npm - @bman654/clodex - Versions diffs - 2.7.0 → 2.8.1 - Mend

@bman654/clodex 2.7.0 → 2.8.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (8) hide show

package/README.md +6 -2
package/dist/{chunk-WZXTVKFX.js → chunk-J7WXOD2K.js} +2 -1
package/dist/claude-wrapper.js +1 -1
package/dist/cli.js +487 -25
package/dist/cli.js.map +1 -1
package/docs/credential-helpers.md +50 -2
package/package.json +1 -1
/package/dist/{chunk-WZXTVKFX.js.map → chunk-J7WXOD2K.js.map} +0 -0

package/dist/cli.js CHANGED Viewed

@@ -47,11 +47,12 @@ import {
   storeActiveOAuthAccount,
   tcpListenerUrlHost,
   unregisterServerRuntimeState,
+  waitForTcpListener,
   withCredentialMutationLock,
   withProviderMutationLock,
   withRegistryWriteLock,
   withRegistryWriteLockSync
-} from "./chunk-WZXTVKFX.js";
+} from "./chunk-J7WXOD2K.js";
 // src/cli.ts
 import pc13 from "picocolors";
@@ -204,6 +205,13 @@ function printOAuthStepsPanel(title, providerLabel2) {
     `${pc.white("3. Approve access for ")}${fmtProvider(providerLabel2)}`
   ]);
 }
+function printOAuthBrowserPanel(title, providerLabel2) {
+  printPanel(pc.cyan(title), [
+    `${pc.white("1. Sign in on the page that opens in your browser")}`,
+    `${pc.white("2. Approve access for ")}${fmtProvider(providerLabel2)}`,
+    `${pc.white("3. Return to this terminal")}`
+  ]);
+}
 function printNetworkWarningPanel() {
   printPanel(pc.yellow("Network mode"), [
     `${pc.yellow(pc.bold("Anyone on your network"))}${pc.white(" who knows the password can use this server through your account.")}`
@@ -374,7 +382,7 @@ import { join } from "path";
 // package.json
 var package_default = {
   name: "@bman654/clodex",
-  version: "2.7.0",
+  version: "2.8.1",
   publishConfig: {
     access: "public"
   },
@@ -821,6 +829,24 @@ function supportsNativeOAuth(providerId) {
 }
 // src/oauth/pkce.ts
+function generateRandomString(length) {
+  const chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
+  return Array.from(crypto.getRandomValues(new Uint8Array(length))).map((b) => chars[b % chars.length]).join("");
+}
+function base64UrlEncode(buffer) {
+  const binary = String.fromCharCode(...new Uint8Array(buffer));
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function generatePkce() {
+  const verifier = generateRandomString(64);
+  const hash = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  return { verifier, challenge: base64UrlEncode(hash) };
+}
+function generateOAuthState() {
+  const bytes = crypto.getRandomValues(new Uint8Array(32));
+  const binary = String.fromCharCode(...bytes);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
 function positiveSecondsToMs(value, defaultMs) {
   const seconds = Number(value);
   return Number.isFinite(seconds) && seconds > 0 ? seconds * 1e3 : defaultMs;
@@ -871,11 +897,112 @@ async function postOAuthRefresh(url, body, options) {
   }
 }
+// src/oauth/callback-server.ts
+import http from "http";
+var SUCCESS_HTML = `<!DOCTYPE html><html><head><meta charset="utf-8"><title>Authorized</title></head>
+<body style="font-family:system-ui;display:flex;justify-content:center;align-items:center;height:100vh;margin:0">
+<div style="text-align:center;padding:2rem;background:#fff;border-radius:8px;box-shadow:0 2px 10px rgba(0,0,0,.1)">
+<div style="color:#22c55e;font-size:2.5rem">&#10003;</div>
+<h1 style="margin:.5rem 0">Authentication successful</h1>
+<p style="color:#666">You can close this tab and return to the terminal.</p>
+</div></body></html>`;
+var FAILURE_HTML = `<!DOCTYPE html><html><head><meta charset="utf-8"><title>Sign-in failed</title></head>
+<body style="font-family:system-ui;display:flex;justify-content:center;align-items:center;height:100vh;margin:0">
+<div style="text-align:center;padding:2rem;background:#fff;border-radius:8px;box-shadow:0 2px 10px rgba(0,0,0,.1)">
+<div style="color:#ef4444;font-size:2.5rem">&#10007;</div>
+<h1 style="margin:.5rem 0">Sign-in failed</h1>
+<p style="color:#666">Return to the terminal for details.</p>
+</div></body></html>`;
+var LOOPBACK_PROBE_TIMEOUT_MS = 250;
+async function isLoopbackPortTaken(port) {
+  const probes = await Promise.all(["127.0.0.1", "::1"].map(
