@cabane/companion 0.6.215 → 0.6.217

package/dist/credential-broker.js

@@ -0,0 +1,653 @@
+// src/credential-broker/broker.ts
+import { randomBytes } from "crypto";
+import { createServer } from "http";
+import { Readable } from "stream";
+import { pipeline } from "stream/promises";
+
+// src/credential-broker/policy.ts
+function createsOrRevealsCredential(origin, path) {
+  if (origin === "https://api.anthropic.com")
+    return /^\/api\/oauth\/claude_cli\/create_api_key(?:\/|$)/.test(path) || /^\/(?:v1\/)?oauth\/token(?:\/|$)/.test(path);
+  if (origin === "https://chatgpt.com")
+    return /^\/api\/auth\/session(?:\/|$)/.test(path) || /^\/(?:v1\/)?oauth\/token(?:\/|$)/.test(path);
+  if (origin === "https://github.com")
+    return /^\/login\/(?:oauth\/access_token|device\/code)(?:\/|$)/.test(path);
+  path = path.replace(/^\/repositories\/[^/]+(?=\/|$)/, "/repos/_/_");
+  return /^\/user\/keys(?:\/|$)/.test(path) || /^\/repos\/[^/]+\/[^/]+\/keys(?:\/|$)/.test(path) || /^\/authorizations(?:\/|$)/.test(path) || /^\/app-manifests\/[^/]+\/conversions(?:\/|$)/.test(path) || /^\/app\/installations\/[^/]+\/access_tokens(?:\/|$)/.test(path) || /^\/applications\/[^/]+\/token(?:\/|$)/.test(path) || /^\/(?:repos\/[^/]+\/[^/]+|orgs\/[^/]+|enterprises\/[^/]+)\/actions\/runners\/(?:registration-token|remove-token|generate-jitconfig)(?:\/|$)/.test(
+    path
+  );
+}
+function brokerRoute(method, target) {
+  if (method === "CONNECT") return null;
+  if (target.startsWith("http://github.com/"))
+    target = "/git/" + target.slice("http://github.com/".length);
+  if (!target.startsWith("/") || target.startsWith("//") || /[\\#]/.test(target) || [...target].some((char) => char.charCodeAt(0) <= 32))
+    return null;
+  const path = target.split("?")[0];
+  let decoded;
+  try {
+    decoded = decodeURIComponent(path);
+  } catch {
+    return null;
+  }
+  if (/[\\%;]/.test(decoded) || /%2f/i.test(path) || decoded.split("/").some((part) => part === "." || part === "..") || [...decoded].some((char) => char.charCodeAt(0) <= 32))
+    return null;
+  const url = new URL(target, "http://broker.invalid");
+  if (path === "/codex/refresh" && method === "POST" && !url.search)
+    return { origin: "https://chatgpt.com", path, service: "codex", refresh: true };
+  const destinations = [
+    ["/claude", "https://api.anthropic.com", "claude"],
+    ["/codex", "https://chatgpt.com", "codex"],
+    ["/github", "https://api.github.com", "github"],
+    ["/git", "https://github.com", "github"]
+  ];
+  for (const [prefix, origin, service] of destinations) {
+    if (!path.startsWith(prefix + "/")) continue;
+    const upstreamPath = path.slice(prefix.length);
+    const canonical = decoded.slice(prefix.length).replace(/\/{2,}/g, "/").toLowerCase();
+    if (createsOrRevealsCredential(origin, canonical)) return null;
+    const operation = upstreamPath.endsWith("/info/refs") ? url.searchParams.get("service") : upstreamPath.split("/").at(-1);
+    const git = origin === "https://github.com" && (operation === "git-upload-pack" || operation === "git-receive-pack");
+    return {
+      origin,
+      path: upstreamPath + url.search,
+      service,
+      ...git ? { git: operation === "git-upload-pack" ? "upload" : "receive" } : {},
+      ...origin === "https://chatgpt.com" && upstreamPath === "/backend-api/ps/mcp" && ["GET", "POST", "DELETE"].includes(method) ? { identityOnly: true } : {}
+    };
+  }
+  return null;
+}
+
+// src/credential-broker/response-filter.ts
+import { Transform } from "stream";
+function credentialEchoes(secrets) {
+  return [
+    ...new Set(
+      secrets.flatMap((secret) => [secret, `Bearer ${secret}`, `x-access-token:${secret}`]).flatMap((value) => [
+        value,
