@cortexkit/opencode-openai-auth 0.3.3 → 0.4.0

package/src/tui-compiled/logger.ts

@@ -0,0 +1,161 @@
+import {
+  appendFileSync,
+  chmodSync,
+  existsSync,
+  renameSync,
+  statSync,
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+type Level = 'error' | 'warn' | 'info' | 'debug' | 'trace'
+const ORDER: Record<Level, number> = {
+  error: 0,
+  warn: 1,
+  info: 2,
+  debug: 3,
+  trace: 4,
+}
+const isTestEnv = process.env.NODE_ENV === 'test'
+const MAX_BYTES = 5 * 1024 * 1024
+
+function logFile(): string {
+  return (
+    process.env.OPENCODE_OPENAI_AUTH_LOG_FILE ??
+    join(tmpdir(), 'opencode-openai-auth.log')
+  )
+}
+let runtimeLevel: Level | undefined
+export function setLogLevel(l: Level | undefined) {
+  if (l === undefined || l in ORDER) runtimeLevel = l
+}
+function configuredLevel(): Level {
+  if (runtimeLevel) return runtimeLevel
+  const env = process.env.OPENCODE_OPENAI_AUTH_LOG_LEVEL as Level | undefined
+  if (env && env in ORDER) return env
+  return 'info'
+}
+
+const SECRET_KEY_EXACT =
+  /^(authorization|x-api-key|cookie|set-cookie|refresh|access|token)$/i
+function isSecretKey(key: string): boolean {
+  if (SECRET_KEY_EXACT.test(key)) return true
+  const k = key.toLowerCase().replace(/[-_]/g, '')
+  // Only the unambiguous ChatGPT stable id (chatgpt-account-id / chatgptAccountId)
+  // is sensitive. A bare `accountId` field is overloaded — most diagnostic logs put
+  // the INTERNAL account id/key ('main' or a fallback id) there, which is safe and
+  // needed for debugging — so it is intentionally NOT redacted by name. The genuine
+  // ChatGPT id is kept out of logs at the source instead.
+  if (k === 'chatgptaccountid') return true
+  if (k.includes('apikey')) return true
+  if (k.endsWith('secret') || k.endsWith('password')) return true
+  if (k.endsWith('token') && !k.endsWith('tokens')) return true
+  return false
+}
+const TOKEN_VALUE = /\b(Bearer\s+[\w.-]+|sk-[\w-]+|eyJ[\w.-]+)\b/g
+export function redact(value: unknown): unknown {
+  return redactInner(value, new WeakSet<object>())
+}
+function redactInner(value: unknown, seen: WeakSet<object>): unknown {
+  if (typeof value === 'string')
+    return value.replace(TOKEN_VALUE, '***REDACTED***')
+  if (Array.isArray(value)) {
+    if (seen.has(value)) return '[Circular]'
+    seen.add(value)
+    const arr = value.map((v) => redactInner(v, seen))
+    seen.delete(value)
+    return arr
+  }
+  if (value && typeof value === 'object') {
+    if (seen.has(value)) return '[Circular]'
+    seen.add(value)
+    const out: Record<string, unknown> = {}
+    for (const [k, v] of Object.entries(value))
+      out[k] = isSecretKey(k) ? '***REDACTED***' : redactInner(v, seen)
+    seen.delete(value)
+    return out
+  }
+  return value
+}
+
+let buffer: string[] = []
+let timer: ReturnType<typeof setTimeout> | undefined
+const ROTATE_KEEP = 3
+function chmodPrivate(path: string) {
+  try {
+    chmodSync(path, 0o600)
+  } catch {
+    /* never throw */
+  }
+}
+function rotateIfNeeded() {
+  try {
+    const f = logFile()
+    if (!(existsSync(f) && statSync(f).size > MAX_BYTES)) return
+    for (let i = ROTATE_KEEP - 1; i >= 1; i--) {
+      if (existsSync(`${f}.${i}`)) {
+        const rotated = `${f}.${i + 1}`
+        renameSync(`${f}.${i}`, rotated)
+        chmodPrivate(rotated)
+      }
+    }
+    const rotated = `${f}.1`
+    renameSync(f, rotated)
+    chmodPrivate(rotated)
+  } catch {
+    /* never throw */
+  }
+}
+function flush() {
+  if (!buffer.length) return
+  const text = buffer.join('')
+  buffer = []
+  try {
+    rotateIfNeeded()
+    const file = logFile()
+    if (existsSync(file)) chmodPrivate(file)
+    appendFileSync(file, text, { encoding: 'utf8', mode: 0o600 })
+  } catch {
+    /* never throw */
+  }
+}
+function schedule() {
+  if (!timer)
+    timer = setTimeout(() => {
+      timer = undefined
+      flush()
+    }, 500)
+}
+if (!isTestEnv) process.on('exit', flush)
+
+function safeSerialize(data: unknown): string {
+  try {
+    return ` ${JSON.stringify(redact(data))}`
+  } catch {
+    return ' [unserializable]'
+  }
+}
+
+function emit(channel: string, level: Level, message: string, data?: unknown) {
+  if (ORDER[level] > ORDER[configuredLevel()]) return
+  const line =
+    `[${new Date().toISOString()}] ${level.toUpperCase()} [${channel}] ${message}` +
+    (data === undefined ? '' : safeSerialize(data)) +
+    '\n'
+  buffer.push(line)
+  if (buffer.length >= 50) flush()
+  else schedule()
+}
+
+export function createLogger(channel: string) {
+  return {
+    error: (m: string, d?: unknown) => emit(channel, 'error', m, d),
+    warn: (m: string, d?: unknown) => emit(channel, 'warn', m, d),
+    info: (m: string, d?: unknown) => emit(channel, 'info', m, d),
+    debug: (m: string, d?: unknown) => emit(channel, 'debug', m, d),
+    trace: (m: string, d?: unknown) => emit(channel, 'trace', m, d),
+  }
+}
+export async function flushForTest() {
+  flush()
+}