+    (host) => waitForTcpListener(host, port, LOOPBACK_PROBE_TIMEOUT_MS).catch(() => false)
+  ));
+  return probes.some(Boolean);
+}
+async function startCallbackServer(options) {
+  let codeResolve;
+  let codeReject;
+  let buffered;
+  const { path, redirectHost } = options;
+  const server = http.createServer((req, res) => {
+    const u = new URL(req.url ?? "/", "http://localhost");
+    if (u.pathname !== path) {
+      res.writeHead(404);
+      res.end();
+      return;
+    }
+    const code = u.searchParams.get("code") ?? "";
+    const state = u.searchParams.get("state") ?? "";
+    const error = u.searchParams.get("error") ?? "";
+    if (options.expectedState !== void 0 && state !== options.expectedState) {
+      res.writeHead(400, { "Content-Type": "text/plain; charset=utf-8" });
+      res.end("Invalid OAuth state");
+      return;
+    }
+    const failed = Boolean(error) || !code;
+    res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+    res.end(failed ? FAILURE_HTML : SUCCESS_HTML);
+    const params = { code, state, error: error || void 0 };
+    if (codeResolve) codeResolve(params);
+    else buffered ??= params;
+  });
+  const ports = options.ports?.length ? options.ports : [0];
+  let address;
+  let lastError;
+  for (const port of ports) {
+    if (port !== 0 && redirectHost === "localhost" && await isLoopbackPortTaken(port)) {
+      const busy = new Error(`listen EADDRINUSE: address already in use localhost:${port}`);
+      busy.code = "EADDRINUSE";
+      lastError = busy;
+      continue;
+    }
+    try {
+      address = await listenTcpServer(server, port, redirectHost);
+      break;
+    } catch (error) {
+      lastError = error;
+    }
+  }
+  if (!address) throw lastError ?? new Error("OAuth callback server could not bind");
+  return {
+    port: address.port,
+    redirectUri: `http://${redirectHost}:${address.port}${path}`,
+    waitForCallback(timeoutMs = 3e5) {
+      return new Promise((resolve3, reject) => {
+        if (buffered) {
+          resolve3(buffered);
+          buffered = void 0;
+          return;
+        }
+        const timer = setTimeout(
+          () => reject(new Error("OAuth timeout \u2014 browser closed without completing sign-in")),
+          timeoutMs
+        );
+        codeResolve = (params) => {
+          clearTimeout(timer);
+          resolve3(params);
+        };
+        codeReject = (err) => {
+          clearTimeout(timer);
+          reject(err);
+        };
+      });
+    },
+    close() {
+      server.close();
+      codeReject?.(new Error("Server closed"));
+    }
+  };
+}
 // src/oauth/openai.ts
 var CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 var ISSUER = "https://auth.openai.com";
 var OAUTH_POLLING_SAFETY_MARGIN_MS = 3e3;
 var DEVICE_CODE_DEFAULT_EXPIRES_MS = 5 * 60 * 1e3;
+var BROWSER_CALLBACK_PORTS = [1455, 1457];
+var BROWSER_CALLBACK_PATH = "/auth/callback";
 function extractOpenAiAccountId(tokens) {
   const token = tokens.id_token ?? tokens.access_token;
   if (!token) return void 0;
@@ -963,6 +1090,74 @@ async function refreshOpenAiAccessToken(refreshToken) {
     }
   );
 }
+function buildOpenAiAuthorizeUrl(redirectUri, challenge, state) {
+  const qs = new URLSearchParams({
+    response_type: "code",
+    client_id: CLIENT_ID,
+    redirect_uri: redirectUri,
+    scope: "openid profile email offline_access",
+    code_challenge: challenge,
+    code_challenge_method: "S256",
+    id_token_add_organizations: "true",
+    codex_cli_simplified_flow: "true",
+    state
+  });
+  return `${ISSUER}/oauth/authorize?${qs.toString()}`;
+}
+async function exchangeOpenAiAuthorizationCode(code, redirectUri, codeVerifier) {
+  return postOAuthRefresh(
+    `${ISSUER}/oauth/token`,
+    new URLSearchParams({
+      grant_type: "authorization_code",
+      code,
+      redirect_uri: redirectUri,
+      client_id: CLIENT_ID,
+      code_verifier: codeVerifier
+    }),
+    {
+      contentType: "form",
+      errorPrefix: "OpenAI token exchange failed",
+      includeStatus: true
+    }
+  );
+}
+async function runOpenAiBrowserFlow(onAuthorizeUrl, opts) {
+  const { verifier, challenge } = await generatePkce();
