@bman654/clodex 1.0.3 → 1.1.0

package/README.md

@@ -14,6 +14,8 @@ You can also run clodex as a local OpenAI-compatible endpoint in front of your C
 
 > clodex is derived from the original [relay-ai](https://github.com/jacob-bd/relay-ai) project, heavily modified and streamlined for this one use case, with the full commit history preserved.
 
+Contributions are welcome — see [CONTRIBUTING.md](./CONTRIBUTING.md) for how to scope a PR and what the quality bar is.
+
 ## Quick Start (ChatGPT/Codex plan)
 
 ```bash

package/dist/claude-wrapper.js

@@ -13,7 +13,11 @@ import { constants as osConstants } from "os";
 
 // src/wrapper-env.ts
 var PROXY_ENV_VARS = ["HTTPS_PROXY", "HTTP_PROXY", "https_proxy", "http_proxy"];
+var REQUIRE_SERVER_ENV = "CLODEX_REQUIRE_SERVER";
 var LOCAL_GATEWAY_API_KEY = "clodex-local";
+function wrapperRequiresServer(env) {
+  return env[REQUIRE_SERVER_ENV] === "1";
+}
 function computeWrapperEnv(baseEnv, state) {
   const env = { ...baseEnv };
   if (!state) return env;
@@ -55,16 +59,18 @@ function portIsOpen(port, timeoutMs = 100) {
 }
 async function main() {
   const argv = process.argv.slice(2);
-  let claudePath;
-  let claudeArgs;
-  if (argv[0] && isExecutableFile(argv[0])) {
+  const checkOnly = argv[0] === "--check";
+  let claudePath = null;
+  let claudeArgs = [];
+  if (checkOnly) {
+  } else if (argv[0] && isExecutableFile(argv[0])) {
     claudePath = argv[0];
     claudeArgs = argv.slice(1);
   } else {
     claudePath = findClaudeBinary();
     claudeArgs = argv;
   }
-  if (!claudePath) {
+  if (!checkOnly && !claudePath) {
     process.stderr.write("clodex-claude: could not find the claude binary (set CLODEX_CLAUDE_PATH)\n");
     process.exit(127);
   }
@@ -75,6 +81,11 @@ async function main() {
       break;
     }
   }
+  if (checkOnly) process.exit(state ? 0 : 1);
+  if (!state && wrapperRequiresServer(process.env)) {
+    process.stderr.write("clodex-claude: no live clodex server is available\n");
+    process.exit(1);
+  }
   const env = computeWrapperEnv(process.env, state);
   const child = spawn(claudePath, claudeArgs, {
     stdio: "inherit",

package/dist/claude-wrapper.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/claude-wrapper.ts","../src/wrapper-env.ts"],"sourcesContent":["// src/claude-wrapper.ts — the `clodex-claude` bin.\n//\n// A tiny, fast exec-style wrapper around the Claude Code binary that injects\n// bridge env for a running standalone `clodex server` (discovered via\n// ~/.clodex/server-runtime.json). Two invocation shapes:\n//\n//   1. CLAUDE_CODE_PROCESS_WRAPPER contract: Claude Code invokes\n//      `clodex-claude <claude-binary-path> <args...>` for every process it\n//      spawns (agents view sessions, background agents). First arg is the\n//      claude binary to exec.\n//   2. Direct terminal use: `clodex-claude [args...]` — the claude binary is\n//      discovered the same way `clodex claude` discovers it\n//      (CLODEX_CLAUDE_PATH override, config override, PATH, fallbacks).\n//\n// With a live proxy-mode server: HTTPS_PROXY/HTTP_PROXY + NODE_EXTRA_CA_CERTS\n// point at it and ANTHROPIC_BASE_URL is removed (claude keeps its own\n// Anthropic auth — this is the recommended mode). With a live endpoint-mode\n// server: ANTHROPIC_BASE_URL points at the gateway. With no live server the\n// env is passed through untouched, so claude always launches.\n//\n// This file must stay a thin shell over pure helpers (wrapper-env.ts,\n// server-runtime.ts) with minimal imports — it runs for every spawned agent.\n\nimport { spawn } from 'node:child_process';\nimport { accessSync, constants as fsConstants, statSync } from 'node:fs';\nimport { connect } from 'node:net';\nimport { constants as osConstants } from 'node:os';\nimport {\n  orderWrapperServerCandidates,\n  readLiveServerRuntimeStates,\n  type ServerRuntimeState,\n} from './server-runtime.js';\nimport { computeWrapperEnv } from './wrapper-env.js';\nimport { findClaudeBinary } from './launch.js';\n\nconst isWindows = process.platform === 'win32';\n\nfunction isExecutableFile(path: string): boolean {\n  try {\n    if (!statSync(path).isFile()) return false;\n    if (!isWindows) accessSync(path, fsConstants.X_OK);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/** Fast TCP probe — the state file can outlive a SIGKILLed listener. Never hangs. */\nfunction portIsOpen(port: number, timeoutMs = 100): Promise<boolean> {\n  return new Promise(resolve => {\n    const socket = connect({ host: '127.0.0.1', port });\n    const done = (result: boolean) => {\n      socket.destroy();\n      resolve(result);\n    };\n    socket.setTimeout(timeoutMs, () => done(false));\n    socket.once('connect', () => done(true));\n    socket.once('error', () => done(false));\n  });\n}\n\nasync function main(): Promise<void> {\n  const argv = process.argv.slice(2);\n\n  let claudePath: string | null;\n  let claudeArgs: string[];\n  if (argv[0] && isExecutableFile(argv[0])) {\n    // CLAUDE_CODE_PROCESS_WRAPPER shape: first arg is the claude binary path.