@bman654/clodex 2.7.0 → 2.8.0

package/README.md

@@ -30,7 +30,7 @@ clodex claude                  # 5. launch Claude Code on an OpenAI model
 ```
 
 1. **Install** — puts the `clodex` command on your PATH.
-2. **Sign in** — opens a device-code OAuth flow for your ChatGPT/Codex plan; the token is stored in your OS credential store. (API-key users: `clodex providers add` instead.)
+2. **Sign in** — opens a device-code OAuth flow for your ChatGPT/Codex plan; the token is stored in your OS credential store. If your workspace admin has disabled device code authorization, add `--browser` to sign in through your browser instead. (API-key users: `clodex providers add` instead.)
 3. **Pick models** — an interactive manager for favorites (max 20) and short aliases like `sol` so you do not need to type the long names. Favorites drive the `/model` switch menu, proxy-mode routing, and the patcher.
 4. **Patch** *(optional but recommended for proxy mode)* — bakes your favorites and aliases into the Claude Code binary so they pass model validation, appear in `/model`, and report their real context windows. Re-run after each `claude` update; `clodex patch --restore` undoes it. This step is required if you want to use clodex-routed models as subagents via the Agent tool.
 5. **Launch** — starts Claude Code bridged to the model you choose.
@@ -273,7 +273,7 @@ Two things worth knowing about the numbers:
 | --- | --- |
 | *(none)* | Provider hub wizard |
 | `add` | Add OpenAI or OpenCode Go with an API key, or sign in with ChatGPT |
-| `auth openai` | Sign in with ChatGPT/Codex-plan OAuth (device code) |
+| `auth openai` | Sign in with ChatGPT/Codex-plan OAuth (device code; `--browser` for workspaces that disable device codes) |
 | `list` | Show configured providers |
 | `remove <id>` | Remove a provider by id |
 | `refresh-models [id]` | Update cached model lists |

package/dist/{chunk-WZXTVKFX.js → chunk-J7WXOD2K.js}

@@ -1708,6 +1708,7 @@ export {
   getInstalledClaudeVersion,
   tcpListenerUrlHost,
   waitForTcpListenerCandidate,
+  waitForTcpListener,
   listenTcpServer,
   isDiscoveryDisabled,
   registerServerRuntimeState,
@@ -1722,4 +1723,4 @@ export {
   wrapperRequiresServer,
   computeWrapperEnv
 };
-//# sourceMappingURL=chunk-WZXTVKFX.js.map
+//# sourceMappingURL=chunk-J7WXOD2K.js.map

package/dist/claude-wrapper.js

@@ -7,7 +7,7 @@ import {
   readLiveServerRuntimeStates,
   waitForTcpListenerCandidate,
   wrapperRequiresServer
-} from "./chunk-WZXTVKFX.js";
+} from "./chunk-J7WXOD2K.js";
 
 // src/claude-wrapper.ts
 import { spawn } from "child_process";

package/dist/cli.js

@@ -47,11 +47,12 @@ import {
   storeActiveOAuthAccount,
   tcpListenerUrlHost,
   unregisterServerRuntimeState,
+  waitForTcpListener,
   withCredentialMutationLock,
   withProviderMutationLock,
   withRegistryWriteLock,
   withRegistryWriteLockSync
-} from "./chunk-WZXTVKFX.js";
+} from "./chunk-J7WXOD2K.js";
 
 // src/cli.ts
 import pc13 from "picocolors";
@@ -204,6 +205,13 @@ function printOAuthStepsPanel(title, providerLabel2) {
     `${pc.white("3. Approve access for ")}${fmtProvider(providerLabel2)}`
   ]);
 }
+function printOAuthBrowserPanel(title, providerLabel2) {
+  printPanel(pc.cyan(title), [
+    `${pc.white("1. Sign in on the page that opens in your browser")}`,
+    `${pc.white("2. Approve access for ")}${fmtProvider(providerLabel2)}`,
+    `${pc.white("3. Return to this terminal")}`
+  ]);
+}
 function printNetworkWarningPanel() {
   printPanel(pc.yellow("Network mode"), [
