@codeworksh/aikit 0.8.0-dev.20260905193244 → 0.9.0-dev.20260922184333

package/README.md

@@ -147,20 +147,29 @@ pnpm aikit modelgen [path]
 
 ### OAuth Providers
 
-Manage OAuth credentials for providers that require it, such as OpenAI Codex.
+Manage OAuth credentials for providers that require it, such as OpenAI Codex and GitHub Copilot.
 
 ```bash
 # Start an OAuth login flow in your browser
 pnpm aikit auth --openai-codex
 
+# Codex with a device code instead: no localhost callback port, so it works
+# over SSH, in containers, and when something else holds port 1455
+pnpm aikit auth --openai-codex --device
+
+# GitHub Copilot uses the device flow; add --enterprise <domain> for GitHub Enterprise
+pnpm aikit auth --github-copilot
+
 # Check the status of your stored credentials
 pnpm aikit auth --openai-codex --status
+pnpm aikit auth --github-copilot --status
 
 # Refresh your current credentials
 pnpm aikit auth --openai-codex --refresh
 
 # Clear stored credentials
 pnpm aikit auth --openai-codex --logout
+pnpm aikit auth --github-copilot --logout
 ```
 
 ## Contribute

package/cli.mjs

@@ -1,105 +1,81 @@
 #!/usr/bin/env node
-import { c as openAICodexHeaders, r as OpenAICodexOAuthClient, t as JsonOpenAICodexAuthStorage } from "./codex-MtP1574D.mjs";
-import { t as ModelgenCommand } from "./modelgen-BjSsusLQ.mjs";
+import { r as OpenAICodexOAuthClient, t as JsonOpenAICodexAuthStorage } from "./codex-CLDBTrFm.mjs";
+import { t as ModelgenCommand } from "./modelgen-DvorXOjJ.mjs";
+import { i as JsonGitHubCopilotAuthStorage, r as GitHubCopilotOAuthClient } from "./copilot-CcD3g6H8.mjs";
+import { n as promptLine, t as openBrowser } from "./interactive-eoNnscGB.mjs";
+import { a as oauthNotice, c as summarizeGitHubCopilot, i as oauthLoginIssue, l as summarizeOpenAICodex, n as checkOAuthProvider, r as formatOAuthSummary, s as oauthRefreshIssue } from "./summary-C_QyCVWa.mjs";
 import yargs from "yargs";
 import { hideBin } from "yargs/helpers";
 //#region package.json
-var version = "0.8.0";
+var version = "0.9.0";
 //#endregion
 //#region src/cli/oauth.ts
-async function promptLine(message) {
-	const rl = (await import("node:readline/promises")).createInterface({
-		input: process.stdin,
-		output: process.stdout
-	});
-	try {
-		return await rl.question(`${message} `);
-	} finally {
-		rl.close();
-	}
-}
-async function openBrowser(url) {
-	const { spawn } = await import("node:child_process");
-	const command = process.platform === "darwin" ? {
-		file: "open",
-		args: [url]
-	} : process.platform === "win32" ? {
-		file: "cmd",
-		args: [
-			"/c",
-			"start",
-			"",
-			url
-		]
-	} : {
-		file: "xdg-open",
-		args: [url]
-	};
-	spawn(command.file, command.args, {
-		detached: true,
-		stdio: "ignore"
-	}).unref();
-}
-function printCredentials(credentials, options) {
-	if (options.json) {
-		console.log(JSON.stringify({
-			accountId: credentials.accountId,
-			expires: credentials.expires,
-			expiresAt: new Date(credentials.expires).toISOString(),
-			headers: options.printHeaders ? openAICodexHeaders(credentials) : void 0
-		}, null, 2));
-		return;
-	}
-	console.log(`Account: ${credentials.accountId}`);
-	console.log(`Expires: ${new Date(credentials.expires).toLocaleString()}`);
-	if (options.printHeaders) {
-		console.log("Headers:");
-		for (const [name, value] of Object.entries(openAICodexHeaders(credentials))) console.log(`${name}: ${value}`);
-	}
-}
 async function runOpenAICodexAuth(args) {
 	const storage = new JsonOpenAICodexAuthStorage({ ...args.authFile !== void 0 && { path: args.authFile } });
 	const client = new OpenAICodexOAuthClient({ storage });
+	const show = (credentials) => process.stdout.write(formatOAuthSummary(summarizeOpenAICodex(credentials), { json: args.json === true }));
 	if (args.logout) {
 		await client.logout();
-		console.log(`Cleared OpenAI Codex credentials from ${storage.path}`);
+		console.warn(oauthNotice("cleared", "openai-codex", storage.path));
 		return;
 	}
-	if (args.status) {
-		const credentials = await storage.get();
+	if (args.status || args.refresh) {
+		const credentials = args.refresh ? await client.getCredentials() : await storage.get();
 		if (!credentials) {
-			console.log(`No OpenAI Codex credentials found at ${storage.path}`);
+			console.error(oauthNotice("missing", "openai-codex", storage.path));
 			process.exitCode = 1;
 			return;
 		}
-		printCredentials(credentials, args);
+		if (args.refresh) console.warn(oauthNotice("refreshed", "openai-codex", storage.path));
+		show(credentials);
+		return;
+	}
+	const credentials = await client.login({
+		device: args.device === true,
+		onAuth: (info) => {
+			console.warn(info.instructions ?? "Complete OpenAI Codex authentication in your browser.");
+			if (info.userCode) console.warn(`Enter code: ${info.userCode}`);
+			console.warn(info.url);
+			if (args.browser !== false) openBrowser(info.url, (error) => console.warn(`Failed to open browser: ${error.message}`));
+		},
+		onProgress: (message) => console.warn(message),
+		onPrompt: async (prompt) => promptLine(prompt.message)
+	});
+	console.warn(oauthNotice("saved", "openai-codex", storage.path));
+	show(credentials);
+}
+async function runGitHubCopilotAuth(args) {
+	const storage = new JsonGitHubCopilotAuthStorage({ ...args.authFile !== void 0 && { path: args.authFile } });
+	const client = new GitHubCopilotOAuthClient({ storage });
+	const show = (credentials) => process.stdout.write(formatOAuthSummary(summarizeGitHubCopilot(credentials), { json: args.json === true }));
+	if (args.logout) {
+		await client.logout();