+        encodeURIComponent(value),
+        Buffer.from(value).toString("base64"),
+        Buffer.from(value).toString("base64url"),
+        JSON.stringify(value).slice(1, -1)
+      ])
+    )
+  ].filter(Boolean);
+}
+function secretResponseFilter(secrets) {
+  const needles = credentialEchoes(secrets).map((value) => Buffer.from(value));
+  const keep = Math.max(1, ...needles.map((needle) => needle.length)) - 1;
+  let pending = Buffer.alloc(0);
+  return new Transform({
+    transform(chunk, _encoding, done) {
+      const bytes = Buffer.concat([pending, chunk]);
+      if (needles.some((needle) => bytes.includes(needle))) {
+        done(new Error("credential_echo"));
+        return;
+      }
+      const length = Math.max(0, bytes.length - keep);
+      if (length) this.push(bytes.subarray(0, length));
+      pending = bytes.subarray(length);
+      done();
+    },
+    flush(done) {
+      if (pending.length) this.push(pending);
+      done();
+    }
+  });
+}
+
+// src/credential-broker/broker.ts
+var REQUEST_HEADERS = [
+  "accept",
+  "content-type",
+  "content-encoding",
+  "user-agent",
+  "anthropic-version",
+  "anthropic-beta",
+  "x-app",
+  "originator",
+  "version",
+  "session_id",
+  "conversation_id",
+  "openai-beta",
+  "git-protocol",
+  "mcp-protocol-version",
+  "mcp-session-id"
+];
+var RESPONSE_HEADERS = [
+  "link",
+  "content-type",
+  "retry-after",
+  "x-request-id",
+  "request-id",
+  "x-ratelimit-limit",
+  "x-ratelimit-remaining",
+  "x-ratelimit-reset",
+  "mcp-session-id"
+];
+async function readBody(req, limit = 64 * 1024 * 1024) {
+  const chunks = [];
+  let length = 0;
+  for await (const chunk of req) {
+    length += chunk.length;
+    if (length > limit) throw new Error("body_limit");
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks);
+}
+function requestToken(req) {
+  const auth = req.headers.authorization;
+  const apiKey = req.headers["x-api-key"];
+  const names = req.rawHeaders.filter((_, index) => index % 2 === 0).map((name) => name.toLowerCase());
+  if (names.filter((name) => ["authorization", "x-api-key"].includes(name)).length > 1 || req.headers["proxy-authorization"] !== void 0)
+    throw new Error("conflicting_credentials");
+  if (apiKey !== void 0) return typeof apiKey === "string" ? apiKey : null;
+  if (auth === void 0) return null;
+  const bearer = auth.match(/^(?:Bearer|token) ([A-Za-z0-9_.-]+)$/i);
+  if (bearer) return bearer[1];
+  const basic = auth.match(/^Basic ([A-Za-z0-9+/=]+)$/i);
+  if (basic) {
+    const value = Buffer.from(basic[1], "base64").toString("utf8");
+    const parts = value.split(":");
+    if (parts.length === 2 && ["x-access-token", "oauth2"].includes(parts[0])) return parts[1];
+  }
+  throw new Error("invalid_credentials");
+}
+function refuse(res, route, body, status = 403) {
+  if (res.headersSent) {
+    res.destroy();
+    return;
+  }
+  if (route?.git === "receive") {
+    const capabilities = body.subarray(0, 1048576).toString().split("\0")[1]?.split("\n")[0]?.split(" ") ?? [];
+    const sideband = capabilities.includes("side-band-64k") || capabilities.includes("side-band");
+    const line = `${sideband ? "" : ""}ERR credential broker refused this operation
+`;
+    res.writeHead(route.path.endsWith("/git-receive-pack") ? 200 : status, {
+      "content-type": "application/x-git-receive-pack-result"
+    });
+    res.end((Buffer.byteLength(line) + 4).toString(16).padStart(4, "0") + line + "0000");
+  } else {
+    res.writeHead(status, { "content-type": "application/json", "cache-control": "no-store" });
+    res.end('{"error":"credential_broker_refused"}\n');
+  }
+}
+function createCredentialBroker(options) {
+  const now = options.now ?? Date.now;