     `${pc.yellow(pc.bold("Anyone on your network"))}${pc.white(" who knows the password can use this server through your account.")}`
@@ -374,7 +382,7 @@ import { join } from "path";
 // package.json
 var package_default = {
   name: "@bman654/clodex",
-  version: "2.7.0",
+  version: "2.8.0",
   publishConfig: {
     access: "public"
   },
@@ -821,6 +829,24 @@ function supportsNativeOAuth(providerId) {
 }
 
 // src/oauth/pkce.ts
+function generateRandomString(length) {
+  const chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
+  return Array.from(crypto.getRandomValues(new Uint8Array(length))).map((b) => chars[b % chars.length]).join("");
+}
+function base64UrlEncode(buffer) {
+  const binary = String.fromCharCode(...new Uint8Array(buffer));
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function generatePkce() {
+  const verifier = generateRandomString(64);
+  const hash = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  return { verifier, challenge: base64UrlEncode(hash) };
+}
+function generateOAuthState() {
+  const bytes = crypto.getRandomValues(new Uint8Array(32));
+  const binary = String.fromCharCode(...bytes);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
 function positiveSecondsToMs(value, defaultMs) {
   const seconds = Number(value);
   return Number.isFinite(seconds) && seconds > 0 ? seconds * 1e3 : defaultMs;
@@ -871,11 +897,112 @@ async function postOAuthRefresh(url, body, options) {
   }
 }
 
+// src/oauth/callback-server.ts
+import http from "http";
+var SUCCESS_HTML = `<!DOCTYPE html><html><head><meta charset="utf-8"><title>Authorized</title></head>
+<body style="font-family:system-ui;display:flex;justify-content:center;align-items:center;height:100vh;margin:0">
+<div style="text-align:center;padding:2rem;background:#fff;border-radius:8px;box-shadow:0 2px 10px rgba(0,0,0,.1)">
+<div style="color:#22c55e;font-size:2.5rem">&#10003;</div>
+<h1 style="margin:.5rem 0">Authentication successful</h1>
+<p style="color:#666">You can close this tab and return to the terminal.</p>
+</div></body></html>`;
+var FAILURE_HTML = `<!DOCTYPE html><html><head><meta charset="utf-8"><title>Sign-in failed</title></head>
+<body style="font-family:system-ui;display:flex;justify-content:center;align-items:center;height:100vh;margin:0">
+<div style="text-align:center;padding:2rem;background:#fff;border-radius:8px;box-shadow:0 2px 10px rgba(0,0,0,.1)">
+<div style="color:#ef4444;font-size:2.5rem">&#10007;</div>
+<h1 style="margin:.5rem 0">Sign-in failed</h1>
+<p style="color:#666">Return to the terminal for details.</p>
+</div></body></html>`;
+var LOOPBACK_PROBE_TIMEOUT_MS = 250;
+async function isLoopbackPortTaken(port) {
+  const probes = await Promise.all(["127.0.0.1", "::1"].map(
+    (host) => waitForTcpListener(host, port, LOOPBACK_PROBE_TIMEOUT_MS).catch(() => false)
+  ));
+  return probes.some(Boolean);
+}
+async function startCallbackServer(options) {
+  let codeResolve;
+  let codeReject;
+  let buffered;
+  const { path, redirectHost } = options;
+  const server = http.createServer((req, res) => {
+    const u = new URL(req.url ?? "/", "http://localhost");
+    if (u.pathname !== path) {
+      res.writeHead(404);
+      res.end();
+      return;
+    }
+    const code = u.searchParams.get("code") ?? "";
+    const state = u.searchParams.get("state") ?? "";
+    const error = u.searchParams.get("error") ?? "";
+    if (options.expectedState !== void 0 && state !== options.expectedState) {
+      res.writeHead(400, { "Content-Type": "text/plain; charset=utf-8" });
+      res.end("Invalid OAuth state");
+      return;
+    }