+  const state = generateOAuthState();
+  const ports = opts?.ports ?? BROWSER_CALLBACK_PORTS;
+  let server;
+  try {
+    server = await startCallbackServer({
+      ports,
+      path: BROWSER_CALLBACK_PATH,
+      redirectHost: "localhost",
+      expectedState: state
+    });
+  } catch (error) {
+    if (error.code === "EADDRINUSE") {
+      throw new Error(
+        `Ports ${ports.join(" and ")} are in use \u2014 close any other OpenAI sign-in (e.g. codex login) and try again.`
+      );
+    }
+    throw new Error(
+      `Could not start the OAuth callback listener: ${error instanceof Error ? error.message : String(error)}`,
+      { cause: error }
+    );
+  }
+  try {
+    onAuthorizeUrl({ url: buildOpenAiAuthorizeUrl(server.redirectUri, challenge, state) });
+    const params = await server.waitForCallback(opts?.timeoutMs);
+    if (params.error) throw new Error(`OpenAI sign-in failed: ${params.error}`);
+    if (!params.code) throw new Error("OpenAI sign-in returned no authorization code");
+    if (params.state !== state) {
+      throw new Error("OpenAI sign-in returned a mismatched state \u2014 try again");
+    }
+    const tokens = await exchangeOpenAiAuthorizationCode(params.code, server.redirectUri, verifier);
+    return { tokens, accountId: extractOpenAiAccountId(tokens) };
+  } finally {
+    server.close();
+  }
+}
 async function runOpenAiDeviceCodeFlow(onDeviceCode, opts) {
   const deviceData = await requestOpenAiDeviceCode();
   onDeviceCode({ url: openAiDeviceCodeUrl(), userCode: deviceData.user_code });
@@ -3224,7 +3419,7 @@ function savedStopsAfter(current, assignments) {
 }
 // src/patch-transforms.ts
-var PATCH_TRANSFORMS_VERSION = 8;
+var PATCH_TRANSFORMS_VERSION = 9;
 var NATIVE_EFFORT_LEVELS = ["low", "medium", "high", "xhigh", "max"];
 var BASE_EFFORT_LEVELS = ["low", "medium", "high"];
 function projectNativeEffort(effort) {
@@ -3427,7 +3622,7 @@ function applyClodexPatches(source, config) {
     }).join("; ");
     applyOnce(
       "PATCH 4: Agent tool model description",
-      /(describe\(`Optional model override for this agent[^`]*?)(`\))/,
+      /(describe\(`Optional model override for this agent(?:[^`\\]|\\.)*?)(`)/,
       (_m, body, close) => body.includes("Additional custom models") ? body + close : body + " Additional custom models: " + listing + "." + close,
       { required: false, noopIsSkip: true }
     );
@@ -3974,7 +4169,7 @@ function captureBuiltInPatchProofs(source, config, results) {
   );
   addPattern(
     "PATCH 4: Agent tool model description",
-    /describe\(`Optional model override for this agent[^`]*?`\)/
+    /describe\(`Optional model override for this agent(?:[^`\\]|\\.)*?`/
   );
   const aliases = configuredAliases(config);
   if (protectsResult(results, "PATCH 6: alias resolver switch")) {
@@ -6605,6 +6800,9 @@ var BUN_OFFSETS_BYTES = 32;
 var TAIL_SCAN_BYTES = 16 * 1024 * 1024;
 var MODULE_STRUCT_BYTES_CURRENT = 52;
 var MODULE_STRUCT_BYTES_LEGACY = 36;
+var CONTENTS_FIELD_AT = 8;
+var LOADER_FROM_END = 3;
+var BUN_JAVASCRIPT_LOADER = 1;
 var MAX_MODULE_NAME_BYTES = 4096;
 var MIN_SHIMMABLE_NAME_BYTES = 7;
 function tweakccRecognizesModuleName(name) {
@@ -6659,6 +6857,8 @@ function parseBunModuleNamesAtUnchecked(fd, offsetsAt) {
   if (!modules) return null;
   const names = [];
   const nameOffsets = [];
+  const contents = [];
+  const loaders = [];
   for (let index = 0; index < moduleCount; index++) {
     const nameOffset = modules.readUInt32LE(index * structBytes);
     const nameLength = modules.readUInt32LE(index * structBytes + 4);
@@ -6670,8 +6870,23 @@ function parseBunModuleNamesAtUnchecked(fd, offsetsAt) {
     if (!/^[\x20-\x7e]+$/.test(name)) return null;
     names.push(name);
     nameOffsets.push(blobAt + nameOffset);
+    contents.push({
+      offset: modules.readUInt32LE(index * structBytes + CONTENTS_FIELD_AT),
+      length: modules.readUInt32LE(index * structBytes + CONTENTS_FIELD_AT + 4)
+    });
+    loaders.push(modules.readUInt8(index * structBytes + structBytes - LOADER_FROM_END));
   }
-  return { names, entryPointId, offsets: nameOffsets };
+  return {
+    names,