\n    claudePath = argv[0];\n    claudeArgs = argv.slice(1);\n  } else {\n    claudePath = findClaudeBinary();\n    claudeArgs = argv;\n  }\n\n  if (!claudePath) {\n    process.stderr.write('clodex-claude: could not find the claude binary (set CLODEX_CLAUDE_PATH)\\n');\n    process.exit(127);\n  }\n\n  // Selection policy (see orderWrapperServerCandidates): proxy-mode servers\n  // are preferred over endpoint-mode ones — bridging keeps Claude Code's own\n  // Anthropic auth — with newest startedAt breaking ties within a mode. The\n  // first candidate whose port answers the TCP probe wins; if only an\n  // endpoint server is live it is used; with none, claude launches untouched.\n  let state: ServerRuntimeState | null = null;\n  for (const candidate of orderWrapperServerCandidates(readLiveServerRuntimeStates())) {\n    if (await portIsOpen(candidate.port)) {\n      state = candidate;\n      break;\n    }\n  }\n  const env = computeWrapperEnv(process.env, state);\n\n  const child = spawn(claudePath, claudeArgs, {\n    stdio: 'inherit',\n    env,\n    shell: isWindows,\n  });\n\n  const forward = (signal: NodeJS.Signals) => child.kill(signal);\n  process.once('SIGINT', () => forward('SIGINT'));\n  process.once('SIGTERM', () => forward('SIGTERM'));\n\n  child.on('error', err => {\n    process.stderr.write(`clodex-claude: failed to launch ${claudePath}: ${err.message}\\n`);\n    process.exit(127);\n  });\n  child.on('exit', (code, signal) => {\n    if (signal) {\n      const signum = osConstants.signals[signal as keyof typeof osConstants.signals];\n      process.exit(signum ? 128 + signum : 1);\n    }\n    process.exit(code ?? 0);\n  });\n}\n\nvoid main();\n","// src/wrapper-env.ts\n//\n// Pure env computation for the `clodex-claude` wrapper bin. Given the process\n// env and a live `clodex server` runtime state (or null), returns the env to\n// launch the Claude Code binary with. Kept dependency-free so the wrapper\n// stays tiny and fast — it runs for every Claude-Code-spawned agent process.\n\nimport type { ServerRuntimeState } from './server-runtime.js';\n\nconst PROXY_ENV_VARS = ['HTTPS_PROXY', 'HTTP_PROXY', 'https_proxy', 'http_proxy'] as const;\n\n/**\n * Any non-empty key satisfies the local endpoint gateway (`isAuthorized`\n * accepts everything when no server password is set, i.e. local listen mode).\n */\nexport const LOCAL_GATEWAY_API_KEY = 'clodex-local';\n\nexport function computeWrapperEnv(\n  baseEnv: NodeJS.ProcessEnv,\n  state: ServerRuntimeState | null,\n): NodeJS.ProcessEnv {\n  const env: NodeJS.ProcessEnv = { ...baseEnv };\n  // No live server: launch claude completely untouched — a down server must\n  // never break launching claude.\n  if (!state) return env;\n\n  if (state.mode === 'proxy') {\n    // Selective MITM: claude keeps its own Anthropic credentials; the proxy\n    // routes clodex:/alias models to OpenAI and passes everything else through.\n    const proxyUrl = `http://127.0.0.1:${state.port}`;\n    delete env['ANTHROPIC_BASE_URL'];\n    for (const name of PROXY_ENV_VARS) env[name] = proxyUrl;\n    if (state.caPath) env['NODE_EXTRA_CA_CERTS'] = state.caPath;\n    return env;\n  }\n\n  // Endpoint gateway: all traffic goes to the local Anthropic-format gateway.\n  for (const name of PROXY_ENV_VARS) delete env[name];\n  env['ANTHROPIC_BASE_URL'] = `http://127.0.0.1:${state.port}/anthropic`;\n  env['ANTHROPIC_API_KEY'] = LOCAL_GATEWAY_API_KEY;\n  return env;\n}\n"],"mappings":";;;;;;;;AAuBA,SAAS,aAAa;AACtB,SAAS,YAAY,aAAa,aAAa,gBAAgB;AAC/D,SAAS,eAAe;AACxB,SAAS,aAAa,mBAAmB;;;ACjBzC,IAAM,iBAAiB,CAAC,eAAe,cAAc,eAAe,YAAY;AAMzE,IAAM,wBAAwB;AAE9B,SAAS,kBACd,SACA,OACmB;AACnB,QAAM,MAAyB,EAAE,GAAG,QAAQ;AAG5C,MAAI,CAAC,MAAO,QAAO;AAEnB,MAAI,MAAM,SAAS,SAAS;AAG1B,UAAM,WAAW,oBAAoB,MAAM,IAAI;AAC/C,WAAO,IAAI,oBAAoB;AAC/B,eAAW,QAAQ,eAAgB,KAAI,IAAI,IAAI;AAC/C,QAAI,MAAM,OAAQ,KAAI,qBAAqB,IAAI,MAAM;AACrD,WAAO;AAAA,EACT;AAGA,aAAW,QAAQ,eAAgB,QAAO,IAAI,IAAI;AAClD,MAAI,oBAAoB,IAAI,oBAAoB,MAAM,IAAI;AAC1D,MAAI,mBAAmB,IAAI;AAC3B,SAAO;AACT;;;ADNA,IAAM,YAAY,QAAQ,aAAa;AAEvC,SAAS,iBAAiB,MAAuB;AAC/C,MAAI;AACF,QAAI,CAAC,SAAS,IAAI,EAAE,OAAO,EAAG,QAAO;AACrC,QAAI,CAAC,UAAW,YAAW,MAAM,YAAY,IAAI;AACjD,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,SAAS,WAAW,MAAc,YAAY,KAAuB;AACnE,SAAO