+		console.warn(oauthNotice("cleared", "github-copilot", storage.path));
 		return;
 	}
-	if (args.refresh) {
-		const credentials = await client.getCredentials();
+	if (args.status) {
+		const credentials = await storage.get();
 		if (!credentials) {
-			console.log(`No OpenAI Codex credentials found at ${storage.path}`);
+			console.error(oauthNotice("missing", "github-copilot", storage.path));
 			process.exitCode = 1;
 			return;
 		}
-		console.log(`Refreshed OpenAI Codex credentials in ${storage.path}`);
-		printCredentials(credentials, args);
+		show(credentials);
 		return;
 	}
 	const credentials = await client.login({
-		...args.originator !== void 0 && { originator: args.originator },
-		...args.manual && { onManualCodeInput: async () => promptLine("Paste the redirect URL or authorization code, or wait for browser callback:") },
+		...args.enterprise !== void 0 && { enterpriseUrl: args.enterprise },
+		enableModels: args.enableModels === true,
 		onAuth: (info) => {
-			console.log(info.instructions ?? "Complete OpenAI Codex authentication in your browser.");
-			console.log(info.url);
-			if (args.browser !== false) openBrowser(info.url).catch((error) => {
-				console.warn(`Failed to open browser: ${error instanceof Error ? error.message : String(error)}`);
-			});
+			console.warn(info.instructions ?? "Complete GitHub Copilot authentication in your browser.");
+			console.warn(`Enter code: ${info.userCode}`);
+			console.warn(info.url);
+			if (args.browser !== false) openBrowser(info.url, (error) => console.warn(`Failed to open browser: ${error.message}`));
 		},
-		onPrompt: async (prompt) => promptLine(prompt.message)
+		onProgress: (message) => console.warn(message)
 	});
-	console.log(`Saved OpenAI Codex credentials to ${storage.path}`);
-	printCredentials(credentials, args);
+	console.warn(oauthNotice("saved", "github-copilot", storage.path));
+	show(credentials);
 }
 //#endregion
 //#region src/cli.ts
@@ -109,6 +85,15 @@ const cli = yargs(hideBin(process.argv)).scriptName("aikit").wrap(100).help("hel
 	builder: (yargs) => yargs.option("openai-codex", {
 		type: "boolean",
 		describe: "use OpenAI Codex OAuth"
+	}).option("github-copilot", {
+		type: "boolean",
+		describe: "use GitHub Copilot OAuth (device flow)"
+	}).option("enterprise", {
+		type: "string",
+		describe: "GitHub Enterprise domain for GitHub Copilot login"
+	}).option("enable-models", {
+		type: "boolean",
+		describe: "enable unconfigured Copilot catalog models after login"
 	}).option("auth-file", {
 		type: "string",
 		describe: "path to auth.json (defaults to CODEWORK_CREDENTIALS or ~/.codework/aikit/auth.json)"
@@ -116,14 +101,10 @@ const cli = yargs(hideBin(process.argv)).scriptName("aikit").wrap(100).help("hel
 		type: "boolean",
 		default: true,
 		describe: "open the authorization URL in the default browser"
-	}).option("manual", {
+	}).option("device", {
 		type: "boolean",
 		default: false,
-		describe: "also prompt for a pasted redirect URL or authorization code"
-	}).option("originator", {
-		type: "string",
-		default: "codework",
-		describe: "OAuth originator value"
+		describe: "use the device-code flow instead of a localhost browser callback"
 	}).option("status", {
 		type: "boolean",
 		describe: "show stored credential status without refreshing"
@@ -136,19 +117,30 @@ const cli = yargs(hideBin(process.argv)).scriptName("aikit").wrap(100).help("hel
 	}).option("json", {
 		type: "boolean",
 		describe: "print machine-readable output"
-	}).option("print-headers", {
-		type: "boolean",
-		describe: "print request headers for Codex API calls"
 	}).check((args) => {
-		if (!args.openaiCodex) throw new Error("choose an auth provider, for example: auth --openai-codex");
+		const checked = checkOAuthProvider({
+			openaiCodex: args["openai-codex"],
+			githubCopilot: args["github-copilot"]
+		});
+		if (!checked.ok) throw new Error(checked.message);
 		if ([
 			args.status,
 			args.refresh,
 			args.logout
 		].filter(Boolean).length > 1) throw new Error("choose only one of --status, --refresh, or --logout");
+		const issue = oauthLoginIssue(checked.provider, {
+			device: args.device,
+			enterprise: args.enterprise,
+			enableModels: args["enable-models"]
+		}) ?? (args.refresh ? oauthRefreshIssue(checked.provider) : void 0);
+		if (issue) throw new Error(issue);
 		return true;
 	}),
 	handler: async (args) => {
+		if (args.githubCopilot) {
+			await runGitHubCopilotAuth(args);
+			return;
+		}
 		await runOpenAICodexAuth(args);
 	}
 }).demandCommand(1, "Choose a command").strict().fail((message, error) => {

package/cli.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"cli.mjs","names":["pkg.version"],"sources":["../../package.json","../../src/cli/oauth.ts","../../src/cli.ts"],"sourcesContent":["","import type { CommandModule } from \"yargs\";\nimport {\n\tJsonOpenAICodexAuthStorage,\n\tOpenAICodexOAuthClient,\n\ttype OpenAICodexOAuthCredentials,\n\topenAICodexHeaders,\n} from \"../oauth/openai/codex.ts\";\n\n// `?: T | undefined` rather than plain `?: T`: yargs hands these through as explicit `undefined`,\n// which a bare optional property no longer accepts under `exactOptionalPropertyTypes`.