+    entryPointId,
+    offsets: nameOffsets,
+    contents,
+    loaders,
+    blobAt,
+    modulesAt: blobAt + modulesOffset,
+    structBytes,
+    byteCount: Number(byteCount)
+  };
 }
 function findStandIn(fd, fileSize, marker) {
   const needle = Buffer.from(marker);
@@ -6717,6 +6932,70 @@ function isMachO(fd) {
   const value = magic.readUInt32BE(0);
   return value === 4277009102 || value === 4277009103 || value === 3472551422 || value === 3489328638 || value === 3405691582 || value === 3405691583;
 }
+function readBunModuleTable(path) {
+  const fd = openSync2(path, "r");
+  try {
+    const parsed = readBunModuleNames(fd, statSync4(path).size);
+    if (!parsed) return null;
+    const { names, loaders, contents, entryPointId, blobAt, modulesAt, structBytes, byteCount } = parsed;
+    return { names, loaders, contents, entryPointId, blobAt, modulesAt, structBytes, byteCount };
+  } finally {
+    closeSync2(fd);
+  }
+}
+function readBunJavaScriptModules(path) {
+  const fd = openSync2(path, "r");
+  try {
+    const parsed = readBunModuleNames(fd, statSync4(path).size);
+    if (!parsed) return null;
+    const modules = [];
+    for (let index = 0; index < parsed.names.length; index++) {
+      if (parsed.loaders[index] !== BUN_JAVASCRIPT_LOADER) continue;
+      const range = parsed.contents[index];
+      if (range.offset < 0 || range.length < 0 || range.offset + range.length > parsed.byteCount) {
+        return null;
+      }
+      const bytes = range.length === 0 ? Buffer.alloc(0) : readAt(fd, range.length, parsed.blobAt + range.offset);
+      if (!bytes) return null;
+      modules.push({
+        index,
+        name: parsed.names[index],
+        source: bytes.toString("utf8"),
+        byteLength: bytes.length
+      });
+    }
+    return modules;
+  } finally {
+    closeSync2(fd);
+  }
+}
+function repointBunModuleContents(path, edits) {
+  if (edits.length === 0) return;
+  const fd = openSync2(path, "r+");
+  try {
+    const parsed = readBunModuleNames(fd, statSync4(path).size);
+    if (!parsed) throw new Error(`cannot read the Bun module table of ${path}`);
+    for (const { index, range } of edits) {
+      if (index < 0 || index >= parsed.names.length) {
+        throw new Error(`module ${index} is outside the ${parsed.names.length}-module table of ${path}`);
+      }
+      if (range.offset < 0 || range.length < 0 || range.offset + range.length > parsed.byteCount) {
+        throw new Error(
+          `module ${index} would point at ${range.offset}+${range.length}, outside the ${parsed.byteCount}-byte blob of ${path}`
+        );
+      }
+      const at = parsed.modulesAt + index * parsed.structBytes + CONTENTS_FIELD_AT;
+      const pair = Buffer.alloc(8);
+      pair.writeUInt32LE(range.offset, 0);
+      pair.writeUInt32LE(range.length, 4);
+      if (writeSync2(fd, pair, 0, pair.length, at) !== pair.length) {
+        throw new Error(`short write repointing module ${index} of ${path}`);
+      }
+    }
+  } finally {
+    closeSync2(fd);
+  }
+}
 function shimEntryModuleName(path) {
   const fd = openSync2(path, "r+");
   try {
@@ -6749,7 +7028,17 @@ function restoreEntryModuleName(path, shim, { resign }) {
     }
     writeNameBytes(fd, shim.original, offset);
     restoreEveryStandIn(fd, statSync4(path).size, shim);
-    machO = resign && isMachO(fd);
+    machO = resign;
+  } finally {
+    closeSync2(fd);
+  }
+  if (machO) resignMachOBinary(path);
+}
+function resignMachOBinary(path) {
+  const fd = openSync2(path, "r");
+  let machO;
+  try {
+    machO = isMachO(fd);
   } finally {
     closeSync2(fd);
   }
@@ -6758,6 +7047,99 @@ function restoreEntryModuleName(path, shim, { resign }) {
   }
 }
+// src/bun-bundle.ts
+function writableModuleIndex(path) {
+  const table = readBunModuleTable(path);
+  if (!table) return null;
+  const index = table.names.findIndex(tweakccRecognizesModuleName);
+  return index < 0 ? null : index;
+}
+var BUNDLE_MODULE_SEPARATOR = '\n/*clodex:module-boundary`;{}"]*/\n';
+function readClaudeBundle(path) {
+  const modules = readBunJavaScriptModules(path);
+  if (!modules || modules.length === 0) return null;