,IAAI,QAAQ,aAAW;AAC5B,UAAM,SAAS,QAAQ,EAAE,MAAM,aAAa,KAAK,CAAC;AAClD,UAAM,OAAO,CAAC,WAAoB;AAChC,aAAO,QAAQ;AACf,cAAQ,MAAM;AAAA,IAChB;AACA,WAAO,WAAW,WAAW,MAAM,KAAK,KAAK,CAAC;AAC9C,WAAO,KAAK,WAAW,MAAM,KAAK,IAAI,CAAC;AACvC,WAAO,KAAK,SAAS,MAAM,KAAK,KAAK,CAAC;AAAA,EACxC,CAAC;AACH;AAEA,eAAe,OAAsB;AACnC,QAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;AAEjC,MAAI;AACJ,MAAI;AACJ,MAAI,KAAK,CAAC,KAAK,iBAAiB,KAAK,CAAC,CAAC,GAAG;AAExC,iBAAa,KAAK,CAAC;AACnB,iBAAa,KAAK,MAAM,CAAC;AAAA,EAC3B,OAAO;AACL,iBAAa,iBAAiB;AAC9B,iBAAa;AAAA,EACf;AAEA,MAAI,CAAC,YAAY;AACf,YAAQ,OAAO,MAAM,4EAA4E;AACjG,YAAQ,KAAK,GAAG;AAAA,EAClB;AAOA,MAAI,QAAmC;AACvC,aAAW,aAAa,6BAA6B,4BAA4B,CAAC,GAAG;AACnF,QAAI,MAAM,WAAW,UAAU,IAAI,GAAG;AACpC,cAAQ;AACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,MAAM,kBAAkB,QAAQ,KAAK,KAAK;AAEhD,QAAM,QAAQ,MAAM,YAAY,YAAY;AAAA,IAC1C,OAAO;AAAA,IACP;AAAA,IACA,OAAO;AAAA,EACT,CAAC;AAED,QAAM,UAAU,CAAC,WAA2B,MAAM,KAAK,MAAM;AAC7D,UAAQ,KAAK,UAAU,MAAM,QAAQ,QAAQ,CAAC;AAC9C,UAAQ,KAAK,WAAW,MAAM,QAAQ,SAAS,CAAC;AAEhD,QAAM,GAAG,SAAS,SAAO;AACvB,YAAQ,OAAO,MAAM,mCAAmC,UAAU,KAAK,IAAI,OAAO;AAAA,CAAI;AACtF,YAAQ,KAAK,GAAG;AAAA,EAClB,CAAC;AACD,QAAM,GAAG,QAAQ,CAAC,MAAM,WAAW;AACjC,QAAI,QAAQ;AACV,YAAM,SAAS,YAAY,QAAQ,MAA0C;AAC7E,cAAQ,KAAK,SAAS,MAAM,SAAS,CAAC;AAAA,IACxC;AACA,YAAQ,KAAK,QAAQ,CAAC;AAAA,EACxB,CAAC;AACH;AAEA,KAAK,KAAK;","names":[]}
+{"version":3,"sources":["../src/claude-wrapper.ts","../src/wrapper-env.ts"],"sourcesContent":["// src/claude-wrapper.ts — the `clodex-claude` bin.\n//\n// A tiny, fast exec-style wrapper around the Claude Code binary that injects\n// bridge env for a running standalone `clodex server` (discovered via\n// ~/.clodex/server-runtime.json). Two invocation shapes:\n//\n//   1. CLAUDE_CODE_PROCESS_WRAPPER contract: Claude Code invokes\n//      `clodex-claude <claude-binary-path> <args...>` for every process it\n//      spawns (agents view sessions, background agents). First arg is the\n//      claude binary to exec.\n//   2. Direct terminal use: `clodex-claude [args...]` — the claude binary is\n//      discovered the same way `clodex claude` discovers it\n//      (CLODEX_CLAUDE_PATH override, config override, PATH, fallbacks).\n//\n// With a live proxy-mode server: HTTPS_PROXY/HTTP_PROXY + NODE_EXTRA_CA_CERTS\n// point at it and ANTHROPIC_BASE_URL is removed (claude keeps its own\n// Anthropic auth — this is the recommended mode). With a live endpoint-mode\n// server: ANTHROPIC_BASE_URL points at the gateway. With no live server the\n// env is passed through untouched, so claude always launches.\n//\n// This file must stay a thin shell over pure helpers (wrapper-env.ts,\n// server-runtime.ts) with minimal imports — it runs for every spawned agent.\n\nimport { spawn } from 'node:child_process';\nimport { accessSync, constants as fsConstants, statSync } from 'node:fs';\nimport { connect } from 'node:net';\nimport { constants as osConstants } from 'node:os';\nimport {\n  orderWrapperServerCandidates,\n  readLiveServerRuntimeStates,\n  type ServerRuntimeState,\n} from './server-runtime.js';\nimport { computeWrapperEnv, wrapperRequiresServer } from './wrapper-env.js';\nimport { findClaudeBinary } from './launch.js';\n\nconst isWindows = process.platform === 'win32';\n\nfunction isExecutableFile(path: string): boolean {\n  try {\n    if (!statSync(path).isFile()) return false;\n    if (!isWindows) accessSync(path, fsConstants.X_OK);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/** Fast TCP probe — the state file can outlive a SIGKILLed listener. Never hangs. */\nfunction portIsOpen(port: number, timeoutMs = 100): Promise<boolean> {\n  return new Promise(resolve => {\n    const socket = connect({ host: '127.0.0.1', port });\n    const done = (result: boolean) => {\n      socket.destroy();\n      resolve(result);\n    };\n    socket.setTimeout(timeoutMs, () => done(false));\n    socket.once('connect', () => done(true));\n    socket.once('error', () => done(false));\n  });\n}\n\nasync function main(): Promise<void> {\n  const argv = process.argv.slice(2);\n  const checkOnly = argv[0] === '--check';\n\n  let claudePath: string | null = null;\n  let claudeArgs: string[] = [];\n  if (checkOnly) {\n    // Readiness checks validate discovery and TCP state without launching Claude.\n  } else if (argv[0] && isExecutableFile(argv[0])) {\n    // CLAUDE_CODE_PROCESS_WRAPPER shape: first arg is the claude binary path.