+  const upstream = options.fetch ?? fetch;
+  const grants = /* @__PURE__ */ new Set();
+  const byToken = /* @__PURE__ */ new Map();
+  function revoke(grant) {
+    grant.revoked = true;
+    for (const alias of grant.aliases) byToken.delete(alias);
+    for (const active of grant.active) active.abort();
+    grants.delete(grant);
+  }
+  async function handle(req, res, githubSocket = false) {
+    const route = brokerRoute(req.method ?? "", (githubSocket ? "/github" : "") + (req.url ?? ""));
+    let grant;
+    let abort;
+    let upstreamStarted = false;
+    let requestBody = Buffer.alloc(0);
+    try {
+      for (const item of grants) if (item.expiresAt <= now()) revoke(item);
+      if (!route || githubSocket && req.headers.host !== "api.github.com") throw new Error();
+      const identity = await options.resolveIdentity(req.socket);
+      if (!identity) throw new Error();
+      let token2 = requestToken(req);
+      if (route.git && token2 === null) {
+        res.writeHead(401, {
+          "www-authenticate": 'Basic realm="credential-broker"',
+          "cache-control": "no-store"
+        });
+        res.end();
+        return;
+      }
+      let body;
+      if (route.refresh) {
+        body = await readBody(req, 16384);
+        const input = JSON.parse(body.toString());
+        if (input.grant_type !== "refresh_token" || typeof input.refresh_token !== "string" || token2 !== null && token2 !== input.refresh_token)
+          throw new Error();
+        token2 = input.refresh_token;
+      }
+      if (token2 !== null) grant = byToken.get(token2);
+      else if (route.identityOnly) {
+        const matches = [...grants].filter(
+          (item) => item.identity === identity && !item.revoked && item.expiresAt > now() && item.credentials[route.service]
+        );
+        if (matches.length === 1) grant = matches[0];
+      }
+      if (!grant || grant.revoked || grant.identity !== identity || grant.expiresAt <= now())
+        throw new Error();
+      const credential = grant.credentials[route.service];
+      if (!credential) throw new Error();
+      if (grant.active.size >= (grant.concurrentRequests ?? 16)) throw new Error();
+      if (now() - grant.windowStart >= 6e4) {
+        grant.windowStart = now();
+        grant.requests = 0;
+      }
+      if (++grant.requests > (grant.requestsPerMinute ?? 120)) throw new Error();
+      abort = new AbortController();
+      grant.active.add(abort);
+      const signal = AbortSignal.any([
+        abort.signal,
+        AbortSignal.timeout(Math.max(1, Math.min(6e5, grant.expiresAt - now())))
+      ]);
+      res.once("close", () => abort?.abort());
+      body ??= await readBody(req);
+      requestBody = body;
+      if (grant.revoked || grant.expiresAt <= now() || signal.aborted || await options.resolveIdentity(req.socket) !== identity)
+        throw new Error();
+      let account = await credential.current();
+      if (grant.revoked || grant.expiresAt <= now() || signal.aborted || await options.resolveIdentity(req.socket) !== identity)
+        throw new Error();
+      if (route.refresh) {
+        if (account.mode !== "codex-oauth") throw new Error();
+        const access = placeholderJwt(
+          grant,
+          account.accountId,
+          account.expiresAt ?? now() + 36e5
+        );
+        res.writeHead(200, { "content-type": "application/json", "cache-control": "no-store" });
+        res.end(
+          JSON.stringify({
+            access_token: access,
+            refresh_token: grant.token,
+            id_token: access,
+            token_type: "Bearer",
+            expires_in: Math.max(1, Math.floor(((account.expiresAt ?? now()) - now()) / 1e3))
+          })
+        );
