@cortexkit/opencode-openai-auth 0.7.2 → 0.8.0

package/dist/raw-ws-node.d.ts

@@ -1,37 +0,0 @@
-type Listener = (event: unknown) => void;
-export declare class RawWebSocket {
-    url: string;
-    readyState: number;
-    private socket;
-    private readonly sessionID;
-    private listeners;
-    private rxBuffer;
-    private handshakeDone;
-    private upgradeFailureEmitted;
-    private expectedAccept;
-    private fragOpcode;
-    private fragChunks;
-    constructor(url: string, headers: Record<string, string>, options?: {
-        sessionID?: string;
-    });
-    addEventListener(type: string, fn: Listener, _opts?: {
-        once?: boolean;
-    }): void;
-    removeEventListener(type: string, fn: Listener): void;
-    /** Close code and reason from the peer's close frame, if one arrived. */
-    private peerClose;
-    private closeEmitted;
-    /** Emit at most one close event, so the first reported code is the one kept. */
-    private emitClose;
-    private emit;
-    private connect;
-    private onData;
-    private emitRejectedUpgrade;
-    private drainFrames;
-    private handleFrame;
-    send(data: string): void;
-    private writeFrame;
-    close(): void;
-    private log;
-}
-export {};

package/dist/raw-ws-upgrade.d.ts

@@ -1,2 +0,0 @@
-export declare function rejectedUpgradeStatus(statusLine: string): number | undefined;
-export declare function rejectedUpgradeEvent(buffer: Uint8Array, headerEnd: number, finalizePartial?: boolean): Record<string, unknown> | undefined;

package/dist/raw-ws.d.ts

@@ -1,3 +0,0 @@
-import { RawWebSocket as BunRawWebSocket } from './raw-ws-bun';
-import { RawWebSocket as NodeRawWebSocket } from './raw-ws-node';
-export declare const RawWebSocket: typeof BunRawWebSocket | typeof NodeRawWebSocket;

package/dist/response-stream-error.d.ts

@@ -1,12 +0,0 @@
-import { APICallError } from 'ai';
-export declare class ResponseStreamError extends APICallError {
-    readonly name = "ProviderResponseStreamError";
-    /**
-     * `retryable` defaults to true because most stream failures are transient.
-     * Pass false for a failure the same request will hit again — resending then
-     * only repeats the cost and the wait.
-     */
-    constructor(message: string, options?: ErrorOptions & {
-        retryable?: boolean;
-    });
-}

package/dist/rpc/notifications.d.ts

@@ -1,5 +0,0 @@
-import type { OpenDialogPayload, RpcNotification } from './protocol';
-export declare function pushNotification(payload: OpenDialogPayload, sessionId?: string): void;
-export declare function drainNotifications(lastReceivedId?: number, sessionId?: string): RpcNotification[];
-export declare function isTuiConnected(sessionId?: string): boolean;
-export declare function resetNotificationsForTest(): void;

package/dist/rpc/rpc-server.d.ts

@@ -1,17 +0,0 @@
-import type { drainNotifications } from './notifications';
-import type { ApplyRequest, ApplyResult } from './protocol';
-export interface RpcServerHandle {
-    port: number;
-    token: string;
-    stop: () => Promise<void>;
-}
-export interface RpcServerOptions {
-    dir: string;
-    secureDir?: boolean;
-    sweepRoot?: string;
-    drain: typeof drainNotifications;
-    apply: (request: ApplyRequest) => Promise<ApplyResult>;
-    timeoutMs?: number;
-    receiptTimeoutMs?: number;
-}
-export declare function startRpcServer(options: RpcServerOptions): Promise<RpcServerHandle>;

package/dist/token-util-jcj7k7pa.js

@@ -1 +0,0 @@
-import{b as a}from"./index-9jpc8yct.js";import"./index-zxqb5ydj.js";export default a();