\n    claudePath = argv[0];\n    claudeArgs = argv.slice(1);\n  } else {\n    claudePath = findClaudeBinary();\n    claudeArgs = argv;\n  }\n\n  if (!checkOnly && !claudePath) {\n    process.stderr.write('clodex-claude: could not find the claude binary (set CLODEX_CLAUDE_PATH)\\n');\n    process.exit(127);\n  }\n\n  // Selection policy (see orderWrapperServerCandidates): proxy-mode servers\n  // are preferred over endpoint-mode ones — bridging keeps Claude Code's own\n  // Anthropic auth — with newest startedAt breaking ties within a mode. The\n  // first candidate whose port answers the TCP probe wins; if only an\n  // endpoint server is live it is used; with none, claude launches untouched.\n  let state: ServerRuntimeState | null = null;\n  for (const candidate of orderWrapperServerCandidates(readLiveServerRuntimeStates())) {\n    if (await portIsOpen(candidate.port)) {\n      state = candidate;\n      break;\n    }\n  }\n  if (checkOnly) process.exit(state ? 0 : 1);\n  if (!state && wrapperRequiresServer(process.env)) {\n    process.stderr.write('clodex-claude: no live clodex server is available\\n');\n    process.exit(1);\n  }\n  const env = computeWrapperEnv(process.env, state);\n\n  const child = spawn(claudePath!, claudeArgs, {\n    stdio: 'inherit',\n    env,\n    shell: isWindows,\n  });\n\n  const forward = (signal: NodeJS.Signals) => child.kill(signal);\n  process.once('SIGINT', () => forward('SIGINT'));\n  process.once('SIGTERM', () => forward('SIGTERM'));\n\n  child.on('error', err => {\n    process.stderr.write(`clodex-claude: failed to launch ${claudePath}: ${err.message}\\n`);\n    process.exit(127);\n  });\n  child.on('exit', (code, signal) => {\n    if (signal) {\n      const signum = osConstants.signals[signal as keyof typeof osConstants.signals];\n      process.exit(signum ? 128 + signum : 1);\n    }\n    process.exit(code ?? 0);\n  });\n}\n\nvoid main();\n","// src/wrapper-env.ts\n//\n// Pure env computation for the `clodex-claude` wrapper bin. Given the process\n// env and a live `clodex server` runtime state (or null), returns the env to\n// launch the Claude Code binary with. Kept dependency-free so the wrapper\n// stays tiny and fast — it runs for every Claude-Code-spawned agent process.\n\nimport type { ServerRuntimeState } from './server-runtime.js';\n\nconst PROXY_ENV_VARS = ['HTTPS_PROXY', 'HTTP_PROXY', 'https_proxy', 'http_proxy'] as const;\nexport const REQUIRE_SERVER_ENV = 'CLODEX_REQUIRE_SERVER';\n\n/**\n * Any non-empty key satisfies the local endpoint gateway (`isAuthorized`\n * accepts everything when no server password is set, i.e. local listen mode).\n */\nexport const LOCAL_GATEWAY_API_KEY = 'clodex-local';\n\nexport function wrapperRequiresServer(env: NodeJS.ProcessEnv): boolean {\n  return env[REQUIRE_SERVER_ENV] === '1';\n}\n\nexport function computeWrapperEnv(\n  baseEnv: NodeJS.ProcessEnv,\n  state: ServerRuntimeState | null,\n): NodeJS.ProcessEnv {\n  const env: NodeJS.ProcessEnv = { ...baseEnv };\n  // No live server: launch claude completely untouched — a down server must\n  // never break launching claude.\n  if (!state) return env;\n\n  if (state.mode === 'proxy') {\n    // Selective MITM: claude keeps its own Anthropic credentials; the proxy\n    // routes clodex:/alias models to OpenAI and passes everything else through.\n    const proxyUrl = `http://127.0.0.1:${state.port}`;\n    delete env['ANTHROPIC_BASE_URL'];\n    for (const name of PROXY_ENV_VARS) env[name] = proxyUrl;\n    if (state.caPath) env['NODE_EXTRA_CA_CERTS'] = state.caPath;\n    return env;\n  }\n\n  // Endpoint gateway: all traffic goes to the local Anthropic-format gateway.\n  for (const name of PROXY_ENV_VARS) delete env[name];\n  env['ANTHROPIC_BASE_URL'] = `http://127.0.0.1:${state.port}/anthropic`;\n  env['ANTHROPIC_API_KEY'] = LOCAL_GATEWAY_API_KEY;\n  return env;\n}\n"],"mappings":";;;;;;;;AAuBA,SAAS,aAAa;AACtB,SAAS,YAAY,aAAa,aAAa,gBAAgB;AAC/D,SAAS,eAAe;AACxB,SAAS,aAAa,mBAAmB;;;ACjBzC,IAAM,iBAAiB,CAAC,eAAe,cAAc,eAAe,YAAY;AACzE,IAAM,qBAAqB;AAM3B,IAAM,wBAAwB;AAE9B,SAAS,sBAAsB,KAAiC;AACrE,SAAO,IAAI,kBAAkB,MAAM;AACrC;AAEO,SAAS,kBACd,SACA,OACmB;AACnB,QAAM,MAAyB,EAAE,GAAG,QAAQ;AAG5C,MAAI,CAAC,MAAO,QAAO;AAEnB,MAAI,MAAM,SAAS,SAAS;AAG1B,UAAM,WAAW,oBAAoB,MAAM,IAAI;AAC/C,WAAO,IAAI,oBAAoB;AAC/B,eAAW,QAAQ,eAAgB,KAAI,IAAI,IAAI;AAC/C,QAAI,MAAM,OAAQ,KAAI,qBAAqB,IAAI,MAAM;AACrD,WAAO;AAAA,EACT;AAGA,aAAW,QAAQ,eAAgB,QAAO,IAAI,IAAI;AAClD,MAAI,oBAAoB,IAAI,oBAAoB,MAAM,IAAI;AAC1D,MAAI,mBAAmB,IAAI;AAC3B,SAAO;AACT;;;ADXA,IAAM,YAAY,QAAQ,aAAa;AAEvC,SAAS,iBAAiB,MAAuB;AAC/C,MAAI;AACF,QAAI,CAAC,SAAS,IAAI,EAAE,OAAO,EAAG,QAAO;AACrC,QAAI,CAAC,UAAW,YAAW,MAAM,YAAY,IAAI;AACjD,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,SAAS,WAAW,MAAc,YAAY,KAAuB;AACnE,SAAO,IAAI,QAAQ,aAAW;AAC5B,UAAM,SAAS,QAAQ,EAAE,MAAM,aAAa,KAAK,CAAC;AAClD,UAAM,OAAO,CAAC,WAAoB;AAChC,aAAO,QAAQ;AACf,cAAQ,MAAM;AAAA,IAChB;AACA,WAAO,WAAW,WAAW,MAAM,KAAK,KAAK,CAAC;AAC9