+        options.audit?.("allowed");
+        return;
+      }
+      const headers = new Headers();
+      for (const name of REQUEST_HEADERS) {
+        const value = req.headers[name];
+        if (typeof value === "string") headers.set(name, value);
+      }
+      headers.set("accept-encoding", "identity");
+      headers.set(
+        "authorization",
+        route.git ? `Basic ${Buffer.from(`x-access-token:${account.accessToken}`).toString("base64")}` : `Bearer ${account.accessToken}`
+      );
+      if (route.service === "codex" && account.accountId)
+        headers.set("chatgpt-account-id", account.accountId);
+      const forward = () => {
+        upstreamStarted = true;
+        return upstream(route.origin + route.path, {
+          method: req.method,
+          headers,
+          redirect: "error",
+          signal,
+          ...body.length ? { body: new Uint8Array(body) } : {}
+        });
+      };
+      let response = await forward();
+      if (response.status === 401 && account.mode.endsWith("-oauth")) {
+        await response.body?.cancel();
+        if (grant.revoked || grant.expiresAt <= now() || signal.aborted || await options.resolveIdentity(req.socket) !== identity)
+          throw new Error();
+        account = await credential.current(account.accessToken);
+        if (grant.revoked || grant.expiresAt <= now() || signal.aborted || await options.resolveIdentity(req.socket) !== identity)
+          throw new Error();
+        headers.set("authorization", `Bearer ${account.accessToken}`);
+        response = await forward();
+      }
+      if (response.status >= 300 && response.status < 400 || response.headers.has("content-encoding") && response.headers.get("content-encoding") !== "identity") {
+        await response.body?.cancel();
+        throw new Error();
+      }
+      if (grant.revoked || grant.expiresAt <= now() || signal.aborted) {
+        await response.body?.cancel();
+        throw new Error();
+      }
+      const forbidden = credential.secrets();
+      const echoes = credentialEchoes(forbidden);
+      for (const value of response.headers.values()) {
+        if (echoes.some((secret) => value.includes(secret))) {
+          await response.body?.cancel();
+          throw new Error();
+        }
+      }
+      for (const name of RESPONSE_HEADERS) {
+        const value = response.headers.get(name);
+        if (value) res.setHeader(name, value);
+      }
+      res.setHeader("cache-control", "no-store");
+      res.statusCode = response.status;
+      if (response.body) {
+        await pipeline(
+          Readable.fromWeb(response.body),
+          secretResponseFilter(forbidden),
+          res,
+          { signal }
+        );
+      } else res.end();
+      options.audit?.("allowed");
+    } catch {
+      options.audit?.(upstreamStarted ? "upstream_failed" : "refused");
+      refuse(res, route, requestBody);
+    } finally {
+      if (grant && abort) grant.active.delete(abort);
+    }
+  }
+  function placeholderJwt(grant, accountId, expiresAt) {
+    const encode = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
+    const token2 = `${encode({ alg: "none", typ: "JWT" })}.${encode({
+      exp: Math.floor(expiresAt / 1e3),
+      sub: grant.token,
+      "https://api.openai.com/auth": { chatgpt_account_id: accountId ?? "broker" }
+    })}.${grant.token}`;
+    grant.aliases.add(token2);
+    byToken.set(token2, grant);
+    return token2;
+  }
+  return {
+    server: createServer((req, res) => {
+      void handle(req, res);
+    }),
+    // gh speaks HTTP to its configured Unix socket with api.github.com as Host.
+    // The adapter MUST still authenticate the peer; the socket path is no proof.