\ntype AuthArgs = {\n\topenaiCodex?: boolean | undefined;\n\tauthFile?: string | undefined;\n\tbrowser?: boolean | undefined;\n\tmanual?: boolean | undefined;\n\tstatus?: boolean | undefined;\n\trefresh?: boolean | undefined;\n\tlogout?: boolean | undefined;\n\tjson?: boolean | undefined;\n\tprintHeaders?: boolean | undefined;\n\toriginator?: string | undefined;\n};\n\nasync function promptLine(message: string): Promise<string> {\n\tconst readline = await import(\"node:readline/promises\");\n\tconst rl = readline.createInterface({\n\t\tinput: process.stdin,\n\t\toutput: process.stdout,\n\t});\n\n\ttry {\n\t\treturn await rl.question(`${message} `);\n\t} finally {\n\t\trl.close();\n\t}\n}\n\nasync function openBrowser(url: string): Promise<void> {\n\tconst { spawn } = await import(\"node:child_process\");\n\tconst command =\n\t\tprocess.platform === \"darwin\"\n\t\t\t? { file: \"open\", args: [url] }\n\t\t\t: process.platform === \"win32\"\n\t\t\t\t? { file: \"cmd\", args: [\"/c\", \"start\", \"\", url] }\n\t\t\t\t: { file: \"xdg-open\", args: [url] };\n\n\tconst child = spawn(command.file, command.args, {\n\t\tdetached: true,\n\t\tstdio: \"ignore\",\n\t});\n\tchild.unref();\n}\n\nfunction printCredentials(\n\tcredentials: OpenAICodexOAuthCredentials,\n\toptions: { json?: boolean | undefined; printHeaders?: boolean | undefined },\n) {\n\tif (options.json) {\n\t\tconsole.log(\n\t\t\tJSON.stringify(\n\t\t\t\t{\n\t\t\t\t\taccountId: credentials.accountId,\n\t\t\t\t\texpires: credentials.expires,\n\t\t\t\t\texpiresAt: new Date(credentials.expires).toISOString(),\n\t\t\t\t\theaders: options.printHeaders ? openAICodexHeaders(credentials) : undefined,\n\t\t\t\t},\n\t\t\t\tnull,\n\t\t\t\t2,\n\t\t\t),\n\t\t);\n\t\treturn;\n\t}\n\n\tconsole.log(`Account: ${credentials.accountId}`);\n\tconsole.log(`Expires: ${new Date(credentials.expires).toLocaleString()}`);\n\tif (options.printHeaders) {\n\t\tconsole.log(\"Headers:\");\n\t\tfor (const [name, value] of Object.entries(openAICodexHeaders(credentials))) {\n\t\t\tconsole.log(`${name}: ${value}`);\n\t\t}\n\t}\n}\n\nasync function runOpenAICodexAuth(args: AuthArgs): Promise<void> {\n\tconst storage = new JsonOpenAICodexAuthStorage({\n\t\t...(args.authFile !== undefined && { path: args.authFile }),\n\t});\n\tconst client = new OpenAICodexOAuthClient({ storage });\n\n\tif (args.logout) {\n\t\tawait client.logout();\n\t\tconsole.log(`Cleared OpenAI Codex credentials from ${storage.path}`);\n\t\treturn;\n\t}\n\n\tif (args.status) {\n\t\tconst credentials = await storage.get();\n\t\tif (!credentials) {\n\t\t\tconsole.log(`No OpenAI Codex credentials found at ${storage.path}`);\n\t\t\tprocess.exitCode = 1;\n\t\t\treturn;\n\t\t}\n\t\tprintCredentials(credentials, args);\n\t\treturn;\n\t}\n\n\tif (args.refresh) {\n\t\tconst credentials = await client.getCredentials();\n\t\tif (!credentials) {\n\t\t\tconsole.log(`No OpenAI Codex credentials found at ${storage.path}`);\n\t\t\tprocess.exitCode = 1;\n\t\t\treturn;\n\t\t}\n\t\tconsole.log(`Refreshed OpenAI Codex credentials in ${storage.path}`);\n\t\tprintCredentials(credentials, args);\n\t\treturn;\n\t}\n\n\tconst credentials = await client.login({\n\t\t...(args.originator !== undefined && { originator: args.originator }),\n\t\t...(args.manual && {\n\t\t\tonManualCodeInput: async () =>\n\t\t\t\tpromptLine(\"Paste the redirect URL or authorization code, or wait for browser callback:\"),\n\t\t}),\n\t\tonAuth: (info) => {\n\t\t\tconsole.log(info.instructions ?? \"Complete OpenAI Codex authentication in your browser.\");\n\t\t\tconsole.log(info.url);\n\t\t\tif (args.browser !== false) {\n\t\t\t\tvoid openBrowser(info.url).catch((error) => {\n\t\t\t\t\tconsole.warn(`Failed to open browser: ${error instanceof Error ? error.message : String(error)}`);\n\t\t\t\t});\n\t\t\t}\n\t\t},\n\t\tonPrompt: async (prompt) => promptLine(prompt.message),\n\t});\n\n\tconsole.log(`Saved OpenAI Codex credentials to ${storage.path}`);\n\tprintCredentials(credentials, args);\n}\n\nexport const OAuthCommand: CommandModule<object, AuthArgs> = {\n\tcommand: \"auth\",\n\tdescribe: \"manage OAuth credentials\",\n\tbuilder: (yargs) =>\n\t\tyargs\n\t\t\t.option(\"openai-codex\", {\n\t\t\t\ttype: \"boolean\",\n\t\t\t\tdescribe: \"use OpenAI Codex OAuth\",\n\t\t\t})\n\t\t\t.option(\"auth-file\", {\n\t\t\t\ttype: \"string\",\n\t\t\t\tdescribe: \"path to auth.json (defaults to CODEWORK_CREDENTIALS or ~/.codework/aikit/auth.json)\",\n\t\t\t})\n\t\t\t.option(\"browser\", {\n\t\t\t\ttype: \"boolean\",\n\t\t\t\tdefault: true,\n\t\t\t\tdescribe: \"open the authorization URL in the default browser\",\n\t\t\t})\n\t\t\t.option(\"manual\", {\n\t\t\t\ttype: \"boolean\",\n\t\t\t\tdefault: false,\n\t\t\t\tdescribe: \"also prompt for a pasted redirect URL or authorization code\",\n\t\t\t})\n\t\t\t.option(\"originator\", {\n\t\t\t\ttype: \"string\",\n\t\t\t\tdefault: \"codework\",\n\t\t\t\tdescribe: \"OAuth originator value\",\n\t\t\t})\n\t\t\t.option(\"status\", {\n\t\t\t\ttype: \"boolean\",\n\t\t\t\tdescribe: \"show stored credential status without refreshing\",\n\t\t\t})\n\t\t\t.option(\"refresh\", {\n\t\t\t\ttype: \"boolean\",\n\t\t\t\tdescribe: \"refresh stored credentials if expired\",\n\t\t\t})\n\t\t\t.option(\"logout\", {\n\t\t\t\ttype: \"boolean\",\n\t\t\t\tdescribe: \"clear stored credentials\",\n\t\t\t})\n\t\t\t.option(\"json\", {\n\t\t\t\ttype: \"boolean\",\n\t\t\t\tdescribe: \"print machine-readable output\",\n\t\t\t})\n\t\t\t.option(\"print-headers\", {\n\t\t\t\ttype: \"boolean\",\n\t\t\t\tdescribe: \"print request headers for Codex API calls\",\n\t\t\t})\n\t\t\t.check((args) => {\n\t\t\t\tif (!args.openaiCodex) throw new Error(\"choose an auth provider, for example: auth --openai-codex\");\n\t\t\t\tconst actions = [args.status, args.refresh, args.logout].filter(Boolean).length;\n\t\t\t\tif (actions > 1) throw new Error(\"choose only one of --status, --refresh, or --logout\");\n\t\t\t\treturn true;\n\t\t\t}),\n\thandler: async (args) => {\n\t\tawait runOpenAICodexAuth(args);\n\t},\n};\n","#!