+    const failed = Boolean(error) || !code;
+    res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+    res.end(failed ? FAILURE_HTML : SUCCESS_HTML);
+    const params = { code, state, error: error || void 0 };
+    if (codeResolve) codeResolve(params);
+    else buffered ??= params;
+  });
+  const ports = options.ports?.length ? options.ports : [0];
+  let address;
+  let lastError;
+  for (const port of ports) {
+    if (port !== 0 && redirectHost === "localhost" && await isLoopbackPortTaken(port)) {
+      const busy = new Error(`listen EADDRINUSE: address already in use localhost:${port}`);
+      busy.code = "EADDRINUSE";
+      lastError = busy;
+      continue;
+    }
+    try {
+      address = await listenTcpServer(server, port, redirectHost);
+      break;
+    } catch (error) {
+      lastError = error;
+    }
+  }
+  if (!address) throw lastError ?? new Error("OAuth callback server could not bind");
+  return {
+    port: address.port,
+    redirectUri: `http://${redirectHost}:${address.port}${path}`,
+    waitForCallback(timeoutMs = 3e5) {
+      return new Promise((resolve3, reject) => {
+        if (buffered) {
+          resolve3(buffered);
+          buffered = void 0;
+          return;
+        }
+        const timer = setTimeout(
+          () => reject(new Error("OAuth timeout \u2014 browser closed without completing sign-in")),
+          timeoutMs
+        );
+        codeResolve = (params) => {
+          clearTimeout(timer);
+          resolve3(params);
+        };
+        codeReject = (err) => {
+          clearTimeout(timer);
+          reject(err);
+        };
+      });
+    },
+    close() {
+      server.close();
+      codeReject?.(new Error("Server closed"));
+    }
+  };
+}
+
 // src/oauth/openai.ts
 var CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 var ISSUER = "https://auth.openai.com";
 var OAUTH_POLLING_SAFETY_MARGIN_MS = 3e3;
 var DEVICE_CODE_DEFAULT_EXPIRES_MS = 5 * 60 * 1e3;
+var BROWSER_CALLBACK_PORTS = [1455, 1457];
+var BROWSER_CALLBACK_PATH = "/auth/callback";
 function extractOpenAiAccountId(tokens) {
   const token = tokens.id_token ?? tokens.access_token;
   if (!token) return void 0;
@@ -963,6 +1090,74 @@ async function refreshOpenAiAccessToken(refreshToken) {
     }
   );
 }
+function buildOpenAiAuthorizeUrl(redirectUri, challenge, state) {
+  const qs = new URLSearchParams({
+    response_type: "code",
+    client_id: CLIENT_ID,
+    redirect_uri: redirectUri,
+    scope: "openid profile email offline_access",
+    code_challenge: challenge,
+    code_challenge_method: "S256",
+    id_token_add_organizations: "true",
+    codex_cli_simplified_flow: "true",
+    state
+  });
+  return `${ISSUER}/oauth/authorize?${qs.toString()}`;
+}
+async function exchangeOpenAiAuthorizationCode(code, redirectUri, codeVerifier) {
+  return postOAuthRefresh(
+    `${ISSUER}/oauth/token`,
+    new URLSearchParams({
+      grant_type: "authorization_code",
+      code,
+      redirect_uri: redirectUri,
+      client_id: CLIENT_ID,
+      code_verifier: codeVerifier
+    }),
+    {
+      contentType: "form",
+      errorPrefix: "OpenAI token exchange failed",
+      includeStatus: true
+    }
+  );
+}
+async function runOpenAiBrowserFlow(onAuthorizeUrl, opts) {
+  const { verifier, challenge } = await generatePkce();
+  const state = generateOAuthState();
+  const ports = opts?.ports ?? BROWSER_CALLBACK_PORTS;
+  let server;
+  try {
+    server = await startCallbackServer({
+      ports,
+      path: BROWSER_CALLBACK_PATH,
+      redirectHost: "localhost",