package/dist/tui/command-dialogs.d.ts

@@ -1,21 +0,0 @@
-/** @jsxImportSource @opentui/solid */
-import type { TuiPluginApi } from '@opencode-ai/plugin/tui';
-import type { OpenDialogPayload } from '../rpc/protocol.js';
-import { type AccountQuota, type SidebarState } from '../sidebar-state.js';
-type ApplyFn = (command: OpenDialogPayload['command'], args: string) => Promise<{
-    text: string;
-    knobs: Record<string, unknown>;
-}>;
-export declare function buildCachekeepDialogOptions(payload: OpenDialogPayload): {
-    title: string;
-    value: string;
-    description: string;
-}[];
-export declare function openCommandDialog(api: TuiPluginApi, payload: OpenDialogPayload, apply: ApplyFn, sessionId?: string): void;
-export declare function formatQuotaWindows(quota: AccountQuota | null | undefined): string;
-export declare function buildAccountDialogRows(state: SidebarState, sessionId?: string): {
-    title: string;
-    value: string;
-    description: string;
-}[];
-export {};

package/dist/util/error.d.ts

@@ -1 +0,0 @@
-export declare function errorMessage(error: unknown): string;

package/dist/util/open-url.d.ts

@@ -1,6 +0,0 @@
-type BrowserExec = (file: string, args: string[], options: {
-    stdio: 'ignore';
-    timeout: number;
-}) => unknown;
-export declare function openUrl(url: string, platform?: NodeJS.Platform, execFileSync?: BrowserExec): void;
-export {};

package/dist/util/proxy-env.d.ts

@@ -1,4 +0,0 @@
-export declare function getProxyForUrl(url: string): string | undefined;
-export declare const ProxyEnv: {
-    getProxyForUrl: typeof getProxyForUrl;
-};

package/dist/util/record.d.ts

@@ -1 +0,0 @@
-export declare function isRecord(input: unknown): input is Record<string, unknown>;

package/dist/util/stable-json.d.ts

@@ -1 +0,0 @@
-export declare function stableStringify(value: unknown): string;

package/dist/util/uuid-v7.d.ts

@@ -1 +0,0 @@
-export declare function uuidV7(): string;

package/dist/version.d.ts

@@ -1 +0,0 @@
-export declare const PackageVersion = "0.7.2";

package/dist/ws-pool.d.ts

@@ -1,57 +0,0 @@
-export declare const TITLE_HEADER = "x-opencode-title";
-export declare const QUOTA_ACCOUNT_HEADER = "x-openai-auth-quota-account";
-export interface CreateWebSocketFetchOptions {
-    httpFetch?: typeof globalThis.fetch;
-    url?: string;
-    connectTimeout?: number;
-    idleTimeout?: number;
-    maxConnectionAge?: number;
-    streamRetries?: number;
-    /** Milliseconds to wait for an immediate provider-side WS error before returning response headers. */
-    firstEventGraceMs?: number;
-    /** Use the hand-rolled raw TCP/TLS WebSocket client instead of native WebSocket. */
-    rawWebSocket?: boolean;
-    /**
-     * Push per-turn quota from a codex.rate_limits in-band frame.
-     *
-     * Receives the snapshot plus the per-request account identity (access token,
-     * internal quota account key, and served ChatGPT account id) captured at send
-     * time so the frame is attributed to the connection's own account, not a
-     * shared mutable global.
-     */
-    onQuota?: (s: Record<string, unknown>, accessToken: string, accountId: string | undefined, servedChatgptAccountId: string | undefined) => void;
-    /** Receives quota exhaustion plus the account identity captured at send time. */
-    onRateLimitReached?: (window: string, accountId: string | undefined, resetAt?: number) => void;
-}
-interface PoolEntry {
-    socket?: WebSocket;
-    connectedAt?: number;
-    lastUsedAt: number;
-    busy: boolean;
-    fallback: boolean;
-    streamFailures: number;
-    continuation?: ContinuationState;
-    turnID?: string;
-    turnStartedAt?: number;
-    turnInput?: unknown[];
-    turnSignature?: string;
-}
-interface ContinuationState {
-    responseID: string;
-    input: unknown[];
-    signature: string;
-    finalizedCallIds: Set<string>;
-}
-export declare function createWebSocketFetch(options?: CreateWebSocketFetchOptions): ((input: RequestInfo | URL, init?: RequestInit) => Promise<Response>) & {
-    close: () => void;
-    remove: (sessionID: string) => void;
-};
-export declare const CODEX_BODY_KEY_ORDER: string[];
-export declare function orderCodexBody(body: Record<string, unknown>): Record<string, unknown>;
-export declare function advanceTurn(entry: PoolEntry, body: Record<string, unknown>, fullBody?: Record<string, unknown>): void;
-export declare function applyTurnId(entry: PoolEntry, body: Record<string, unknown>, fullBody?: Record<string, unknown>): Record<string, unknown>;
-export { hasWebSocketResponsesLiteMetadata, sanitizeHttpFallbackBody, } from './codex-http';
-export declare function withoutInternalHeaders<T extends {
-    headers?: HeadersInit;
-}>(init: T | undefined): T | undefined;
-export * as OpenAIWebSocketPool from './ws-pool';