/usr/bin/env node\nimport pkg from \"../package.json\" with { type: \"json\" };\nimport yargs from \"yargs\";\nimport { hideBin } from \"yargs/helpers\";\nimport { ModelgenCommand } from \"./cli/modelgen.ts\";\nimport { OAuthCommand } from \"./cli/oauth.ts\";\n\nconst cli = yargs(hideBin(process.argv))\n\t.scriptName(\"aikit\")\n\t.wrap(100)\n\t.help(\"help\", \"show help\")\n\t.alias(\"help\", \"h\")\n\t.version(\"version\", \"show version number\", pkg.version)\n\t.alias(\"version\", \"v\")\n\t.command(ModelgenCommand)\n\t.command(OAuthCommand)\n\t.demandCommand(1, \"Choose a command\")\n\t.strict()\n\t.fail((message, error) => {\n\t\tif (error) throw error;\n\t\tif (message) throw new Error(message);\n\t});\n\ntry {\n\tawait cli.parse();\n} catch (error) {\n\tprocess.exitCode = 1;\n\tconsole.error(error instanceof Error ? error.message : String(error));\n}\n"],"mappings":";;;;;;;;;ACuBA,eAAe,WAAW,SAAkC;CAE3D,MAAM,MAAK,MADY,OAAO,0BAAA,CACV,gBAAgB;EACnC,OAAO,QAAQ;EACf,QAAQ,QAAQ;CACjB,CAAC;CAED,IAAI;EACH,OAAO,MAAM,GAAG,SAAS,GAAG,QAAQ,EAAE;CACvC,UAAU;EACT,GAAG,MAAM;CACV;AACD;AAEA,eAAe,YAAY,KAA4B;CACtD,MAAM,EAAE,UAAU,MAAM,OAAO;CAC/B,MAAM,UACL,QAAQ,aAAa,WAClB;EAAE,MAAM;EAAQ,MAAM,CAAC,GAAG;CAAE,IAC5B,QAAQ,aAAa,UACpB;EAAE,MAAM;EAAO,MAAM;GAAC;GAAM;GAAS;GAAI;EAAG;CAAE,IAC9C;EAAE,MAAM;EAAY,MAAM,CAAC,GAAG;CAAE;CAMrC,MAJoB,QAAQ,MAAM,QAAQ,MAAM;EAC/C,UAAU;EACV,OAAO;CACR,CACI,CAAC,CAAC,MAAM;AACb;AAEA,SAAS,iBACR,aACA,SACC;CACD,IAAI,QAAQ,MAAM;EACjB,QAAQ,IACP,KAAK,UACJ;GACC,WAAW,YAAY;GACvB,SAAS,YAAY;GACrB,WAAW,IAAI,KAAK,YAAY,OAAO,CAAC,CAAC,YAAY;GACrD,SAAS,QAAQ,eAAe,mBAAmB,WAAW,IAAI,KAAA;EACnE,GACA,MACA,CACD,CACD;EACA;CACD;CAEA,QAAQ,IAAI,YAAY,YAAY,WAAW;CAC/C,QAAQ,IAAI,YAAY,IAAI,KAAK,YAAY,OAAO,CAAC,CAAC,eAAe,GAAG;CACxE,IAAI,QAAQ,cAAc;EACzB,QAAQ,IAAI,UAAU;EACtB,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,mBAAmB,WAAW,CAAC,GACzE,QAAQ,IAAI,GAAG,KAAK,IAAI,OAAO;CAEjC;AACD;AAEA,eAAe,mBAAmB,MAA+B;CAChE,MAAM,UAAU,IAAI,2BAA2B,EAC9C,GAAI,KAAK,aAAa,KAAA,KAAa,EAAE,MAAM,KAAK,SAAS,EAC1D,CAAC;CACD,MAAM,SAAS,IAAI,uBAAuB,EAAE,QAAQ,CAAC;CAErD,IAAI,KAAK,QAAQ;EAChB,MAAM,OAAO,OAAO;EACpB,QAAQ,IAAI,yCAAyC,QAAQ,MAAM;EACnE;CACD;CAEA,IAAI,KAAK,QAAQ;EAChB,MAAM,cAAc,MAAM,QAAQ,IAAI;EACtC,IAAI,CAAC,aAAa;GACjB,QAAQ,IAAI,wCAAwC,QAAQ,MAAM;GAClE,QAAQ,WAAW;GACnB;EACD;EACA,iBAAiB,aAAa,IAAI;EAClC;CACD;CAEA,IAAI,KAAK,SAAS;EACjB,MAAM,cAAc,MAAM,OAAO,eAAe;EAChD,IAAI,CAAC,aAAa;GACjB,QAAQ,IAAI,wCAAwC,QAAQ,MAAM;GAClE,QAAQ,WAAW;GACnB;EACD;EACA,QAAQ,IAAI,yCAAyC,QAAQ,MAAM;EACnE,iBAAiB,aAAa,IAAI;EAClC;CACD;CAEA,MAAM,cAAc,MAAM,OAAO,MAAM;EACtC,GAAI,KAAK,eAAe,KAAA,KAAa,EAAE,YAAY,KAAK,WAAW;EACnE,GAAI,KAAK,UAAU,EAClB,mBAAmB,YAClB,WAAW,6EAA6E,EAC1F;EACA,SAAS,SAAS;GACjB,QAAQ,IAAI,KAAK,gBAAgB,uDAAuD;GACxF,QAAQ,IAAI,KAAK,GAAG;GACpB,IAAI,KAAK,YAAY,OACpB,YAAiB,KAAK,GAAG,CAAC,CAAC,OAAO,UAAU;IAC3C,QAAQ,KAAK,2BAA2B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG;GACjG,CAAC;EAEH;EACA,UAAU,OAAO,WAAW,WAAW,OAAO,OAAO;CACtD,CAAC;CAED,QAAQ,IAAI,qCAAqC,QAAQ,MAAM;CAC/D,iBAAiB,aAAa,IAAI;AACnC;;;ACnIA,MAAM,MAAM,MAAM,QAAQ,QAAQ,IAAI,CAAC,CAAC,CACtC,WAAW,OAAO,CAAC,CACnB,KAAK,GAAG,CAAC,CACT,KAAK,QAAQ,WAAW,CAAC,CACzB,MAAM,QAAQ,GAAG,CAAC,CAClB,QAAQ,WAAW,uBAAuBA,OAAW,CAAC,CACtD,MAAM,WAAW,GAAG,CAAC,CACrB,QAAQ,eAAe,CAAC,CACxB,QAAQ;CD8HT,SAAS;CACT,UAAU;CACV,UAAU,UACT,MACE,OAAO,gBAAgB;EACvB,MAAM;EACN,UAAU;CACX,CAAC,CAAC,CACD,OAAO,aAAa;EACpB,MAAM;EACN,UAAU;CACX,CAAC,CAAC,CACD,OAAO,WAAW;EAClB,MAAM;EACN,SAAS;EACT,UAAU;CACX,CAAC,CAAC,CACD,OAAO,UAAU;EACjB,MAAM;EACN,SAAS;EACT,UAAU;CACX,CAAC,CAAC,CACD,OAAO,cAAc;EACrB,MAAM;EACN,SAAS;EACT,UAAU;CACX,CAAC,CAAC,CACD,OAAO,UAAU;EACjB,MAAM;EACN,UAAU;CACX,CAAC,CAAC,CACD,OAAO,WAAW;EAClB,MAAM;EACN,UAAU;CACX,CAAC,CAAC,CACD,OAAO,UAAU;EACjB,MAAM;EACN,UAAU;CACX,CAAC,CAAC,CACD,OAAO,QAAQ;EACf,MAAM;EACN,UAAU;CACX,CAAC,CAAC,CACD,OAAO,iBAAiB;EACxB,MAAM;EACN,UAAU;CACX,CAAC,CAAC,CACD,OAAO,SAAS;EAChB,IAAI,CAAC,KAAK,aAAa,MAAM,IAAI,MAAM,2DAA2D;EAElG,IADgB;GAAC,KAAK;GAAQ,KAAK;GAAS,KAAK;EAAM,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,SAC3D,GAAG,MAAM,IAAI,MAAM,qDAAqD;EACtF,OAAO;CACR,CAAC;CACH,SAAS,OAAO,SAAS;EACxB,MAAM,mBAAmB,IAAI;CAC9B;ACrLS,CAAY,CAAC,CACrB,cAAc,GAAG,kBAAkB,CAAC,CACpC,OAAO,CAAC,CACR,MAAM,SAAS,UAAU;CACzB,IAAI,OAAO,MAAM;CACjB,IAAI,SAAS,MAAM,IAAI,MAAM,OAAO;AACrC,CAAC;AAEF,IAAI;CACH,MAAM,IAAI,MAAM;AACjB,SAAS,OAAO;CACf,QAAQ,WAAW;CACnB,QAAQ,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AACrE"}
+{"version":3,"file":"cli.mjs","names":["pkg.version"],"sources":["../../package.json","../../src/cli/oauth.ts","../../src/cli.ts"],"sourcesContent":["","import type { CommandModule } from \"yargs\";\nimport {\n\tGitHubCopilotOAuthClient,\n\ttype GitHubCopilotOAuthCredentials,\n\tJsonGitHubCopilotAuthStorage,\n} from \"../oauth/github/copilot.ts\";\nimport {\n\tJsonOpenAICodexAuthStorage,\n\tOpenAICodexOAuthClient,\n\ttype OpenAICodexOAuthCredentials,\n} from \"../oauth/openai/codex.ts\";\nimport { openBrowser, promptLine } from \"../oauth/interactive.ts\";\nimport {\n\tcheckOAuthProvider,\n\tformatOAuthSummary,\n\toauthLoginIssue,\n\toauthRefreshIssue,\n\toauthNotice,\n\tsummarizeGitHubCopilot,\n\tsummarizeOpenAICodex,\n} from \"../oauth/summary.ts\";\n\n// `?: T | undefined` rather than plain `?: T`: yargs hands these through as explicit `undefined`,\n// which a bare optional property no longer accepts under `exactOptionalPropertyTypes`.\ntype AuthArgs = {\n\topenaiCodex?: boolean | undefined;\n\tgithubCopilot?: boolean | undefined;\n\tauthFile?: string | undefined;\n\tbrowser?: boolean | undefined;\n\tdevice?: boolean | undefined;\n\tstatus?: boolean | undefined;\n\trefresh?: boolean | undefined;\n\tlogout?: boolean | undefined;\n\tjson?: boolean | undefined;\n\tenterprise?: string | undefined;\n\tenableModels?: boolean | undefined;\n};\n\nasync function runOpenAICodexAuth(args: AuthArgs): Promise<void> {\n\tconst storage = new JsonOpenAICodexAuthStorage({\n\t\t...