+  if (modules.some((module) => module.source.includes(BUNDLE_MODULE_SEPARATOR))) return null;
+  if (modules.some((module) => !roundTripsAsUtf8(module.source, module.byteLength))) return null;
+  return { modules, source: modules.map((module) => module.source).join(BUNDLE_MODULE_SEPARATOR) };
+}
+function roundTripsAsUtf8(source, byteLength) {
+  return Buffer.byteLength(source, "utf8") === byteLength && !source.includes("\uFFFD");
+}
+function splitBundleSource(bundle, patched) {
+  const parts = patched.split(BUNDLE_MODULE_SEPARATOR);
+  if (parts.length !== bundle.modules.length) {
+    throw new Error(
+      `the patched bundle has ${parts.length} module boundaries, expected ${bundle.modules.length}`
+    );
+  }
+  return parts;
+}
+function planBundleWrite(bundle, patchedSources, writableIndex) {
+  if (patchedSources.length !== bundle.modules.length) {
+    throw new Error(
+      `expected ${bundle.modules.length} patched module sources, got ${patchedSources.length}`
+    );
+  }
+  const writable = bundle.modules.findIndex((module) => module.index === writableIndex);
+  if (writable < 0) {
+    throw new Error(`module ${writableIndex} is not one of this binary's JavaScript modules`);
+  }
+  const changed = bundle.modules.map((module, at) => at).filter((at) => at !== writable && patchedSources[at] !== bundle.modules[at].source);
+  if (changed.length === 0) return { content: patchedSources[writable], repoints: [] };
+  const order = [writable, ...changed];
+  const repoints = [];
+  let content = "";
+  let start = 0;
+  for (const at of order) {
+    const source = patchedSources[at];
+    const length = Buffer.byteLength(source, "utf8");
+    repoints.push({ index: bundle.modules[at].index, start, length, expected: source });
+    content += source + "\0";
+    start += length + 1;
+  }
+  return { content, repoints };
+}
+function applyBundleWritePlan(path, plan) {
+  const table = readBunModuleTable(path);
+  if (!table) {
+    if (plan.repoints.length === 0) return;
+    throw new Error(`cannot read the Bun module table of ${path} after repacking`);
+  }
+  const recognized = table.names.filter(tweakccRecognizesModuleName);
+  if (recognized.length !== 1) {
+    throw new Error(
+      `${path} has ${recognized.length} modules tweakcc would write to; the patch was planned around exactly one`
+    );
+  }
+  if (plan.repoints.length === 0) return;
+  const writable = table.names.findIndex(tweakccRecognizesModuleName);
+  if (writable !== plan.repoints[0].index) {
+    throw new Error(
+      `${path} exposes module ${writable} to tweakcc, but the patch was planned around module ${plan.repoints[0].index}`
+    );
+  }
+  const written = table.contents[writable];
+  const expectedBytes = Buffer.byteLength(plan.content, "utf8");
+  if (written.length !== expectedBytes) {
+    throw new Error(
+      `${path} holds ${written.length} bytes where the ${expectedBytes} bytes clodex wrote should be; refusing to repoint its modules`
+    );
+  }
+  const edits = plan.repoints.map((repoint) => ({
+    index: repoint.index,
+    range: { offset: written.offset + repoint.start, length: repoint.length }
+  }));
+  repointBunModuleContents(path, edits);
+  const after = readBunJavaScriptModules(path);
+  if (!after) throw new Error(`cannot re-read the modules of ${path} after repointing them`);
+  const byIndex = new Map(after.map((module) => [module.index, module.source]));
+  for (const repoint of plan.repoints) {
+    if (byIndex.get(repoint.index) !== repoint.expected) {
+      throw new Error(`module ${repoint.index} of ${path} did not read back as the patched source`);
+    }
+  }
+}
 // src/patch-backup.ts
 import { createHash as createHash5 } from "crypto";
 import { existsSync as existsSync4, readFileSync as readFileSync7, readdirSync, statSync as statSync5 } from "fs";
@@ -12109,9 +12491,15 @@ async function applyPatch(binaryPath, version, desired, configHash, opts) {
       copyFileSync(from, candidatePath);
       const shim = shimEntryModuleName(candidatePath);
       const installation = await tryDetectInstallation({ path: candidatePath });
-      const source = await readContent(installation);