+    githubServer: createServer((req, res) => {
+      void handle(req, res, true);
+    }),
+    grant(input) {
+      for (const item of grants) if (item.expiresAt <= now()) revoke(item);
+      if (grants.size >= 1e4) throw new Error("grant_limit");
+      if (!input.identity || input.expiresAt <= now()) throw new Error("invalid_grant");
+      if (input.credentials.claude && !["claude-setup", "claude-oauth"].includes(input.credentials.claude.mode) || input.credentials.codex && input.credentials.codex.mode !== "codex-oauth" || input.credentials.github && input.credentials.github.mode !== "github")
+        throw new Error("invalid_grant");
+      const grant = {
+        ...input,
+        credentials: { ...input.credentials },
+        token: `cbg_${randomBytes(32).toString("hex")}`,
+        aliases: /* @__PURE__ */ new Set(),
+        revoked: false,
+        active: /* @__PURE__ */ new Set(),
+        windowStart: now(),
+        requests: 0
+      };
+      grant.aliases.add(grant.token);
+      grants.add(grant);
+      byToken.set(grant.token, grant);
+      return {
+        token: grant.token,
+        revoke: () => revoke(grant),
+        async codexAuth() {
+          if (grant.revoked || grant.expiresAt <= now() || !grant.credentials.codex)
+            throw new Error("invalid_grant");
+          const account = await grant.credentials.codex.current();
+          if (account.mode !== "codex-oauth" || grant.revoked) throw new Error("invalid_grant");
+          const token2 = placeholderJwt(grant, account.accountId, account.expiresAt ?? now());
+          return {
+            auth_mode: "chatgpt",
+            OPENAI_API_KEY: null,
+            tokens: {
+              access_token: token2,
+              refresh_token: grant.token,
+              id_token: token2,
+              account_id: account.accountId ?? "broker"
+            },
+            last_refresh: new Date(now()).toISOString()
+          };
+        }
+      };
+    },
+    revokeIdentity(identity) {
+      for (const grant of grants) if (grant.identity === identity) revoke(grant);
+    },
+    revokeAll() {
+      for (const grant of grants) revoke(grant);
+    }
+  };
+}
+
+// src/credential-broker/credentials.ts
+import { randomUUID } from "crypto";
+import { constants } from "fs";
+import { open, rename, unlink } from "fs/promises";
+import { dirname } from "path";
+import { z } from "zod";
+var token = z.string().min(8).max(32768).regex(/^[\x21-\x7e]+$/);
+var accountSchema = z.object({
+  mode: z.enum(["claude-setup", "claude-oauth", "codex-oauth", "github"]),
+  accessToken: token,
+  refreshToken: token.optional(),
+  idToken: token.optional(),
+  expiresAt: z.number().finite().optional(),
+  accountId: z.string().min(1).optional()
+}).strict().superRefine((value, ctx) => {
+  if (value.mode.endsWith("-oauth") && (!value.refreshToken || value.expiresAt === void 0)) {
+    ctx.addIssue({ code: "custom", message: "OAuth requires renewal state" });
+  }
+});
+var BrokerError = class extends Error {
+  constructor(code) {
+    super(code);
+    this.code = code;
+  }
+  code;
+};
+function fileCredentialStore(path) {
+  return {
+    async read() {
+      let file;
+      try {
+        file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+        const stat = await file.stat();
+        if (!stat.isFile() || stat.nlink !== 1 || (stat.mode & 63) !== 0 || stat.uid !== process.getuid?.() || stat.size > 131072)
+          throw new Error();
+        return accountSchema.parse(JSON.parse(await file.readFile("utf8")));
+      } catch {
+        throw new BrokerError("credential_unavailable");
+      } finally {
+        await file?.close();
+      }
+    },
+    async write(account) {
+      const tmp = `${path}.${randomUUID()}.tmp`;
+      try {
+        const validated = accountSchema.parse(account);
+        const file = await open(tmp, "wx", 384);
+        try {
+          await file.writeFile(JSON.stringify(validated) + "\n");