(args.authFile !== undefined && { path: args.authFile }),\n\t});\n\tconst client = new OpenAICodexOAuthClient({ storage });\n\n\tconst show = (credentials: OpenAICodexOAuthCredentials) =>\n\t\tprocess.stdout.write(formatOAuthSummary(summarizeOpenAICodex(credentials), { json: args.json === true }));\n\n\tif (args.logout) {\n\t\tawait client.logout();\n\t\tconsole.warn(oauthNotice(\"cleared\", \"openai-codex\", storage.path));\n\t\treturn;\n\t}\n\n\tif (args.status || args.refresh) {\n\t\t// --status is a read: asking the client for headers would refresh behind it.\n\t\tconst credentials = args.refresh ? await client.getCredentials() : await storage.get();\n\t\tif (!credentials) {\n\t\t\tconsole.error(oauthNotice(\"missing\", \"openai-codex\", storage.path));\n\t\t\tprocess.exitCode = 1;\n\t\t\treturn;\n\t\t}\n\t\tif (args.refresh) console.warn(oauthNotice(\"refreshed\", \"openai-codex\", storage.path));\n\t\tshow(credentials);\n\t\treturn;\n\t}\n\n\tconst credentials = await client.login({\n\t\tdevice: args.device === true,\n\t\t// stderr, so `--json` stdout stays parseable.\n\t\tonAuth: (info) => {\n\t\t\tconsole.warn(info.instructions ?? \"Complete OpenAI Codex authentication in your browser.\");\n\t\t\tif (info.userCode) console.warn(`Enter code: ${info.userCode}`);\n\t\t\tconsole.warn(info.url);\n\t\t\tif (args.browser !== false) {\n\t\t\t\tvoid openBrowser(info.url, (error) => console.warn(`Failed to open browser: ${error.message}`));\n\t\t\t}\n\t\t},\n\t\tonProgress: (message) => console.warn(message),\n\t\tonPrompt: async (prompt) => promptLine(prompt.message),\n\t});\n\n\tconsole.warn(oauthNotice(\"saved\", \"openai-codex\", storage.path));\n\tshow(credentials);\n}\n\nasync function runGitHubCopilotAuth(args: AuthArgs): Promise<void> {\n\tconst storage = new JsonGitHubCopilotAuthStorage({\n\t\t...(args.authFile !== undefined && { path: args.authFile }),\n\t});\n\tconst client = new GitHubCopilotOAuthClient({ storage });\n\n\tconst show = (credentials: GitHubCopilotOAuthCredentials) =>\n\t\tprocess.stdout.write(formatOAuthSummary(summarizeGitHubCopilot(credentials), { json: args.json === true }));\n\n\tif (args.logout) {\n\t\tawait client.logout();\n\t\tconsole.warn(oauthNotice(\"cleared\", \"github-copilot\", storage.path));\n\t\treturn;\n\t}\n\n\tif (args.status) {\n\t\tconst credentials = await storage.get();\n\t\tif (!credentials) {\n\t\t\tconsole.error(oauthNotice(\"missing\", \"github-copilot\", storage.path));\n\t\t\tprocess.exitCode = 1;\n\t\t\treturn;\n\t\t}\n\t\tshow(credentials);\n\t\treturn;\n\t}\n\n\t// GitHub OAuth tokens never expire; there is no refresh path.\n\tconst credentials = await client.login({\n\t\t...(args.enterprise !== undefined && { enterpriseUrl: args.enterprise }),\n\t\tenableModels: args.enableModels === true,\n\t\t// stderr, so `--json` stdout stays parseable.\n\t\tonAuth: (info) => {\n\t\t\tconsole.warn(info.instructions ?? \"Complete GitHub Copilot authentication in your browser.\");\n\t\t\tconsole.warn(`Enter code: ${info.userCode}`);\n\t\t\tconsole.warn(info.url);\n\t\t\tif (args.browser !== false) {\n\t\t\t\tvoid openBrowser(info.url, (error) => console.warn(`Failed to open browser: ${error.message}`));\n\t\t\t}\n\t\t},\n\t\tonProgress: (message) => console.warn(message),\n\t});\n\n\tconsole.warn(oauthNotice(\"saved\", \"github-copilot\", storage.path));\n\tshow(credentials);\n}\n\nexport const OAuthCommand: CommandModule<object, AuthArgs> = {\n\tcommand: \"auth\",\n\tdescribe: \"manage OAuth credentials\",\n\tbuilder: (yargs) =>\n\t\tyargs\n\t\t\t.option(\"openai-codex\", {\n\t\t\t\ttype: \"boolean\",\n\t\t\t\tdescribe: \"use OpenAI Codex OAuth\",\n\t\t\t})\n\t\t\t.option(\"github-copilot\", {\n\t\t\t\ttype: \"boolean\",\n\t\t\t\tdescribe: \"use GitHub Copilot OAuth (device flow)\",\n\t\t\t})\n\t\t\t.option(\"enterprise\", {\n\t\t\t\ttype: \"string\",\n\t\t\t\tdescribe: \"GitHub Enterprise domain for GitHub Copilot login\",\n\t\t\t})\n\t\t\t.option(\"enable-models\", {\n\t\t\t\ttype: \"boolean\",\n\t\t\t\tdescribe: \"enable unconfigured Copilot catalog models after login\",\n\t\t\t})\n\t\t\t.option(\"auth-file\", {\n\t\t\t\ttype: \"string\",\n\t\t\t\tdescribe: \"path to auth.json (defaults to CODEWORK_CREDENTIALS or ~/.codework/aikit/auth.json)\",\n\t\t\t})\n\t\t\t.option(\"browser\", {\n\t\t\t\ttype: \"boolean\",\n\t\t\t\tdefault: true,\n\t\t\t\tdescribe: \"open the authorization URL in the default browser\",\n\t\t\t})\n\t\t\t.option(\"device\", {\n\t\t\t\ttype: \"boolean\",\n\t\t\t\tdefault: false,\n\t\t\t\tdescribe: \"use the device-code flow instead of a localhost browser callback\",\n\t\t\t})\n\t\t\t.option(\"status\", {\n\t\t\t\ttype: \"boolean\",\n\t\t\t\tdescribe: \"show stored credential status without refreshing\",\n\t\t\t})\n\t\t\t.option(\"refresh\", {\n\t\t\t\ttype: \"boolean\",\n\t\t\t\tdescribe: \"refresh stored credentials if expired\",\n\t\t\t})\n\t\t\t.option(\"logout\", {\n\t\t\t\ttype: \"boolean\",\n\t\t\t\tdescribe: \"clear stored credentials\",\n\t\t\t})\n\t\t\t.option(\"json\", {\n\t\t\t\ttype: \"boolean\",\n\t\t\t\tdescribe: \"print machine-readable output\",\n\t\t\t})\n\t\t\t// yargs types this callback with the kebab-case keys, so read those.