") {
+        const code = error.code;
+        return typeof code === "string" ? code : "";
+    }
+    return "";
+}
+async function loginOpenAICodexDeviceCode(provider, interaction) {
+    const started = await postJsonObject(provider.deviceAuthUrl, { client_id: provider.clientId }, interaction.signal);
+    if (!started.ok)
+        throw new Error(`OpenAI Codex device authorization failed (${started.status}): ${started.text.slice(0, 200)}`);
+    const deviceAuthId = typeof started.payload.device_auth_id === "string" ? started.payload.device_auth_id : "";
+    const userCode = typeof started.payload.user_code === "string" ? started.payload.user_code : "";
+    const rawInterval = Number(started.payload.interval);
+    const interval = Number.isFinite(rawInterval) && rawInterval >= 0 ? rawInterval : 5;
+    if (!deviceAuthId || !userCode)
+        throw new Error(`Invalid OpenAI Codex device authorization response: ${JSON.stringify(started.payload)}`);
+    const expiresInSeconds = 15 * 60;
+    interaction.notify({
+        type: "device_code",
+        userCode,
+        verificationUri: "https://auth.openai.com/codex/device",
+        intervalSeconds: interval,
+        expiresInSeconds,
+    });
+    const deadline = Date.now() + expiresInSeconds * 1000;
+    let authorizationCode = "";
+    let codeVerifier = "";
+    let waitMs = interval * 1000;
+    await sleep(waitMs);
+    while (Date.now() <= deadline) {
+        if (interaction.signal?.aborted)
+            throw new Error("Login aborted");
+        const polled = await postJsonObject(provider.deviceTokenUrl, { device_auth_id: deviceAuthId, user_code: userCode }, interaction.signal);
+        if (polled.ok) {
+            authorizationCode = typeof polled.payload.authorization_code === "string" ? polled.payload.authorization_code : "";
+            codeVerifier = typeof polled.payload.code_verifier === "string" ? polled.payload.code_verifier : "";
+            if (!authorizationCode || !codeVerifier)
+                throw new Error(`Invalid OpenAI Codex device token response: ${JSON.stringify(polled.payload)}`);
+            break;
+        }
+        const errorCode = nestedOAuthErrorCode(polled.payload);
+        if (polled.status === 403 || polled.status === 404 || errorCode === "deviceauth_authorization_pending") {
+            await sleep(waitMs);
+            continue;
+        }
+        if (errorCode === "slow_down") {
+            waitMs += 5000;
+            await sleep(waitMs);
+            continue;
+        }
+        throw new Error(`OpenAI Codex device authorization failed (${polled.status}): ${polled.text.slice(0, 200)}`);
+    }
+    if (!authorizationCode || !codeVerifier)
+        throw new Error("OpenAI Codex device login timed out. Please try again.");
+    const payload = await postToken(provider.tokenUrl, provider.tokenEncoding, {
+        grant_type: "authorization_code",
+        client_id: provider.clientId,
+        code: authorizationCode,
+        code_verifier: codeVerifier,
+        redirect_uri: "https://auth.openai.com/deviceauth/callback",
+    });
+    return tokensFrom(provider, payload);
+}
 // --- Public API --------------------------------------------------------------
 /** Provider ids Bivy can natively drive a subscription login for. */
 export { isNativeOAuthProvider, nativeOAuthProviderIds } from "./model-oauth-providers.js";
@@ -312,7 +394,9 @@ export async function loginModelOAuth(credsDir, providerId, interaction, label =
     const provider = getModelOAuthProvider(providerId);
     if (!provider)
         throw new Error(`Provider "${providerId}" does not support subscription login`);
-    const tokens = provider.flow === "device_code" ? await loginDeviceCode(provider, interaction) : await loginAuthCode(provider, interaction);
+    const tokens = provider.flow === "device_code" ? await loginDeviceCode(provider, interaction)
+        : provider.flow === "openai_codex_device_code" ? await loginOpenAICodexDeviceCode(provider, interaction)
+            : await loginAuthCode(provider, interaction);
     const credential = { type: "oauth", access: tokens.access, refresh: tokens.refresh, expires: tokens.expires, refreshedAt: tokens.refreshedAt, ...(tokens.accountId ? { accountId: tokens.accountId } : {}) };
     await createCredentialVault(credsDir).modifyRecord(providerId, label, async () => credential);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.16.18-staging.2",
+  "version": "0.16.18-staging.3",
   "type": "module",
   "license": "AGPL-3.0-only",
   "description": "Run coding agents on machines you own. Open-source, self-hostable agent workspace.",