+      const bundle = readClaudeBundle(candidatePath);
+      if (!bundle && installation.kind === "native") {
+        p2.log.warn(
+          `Could not read ${candidatePath} as a Bun module table, so only the module tweakcc names is being patched. On Claude Code 2.1.242 and later that module is a stub holding none of the code clodex patches, and the patch below will fail at its first required site \u2014 the cause is this read, not a changed anchor.`
+        );
+      }
+      const source = bundle ? bundle.source : await readContent(installation);
       if (shim) restoreEntryModuleName(candidatePath, shim, { resign: false });
-      return { installation, source };
+      return { installation, source, bundle };
     };
     const facts = collectPristineFacts({
       version,
@@ -12204,8 +12592,25 @@ async function applyPatch(binaryPath, version, desired, configHash, opts) {
     }
     results = [...results, ...local.results];
     const writeShim = shimEntryModuleName(candidatePath);
-    await writeContent(loaded.installation, local.content);
+    let repointed = false;
+    if (loaded.bundle) {
+      const writable = writableModuleIndex(candidatePath);
+      if (writable === null) {
+        throw new Error("no module of the patch candidate carries a name tweakcc can write to");
+      }
+      const plan2 = planBundleWrite(
+        loaded.bundle,
+        splitBundleSource(loaded.bundle, local.content),
+        writable
+      );
+      await writeContent(loaded.installation, plan2.content);
+      applyBundleWritePlan(candidatePath, plan2);
+      repointed = plan2.repoints.length > 0;
+    } else {
+      await writeContent(loaded.installation, local.content);
+    }
     if (writeShim) restoreEntryModuleName(candidatePath, writeShim, { resign: true });
+    else if (repointed) resignMachOBinary(candidatePath);
     patchedSize = statSync6(candidatePath).size;
     patchedSha256 = sha256File(candidatePath);
     renameSync2(candidatePath, binaryPath);
@@ -14226,6 +14631,25 @@ async function runNativeDeviceCode(providerId) {
     throw err;
   }
 }
+async function runNativeBrowserSignIn(providerId) {
+  const label = PROVIDER_DISPLAY[providerId];
+  printOAuthBrowserPanel(`${label} \u2014 Sign in`, label);
+  const spinner5 = p3.spinner();
+  spinner5.start("Opening your browser...");
+  try {
+    const { tokens, accountId } = await runOpenAiBrowserFlow(({ url }) => {
+      spinner5.stop("");
+      p3.log.info(`If the browser did not open, visit: ${pc4.cyan(url)}`);
+      openBrowser(url);
+      spinner5.start("Waiting for sign-in in your browser...");
+    });
+    spinner5.stop(pc4.green("Signed in to OpenAI ChatGPT"));
+    return tokensToStoredCredential(tokens, void 0, accountId);
+  } catch (err) {
+    spinner5.stop("");
+    throw err;
+  }
+}
 async function upsertOAuthAccountSlot(registryId, account, authRef, expectedAuthRef) {
   return withRegistryWriteLock(async () => {
     const registry = loadRegistryStrict();
@@ -14429,7 +14853,7 @@ async function authenticateProvider(providerId, options = {}) {
       `Credential store is unavailable${storeDiagMsg ? `: ${storeDiagMsg}` : ""}. Set CLODEX_CREDENTIAL_HELPER to an absolute path to an external credential helper and try again.`
     );
   }
-  const cred = await runNativeDeviceCode(providerId);
+  const cred = options.method === "browser" ? await runNativeBrowserSignIn(providerId) : await runNativeDeviceCode(providerId);
   const persisted = await persistNativeOAuthCredential(providerId, cred, accountName);
   const refreshSpinner = p3.spinner();
   refreshSpinner.start("Refreshing model list...");
@@ -14468,11 +14892,17 @@ function providerAuthHelpText() {
 ${pc4.bold("Usage:")}
   clodex providers auth openai
+  clodex providers auth openai --browser
   clodex providers auth openai --account work
 ${pc4.bold("Device code (works on SSH/VPS):")}
   openai   ChatGPT Plus/Pro (device code at auth.openai.com/codex/device)
+${pc4.bold("Browser sign-in:")}
+  --browser   sign in through your browser instead of a device code \u2014 use this
+              when your workspace admin has disabled device code authorization.