package/src/tui-compiled/rpc/port-file.ts

@@ -0,0 +1,70 @@
+import {
+  mkdir,
+  readdir,
+  readFile,
+  rename,
+  unlink,
+  writeFile,
+} from 'node:fs/promises'
+import { join } from 'node:path'
+
+export interface PortFileEntry {
+  port: number
+  token: string
+  pid: number
+  startedAt: number
+}
+
+function pidAlive(pid: number): boolean {
+  try {
+    process.kill(pid, 0)
+    return true
+  } catch (error) {
+    return (error as NodeJS.ErrnoException).code === 'EPERM'
+  }
+}
+
+export async function writePortFile(
+  dir: string,
+  entry: { port: number; token: string; pid: number },
+): Promise<string> {
+  await mkdir(dir, { recursive: true })
+  const full: PortFileEntry = { ...entry, startedAt: Date.now() }
+  const target = join(dir, `port-${entry.pid}.json`)
+  const tmp = `${target}.${process.pid}.tmp`
+  await writeFile(tmp, JSON.stringify(full), { encoding: 'utf8', mode: 0o600 })
+  await rename(tmp, target)
+  return target
+}
+
+export async function discoverPortFile(
+  dir: string,
+  expectedPid?: number,
+): Promise<PortFileEntry | null> {
+  let names: string[]
+  try {
+    names = await readdir(dir)
+  } catch {
+    return null
+  }
+  const live: PortFileEntry[] = []
+  for (const name of names) {
+    if (!name.startsWith('port-') || !name.endsWith('.json')) continue
+    try {
+      const parsed = JSON.parse(
+        await readFile(join(dir, name), 'utf8'),
+      ) as PortFileEntry
+      if (Number.isFinite(parsed.port)) {
+        if (pidAlive(parsed.pid)) live.push(parsed)
+        else unlink(join(dir, name)).catch(() => {})
+      }
+    } catch {}
+  }
+  if (live.length === 0) return null
+  const candidates =
+    expectedPid !== undefined && expectedPid >= 1
+      ? live.filter((entry) => entry.pid === expectedPid)
+      : []
+  const entries = candidates.length > 0 ? candidates : live
+  return entries.sort((a, b) => b.startedAt - a.startedAt)[0] ?? null
+}