C,WAAO,KAAK,WAAW,MAAM,KAAK,IAAI,CAAC;AACvC,WAAO,KAAK,SAAS,MAAM,KAAK,KAAK,CAAC;AAAA,EACxC,CAAC;AACH;AAEA,eAAe,OAAsB;AACnC,QAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;AACjC,QAAM,YAAY,KAAK,CAAC,MAAM;AAE9B,MAAI,aAA4B;AAChC,MAAI,aAAuB,CAAC;AAC5B,MAAI,WAAW;AAAA,EAEf,WAAW,KAAK,CAAC,KAAK,iBAAiB,KAAK,CAAC,CAAC,GAAG;AAE/C,iBAAa,KAAK,CAAC;AACnB,iBAAa,KAAK,MAAM,CAAC;AAAA,EAC3B,OAAO;AACL,iBAAa,iBAAiB;AAC9B,iBAAa;AAAA,EACf;AAEA,MAAI,CAAC,aAAa,CAAC,YAAY;AAC7B,YAAQ,OAAO,MAAM,4EAA4E;AACjG,YAAQ,KAAK,GAAG;AAAA,EAClB;AAOA,MAAI,QAAmC;AACvC,aAAW,aAAa,6BAA6B,4BAA4B,CAAC,GAAG;AACnF,QAAI,MAAM,WAAW,UAAU,IAAI,GAAG;AACpC,cAAQ;AACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,UAAW,SAAQ,KAAK,QAAQ,IAAI,CAAC;AACzC,MAAI,CAAC,SAAS,sBAAsB,QAAQ,GAAG,GAAG;AAChD,YAAQ,OAAO,MAAM,qDAAqD;AAC1E,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,QAAM,MAAM,kBAAkB,QAAQ,KAAK,KAAK;AAEhD,QAAM,QAAQ,MAAM,YAAa,YAAY;AAAA,IAC3C,OAAO;AAAA,IACP;AAAA,IACA,OAAO;AAAA,EACT,CAAC;AAED,QAAM,UAAU,CAAC,WAA2B,MAAM,KAAK,MAAM;AAC7D,UAAQ,KAAK,UAAU,MAAM,QAAQ,QAAQ,CAAC;AAC9C,UAAQ,KAAK,WAAW,MAAM,QAAQ,SAAS,CAAC;AAEhD,QAAM,GAAG,SAAS,SAAO;AACvB,YAAQ,OAAO,MAAM,mCAAmC,UAAU,KAAK,IAAI,OAAO;AAAA,CAAI;AACtF,YAAQ,KAAK,GAAG;AAAA,EAClB,CAAC;AACD,QAAM,GAAG,QAAQ,CAAC,MAAM,WAAW;AACjC,QAAI,QAAQ;AACV,YAAM,SAAS,YAAY,QAAQ,MAA0C;AAC7E,cAAQ,KAAK,SAAS,MAAM,SAAS,CAAC;AAAA,IACxC;AACA,YAAQ,KAAK,QAAQ,CAAC;AAAA,EACxB,CAAC;AACH;AAEA,KAAK,KAAK;","names":[]}

package/dist/cli.js

@@ -202,7 +202,7 @@ import { join } from "path";
 // package.json
 var package_default = {
   name: "@bman654/clodex",
-  version: "1.0.3",
+  version: "1.1.0",
   publishConfig: {
     access: "public"
   },
@@ -2338,6 +2338,111 @@ async function outboundWsProxyAgent(wsUrl) {
   return new HttpsProxyAgent(proxyUrl);
 }
 
+// src/upstream-error.ts
+import { APICallError, RetryError } from "ai";
+function sdkUpstreamErrorDetails(err) {
+  const retry = RetryError.isInstance(err) ? err : void 0;
+  const inner = retry?.lastError ?? err;
+  if (!APICallError.isInstance(inner)) return void 0;
+  let errorContent = inner.responseBody;
+  if (!errorContent && inner.data !== void 0) {
+    try {
+      errorContent = JSON.stringify(inner.data);
+    } catch {
+    }
+  }
+  return {
+    statusCode: inner.statusCode,
+    errorContent: errorContent || inner.message,
+    isRetryable: inner.isRetryable,
+    attemptCount: retry?.errors.length ?? 1
+  };
+}
+function isContextLengthExceededError(err, formattedMessage = "") {
+  const details = sdkUpstreamErrorDetails(err);
+  const rec = err && typeof err === "object" ? err : void 0;
+  const candidates = [
+    formattedMessage,
+    details?.errorContent,
+    rec?.message,
+    rec?.responseBody,
+    rec?.data?.error?.code,
+    rec?.data?.error?.type,
+    rec?.data?.error?.message,
+    rec?.lastError?.message,
+    ...rec?.errors?.map((error) => error.message) ?? []
+  ].filter((value) => typeof value === "string");
+  return candidates.some((value) => /context_length_exceeded/i.test(value) || /context window/i.test(value) || /maximum context length/i.test(value) || /prompt is too long/i.test(value));
+}
+function formatUpstreamError(err) {
+  if (!err || typeof err !== "object") return "Upstream model request failed.";
+  const rec = err;
+  if (rec.data?.error?.message) {
+    const short = sanitizeMessage(rec.data.error.message);
+    return rec.statusCode ? `${short} (HTTP ${rec.statusCode})` : short;
+  }
+  if (rec.responseBody) {
+    try {
+      const parsed = JSON.parse(rec.responseBody);
+      if (parsed.error?.message) {
+        const short = sanitizeMessage(parsed.error.message);
+        return rec.statusCode ? `${short} (HTTP ${rec.statusCode})` : short;
+      }
+    } catch {
+    }
+  }
+  const last = rec.lastError;
+  if (last?.message) {
+    const code = last.statusCode;
+    const short = sanitizeMessage(last.message);
+    return code ? `${short} (HTTP ${code})` : short;
+  }
+  const fromList = rec.errors?.[rec.errors.length - 1];
+  if (fromList?.message) {
+    const short = sanitizeMessage(fromList.message);
+    return fromList.statusCode ? `${short} (HTTP ${fromList.statusCode})` : short;
+  }
+  if (rec.message) {
+    const short = sanitizeMessage(rec.message);
+    if (short && !short.includes("file://") && !short.includes("APICallError") && short.length < 240) {
+      return rec.statusCode ? `${short} (HTTP ${rec.statusCode})` : short;
+    }
+  }
+  return "Upstream model request failed.";
+}
+function upstreamHttpStatus(err, message) {
+  if (err && typeof err === "object" && "statusCode" in err) {
+    const code = err.statusCode;
+    if (typeof code === "number" && code >= 400 && code <= 599) return code;