\n\t\t\t.check((args) => {\n\t\t\t\tconst checked = checkOAuthProvider({\n\t\t\t\t\topenaiCodex: args[\"openai-codex\"],\n\t\t\t\t\tgithubCopilot: args[\"github-copilot\"],\n\t\t\t\t});\n\t\t\t\tif (!checked.ok) throw new Error(checked.message);\n\t\t\t\tif ([args.status, args.refresh, args.logout].filter(Boolean).length > 1) {\n\t\t\t\t\tthrow new Error(\"choose only one of --status, --refresh, or --logout\");\n\t\t\t\t}\n\t\t\t\tconst issue =\n\t\t\t\t\toauthLoginIssue(checked.provider, {\n\t\t\t\t\t\tdevice: args.device,\n\t\t\t\t\t\tenterprise: args.enterprise,\n\t\t\t\t\t\tenableModels: args[\"enable-models\"],\n\t\t\t\t\t}) ?? (args.refresh ? oauthRefreshIssue(checked.provider) : undefined);\n\t\t\t\tif (issue) throw new Error(issue);\n\t\t\t\treturn true;\n\t\t\t}),\n\thandler: async (args) => {\n\t\tif (args.githubCopilot) {\n\t\t\tawait runGitHubCopilotAuth(args);\n\t\t\treturn;\n\t\t}\n\t\tawait runOpenAICodexAuth(args);\n\t},\n};\n","#!/usr/bin/env node\nimport pkg from \"../package.json\" with { type: \"json\" };\nimport yargs from \"yargs\";\nimport { hideBin } from \"yargs/helpers\";\nimport { ModelgenCommand } from \"./cli/modelgen.ts\";\nimport { OAuthCommand } from \"./cli/oauth.ts\";\n\nconst cli = yargs(hideBin(process.argv))\n\t.scriptName(\"aikit\")\n\t.wrap(100)\n\t.help(\"help\", \"show help\")\n\t.alias(\"help\", \"h\")\n\t.version(\"version\", \"show version number\", pkg.version)\n\t.alias(\"version\", \"v\")\n\t.command(ModelgenCommand)\n\t.command(OAuthCommand)\n\t.demandCommand(1, \"Choose a command\")\n\t.strict()\n\t.fail((message, error) => {\n\t\tif (error) throw error;\n\t\tif (message) throw new Error(message);\n\t});\n\ntry {\n\tawait cli.parse();\n} catch (error) {\n\tprocess.exitCode = 1;\n\tconsole.error(error instanceof Error ? error.message : String(error));\n}\n"],"mappings":";;;;;;;;;;;;ACsCA,eAAe,mBAAmB,MAA+B;CAChE,MAAM,UAAU,IAAI,2BAA2B,EAC9C,GAAI,KAAK,aAAa,KAAA,KAAa,EAAE,MAAM,KAAK,SAAS,EAC1D,CAAC;CACD,MAAM,SAAS,IAAI,uBAAuB,EAAE,QAAQ,CAAC;CAErD,MAAM,QAAQ,gBACb,QAAQ,OAAO,MAAM,mBAAmB,qBAAqB,WAAW,GAAG,EAAE,MAAM,KAAK,SAAS,KAAK,CAAC,CAAC;CAEzG,IAAI,KAAK,QAAQ;EAChB,MAAM,OAAO,OAAO;EACpB,QAAQ,KAAK,YAAY,WAAW,gBAAgB,QAAQ,IAAI,CAAC;EACjE;CACD;CAEA,IAAI,KAAK,UAAU,KAAK,SAAS;EAEhC,MAAM,cAAc,KAAK,UAAU,MAAM,OAAO,eAAe,IAAI,MAAM,QAAQ,IAAI;EACrF,IAAI,CAAC,aAAa;GACjB,QAAQ,MAAM,YAAY,WAAW,gBAAgB,QAAQ,IAAI,CAAC;GAClE,QAAQ,WAAW;GACnB;EACD;EACA,IAAI,KAAK,SAAS,QAAQ,KAAK,YAAY,aAAa,gBAAgB,QAAQ,IAAI,CAAC;EACrF,KAAK,WAAW;EAChB;CACD;CAEA,MAAM,cAAc,MAAM,OAAO,MAAM;EACtC,QAAQ,KAAK,WAAW;EAExB,SAAS,SAAS;GACjB,QAAQ,KAAK,KAAK,gBAAgB,uDAAuD;GACzF,IAAI,KAAK,UAAU,QAAQ,KAAK,eAAe,KAAK,UAAU;GAC9D,QAAQ,KAAK,KAAK,GAAG;GACrB,IAAI,KAAK,YAAY,OACpB,YAAiB,KAAK,MAAM,UAAU,QAAQ,KAAK,2BAA2B,MAAM,SAAS,CAAC;EAEhG;EACA,aAAa,YAAY,QAAQ,KAAK,OAAO;EAC7C,UAAU,OAAO,WAAW,WAAW,OAAO,OAAO;CACtD,CAAC;CAED,QAAQ,KAAK,YAAY,SAAS,gBAAgB,QAAQ,IAAI,CAAC;CAC/D,KAAK,WAAW;AACjB;AAEA,eAAe,qBAAqB,MAA+B;CAClE,MAAM,UAAU,IAAI,6BAA6B,EAChD,GAAI,KAAK,aAAa,KAAA,KAAa,EAAE,MAAM,KAAK,SAAS,EAC1D,CAAC;CACD,MAAM,SAAS,IAAI,yBAAyB,EAAE,QAAQ,CAAC;CAEvD,MAAM,QAAQ,gBACb,QAAQ,OAAO,MAAM,mBAAmB,uBAAuB,WAAW,GAAG,EAAE,MAAM,KAAK,SAAS,KAAK,CAAC,CAAC;CAE3G,IAAI,KAAK,QAAQ;EAChB,MAAM,OAAO,OAAO;EACpB,QAAQ,KAAK,YAAY,WAAW,kBAAkB,QAAQ,IAAI,CAAC;EACnE;CACD;CAEA,IAAI,KAAK,QAAQ;EAChB,MAAM,cAAc,MAAM,QAAQ,IAAI;EACtC,IAAI,CAAC,aAAa;GACjB,QAAQ,MAAM,YAAY,WAAW,kBAAkB,QAAQ,IAAI,CAAC;GACpE,QAAQ,WAAW;GACnB;EACD;EACA,KAAK,WAAW;EAChB;CACD;CAGA,MAAM,cAAc,MAAM,OAAO,MAAM;EACtC,GAAI,KAAK,eAAe,KAAA,KAAa,EAAE,eAAe,KAAK,WAAW;EACtE,cAAc,KAAK,iBAAiB;EAEpC,SAAS,SAAS;GACjB,QAAQ,KAAK,KAAK,gBAAgB,yDAAyD;GAC3F,QAAQ,KAAK,eAAe,KAAK,UAAU;GAC3C,QAAQ,KAAK,KAAK,GAAG;GACrB,IAAI,KAAK,YAAY,OACpB,YAAiB,KAAK,MAAM,UAAU,QAAQ,KAAK,2BAA2B,MAAM,SAAS,CAAC;EAEhG;EACA,aAAa,YAAY,QAAQ,KAAK,OAAO;CAC9C,CAAC;CAED,QAAQ,KAAK,YAAY,SAAS,kBAAkB,QAAQ,IAAI,CAAC;CACjE,KAAK,WAAW;AACjB;;;AC1HA,MAAM,MAAM,MAAM,QAAQ,QAAQ,IAAI,CAAC,CAAC,CACtC,WAAW,OAAO,CAAC,CACnB,KAAK,GAAG,CAAC,CACT,KAAK,QAAQ,WAAW,CAAC,CACzB,MAAM,QAAQ,GAAG,CAAC,CAClB,QAAQ,WAAW,uBAAuBA,OAAW,CAAC,CACtD,MAAM,WAAW,GAAG,CAAC,CACrB,QAAQ,eAAe,CAAC,CACxB,QAAQ;CDqHT,SAAS;CACT,UAAU;CACV,UAAU,UACT,MACE,OAAO,gBAAgB;EACvB,MAAM;EACN,UAAU;CACX,CAAC,CAAC,CACD,OAAO,kBAAkB;EACzB,MAAM;EACN,UAAU;CACX,CAAC,CAAC,CACD,OAAO,cAAc;EACrB,MAAM;EACN,UAAU;CACX,CAAC,CAAC,CACD,OAAO,iBAAiB;EACxB,MAAM;EACN,UAAU;CACX,CAAC,CAAC,CACD,OAAO,aAAa;EACpB,MAAM;EACN,UAAU;CACX,CAAC,CAAC,CACD,OAAO,WAAW;EAClB,MAAM;EACN,SAAS;EACT,UAAU;CACX,CAAC,CAAC,CACD,OAAO,UAAU;EACjB,MAAM;EACN,SAAS;EACT,UAAU;CACX,CAAC,CAAC,CACD,OAAO,UAAU;EACjB,MAAM;EACN,UAAU;CACX,CAAC,CAAC,CACD,OAAO,WAAW;EAClB,MAAM;EACN,UAAU;CACX,CAAC,CAAC,CACD,OAAO,UAAU;EACjB,MAAM;EACN,UAAU;CACX,CAAC,CAAC,CACD,OAAO,QAAQ;EACf,MAAM;EACN,UAAU;CACX,CAAC,CAAC,CAED,OAAO,SAAS;EAChB,MAAM,UAAU,mBAAmB;GAClC,aAAa,KAAK;GAClB,eAAe,KAAK;EACrB,CAAC;EACD,IAAI,CAAC,QAAQ,IAAI,MAAM,IAAI,MAAM,QAAQ,OAAO;EAChD,IAAI;GAAC,KAAK;GAAQ,KAAK;GAAS,KAAK;EAAM,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,SAAS,GACrE,MAAM,IAAI,MAAM,qDAAqD;EAEtE,MAAM,QACL,gBAAgB,QAAQ,UAAU;GACjC,QAAQ,KAAK;GACb,YAAY,KAAK;GACjB,cAAc,KAAK;EACpB,CAAC,MAAM,KAAK,UAAU,kBAAkB,QAAQ,QAAQ,IAAI,KAAA;EAC7D,IAAI,OAAO,MAAM,IAAI,MAAM,KAAK;EAChC,OAAO;CACR,CAAC;CACH,SAAS,OAAO,SAAS;EACxB,IAAI,KAAK,eAAe;GACvB,MAAM,qBAAqB,IAAI;GAC/B;EACD;EACA,MAAM,mBAAmB,IAAI;CAC9B;AChMS,CAAY,CAAC,CACrB,cAAc,GAAG,kBAAkB,CAAC,CACpC,OAAO,CAAC,CACR,MAAM,SAAS,UAAU;CACzB,IAAI,OAAO,MAAM;CACjB,IAAI,SAAS,MAAM,IAAI,MAAM,OAAO;AACrC,CAAC;AAEF,IAAI;CACH,MAAM,IAAI,MAAM;AACjB,SAAS,OAAO;CACf,QAAQ,WAAW;CACnB,QAAQ,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AACrE"}

package/{codex-MtP1574D.mjs → codex-CLDBTrFm.mjs}

@@ -1,3 +1,4 @@
+import { i as pollDeviceCode, n as isObject, r as readEnv, t as JsonAuthStorage } from "./storage-v6qjTQ0v.mjs";
 import dedent from "dedent";
 //#region src/oauth/openai/codex.ts
 /**
@@ -18,47 +19,20 @@ import dedent from "dedent";
 * not exported.