+      expectedState: state
+    });
+  } catch (error) {
+    if (error.code === "EADDRINUSE") {
+      throw new Error(
+        `Ports ${ports.join(" and ")} are in use \u2014 close any other OpenAI sign-in (e.g. codex login) and try again.`
+      );
+    }
+    throw new Error(
+      `Could not start the OAuth callback listener: ${error instanceof Error ? error.message : String(error)}`,
+      { cause: error }
+    );
+  }
+  try {
+    onAuthorizeUrl({ url: buildOpenAiAuthorizeUrl(server.redirectUri, challenge, state) });
+    const params = await server.waitForCallback(opts?.timeoutMs);
+    if (params.error) throw new Error(`OpenAI sign-in failed: ${params.error}`);
+    if (!params.code) throw new Error("OpenAI sign-in returned no authorization code");
+    if (params.state !== state) {
+      throw new Error("OpenAI sign-in returned a mismatched state \u2014 try again");
+    }
+    const tokens = await exchangeOpenAiAuthorizationCode(params.code, server.redirectUri, verifier);
+    return { tokens, accountId: extractOpenAiAccountId(tokens) };
+  } finally {
+    server.close();
+  }
+}
 async function runOpenAiDeviceCodeFlow(onDeviceCode, opts) {
   const deviceData = await requestOpenAiDeviceCode();
   onDeviceCode({ url: openAiDeviceCodeUrl(), userCode: deviceData.user_code });
@@ -14226,6 +14421,25 @@ async function runNativeDeviceCode(providerId) {
     throw err;
   }
 }
+async function runNativeBrowserSignIn(providerId) {
+  const label = PROVIDER_DISPLAY[providerId];
+  printOAuthBrowserPanel(`${label} \u2014 Sign in`, label);
+  const spinner5 = p3.spinner();
+  spinner5.start("Opening your browser...");
+  try {
+    const { tokens, accountId } = await runOpenAiBrowserFlow(({ url }) => {
+      spinner5.stop("");
+      p3.log.info(`If the browser did not open, visit: ${pc4.cyan(url)}`);
+      openBrowser(url);
+      spinner5.start("Waiting for sign-in in your browser...");
+    });
+    spinner5.stop(pc4.green("Signed in to OpenAI ChatGPT"));
+    return tokensToStoredCredential(tokens, void 0, accountId);
+  } catch (err) {
+    spinner5.stop("");
+    throw err;
+  }
+}
 async function upsertOAuthAccountSlot(registryId, account, authRef, expectedAuthRef) {
   return withRegistryWriteLock(async () => {
     const registry = loadRegistryStrict();
@@ -14429,7 +14643,7 @@ async function authenticateProvider(providerId, options = {}) {
       `Credential store is unavailable${storeDiagMsg ? `: ${storeDiagMsg}` : ""}. Set CLODEX_CREDENTIAL_HELPER to an absolute path to an external credential helper and try again.`
     );
   }
-  const cred = await runNativeDeviceCode(providerId);
+  const cred = options.method === "browser" ? await runNativeBrowserSignIn(providerId) : await runNativeDeviceCode(providerId);
   const persisted = await persistNativeOAuthCredential(providerId, cred, accountName);
   const refreshSpinner = p3.spinner();
   refreshSpinner.start("Refreshing model list...");
@@ -14468,11 +14682,17 @@ function providerAuthHelpText() {
 
 ${pc4.bold("Usage:")}
   clodex providers auth openai
+  clodex providers auth openai --browser
   clodex providers auth openai --account work
 
 ${pc4.bold("Device code (works on SSH/VPS):")}
   openai   ChatGPT Plus/Pro (device code at auth.openai.com/codex/device)
 
+${pc4.bold("Browser sign-in:")}
+  --browser   sign in through your browser instead of a device code \u2014 use this
+              when your workspace admin has disabled device code authorization.
+              Needs a local browser, so it does not work over plain SSH.
