@bman654/clodex 2.18.5 → 2.18.7

package/dist/cli.js

@@ -74,7 +74,7 @@ import {
   withRegistryWriteLockSync,
   writeParentNoticeLines,
   writeParentNoticeLinesSync
-} from "./chunk-YGEPQOPA.js";
+} from "./chunk-VFYRDLDD.js";
 
 // src/cli.ts
 import pc13 from "picocolors";
@@ -346,7 +346,7 @@ import { join } from "path";
 // package.json
 var package_default = {
   name: "@bman654/clodex",
-  version: "2.18.5",
+  version: "2.18.7",
   publishConfig: {
     access: "public"
   },
@@ -6062,16 +6062,33 @@ function compareCodexClientVersions(a, b) {
   }
   return 0;
 }
-function requiresNewerCodexClient(model) {
-  if (!model.useResponsesLite) return false;
+function atLeast(version, floor) {
+  const order = compareCodexClientVersions(version, floor);
+  return order === 0 || order === 1;
+}
+function codexClientRequirement(model) {
+  if (!model.useResponsesLite) return void 0;
   const minimum = readCodexClientVersion(model.minimalClientVersion);
-  return minimum !== void 0 && compareCodexClientVersions(minimum, CODEX_RESPONSES_LITE_VERSION) === 1;
+  const withheldAt = readCodexClientVersion(model.withheldAtClientVersion);
+  const blockingMinimum = minimum !== void 0 && compareCodexClientVersions(minimum, CODEX_RESPONSES_LITE_VERSION) === 1 ? minimum : void 0;
+  const blockingWithheld = withheldAt !== void 0 && atLeast(withheldAt, CODEX_RESPONSES_LITE_VERSION) ? withheldAt : void 0;
+  if (blockingMinimum !== void 0 && (blockingWithheld === void 0 || compareCodexClientVersions(blockingMinimum, blockingWithheld) === 1)) {
+    return { kind: "minimum", version: blockingMinimum };
+  }
+  return blockingWithheld === void 0 ? void 0 : { kind: "withheld", version: blockingWithheld };
+}
+function requiresNewerCodexClient(model) {
+  return codexClientRequirement(model) !== void 0;
 }
 function codexClientVersionWarning(models) {
-  const unavailable = models.filter(requiresNewerCodexClient);
+  const unavailable = models.flatMap((model) => {
+    const requirement = codexClientRequirement(model);
+    return requirement ? [{ id: model.id, requirement }] : [];
+  });
   if (unavailable.length === 0) return void 0;
-  const details = unavailable.map((model) => `${printableServerText(model.id)} (requires ${model.minimalClientVersion})`).join(", ");
-  return `Hidden ChatGPT-plan models: ${details}. clodex sends Codex client version ${CODEX_RESPONSES_LITE_VERSION} for Responses-Lite; their catalog minimum exceeds this version. Update clodex to a release supporting their required version to use them.`;
+  const details = unavailable.map(({ id, requirement }) => `${printableServerText(id)} (requires ${requirement.kind === "minimum" ? requirement.version : `a version newer than ${requirement.version}`})`).join(", ");
+  const reason = unavailable.every(({ requirement }) => requirement.kind === "minimum") ? "their catalog minimum exceeds this version" : "the ChatGPT catalog does not offer them to this version";
+  return `Hidden ChatGPT-plan models: ${details}. clodex sends Codex client version ${CODEX_RESPONSES_LITE_VERSION} for Responses-Lite; ${reason}. Update clodex to a release supporting their required version to use them.`;
 }
 