+              Needs a local browser, so it does not work over plain SSH.
 ${pc4.bold("Named accounts:")}
   --account <name>   store an additional ChatGPT account under a named slot
                      (the default sign-in is untouched). Select one at launch:
@@ -14830,6 +15260,7 @@ function parseProvidersArgs(args) {
     for (let i = 0; i < rest.length; i++) {
       const arg = rest[i];
       if (arg === "--native") authMethod = "native";
+      else if (arg === "--browser") authMethod = "browser";
       else if (arg === "--account") {
         const value = rest[i + 1];
         if (!value || value.startsWith("-")) {
@@ -14870,11 +15301,12 @@ ${pc6.bold("Usage:")}
   clodex providers remove <id>
   clodex providers refresh-models [id]
   clodex providers auth openai
+  clodex providers auth openai --browser
 ${pc6.bold("Subcommands:")}
   (none)      Provider hub wizard
   add         Add a built-in provider or sign in with ChatGPT
-  auth        Sign in with ChatGPT/Codex-plan OAuth (device code)
+  auth        Sign in with ChatGPT/Codex-plan OAuth (device code, or --browser)
   list        Show configured providers
   remove      Remove a provider by id
   refresh-models  Update cached model lists`;
@@ -14999,6 +15431,21 @@ function shouldOfferAccountSwitch(provider) {
 function providerLabel(name, modelCount, enabled) {
   return `${fmtEnabledStar(enabled)} ${fmtProvider(name)} ${pc6.dim(`(${modelCount} model${modelCount === 1 ? "" : "s"})`)}`;
 }
+async function promptOAuthMethod() {
+  const choice = await p5.select({
+    message: "How do you want to sign in?",
+    initialValue: "native",
+    options: [
+      { value: "native", label: "Device code", hint: "works everywhere, including SSH/VPS" },
+      { value: "browser", label: "Browser", hint: "for workspaces that disable device code authorization" }
+    ]
+  });
+  if (p5.isCancel(choice)) {
+    p5.cancel("Cancelled.");
+    return null;
+  }
+  return choice;
+}
 async function runProvidersAuthWithCleanupState(providerId, method, cleanupState, account) {
   try {
     const result = await authenticateProvider(providerId, { method, account });
@@ -15161,7 +15608,7 @@ async function runProvidersAddWithCleanupState(cleanupState) {
     options.push({
       value: "oauth",
       label: "Sign in with ChatGPT (Plus/Pro plan)",
-      hint: "OAuth device code \u2014 no API key needed"
+      hint: "OAuth (device code or browser) \u2014 no API key needed"
     });
   }
   for (const template of listRegistryAddableTemplates(providers)) {
@@ -15184,7 +15631,9 @@ async function runProvidersAddWithCleanupState(cleanupState) {
     return 0;
   }
   if (choice === "oauth") {
-    return runProvidersAuthWithCleanupState("openai", void 0, cleanupState);
+    const method = await promptOAuthMethod();
+    if (method === null) return 0;
+    return runProvidersAuthWithCleanupState("openai", method, cleanupState);
   }
   if (typeof choice === "string" && choice.startsWith("api:")) {
     return runTemplateAddFlow(choice.slice("api:".length), cleanupState);
@@ -15324,7 +15773,9 @@ async function runProviderDetail(id) {
     return "back";
   }
   if (action === "auth") {
-    await runWithCredentialCleanup((state) => runProvidersAuthWithCleanupState(id, void 0, state));
+    const method = await promptOAuthMethod();
+    if (method === null) return "back";
+    await runWithCredentialCleanup((state) => runProvidersAuthWithCleanupState(id, method, state));
     return "back";
   }
   if (action === "account") {
@@ -15419,7 +15870,7 @@ async function runProvidersHub() {
     }
     const configuredIds = new Set(entries.map((entry) => entry.id));
     if (listVisibleOAuthTemplates(configuredIds).length > 0) {
-      options.push({ value: "auth-menu", label: "\u2192 Sign in with ChatGPT (OAuth)", hint: "device code" });
+      options.push({ value: "auth-menu", label: "\u2192 Sign in with ChatGPT (OAuth)", hint: "device code or browser" });
     } else if (configuredIds.has("openai-oauth")) {
       options.push({