 */
 const CODEWORK_OAUTH_CALLBACK_HOST = "CODEWORK_OAUTH_CALLBACK_HOST";
-const CODEWORK_CREDENTIALS = "CODEWORK_CREDENTIALS";
-const CODEWORK_HOME_DIR = "CODEWORK_HOME_DIR";
 const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 const AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize";
 const TOKEN_URL = "https://auth.openai.com/oauth/token";
 const DEFAULT_REDIRECT_URI = "http://localhost:1455/auth/callback";
+const DEVICE_USER_CODE_URL = "https://auth.openai.com/api/accounts/deviceauth/usercode";
+const DEVICE_TOKEN_URL = "https://auth.openai.com/api/accounts/deviceauth/token";
+const DEVICE_VERIFICATION_URI = "https://auth.openai.com/codex/device";
+const DEVICE_REDIRECT_URI = "https://auth.openai.com/deviceauth/callback";
+const DEVICE_TIMEOUT_SECONDS = 900;
 const DEFAULT_SCOPE = "openid profile email offline_access";
 const DEFAULT_ORIGINATOR = "codework";
 const DEFAULT_PROVIDER_ID = "openai-codex";
 const JWT_CLAIM_PATH = "https://api.openai.com/auth";
 const REFRESH_SKEW_MS = 6e4;
-function readEnv(name) {
-	if (typeof process === "undefined") return void 0;
-	return process.env[name];
-}
-function joinPath(...parts) {
-	return parts.filter(Boolean).join("/").replaceAll(/\/+/g, "/");
-}
-function expandHome(path) {
-	if (path === "~") return homeDirectory();
-	if (path.startsWith("~/")) return joinPath(homeDirectory(), path.slice(2));
-	return path;
-}
-function homeDirectory() {
-	const home = readEnv("HOME") ?? readEnv("USERPROFILE");
-	if (!home) throw new Error("unable to resolve home directory for OpenAI Codex auth storage");
-	return home;
-}
-function codeworkHomeDirectory() {
-	const override = readEnv(CODEWORK_HOME_DIR);
-	if (override) return expandHome(override);
-	return joinPath(homeDirectory(), ".codework");
-}
-function defaultOpenAICodexAuthFilePath() {
-	const authFile = readEnv(CODEWORK_CREDENTIALS);
-	if (authFile) return expandHome(authFile);
-	return joinPath(codeworkHomeDirectory(), "aikit", "auth.json");
-}
-function isObject(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function isOpenAICodexCredentials(value) {
 	if (!isObject(value)) return false;
 	return typeof value.access === "string" && typeof value.refresh === "string" && typeof value.expires === "number" && typeof value.accountId === "string";
@@ -283,7 +257,9 @@ function oauthErrorHtml(message, details) {
 		...details !== void 0 && { details }
 	});
 }
-async function startLocalOAuthServer(state) {
+async function startLocalOAuthServer(state, redirectUri) {
+	const callback = new URL(redirectUri);
+	const port = Number(callback.port || (callback.protocol === "https:" ? 443 : 80));
 	const http = await import("node:http").catch(() => void 0);
 	if (!http) throw new Error("openAI codex OAuth callback server is only available in Node.js environments");
 	let settleWait;
@@ -298,7 +274,7 @@ async function startLocalOAuthServer(state) {
 	const server = http.createServer((req, res) => {
 		try {
 			const url = new URL(req.url || "", "http://localhost");
-			if (url.pathname !== "/auth/callback") {
+			if (url.pathname !== callback.pathname) {
 				res.statusCode = 404;
 				res.setHeader("Content-Type", "text/html; charset=utf-8");
 				res.end(oauthErrorHtml("Callback route not found."));
@@ -335,84 +311,139 @@ async function startLocalOAuthServer(state) {
 		});
 	};
 	return new Promise((resolve) => {
-		server.listen(1455, readEnv(CODEWORK_OAUTH_CALLBACK_HOST) || "127.0.0.1", () => {
+		server.listen(port, readEnv(CODEWORK_OAUTH_CALLBACK_HOST) || "127.0.0.1", () => {
 			resolve({
 				close,
-				cancelWait: () => {
-					settleWait?.(null);
-				},
 				waitForCode: () => waitForCodePromise
 			});
-		}).on("error", () => {
+		}).on("error", (error) => {
 			settleWait?.(null);
 			resolve({
 				close,
-				cancelWait: () => {},
-				waitForCode: async () => null
+				waitForCode: async () => null,
+				listenError: error
 			});
 		});
 	});
 }
 async function loginOpenAICodex(options) {
+	if (options.device) return loginOpenAICodexDeviceCode(options);
 	const flow = await createOpenAICodexAuthorizationFlow(options);
-	const server = await startLocalOAuthServer(flow.state);
+	const server = await startLocalOAuthServer(flow.state, flow.redirectUri);
 	options.onAuth({
 		url: flow.url,
 		instructions: "Complete the browser login to finish OpenAI Codex authentication."
 	});
+	if (server.listenError) options.onProgress?.(`Could not listen on ${flow.redirectUri}: ${server.listenError.message}. Another sign-in is probably already running on that port and would receive the callback. Finish the login in the browser, then paste the redirect URL here.`);
 	let code;
 	try {
-		if (options.onManualCodeInput) {
-			let manualCode;
-			let manualError;
-			const manualPromise = options.onManualCodeInput().then((input) => {
-				manualCode = input;
-				if (input.trim()) server.cancelWait();
-			}).catch((error) => {
-				manualError = error instanceof Error ? error : new Error(String(error));
-				server.cancelWait();
-			});
-			const result = await server.waitForCode();
-			if (manualError) throw manualError;
-			if (result?.code) code = result.code;
-			else if (manualCode) {
-				const parsed = parseOpenAICodexAuthorizationInput(manualCode);
-				if (parsed.state && parsed.state !== flow.state) throw new Error("state mismatch");
-				code = parsed.code;
-			}
-			if (!code) {
-				await manualPromise;
-				if (manualError) throw manualError;
-				if (manualCode) {
-					const parsed = parseOpenAICodexAuthorizationInput(manualCode);
-					if (parsed.state && parsed.state !== flow.state) throw new Error("state mismatch");
-					code = parsed.code;
-				}
-			}
-		} else {
-			const result = await server.waitForCode();
-			if (result?.code) code = result.code;
-		}
+		const result = await server.waitForCode();
+		if (result?.code) code = result.code;
 		if (!code) {
 			const parsed = parseOpenAICodexAuthorizationInput(await options.onPrompt({ message: "Paste the authorization code or full redirect URL:" }));
 			if (parsed.state && parsed.state !== flow.state) throw new Error("state mismatch");
 			code = parsed.code;
 		}
 		if (!code) throw new Error("missing authorization code");
-		const tokenResult = await exchangeOpenAICodexAuthorizationCode(code, flow.verifier, flow.redirectUri);
-		if (tokenResult.type !== "success") throw new Error(tokenResult.message);
-		const accountId = getOpenAICodexAccountId(tokenResult.access);
-		if (!accountId) throw new Error("failed to extract accountId from token");
-		return {
-			access: tokenResult.access,
-			refresh: tokenResult.refresh,
-			expires: tokenResult.expires,
-			accountId
-		};
+		return await credentialsFromCode(code, flow.verifier, flow.redirectUri);
 	} finally {
 		await server.close();
 	}
 }
+/** The step both flows share: redeem the code, then read the account off the JWT. */
+async function credentialsFromCode(code, verifier, redirectUri) {
+	const tokenResult = await exchangeOpenAICodexAuthorizationCode(code, verifier, redirectUri);
+	if (tokenResult.type !== "success") throw new Error(tokenResult.message);
+	const accountId = getOpenAICodexAccountId(tokenResult.access);
+	if (!accountId) throw new Error("failed to extract accountId from token");
+	return {
+		access: tokenResult.access,