+          await file.sync();
+        } finally {
+          await file.close();
+        }
+        await rename(tmp, path);
+        const dir = await open(dirname(path), constants.O_RDONLY | constants.O_DIRECTORY);
+        try {
+          await dir.sync();
+        } finally {
+          await dir.close();
+        }
+      } catch {
+        throw new BrokerError("persistence_failed");
+      } finally {
+        await unlink(tmp).catch(() => {
+        });
+      }
+    }
+  };
+}
+var renewalSchema = z.object({
+  access_token: token,
+  refresh_token: token.optional(),
+  id_token: token.optional(),
+  expires_in: z.number().positive().finite().max(31536e3).optional()
+});
+var OAUTH = {
+  "claude-oauth": {
+    url: "https://platform.claude.com/v1/oauth/token",
+    clientId: "9d1c250a-e61b-44d9-88ed-5944d1962f5e"
+  },
+  "codex-oauth": {
+    url: "https://auth.openai.com/oauth/token",
+    clientId: "app_EMoamEEZ73f0CkXaXp7hrann"
+  }
+};
+async function openBrokerCredentials(store, ports = {}) {
+  let account;
+  try {
+    account = accountSchema.parse(await store.read());
+  } catch {
+    throw new BrokerError("credential_unavailable");
+  }
+  const fetchUpstream = ports.fetch ?? fetch;
+  const now = ports.now ?? Date.now;
+  let pending;
+  let poisoned = false;
+  const secrets = /* @__PURE__ */ new Set();
+  function remember(value) {
+    for (const secret of [value.accessToken, value.refreshToken, value.idToken]) {
+      if (secret) secrets.add(secret);
+    }
+  }
+  remember(account);
+  async function renew() {
+    const mode = account.mode;
+    if (mode !== "claude-oauth" && mode !== "codex-oauth") return account;
+    try {
+      const oauth = OAUTH[mode];
+      const response = await fetchUpstream(oauth.url, {
+        method: "POST",
+        redirect: "error",
+        signal: AbortSignal.timeout(3e4),
+        headers: { "content-type": "application/json", accept: "application/json" },
+        body: JSON.stringify({
+          grant_type: "refresh_token",
+          client_id: oauth.clientId,
+          refresh_token: account.refreshToken
+        })
+      });
+      if (!response.ok) {
+        await response.body?.cancel();
+        throw new Error();
+      }
+      const reader = response.body?.getReader();
+      if (!reader) throw new Error();
+      const chunks = [];
+      let size = 0;
+      try {
+        while (true) {
+          const chunk = await reader.read();
+          if (chunk.done) break;
+          size += chunk.value.length;
+          if (size > 131072) throw new Error();
+          chunks.push(chunk.value);
+        }
+      } finally {
+        await reader.cancel().catch(() => {
+        });
+      }
+      const renewed = renewalSchema.parse(JSON.parse(Buffer.concat(chunks).toString("utf8")));
+      let lifetime = renewed.expires_in;
+      if (lifetime === void 0 && mode === "codex-oauth") {
+        const payload = JSON.parse(
+          Buffer.from(renewed.access_token.split(".")[1] ?? "", "base64url").toString()
+        );
+        if (typeof payload.exp === "number") lifetime = payload.exp - now() / 1e3;
+      }
+      if (!lifetime || !Number.isFinite(lifetime) || lifetime <= 0) throw new Error();
+      const next = accountSchema.parse({
+        ...account,
+        accessToken: renewed.access_token,
+        refreshToken: renewed.refresh_token ?? account.refreshToken,
+        idToken: renewed.id_token ?? account.idToken,
+        expiresAt: now() + lifetime * 1e3
+      });
+      remember(next);
+      try {
+        await store.write(next);
+      } catch {
+        poisoned = true;
+        throw new BrokerError("persistence_failed");
+      }
+      account = next;
+      return account;
+    } catch (error) {
+      if (error instanceof BrokerError) throw error;
+      throw new BrokerError("refresh_failed");
+    }
+  }
+  return {
+    mode: account.mode,
+    // A snapshot used only by the response filter, inside the trusted process.