package/dist/ws.d.ts

@@ -1,71 +0,0 @@
-import { ResponseStreamError } from './response-stream-error';
-export declare const PROTOCOL_HEADER = "responses_websockets=2026-02-06";
-export interface ConnectResponsesWebSocketOptions {
-    url: string;
-    headers: Record<string, string>;
-    timeout?: number;
-    /** Use the hand-rolled raw TCP/TLS WebSocket client instead of native WebSocket. */
-    rawWebSocket?: boolean;
-    signal?: AbortSignal;
-}
-export interface StreamResponsesWebSocketOptions {
-    socket: WebSocket;
-    body: Record<string, unknown>;
-    sessionID?: string;
-    idleTimeout?: number;
-    signal?: AbortSignal;
-    onFirstEvent?: (error?: WrappedError) => void;
-    /**
-     * Fires on response.completed/response.done. `finalizedFunctionCallIds` is the
-     * set of function/custom tool call ids the response actually finalized (emitted
-     * a response.output_item.done for). The pool uses it to decide which suffix
-     * function_call items are safe to trim from a continuation: only those present
-     * in the chained response may be dropped — an unfinalized call (e.g. an aborted
-     * partial) must be kept inline or its function_call_output orphans → 400.
-     */
-    onComplete?: (event: Record<string, unknown>, finalizedFunctionCallIds: Set<string>) => void;
-    onTerminal?: (event: Record<string, unknown>) => void;
-    onRetryableTerminal?: (event: Record<string, unknown>) => Promise<WebSocket | undefined>;
-    onConnectionInvalid?: (error: ResponseStreamError) => void;
-    onAbort?: (error: Error) => void;
-    /** Push per-turn quota from a codex.rate_limits in-band frame. */
-    onQuota?: (s: Record<string, unknown>) => void;
-    /** Called when the transport reports quota exhaustion for the current connection. */
-    onRateLimitReached?: (window: string, resetAt?: number) => void;
-}
-export interface WrappedError {
-    status: number;
-    headers?: Record<string, string>;
-    body: string;
-}
-export declare function toWebSocketUrl(url: string): string;
-export declare function normalizeHeaders(headers: HeadersInit | undefined): Record<string, string>;
-export declare function isAbortError(error: unknown): error is DOMException;
-export declare function isUpgradeFailure(error: unknown): boolean;
-export declare function isOversizedFrame(error: unknown): boolean;
-export declare function markOversizedFrame<T extends object>(error: T): T;
-export declare function connectResponsesWebSocket(options: ConnectResponsesWebSocketOptions): Promise<WebSocket>;
-export declare function streamResponsesWebSocket(options: StreamResponsesWebSocketOptions): Response;
-export declare function parseRateLimitSignal(value: unknown): {
-    window: string;
-    resetAt?: number;
-} | undefined;
-/**
- * Surfaced when a stream dies after output has reached the reader.
- *
- * Must not contain any substring the host reads as retryable — no provider
- * wording, no response ids, no byte counts. `ws-pool.test.ts` pins it against
- * the host's pattern set.
- */
-export declare const TERMINAL_AFTER_OUTPUT_MESSAGE = "The response ended early after part of it had already been shown. It was not sent again, because repeating it would duplicate that output and re-run any tools it had started. The transport log records what ended it.";
-/**
- * Surfaced when the peer refuses the request frame as too large (close 1009).
- *
- * Fixed text for the same reason as {@link TERMINAL_AFTER_OUTPUT_MESSAGE}: the
- * host can override this error's non-retryable flag by matching the message,
- * and resending a frame the peer has already measured and refused is the one
- * outcome this path exists to prevent. The size and the peer's reason are
- * logged instead.
- */
-export declare const OVERSIZED_FRAME_MESSAGE = "The request was larger than the websocket would carry, so it was sent over HTTP instead. Resending it unchanged over the same socket cannot succeed. The transport log records the size.";
-export * as OpenAIWebSocket from './ws';