+		refresh: tokenResult.refresh,
+		expires: tokenResult.expires,
+		accountId
+	};
+}
+/** Ask for a user code to type at {@link DEVICE_VERIFICATION_URI}. */
+async function createOpenAICodexDeviceAuth(options = {}) {
+	const response = await fetch(DEVICE_USER_CODE_URL, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({ client_id: CLIENT_ID }),
+		signal: options.signal ?? null
+	});
+	if (!response.ok) {
+		if (response.status === 404) throw new Error("OpenAI Codex device code login is not available for this account. Use the browser login instead.");
+		const body = await response.text().catch(() => "");
+		throw new Error(`OpenAI Codex device code request failed (${response.status})${body ? `: ${redactOAuthSecrets(body)}` : ""}`);
+	}
+	const data = await response.json();
+	if (!isObject(data)) throw new Error("Invalid OpenAI Codex device code response");
+	const interval = typeof data.interval === "string" ? Number(data.interval.trim()) : data.interval;
+	if (typeof data.device_auth_id !== "string" || typeof data.user_code !== "string" || typeof interval !== "number" || !Number.isFinite(interval) || interval < 0) throw new Error("Invalid OpenAI Codex device code response fields");
+	return {
+		deviceAuthId: data.device_auth_id,
+		userCode: data.user_code,
+		verificationUri: DEVICE_VERIFICATION_URI,
+		intervalSeconds: interval
+	};
+}
+/** Wait for the code to be approved; the server returns the code and its verifier. */
+async function pollOpenAICodexDeviceAuth(device, options = {}) {
+	return pollDeviceCode({
+		intervalSeconds: device.intervalSeconds,
+		expiresInSeconds: DEVICE_TIMEOUT_SECONDS,
+		...options.signal !== void 0 && { signal: options.signal },
+		poll: async () => {
+			const response = await fetch(DEVICE_TOKEN_URL, {
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify({
+					device_auth_id: device.deviceAuthId,
+					user_code: device.userCode
+				}),
+				signal: options.signal ?? null
+			});
+			if (response.ok) {
+				const data = await response.json();
+				if (!isObject(data) || typeof data.authorization_code !== "string" || typeof data.code_verifier !== "string") return {
+					status: "failed",
+					message: "Invalid OpenAI Codex device auth token response"
+				};
+				return {
+					status: "complete",
+					value: {
+						authorizationCode: data.authorization_code,
+						codeVerifier: data.code_verifier
+					}
+				};
+			}
+			if (response.status === 403 || response.status === 404) return { status: "pending" };
+			const body = await response.text().catch(() => "");
+			let errorCode;
+			try {
+				const parsed = JSON.parse(body);
+				const error = isObject(parsed) ? parsed.error : void 0;
+				errorCode = isObject(error) ? error.code : error;
+			} catch {}
+			if (errorCode === "deviceauth_authorization_pending") return { status: "pending" };
+			if (errorCode === "slow_down") return { status: "slow_down" };
+			return {
+				status: "failed",
+				message: `OpenAI Codex device authorization failed (${response.status})${body ? `: ${redactOAuthSecrets(body)}` : ""}`
+			};
+		}
+	});
+}
+async function loginOpenAICodexDeviceCode(options) {
+	const device = await createOpenAICodexDeviceAuth(options);
+	options.onAuth({
+		url: device.verificationUri,
+		userCode: device.userCode,
+		instructions: "Open the URL and enter the code to finish OpenAI Codex authentication."
+	});
+	const { authorizationCode, codeVerifier } = await pollOpenAICodexDeviceAuth(device, options);
+	return credentialsFromCode(authorizationCode, codeVerifier, DEVICE_REDIRECT_URI);
+}
 async function refreshOpenAICodexToken(refreshToken) {
 	const result = await refreshAccessToken(refreshToken);
 	if (result.type !== "success") throw new Error(result.message);
@@ -433,61 +464,28 @@ function openAICodexHeaders(credentials) {
 	};
 }
 var JsonOpenAICodexAuthStorage = class {
-	path;
-	providerId;
+	storage;
 	constructor(options = {}) {
-		this.path = options.path ? expandHome(options.path) : defaultOpenAICodexAuthFilePath();
-		this.providerId = options.providerId ?? DEFAULT_PROVIDER_ID;
+		this.storage = new JsonAuthStorage({
+			providerId: options.providerId ?? DEFAULT_PROVIDER_ID,
+			isCredentials: isOpenAICodexCredentials,
+			...options.path !== void 0 && { path: options.path }
+		});
 	}
-	async get() {
-		const file = await this.readFile();
-		if (!file) return void 0;
-		if (isOpenAICodexCredentials(file)) return file;
-		const direct = file[this.providerId];
-		if (isOpenAICodexCredentials(direct)) return direct;
-		const providers = file.providers;
-		if (isObject(providers) && isOpenAICodexCredentials(providers[this.providerId])) return providers[this.providerId];
+	get path() {
+		return this.storage.path;
 	}
-	async set(credentials) {
-		const current = await this.readFile();
-		const next = isObject(current) && !isOpenAICodexCredentials(current) ? current : {};
-		next[this.providerId] = credentials;
-		await this.writeFile(next);
+	get providerId() {
+		return this.storage.providerId;
 	}
-	async clear() {
-		const current = await this.readFile();
-		if (!current) return;
-		if (isOpenAICodexCredentials(current)) {
-			await this.writeFile({});
-			return;
-		}
-		delete current[this.providerId];
-		const providers = current.providers;
-		if (isObject(providers)) delete providers[this.providerId];
-		await this.writeFile(current);
+	get() {
+		return this.storage.get();
 	}
-	async readFile() {
-		const fs = await import("node:fs/promises");
-		try {
-			const text = await fs.readFile(this.path, "utf8");
-			const parsed = JSON.parse(text);
-			return isObject(parsed) ? parsed : void 0;
-		} catch (error) {
-			if (isObject(error) && error.code === "ENOENT") return void 0;
-			throw error;
-		}
+	set(credentials) {
+		return this.storage.set(credentials);
 	}
-	async writeFile(value) {
-		const fs = await import("node:fs/promises");
-		const path = await import("node:path");
-		await fs.mkdir(path.dirname(this.path), { recursive: true });
-		const tempPath = `${this.path}.${process.pid}.${Date.now()}.tmp`;
-		await fs.writeFile(tempPath, `${JSON.stringify(value, null, "	")}\n`, {
-			encoding: "utf8",
-			mode: 384
-		});
-		await fs.chmod(tempPath, 384);
-		await fs.rename(tempPath, this.path);
+	clear() {
+		return this.storage.clear();
 	}
 };
 var OpenAICodexOAuthClient = class {
@@ -536,6 +534,6 @@ async function getOpenAICodexApiKey(options = {}) {
 	return new OpenAICodexOAuthClient(options).getApiKey();
 }
 //#endregion
-export { exchangeOpenAICodexAuthorizationCode as a, openAICodexHeaders as c, createOpenAICodexAuthorizationFlow as i, parseOpenAICodexAuthorizationInput as l, OPENAI_CODEX_API_KEY_ENV as n, getOpenAICodexAccountId as o, OpenAICodexOAuthClient as r, getOpenAICodexApiKey as s, JsonOpenAICodexAuthStorage as t, refreshOpenAICodexToken as u };
+export { createOpenAICodexDeviceAuth as a, getOpenAICodexApiKey as c, pollOpenAICodexDeviceAuth as d, refreshOpenAICodexToken as f, createOpenAICodexAuthorizationFlow as i, openAICodexHeaders as l, OPENAI_CODEX_API_KEY_ENV as n, exchangeOpenAICodexAuthorizationCode as o, OpenAICodexOAuthClient as r, getOpenAICodexAccountId as s, JsonOpenAICodexAuthStorage as t, parseOpenAICodexAuthorizationInput as u };
 
-//# sourceMappingURL=codex-MtP1574D.mjs.map
+//# sourceMappingURL=codex-CLDBTrFm.mjs.map