+  }
+  if (message.includes("HTTP 429") || message.includes("429")) return 429;
+  if (message.includes("HTTP 400")) return 400;
+  return 500;
+}
+function anthropicErrorType(status) {
+  switch (status) {
+    case 400:
+      return "invalid_request_error";
+    case 401:
+      return "authentication_error";
+    case 403:
+      return "permission_error";
+    case 404:
+      return "not_found_error";
+    case 429:
+      return "rate_limit_error";
+    default:
+      return "api_error";
+  }
+}
+function sanitizeMessage(message) {
+  const line = message.split("\n")[0]?.trim() ?? message;
+  if (line.startsWith("RetryError") || line.includes("AI_RetryError")) {
+    return "Upstream model request failed after retries.";
+  }
+  return line;
+}
+
 // src/oauth/responses-websocket.ts
 var RESPONSES_LITE_HEADER = "x-openai-internal-codex-responses-lite";
 var TERMINAL_EVENT_TYPES = /* @__PURE__ */ new Set(["response.completed", "response.failed", "response.incomplete"]);
@@ -2413,6 +2518,10 @@ function hasResponsesLiteHeader(headers) {
     ([key, value]) => key.toLowerCase() === RESPONSES_LITE_HEADER && value.toLowerCase() === "true"
   );
 }
+function authorizationHeaderFingerprint(headers) {
+  const authorization = Object.entries(headers).find(([key]) => key.toLowerCase() === "authorization")?.[1];
+  return authorization ? createHash("sha256").update(authorization).digest("hex") : "";
+}
 function bodyToString(body) {
   if (body == null) return "";
   if (typeof body === "string") return body;
@@ -2471,7 +2580,7 @@ function instructionChangeSummary(previous, current) {
   const firstDiffLine = previous.slice(0, prefix).split("\n").length;
   return `instructions changed: previous_chars=${previous.length} current_chars=${current.length} common_prefix_chars=${prefix} common_suffix_chars=${suffix} first_diff_line=${firstDiffLine}`;
 }
-function responsesWebSocketPartitionKey(wsUrl, payload, options = {}) {
+function responsesWebSocketPartitionKey(wsUrl, payload, options = {}, authorizationFingerprint = "") {
   const promptCacheKey = payload.prompt_cache_key;
   const model = payload.model;
   if (typeof promptCacheKey !== "string" || !promptCacheKey || typeof model !== "string" || !model) return void 0;
@@ -2483,7 +2592,8 @@ function responsesWebSocketPartitionKey(wsUrl, payload, options = {}) {
     options.accountId ?? "",
     model,
     effort,
-    promptCacheKey
+    promptCacheKey,
+    authorizationFingerprint
   ].join("");
   return createHash("sha256").update(material).digest("hex");
 }
@@ -2852,7 +2962,7 @@ function deleteEntry(entry, closeSocket = true) {
     }
   }
 }
-function failContext(entry, ctx, message, diagnosticDetails) {
+function failContext(entry, ctx, message, diagnosticDetails, statusCode) {
   if (ctx.closed || entry.current !== ctx) return;
   entry.debug(`fail: ${message}`);
   emitResponseErrorDiagnostic(entry, ctx, {
@@ -2860,7 +2970,16 @@ function failContext(entry, ctx, message, diagnosticDetails) {
     ...diagnosticTextFingerprint("errorMessage", message)
   });
   flushPending(ctx);
-  encodeSse(ctx, { type: "error", error: { message } });
+  encodeSse(ctx, {
+    type: "error",
+    sequence_number: ctx.frameCount,
+    error: {
+      type: statusCode === void 0 ? "transport_error" : anthropicErrorType(statusCode),
+      code: statusCode === void 0 ? "websocket_transport_error" : String(statusCode),
+      message,
+      param: null
+    }
+  });
   deleteEntry(entry);
   closeContext(ctx);
 }
@@ -3047,13 +3166,17 @@ function createConnection(WebSocket, wsUrl, headers, persistent, key, options, d
     if (ctx && !ctx.closed) sendContext(entry, ctx);
   });
   socket.on("unexpected-response", (_request, response) => {
-    debug(`unexpected-response status=${response.statusCode}`);
+    const statusCode = response.statusCode ?? 502;
+    debug(`unexpected-response status=${statusCode}`);
+    response.resume();
     const ctx = entry.current;
     if (ctx && !ctx.closed) {
-      emitResponseErrorDiagnostic(entry, ctx, {
+      failContext(entry, ctx, `WebSocket upgrade failed (HTTP ${statusCode})`, {
         source: "unexpected_response",
-        httpStatusCode: response.statusCode
-      });
+        httpStatusCode: statusCode
+      }, statusCode);
+    } else {
+      deleteEntry(entry);
     }
   });
   socket.on("message", (data) => handleSocketMessage(entry, data));
@@ -3111,7 +3234,13 @@ function createResponsesWebSocketFetch(wsUrl, log12, options = {}) {
       payload = {};
     }
     if (hasResponsesLiteHeader(headers)) payload = applyResponsesLiteShape(payload);