+    secrets: () => [...secrets],
+    async current(rejectedAccessToken) {
+      if (poisoned) throw new BrokerError("persistence_failed");
+      if (pending) return pending;
+      if (!account.mode.endsWith("-oauth") || rejectedAccessToken !== void 0 && rejectedAccessToken !== account.accessToken || rejectedAccessToken === void 0 && (account.expiresAt ?? 0) > now() + 6e4) {
+        return account;
+      }
+      pending = renew();
+      try {
+        return await pending;
+      } finally {
+        pending = void 0;
+      }
+    }
+  };
+}
+
+// src/credential-broker/client-config.ts
+import { parse, stringify } from "smol-toml";
+function brokerClientConfiguration(input) {
+  const base = new URL(input.baseUrl);
+  if (base.protocol !== "http:" || !["127.0.0.1", "[::1]"].includes(base.hostname) || base.username || base.password || base.pathname !== "/" || base.search || base.hash || !/^cbg_[a-f0-9]{64}$/.test(input.placeholder) || input.githubSocket != null && (!input.githubSocket.startsWith("/") || [...input.githubSocket].some((char) => char.charCodeAt(0) < 32)))
+    throw new Error("invalid_broker_configuration");
+  const origin = base.origin;
+  const config = parse(input.codexConfig);
+  const providers = config.model_providers;
+  if (providers !== void 0 && (!providers || typeof providers !== "object" || Array.isArray(providers) || providers instanceof Date)) {
+    throw new Error("invalid_broker_configuration");
+  }
+  config.model_provider = "credential_broker";
+  config.chatgpt_base_url = `${origin}/codex/backend-api/`;
+  config.model_providers = {
+    ...providers,
+    credential_broker: {
+      name: "Credential broker",
+      base_url: `${origin}/codex/backend-api/codex`,
+      wire_api: "responses",
+      requires_openai_auth: true,
+      supports_websockets: false
+    }
+  };
+  const git = new URL("http://github.com/");
+  git.username = "x-access-token";
+  git.password = input.placeholder;
+  const githubEnv = input.githubSocket == null ? {} : {
+    GH_TOKEN: input.placeholder
+  };
+  return {
+    env: {
+      ANTHROPIC_BASE_URL: `${origin}/claude`,
+      CLAUDE_CODE_OAUTH_TOKEN: input.placeholder,
+      CODEX_REFRESH_TOKEN_URL_OVERRIDE: `${origin}/codex/refresh`,
+      ...githubEnv
+    },
+    codexConfig: stringify(config),
+    // Include from the sandbox's global config. The stored remote stays HTTPS.
+    // No generic forward proxy, CONNECT tunnel or arbitrary host is enabled.
+    gitConfig: input.githubSocket == null ? "" : `[url ${JSON.stringify(git.href)}]
+	insteadOf = https://github.com/
+[http "http://github.com/"]
+	proxy = ${JSON.stringify(origin)}
+	followRedirects = false
+`,
+    // YAML accepts a JSON string scalar, including quotes/backslashes in paths.
+    ghConfig: input.githubSocket == null ? "" : `http_unix_socket: ${JSON.stringify(input.githubSocket)}
+`
+  };
+}
+export {
+  brokerClientConfiguration,
+  createCredentialBroker,
+  fileCredentialStore,
+  openBrokerCredentials
+};

package/dist/launch.js

@@ -145,9 +145,9 @@ var companionConfigSchema = z2.object({
   // silent roster: an agent nobody listed gets no hook and no error, and starts
   // in the operator's `$HOME`.
   prepareHook: prepareHookSchema.optional(),
-  // `dashboardPort` and `autoOpen` are IGNORED by the CLI (no port, no browser)
-  // but stay in the schema so an existing file still parses; the Electron shell
-  // reads them. `logLevel` is pino's level, live-editable.
+  // The CLI ignores both dashboard settings. Desktop uses `dashboardPort`;
+  // `autoOpen` remains parseable for older config files but no longer controls
+  // startup. `logLevel` is pino's level, live-editable.
   dashboardPort: z2.number().int().min(1).max(65535).optional(),
   autoOpen: z2.boolean().optional(),
   logLevel: z2.enum(["warn", "info", "debug"]).optional(),
@@ -185,7 +185,10 @@ var companionConfigSchema = z2.object({
   // credential and secrets on its stdin (`runner/launch.ts`, `wrapped`). The README lists
   // what a wrapper can rely on.
   runner: z2.object({
-    command: z2.array(z2.string().min(1)).min(1)
+    command: z2.array(z2.string().min(1)).min(1),
+    // The external wrapper supplies only broker placeholders and removes
+    // credential mounts. Do not hand provider logins to that runner on stdin.
+    brokeredCredentials: z2.boolean().optional()
   }).strict().optional()
 });
 var legacyOfferSchema = z2.object({