+
 ${pc4.bold("Named accounts:")}
   --account <name>   store an additional ChatGPT account under a named slot
                      (the default sign-in is untouched). Select one at launch:
@@ -14830,6 +15050,7 @@ function parseProvidersArgs(args) {
     for (let i = 0; i < rest.length; i++) {
       const arg = rest[i];
       if (arg === "--native") authMethod = "native";
+      else if (arg === "--browser") authMethod = "browser";
       else if (arg === "--account") {
         const value = rest[i + 1];
         if (!value || value.startsWith("-")) {
@@ -14870,11 +15091,12 @@ ${pc6.bold("Usage:")}
   clodex providers remove <id>
   clodex providers refresh-models [id]
   clodex providers auth openai
+  clodex providers auth openai --browser
 
 ${pc6.bold("Subcommands:")}
   (none)      Provider hub wizard
   add         Add a built-in provider or sign in with ChatGPT
-  auth        Sign in with ChatGPT/Codex-plan OAuth (device code)
+  auth        Sign in with ChatGPT/Codex-plan OAuth (device code, or --browser)
   list        Show configured providers
   remove      Remove a provider by id
   refresh-models  Update cached model lists`;
@@ -14999,6 +15221,21 @@ function shouldOfferAccountSwitch(provider) {
 function providerLabel(name, modelCount, enabled) {
   return `${fmtEnabledStar(enabled)} ${fmtProvider(name)} ${pc6.dim(`(${modelCount} model${modelCount === 1 ? "" : "s"})`)}`;
 }
+async function promptOAuthMethod() {
+  const choice = await p5.select({
+    message: "How do you want to sign in?",
+    initialValue: "native",
+    options: [
+      { value: "native", label: "Device code", hint: "works everywhere, including SSH/VPS" },
+      { value: "browser", label: "Browser", hint: "for workspaces that disable device code authorization" }
+    ]
+  });
+  if (p5.isCancel(choice)) {
+    p5.cancel("Cancelled.");
+    return null;
+  }
+  return choice;
+}
 async function runProvidersAuthWithCleanupState(providerId, method, cleanupState, account) {
   try {
     const result = await authenticateProvider(providerId, { method, account });
@@ -15161,7 +15398,7 @@ async function runProvidersAddWithCleanupState(cleanupState) {
     options.push({
       value: "oauth",
       label: "Sign in with ChatGPT (Plus/Pro plan)",
-      hint: "OAuth device code \u2014 no API key needed"
+      hint: "OAuth (device code or browser) \u2014 no API key needed"
     });
   }
   for (const template of listRegistryAddableTemplates(providers)) {
@@ -15184,7 +15421,9 @@ async function runProvidersAddWithCleanupState(cleanupState) {
     return 0;
   }
   if (choice === "oauth") {
-    return runProvidersAuthWithCleanupState("openai", void 0, cleanupState);
+    const method = await promptOAuthMethod();
+    if (method === null) return 0;
+    return runProvidersAuthWithCleanupState("openai", method, cleanupState);
   }
   if (typeof choice === "string" && choice.startsWith("api:")) {
     return runTemplateAddFlow(choice.slice("api:".length), cleanupState);
@@ -15324,7 +15563,9 @@ async function runProviderDetail(id) {
     return "back";
   }
   if (action === "auth") {
-    await runWithCredentialCleanup((state) => runProvidersAuthWithCleanupState(id, void 0, state));
+    const method = await promptOAuthMethod();
+    if (method === null) return "back";
+    await runWithCredentialCleanup((state) => runProvidersAuthWithCleanupState(id, method, state));
     return "back";
   }
   if (action === "account") {
@@ -15419,7 +15660,7 @@ async function runProvidersHub() {
     }
     const configuredIds = new Set(entries.map((entry) => entry.id));
     if (listVisibleOAuthTemplates(configuredIds).length > 0) {
-      options.push({ value: "auth-menu", label: "\u2192 Sign in with ChatGPT (OAuth)", hint: "device code" });
+      options.push({ value: "auth-menu", label: "\u2192 Sign in with ChatGPT (OAuth)", hint: "device code or browser" });
     } else if (configuredIds.has("openai-oauth")) {
       options.push({
         value: "auth-account",