package/src/rpc/notifications.ts

@@ -1,54 +0,0 @@
-import type { OpenDialogPayload, RpcNotification } from './protocol'
-
-const QUEUE_CAP = 100
-const TUI_CONNECTED_WINDOW_MS = 3_000
-
-let queue: RpcNotification[] = []
-let nextId = 1
-let lastDrainAtAny = 0
-const lastDrainAtBySession = new Map<string, number>()
-
-export function pushNotification(
-  payload: OpenDialogPayload,
-  sessionId?: string,
-): void {
-  queue.push({ id: nextId++, type: 'open-dialog', payload, sessionId })
-  if (queue.length > QUEUE_CAP) queue = queue.slice(queue.length - QUEUE_CAP)
-}
-
-export function drainNotifications(
-  lastReceivedId = 0,
-  sessionId?: string,
-): RpcNotification[] {
-  const now = Date.now()
-  lastDrainAtAny = now
-  if (sessionId !== undefined) lastDrainAtBySession.set(sessionId, now)
-  const matches = (n: RpcNotification) =>
-    sessionId === undefined ||
-    n.sessionId === undefined ||
-    n.sessionId === sessionId
-  if (lastReceivedId > 0) {
-    queue = queue.filter((n) => {
-      if (n.id > lastReceivedId) return true
-      if (sessionId === undefined) return false
-      return n.sessionId !== sessionId
-    })
-  }
-  return queue.filter((n) => n.id > lastReceivedId && matches(n))
-}
-
-export function isTuiConnected(sessionId?: string): boolean {
-  const now = Date.now()
-  if (sessionId !== undefined) {
-    const at = lastDrainAtBySession.get(sessionId) ?? 0
-    return at > 0 && now - at < TUI_CONNECTED_WINDOW_MS
-  }
-  return lastDrainAtAny > 0 && now - lastDrainAtAny < TUI_CONNECTED_WINDOW_MS
-}
-
-export function resetNotificationsForTest(): void {
-  queue = []
-  nextId = 1
-  lastDrainAtAny = 0
-  lastDrainAtBySession.clear()
-}

package/src/rpc/protocol.ts

@@ -1,33 +0,0 @@
-export type CommandModalName =
-  | 'openai-quota'
-  | 'openai-account'
-  | 'openai-routing'
-  | 'openai-killswitch'
-  | 'openai-dump'
-  | 'openai-logging'
-  | 'openai-cachekeep'
-  | 'openai-reset'
-
-export interface OpenDialogPayload {
-  command: CommandModalName
-  text: string
-  knobs: Record<string, unknown>
-}
-
-export interface RpcNotification {
-  id: number
-  type: 'open-dialog'
-  payload: OpenDialogPayload
-  sessionId?: string
-}
-
-export interface ApplyRequest {
-  command: CommandModalName
-  arguments: string
-  sessionId?: string
-}
-
-export interface ApplyResult {
-  text: string
-  knobs: Record<string, unknown>
-}