package/src/tui-compiled/rpc/protocol.ts

@@ -0,0 +1,31 @@
+export type CommandModalName =
+  | 'openai-quota'
+  | 'openai-account'
+  | 'openai-routing'
+  | 'openai-killswitch'
+  | 'openai-dump'
+  | 'openai-logging'
+  | 'openai-cachekeep'
+
+export interface OpenDialogPayload {
+  command: CommandModalName
+  text: string
+  knobs: Record<string, unknown>
+}
+
+export interface RpcNotification {
+  id: number
+  type: 'open-dialog'
+  payload: OpenDialogPayload
+  sessionId?: string
+}
+
+export interface ApplyRequest {
+  command: CommandModalName
+  arguments: string
+}
+
+export interface ApplyResult {
+  text: string
+  knobs: Record<string, unknown>
+}

package/src/tui-compiled/rpc/rpc-client.ts

@@ -0,0 +1,78 @@
+import { discoverPortFile, type PortFileEntry } from './port-file'
+import type { ApplyRequest, ApplyResult, RpcNotification } from './protocol'
+
+export interface RpcClient {
+  pending: (
+    lastReceivedId: number,
+    sessionId?: string,
+  ) => Promise<RpcNotification[]>
+  apply: (request: ApplyRequest) => Promise<ApplyResult>
+}
+
+async function call<T>(
+  dir: string,
+  expectedPid: number | undefined,
+  onSelected: ((entry: PortFileEntry | null) => void) | undefined,
+  method: string,
+  params: Record<string, unknown>,
+): Promise<T | null> {
+  const entry = await discoverPortFile(dir, expectedPid)
+  onSelected?.(entry)
+  if (!entry) return null
+  const controller = new AbortController()
+  const timer = setTimeout(() => controller.abort(), 2_000)
+  try {
+    const res = await fetch(`http://127.0.0.1:${entry.port}/rpc/${method}`, {
+      method: 'POST',
+      headers: {
+        'content-type': 'application/json',
+        authorization: `Bearer ${entry.token}`,
+      },
+      body: JSON.stringify(params),
+      signal: controller.signal,
+    })
+    if (!res.ok) return null
+    return (await res.json()) as T
+  } catch {
+    return null
+  } finally {
+    clearTimeout(timer)
+  }
+}
+
+export function createRpcClient(
+  dir: string,
+  expectedPid?: number,
+  onSelected?: (entry: PortFileEntry | null) => void,
+): RpcClient {
+  let reportedSelection = false
+  const reportSelected = (entry: PortFileEntry | null) => {
+    if (reportedSelection) return
+    reportedSelection = true
+    onSelected?.(entry)
+  }
+  return {
+    async pending(lastReceivedId, sessionId) {
+      const out = await call<{ messages: RpcNotification[] }>(
+        dir,
+        expectedPid,
+        reportSelected,
+        'pending-notifications',
+        { lastReceivedId, sessionId },
+      )
+      return out?.messages ?? []
+    },
+    async apply(request) {
+      const out = await call<ApplyResult>(
+        dir,
+        expectedPid,
+        reportSelected,
+        'apply',
+        {
+          ...request,
+        },
+      )
+      return out ?? { text: 'apply failed', knobs: {} }
+    },
+  }
+}

package/src/tui-compiled/rpc/rpc-dir.ts

@@ -0,0 +1,22 @@
+import { createHash } from 'node:crypto'
+import { homedir, tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+
+const RPC_DIR_ENV = 'OPENCODE_OPENAI_AUTH_RPC_DIR'
+
+// Both processes must resolve the SAME dir from the SAME project directory.
+export function getRpcDir(projectDirectory: string): string {
+  const override = process.env[RPC_DIR_ENV]?.trim()
+  // A relative override is anchored to projectDirectory (shared by both processes)
+  // so server and TUI halves always resolve the same dir. An absolute override is
+  // used as-is (resolve(base, absolute) returns the absolute path unchanged).
+  if (override) return resolve(projectDirectory, override)
+  const hash = createHash('sha256')
+    .update(projectDirectory)
+    .digest('hex')
+    .slice(0, 16)
+  const base = process.env.XDG_STATE_HOME || join(homedir(), '.local', 'state')
+  return join(base, 'cortexkit', 'openai-auth', 'rpc', hash)
+}
+
+export { tmpdir }