@@ -15447,7 +15688,9 @@ async function runProvidersHub() {
       continue;
     }
     if (choice === "auth-menu") {
-      await runWithCredentialCleanup((state) => runProvidersAuthWithCleanupState("openai", void 0, state));
+      const method = await promptOAuthMethod();
+      if (method === null) continue;
+      await runWithCredentialCleanup((state) => runProvidersAuthWithCleanupState("openai", method, state));
       continue;
     }
     if (choice === "auth-account") {
@@ -15464,7 +15707,9 @@ async function runProvidersHub() {
         }
       });
       if (p5.isCancel(name)) continue;
-      await runWithCredentialCleanup((state) => runProvidersAuthWithCleanupState("openai", void 0, state, String(name)));
+      const accountMethod = await promptOAuthMethod();
+      if (accountMethod === null) continue;
+      await runWithCredentialCleanup((state) => runProvidersAuthWithCleanupState("openai", accountMethod, state, String(name)));
       continue;
     }
     if (typeof choice === "string" && choice.startsWith("provider:")) {
@@ -15520,7 +15765,7 @@ async function runFirstRunWizard(_trace = false) {
       {
         value: "oauth",
         label: pc7.cyan("Sign in with ChatGPT (Plus/Pro plan)"),
-        hint: "OAuth device code \u2014 uses your ChatGPT/Codex plan"
+        hint: "OAuth (device code or browser) \u2014 uses your ChatGPT/Codex plan"
       },
       {
         value: "apikey",
@@ -15533,7 +15778,14 @@ async function runFirstRunWizard(_trace = false) {
     p6.cancel("Cancelled.");
     return "cancel";
   }
-  const code = choice === "oauth" ? await runProvidersAuth("openai") : await runProvidersAdd();
+  let code;
+  if (choice === "oauth") {
+    const method = await promptOAuthMethod();
+    if (method === null) return "cancel";
+    code = await runProvidersAuth("openai", method);
+  } else {
+    code = await runProvidersAdd();
+  }
   if (code !== 0) return "cancel";
   if (await needsFirstRunSetup()) return "cancel";
   p6.log.success("OpenAI provider ready \u2014 picking a model next.");
@@ -16660,7 +16912,7 @@ import pc10 from "picocolors";
 import * as p9 from "@clack/prompts";
 
 // src/http-proxy/server.ts
-import * as http from "http";
+import * as http2 from "http";
 import * as https from "https";
 import * as net from "net";
 import { randomUUID as randomUUID6 } from "crypto";
@@ -17097,7 +17349,7 @@ function forwardRawAnthropicRequest(req, res, rawBody, origin, rejectUnauthorize
     upstream.end(rawBody);
   });
 }
-function forwardToAdapter(req, res, rawBody, adapter, adapterRequest = http.request, adapterAgent, lifecycle, isLocalShutdown = () => false) {
+function forwardToAdapter(req, res, rawBody, adapter, adapterRequest = http2.request, adapterAgent, lifecycle, isLocalShutdown = () => false) {
   return new Promise((resolve3) => {
     const startedAt = Date.now();
     let lastActivityAt = startedAt;
@@ -17298,7 +17550,7 @@ function forwardPlainHttp(req, res) {
     res.end("HTTP proxy requests must use an absolute URL");
     return;
   }
-  const transport = target.protocol === "https:" ? https : http;
+  const transport = target.protocol === "https:" ? https : http2;
   const upstream = transport.request({
     protocol: target.protocol,
     hostname: target.hostname,
@@ -17349,7 +17601,7 @@ async function startHttpProxy(options) {
       options.modelAliases
     );
   }
-  const adapterAgent = adapter ? new http.Agent({ keepAlive: true }) : void 0;
+  const adapterAgent = adapter ? new http2.Agent({ keepAlive: true }) : void 0;
   let shuttingDown = false;
   const mitmServer = https.createServer({
     key: certificates.serverKey,
@@ -17505,7 +17757,7 @@ async function startHttpProxy(options) {
     );
   });
   const sockets = /* @__PURE__ */ new Set();
-  const proxyServer = http.createServer(forwardPlainHttp);
+  const proxyServer = http2.createServer(forwardPlainHttp);
   proxyServer.on("connection", (socket) => {
     sockets.add(socket);
     socket.once("close", () => sockets.delete(socket));