 // src/data/openai-oauth-models.ts
@@ -15992,21 +16009,17 @@ var BLOCKED_HOSTNAMES = /* @__PURE__ */ new Set([
   "169.254.169.254",
   "metadata.google.internal",
   "169.254.170.2",
-  "fd00:ec2::254"
+  "fd00:ec2::254",
+  "100.100.100.200",
+  // Alibaba Cloud ECS
+  "fd20:ce::254"
+  // Google Cloud IPv6
 ]);
-function isBlockedIp(ipStr, allowInsecureLocal) {
+var NON_PUBLIC_RANGES = /* @__PURE__ */ new Set(["loopback", "private", "uniqueLocal", "carrierGradeNat"]);
+function isBlockedIp(ipStr) {
   try {
     const ip = ipaddr.process(ipStr);
-    const range = ip.range();
-    if (allowInsecureLocal && (range === "loopback" || range === "private")) {
-      return false;
-    }
-    if (range === "loopback") return true;
-    if (range === "private") return true;
-    if (range === "linkLocal") return true;
-    if (range === "uniqueLocal") return true;
-    if (range === "carrierGradeNat") return true;
-    return false;
+    return ip.range() === "linkLocal" || BLOCKED_HOSTNAMES.has(ip.toString());
   } catch {
     return true;
   }
@@ -16040,10 +16053,10 @@ async function validateCustomEndpointUrl(rawUrl, opts = {}) {
     return {
       ok: false,
       error: "Only HTTPS URLs are allowed.",
-      hint: "For local or LAN servers (Ollama, LM Studio, vLLM), allow insecure HTTP when prompted."
+      hint: "For a server on this machine, your LAN or Tailscale (Ollama, LM Studio, vLLM), allow insecure HTTP when prompted."
     };
   } else if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-    return { ok: false, error: "URL must use https:// or user-approved http:// for local/LAN servers." };
+    return { ok: false, error: "URL must use https:// or user-approved http:// for local, LAN or Tailscale servers." };
   }
   const rawHostname = parsed.hostname.toLowerCase();
   const hostname = rawHostname.replace(/^\[(.*)\]$/, "$1");
@@ -16051,7 +16064,7 @@ async function validateCustomEndpointUrl(rawUrl, opts = {}) {
     return {
       ok: false,
       error: "This URL points to a blocked internal/metadata host.",
-      hint: "Use a public API endpoint for your provider."
+      hint: "Use your model server's own loopback, LAN, Tailscale or public address."
     };
   }
   const addresses = await resolveHostAddresses(hostname);
@@ -16068,19 +16081,18 @@ async function validateCustomEndpointUrl(rawUrl, opts = {}) {
     } catch {
       continue;
     }
-    if (isBlockedIp(addr, allowLocal)) {
+    if (isBlockedIp(addr)) {
       return {
         ok: false,
-        error: "URL resolves to a private or restricted network address.",
-        hint: "Use a public HTTPS endpoint, or explicitly allow insecure HTTP for a trusted local/LAN server."
+        error: "URL resolves to a restricted link-local or cloud metadata address.",
+        hint: "Link-local addresses are not supported. Use the server's loopback, LAN, Tailscale or public address."
       };
     }
   }
   if (parsed.protocol === "http:") {
     const allResolvedAddressesAreLocal = addresses.every((addr) => {
       try {
-        const range = ipaddr.process(addr).range();
-        return range === "loopback" || range === "private" || range === "uniqueLocal";
+        return NON_PUBLIC_RANGES.has(ipaddr.process(addr).range());
       } catch {
         return false;
       }
@@ -16088,8 +16100,8 @@ async function validateCustomEndpointUrl(rawUrl, opts = {}) {
     if (!allowLocal || !allResolvedAddressesAreLocal) {
       return {
         ok: false,
-        error: "HTTP is only allowed for local loopback or private-network addresses.",
-        hint: "Use https://, or allow insecure HTTP for a trusted local/LAN server."
+        error: "HTTP is only allowed for addresses on this machine, your LAN or a private network such as Tailscale.",
+        hint: "Use https:// for a server on the public internet."
       };
     }
   }
@@ -16337,9 +16349,9 @@ async function runCustomEndpointAddFlow(onResult) {
   }
   let allowInsecureLocal = false;
   if (/^http:\/\//i.test(String(baseUrl).trim())) {
-    p3.log.warn("HTTP is not encrypted. Only use it for a trusted local or LAN server.");
+    p3.log.warn("HTTP is not encrypted. Only use it for a trusted server on this machine, your LAN or Tailscale.");
     const allow = await p3.confirm({
-      message: "Allow insecure HTTP for this local/LAN server?",
+      message: "Allow insecure HTTP for this local, LAN or Tailscale server?",
       initialValue: true
     });
     if (p3.isCancel(allow)) {
@@ -16629,12 +16641,7 @@ async function resolveRefreshCredentialWithSource(provider, resolveKey, selected
   return resolved;
 }
 