-    const partitionKey = responsesWebSocketPartitionKey(wsUrl, payload, options);
+    const authorizationFingerprint = authorizationHeaderFingerprint(headers);
+    const partitionKey = responsesWebSocketPartitionKey(
+      wsUrl,
+      payload,
+      options,
+      authorizationFingerprint
+    );
     const promptFingerprint = responsesWebSocketPromptFingerprint(payload);
     const promptFieldHashes = responsesWebSocketPromptFieldHashes(payload);
     const instructionsSnapshot = instructionsFromPayload(payload);
@@ -3480,7 +3609,8 @@ async function createLanguageModel(spec) {
   if (npm === "@ai-sdk/openai") {
     const { createOpenAI } = await import("@ai-sdk/openai");
     const useResponsesEndpoint = shouldUseOpenAiResponsesEndpoint(modelId);
-    const accountId = spec.authType === "oauth" ? spec.oauthAccountId ?? extractOpenAiAccountId({ access_token: apiKey }) : void 0;
+    const tokenAccountId = spec.authType === "oauth" ? extractOpenAiAccountId({ access_token: apiKey })?.trim() : void 0;
+    const accountId = spec.authType === "oauth" ? tokenAccountId || spec.oauthAccountId : void 0;
     const oauthOptions = spec.authType === "oauth" ? {
       apiKey,
       baseURL: "https://chatgpt.com/backend-api/codex",
@@ -6783,111 +6913,6 @@ function resolveUpstreamTools(tools, messages) {
   return upstream;
 }
 
-// src/upstream-error.ts
-import { APICallError, RetryError } from "ai";
-function sdkUpstreamErrorDetails(err) {
-  const retry = RetryError.isInstance(err) ? err : void 0;
-  const inner = retry?.lastError ?? err;
-  if (!APICallError.isInstance(inner)) return void 0;
-  let errorContent = inner.responseBody;
-  if (!errorContent && inner.data !== void 0) {
-    try {
-      errorContent = JSON.stringify(inner.data);
-    } catch {
-    }
-  }
-  return {
-    statusCode: inner.statusCode,
-    errorContent: errorContent || inner.message,
-    isRetryable: inner.isRetryable,
-    attemptCount: retry?.errors.length ?? 1
-  };
-}
-function isContextLengthExceededError(err, formattedMessage = "") {
-  const details = sdkUpstreamErrorDetails(err);
-  const rec = err && typeof err === "object" ? err : void 0;
-  const candidates = [
-    formattedMessage,
-    details?.errorContent,
-    rec?.message,
-    rec?.responseBody,
-    rec?.data?.error?.code,
-    rec?.data?.error?.type,
-    rec?.data?.error?.message,
-    rec?.lastError?.message,
-    ...rec?.errors?.map((error) => error.message) ?? []
-  ].filter((value) => typeof value === "string");
-  return candidates.some((value) => /context_length_exceeded/i.test(value) || /context window/i.test(value) || /maximum context length/i.test(value) || /prompt is too long/i.test(value));
-}
-function formatUpstreamError(err) {
-  if (!err || typeof err !== "object") return "Upstream model request failed.";
-  const rec = err;
-  if (rec.data?.error?.message) {
-    const short = sanitizeMessage(rec.data.error.message);
-    return rec.statusCode ? `${short} (HTTP ${rec.statusCode})` : short;
-  }
-  if (rec.responseBody) {
-    try {
-      const parsed = JSON.parse(rec.responseBody);
-      if (parsed.error?.message) {
-        const short = sanitizeMessage(parsed.error.message);
-        return rec.statusCode ? `${short} (HTTP ${rec.statusCode})` : short;
-      }
-    } catch {
-    }
-  }
-  const last = rec.lastError;
-  if (last?.message) {
-    const code = last.statusCode;
-    const short = sanitizeMessage(last.message);
-    return code ? `${short} (HTTP ${code})` : short;
-  }
-  const fromList = rec.errors?.[rec.errors.length - 1];
-  if (fromList?.message) {
-    const short = sanitizeMessage(fromList.message);
-    return fromList.statusCode ? `${short} (HTTP ${fromList.statusCode})` : short;
-  }
-  if (rec.message) {
-    const short = sanitizeMessage(rec.message);
-    if (short && !short.includes("file://") && !short.includes("APICallError") && short.length < 240) {
-      return rec.statusCode ? `${short} (HTTP ${rec.statusCode})` : short;
-    }
-  }
-  return "Upstream model request failed.";
-}
-function upstreamHttpStatus(err, message) {
-  if (err && typeof err === "object" && "statusCode" in err) {
-    const code = err.statusCode;
-    if (typeof code === "number" && code >= 400 && code <= 599) return code;
-  }
-  if (message.includes("HTTP 429") || message.includes("429")) return 429;
-  if (message.includes("HTTP 400")) return 400;
-  return 500;
-}
-function anthropicErrorType(status) {
-  switch (status) {
-    case 400:
-      return "invalid_request_error";
-    case 401:
-      return "authentication_error";
-    case 403:
-      return "permission_error";
-    case 404:
-      return "not_found_error";
-    case 429:
-      return "rate_limit_error";
-    default:
-      return "api_error";
-  }
-}
-function sanitizeMessage(message) {
-  const line = message.split("\n")[0]?.trim() ?? message;
-  if (line.startsWith("RetryError") || line.includes("AI_RetryError")) {
-    return "Upstream model request failed after retries.";
-  }
-  return line;
-}
-
 // src/sdk-adapter.ts
 function sdkTranslationErrorSignature(error) {
   const message = error instanceof Error ? error.message : typeof error === "string" ? error : void 0;
@@ -7495,6 +7520,9 @@ async function generateAnthropicResponse(model, params, modelId, options) {
         if (abortSignal.aborted || part.type === "abort") {
           throw streamAbortError(abortSignal);
         }
+        if (part.type === "error") {
+          throw part.error instanceof Error || part.error && typeof part.error === "object" ? part.error : new Error(typeof part.error === "string" ? part.error : "Upstream stream failed");
+        }
         if (part.type === "text-delta") streamedText.push(part.text ?? "");
         else if (part.type === "tool-call") {
           streamedToolCalls.push({
@@ -7599,6 +7627,8 @@ function anthropicPromptTooLongMessage(body, contextWindow) {
 }
 
 // src/proxy.ts
+var STREAM_KEEPALIVE_INTERVAL_MS = 2e4;
+var STREAM_KEEPALIVE_PING = 'event: ping\ndata: {"type":"ping"}\n\n';
 function createTranslationLifecycle(logPath, requestId, modelId, provider) {
   if (!logPath || !requestId) return void 0;
   const startedAt = Date.now();
@@ -7942,6 +7972,9 @@ function startProxyCatalog(routes, defaultAliasId, debug = false, inferenceLogPa
           });
           translationLifecycle?.dispatched();
           if (clientWantsStream) {
+            const keepAliveMs = Number(process.env.CLODEX_STREAM_KEEPALIVE_INTERVAL_MS) || STREAM_KEEPALIVE_INTERVAL_MS;
+            let lastDownstreamWriteAt = Date.now();
+            let lastUpstreamPartAt = Date.now();
             const writeStreamChunk = (chunk) => {
               translationLifecycle?.onOutput(chunk);
               if (!res.headersSent) {
@@ -7951,23 +7984,43 @@ function startProxyCatalog(routes, defaultAliasId, debug = false, inferenceLogPa
                   "Connection": "keep-alive"
                 });
               }
+              lastDownstreamWriteAt = Date.now();
               res.write(chunk);
             };
-            await withResponsesWebSocketDiagnosticContext(
-              { requestId: relayRequestId, claudeSessionId },
-              () => streamAnthropicResponse(
-                model,
-                params,
-                originalModel,
-                writeStreamChunk,
-                plog,
-                {
-                  onPart: (partType) => translationLifecycle?.onPart(partType),
-                  initialInputTokens: estimateAnthropicInputTokens(anthropicBody),
-                  abortSignal: clientAbort.signal
-                }
-              )
-            );
+            const keepAlive = setInterval(() => {
+              if (res.writableEnded || !res.headersSent) return;
+              const now = Date.now();
+              const outputIdleMs = now - lastDownstreamWriteAt;
+              const upstreamIdleMs = now - lastUpstreamPartAt;
+              if (outputIdleMs >= keepAliveMs && upstreamIdleMs < keepAliveMs) {
+                lastDownstreamWriteAt = now;
+                res.write(STREAM_KEEPALIVE_PING);
+                plog(() => `stream keepalive ping: output idle ${outputIdleMs}ms, upstream active (${upstreamIdleMs}ms since last part)`);
+              }
+            }, keepAliveMs);
+            keepAlive.unref();
+            try {
+              await withResponsesWebSocketDiagnosticContext(
+                { requestId: relayRequestId, claudeSessionId },
+                () => streamAnthropicResponse(
+                  model,
+                  params,
+                  originalModel,
+                  writeStreamChunk,
+                  plog,
+                  {
+                    onPart: (partType) => {
+                      lastUpstreamPartAt = Date.now();
+                      translationLifecycle?.onPart(partType);
+                    },
+                    initialInputTokens: estimateAnthropicInputTokens(anthropicBody),
+                    abortSignal: clientAbort.signal
+                  }
+                )
+              );
+            } finally {
+              clearInterval(keepAlive);
+            }
             translationLifecycle?.complete();
             if (!res.headersSent) writeStreamChunk("");
             res.end();