         value: "auth-account",
@@ -15447,7 +15898,9 @@ async function runProvidersHub() {
       continue;
     }
     if (choice === "auth-menu") {
-      await runWithCredentialCleanup((state) => runProvidersAuthWithCleanupState("openai", void 0, state));
+      const method = await promptOAuthMethod();
+      if (method === null) continue;
+      await runWithCredentialCleanup((state) => runProvidersAuthWithCleanupState("openai", method, state));
       continue;
     }
     if (choice === "auth-account") {
@@ -15464,7 +15917,9 @@ async function runProvidersHub() {
         }
       });
       if (p5.isCancel(name)) continue;
-      await runWithCredentialCleanup((state) => runProvidersAuthWithCleanupState("openai", void 0, state, String(name)));
+      const accountMethod = await promptOAuthMethod();
+      if (accountMethod === null) continue;
+      await runWithCredentialCleanup((state) => runProvidersAuthWithCleanupState("openai", accountMethod, state, String(name)));
       continue;
     }
     if (typeof choice === "string" && choice.startsWith("provider:")) {
@@ -15520,7 +15975,7 @@ async function runFirstRunWizard(_trace = false) {
       {
         value: "oauth",
         label: pc7.cyan("Sign in with ChatGPT (Plus/Pro plan)"),
-        hint: "OAuth device code \u2014 uses your ChatGPT/Codex plan"
+        hint: "OAuth (device code or browser) \u2014 uses your ChatGPT/Codex plan"
       },
       {
         value: "apikey",
@@ -15533,7 +15988,14 @@ async function runFirstRunWizard(_trace = false) {
     p6.cancel("Cancelled.");
     return "cancel";
   }
-  const code = choice === "oauth" ? await runProvidersAuth("openai") : await runProvidersAdd();
+  let code;
+  if (choice === "oauth") {
+    const method = await promptOAuthMethod();
+    if (method === null) return "cancel";
+    code = await runProvidersAuth("openai", method);
+  } else {
+    code = await runProvidersAdd();
+  }
   if (code !== 0) return "cancel";
   if (await needsFirstRunSetup()) return "cancel";
   p6.log.success("OpenAI provider ready \u2014 picking a model next.");
@@ -16660,7 +17122,7 @@ import pc10 from "picocolors";
 import * as p9 from "@clack/prompts";
 // src/http-proxy/server.ts
-import * as http from "http";
+import * as http2 from "http";
 import * as https from "https";
 import * as net from "net";
 import { randomUUID as randomUUID6 } from "crypto";
@@ -17097,7 +17559,7 @@ function forwardRawAnthropicRequest(req, res, rawBody, origin, rejectUnauthorize
     upstream.end(rawBody);
   });
 }
-function forwardToAdapter(req, res, rawBody, adapter, adapterRequest = http.request, adapterAgent, lifecycle, isLocalShutdown = () => false) {
+function forwardToAdapter(req, res, rawBody, adapter, adapterRequest = http2.request, adapterAgent, lifecycle, isLocalShutdown = () => false) {
   return new Promise((resolve3) => {
     const startedAt = Date.now();
     let lastActivityAt = startedAt;
@@ -17298,7 +17760,7 @@ function forwardPlainHttp(req, res) {
     res.end("HTTP proxy requests must use an absolute URL");
     return;
   }
-  const transport = target.protocol === "https:" ? https : http;
+  const transport = target.protocol === "https:" ? https : http2;
   const upstream = transport.request({
     protocol: target.protocol,
     hostname: target.hostname,
@@ -17349,7 +17811,7 @@ async function startHttpProxy(options) {
       options.modelAliases
     );
   }
-  const adapterAgent = adapter ? new http.Agent({ keepAlive: true }) : void 0;
+  const adapterAgent = adapter ? new http2.Agent({ keepAlive: true }) : void 0;
   let shuttingDown = false;
   const mitmServer = https.createServer({
     key: certificates.serverKey,
@@ -17505,7 +17967,7 @@ async function startHttpProxy(options) {
     );
   });
   const sockets = /* @__PURE__ */ new Set();
-  const proxyServer = http.createServer(forwardPlainHttp);
+  const proxyServer = http2.createServer(forwardPlainHttp);
   proxyServer.on("connection", (socket) => {
     sockets.add(socket);
     socket.once("close", () => sockets.delete(socket));