-// src/registry/refresh-models.ts
-async function refreshOAuthProvider(provider, accessToken) {
-  const tpl = provider.templateId ?? provider.id;
-  if (tpl === "openai" || tpl === "openai-oauth") return refreshOpenAiOAuthModels(accessToken);
-  throw new Error(`refreshOAuthProvider: unsupported template "${tpl}"`);
-}
+// src/registry/openai-oauth-catalog.ts
 function positiveInteger2(value) {
   return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : void 0;
 }
@@ -16754,7 +16761,41 @@ async function fetchJsonWithAuth(url, accessToken, timeoutMs) {
     }
   }
 }
-async function refreshOpenAiOAuthModels(accessToken) {
+async function markModelsWithheldAtRequestVersion(models, accessToken, timeoutMs, previous) {
+  const pinned = await fetchJsonWithAuth(
+    `https://chatgpt.com/backend-api/codex/models?client_version=${CODEX_RESPONSES_LITE_VERSION}`,
+    accessToken,
+    timeoutMs
+  );
+  const offered = readOfferedIds(pinned.body);
+  if (!offered) return carryWithheldMarkers(models, previous);
+  return models.map((model) => offered.has(model.id) ? model : { ...model, withheldAtClientVersion: CODEX_RESPONSES_LITE_VERSION });
+}
+function readOfferedIds(body) {
+  if (!body || typeof body !== "object") return void 0;
+  const record = body;
+  const shape = Array.isArray(record.models) ? { rows: record.models, key: "slug" } : Array.isArray(record.data) ? { rows: record.data, key: "id" } : void 0;
+  if (!shape || shape.rows.length === 0) return void 0;
+  const ids = /* @__PURE__ */ new Set();
+  for (const row of shape.rows) {
+    const id = row !== null && typeof row === "object" ? row[shape.key] : void 0;
+    if (typeof id !== "string" || id === "" || id !== id.trim()) return void 0;
+    ids.add(id);
+  }
+  return ids;
+}
+function carryWithheldMarkers(models, previous) {
+  const withheld = new Map(previous.flatMap((model) => {
+    const version = readCodexClientVersion(model.withheldAtClientVersion);
+    return version ? [[model.id, version]] : [];
+  }));
+  if (withheld.size === 0) return models;
+  return models.map((model) => {
+    const version = withheld.get(model.id);
+    return version ? { ...model, withheldAtClientVersion: version } : model;
+  });
+}
+async function refreshOpenAiOAuthModels(accessToken, previous = []) {
   const TIMEOUT_MS = 1e4;
   const seedById = new Map(buildOpenAiOAuthModels().map((m) => [m.id, m]));
   const toModels = (entries, codexCatalog) => entries.map((entry) => buildDynamicOAuthModel(entry, seedById, codexCatalog));
@@ -16766,7 +16807,11 @@ async function refreshOpenAiOAuthModels(accessToken) {
   );
   const codexEntries = parseOpenAiModelEntries(codexResult.body);
   if (codexEntries.length > 0) {
-    return { models: toModels(codexEntries, true), source: "live" };
+    const models = toModels(codexEntries, true);
+    return {
+      models: await markModelsWithheldAtRequestVersion(models, accessToken, TIMEOUT_MS, previous),
+      source: "live"
+    };
   }
   const chatGptResult = await fetchJsonWithAuth(
     "https://chatgpt.com/backend-api/models",
@@ -16775,7 +16820,10 @@ async function refreshOpenAiOAuthModels(accessToken) {
   );
   const chatGptEntries = parseOpenAiModelEntries(chatGptResult.body).filter(({ id }) => !CHATGPT_CODEX_UNSUPPORTED_MODELS.has(id));
   if (chatGptEntries.length > 0) {
-    return { models: toModels(chatGptEntries, false), source: "live" };
+    return {
+      models: carryWithheldMarkers(toModels(chatGptEntries, false), previous),
+      source: "live"
+    };
   }
   const failures = [codexResult.error, chatGptResult.error].filter((error) => error !== void 0);
   const credentialFailure = failures.find((error) => /(?:\brejected\b|\b401\b|\b403\b)/i.test(error));
@@ -16786,6 +16834,15 @@ async function refreshOpenAiOAuthModels(accessToken) {
     credentialRejected: credentialFailure !== void 0
   };
 }
+
+// src/registry/refresh-models.ts
+async function refreshOAuthProvider(provider, accessToken) {
+  const tpl = provider.templateId ?? provider.id;
+  if (tpl === "openai" || tpl === "openai-oauth") {
+    return refreshOpenAiOAuthModels(accessToken, provider.modelsCache?.models);
+  }
+  throw new Error(`refreshOAuthProvider: unsupported template "${tpl}"`);
+}
 function warningSuffix(models) {
   const warning = codexClientVersionWarning(applyOAuthSeedContextMetadata(models));
   return warning ? ` ${warning}` : "";
@@ -16817,8 +16874,9 @@ async function refreshApiListProvider(provider, apiKey) {
   let safeBaseUrl = baseUrl;
   const templateDefault = catalogTemplate?.defaultBaseUrl?.trim();
   if (configuredUrl && configuredUrl !== templateDefault) {
+    const customEndpoint = provider.templateId === "custom-openai" || provider.templateId === "custom-anthropic";
     const urlCheck = await validateCustomEndpointUrl(baseUrl, {
-      allowInsecureLocal: catalogTemplate?.apiKeyOptional === true
+      allowInsecureLocal: catalogTemplate?.apiKeyOptional === true || customEndpoint
     });
     if (!urlCheck.ok || !urlCheck.normalizedUrl) {
       return { models: [], error: `${urlCheck.error ?? "Invalid API base URL."} ${urlCheck.hint ?? ""}`.trim() };
@@ -17016,7 +17074,7 @@ async function refreshProviderModels(providerId, apiKey, registry, credentialSna
       }
     } else {
       const template = resolveProviderTemplate(provider);
-      const keyOptional = template?.apiKeyOptional === true;
+      const keyOptional = template?.apiKeyOptional === true || isAnonymousProvider(provider);
       const effectiveKey = keyOptional && isLikelyPlaceholderKey(apiKey) ? "" : apiKey;
       if (!keyOptional && isLikelyPlaceholderKey(effectiveKey)) {
         if (cachedModelCount(cacheProvider) > 0) {