package/src/rpc/rpc-server.ts

@@ -1,172 +0,0 @@
-import { randomBytes, timingSafeEqual } from 'node:crypto'
-import { unlink } from 'node:fs/promises'
-import {
-  createServer,
-  type IncomingMessage,
-  type ServerResponse,
-} from 'node:http'
-import { join } from 'node:path'
-import { createLogger } from '../logger'
-import type { drainNotifications } from './notifications'
-import { sweepRpcState, writePortFile } from './port-file'
-import type { ApplyRequest, ApplyResult } from './protocol'
-
-const log = createLogger('rpc')
-
-export interface RpcServerHandle {
-  port: number
-  token: string
-  stop: () => Promise<void>
-}
-
-export interface RpcServerOptions {
-  dir: string
-  secureDir?: boolean
-  sweepRoot?: string
-  drain: typeof drainNotifications
-  apply: (request: ApplyRequest) => Promise<ApplyResult>
-  // Bounds handler execution via the socket inactivity timer.
-  timeoutMs?: number
-  // Bounds request delivery only (requestTimeout/headersTimeout).
-  receiptTimeoutMs?: number
-}
-
-function readBody(req: IncomingMessage): Promise<string> {
-  return new Promise((resolve, reject) => {
-    const chunks: Buffer[] = []
-    let size = 0
-    req.on('data', (chunk: Buffer) => {
-      size += chunk.length
-      if (size > 1_000_000) {
-        req.destroy()
-        reject(new Error('body too large'))
-        return
-      }
-      chunks.push(chunk)
-    })
-    req.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')))
-    req.on('error', reject)
-  })
-}
-
-function tokenOk(header: string | undefined, token: string): boolean {
-  if (!header?.startsWith('Bearer ')) return false
-  const got = Buffer.from(header.slice(7))
-  const want = Buffer.from(token)
-  return got.length === want.length && timingSafeEqual(got, want)
-}
-
-export async function startRpcServer(
-  options: RpcServerOptions,
-): Promise<RpcServerHandle> {
-  const token = randomBytes(32).toString('hex')
-  // Two different bounds, deliberately not one value.
-  //
-  // requestTimeout/headersTimeout bound how long a client may take to DELIVER
-  // a request; they do not bound handler execution. A receipt bound of 500ms
-  // still returns 200 for a 3s handler. Over loopback with a 1 MiB body cap,
-  // seconds is already generous.
-  //
-  // The inactivity timer is the one that can kill a working handler: it
-  // destroys the socket out from under it. It must therefore outlast the
-  // slowest legitimate apply — a reset redemption is bounded by a 60s consume
-  // call — or the response is lost server-side no matter what deadline the
-  // client passed. Fast commands respond in milliseconds regardless.
-  //
-  // Collapsing these back into a single value reintroduces one of two bugs:
-  // a receipt bound that aborts a slow reset, or a socket timer that leaves
-  // every endpoint holding a dead connection for 90s.
-  const handlerTimeoutMs = options.timeoutMs ?? 90_000
-  const receiptTimeoutMs = options.receiptTimeoutMs ?? 2_000
-  const server = createServer((req, res) => {
-    req.setTimeout(handlerTimeoutMs, () => {
-      req.socket.destroy()
-    })
-    void dispatch(req, res)
-  })
-  server.requestTimeout = receiptTimeoutMs
-  server.headersTimeout = receiptTimeoutMs
-
-  async function dispatch(req: IncomingMessage, res: ServerResponse) {
-    const json = (status: number, value: unknown) => {
-      // Guard against writing to a socket that was destroyed (e.g. when
-      // readBody rejected after req.destroy() on an oversized body).
-      if (res.headersSent || res.writableEnded || res.destroyed) return
-      res.writeHead(status, { 'content-type': 'application/json' })
-      res.end(JSON.stringify(value))
-    }
-    try {
-      const url = req.url ?? ''
-      if (req.method === 'GET' && url === '/health')
-        return json(200, { ok: true })
-      if (req.method !== 'POST' || !url.startsWith('/rpc/'))
-        return json(404, { error: 'not found' })
-      if (!tokenOk(req.headers.authorization, token))
-        return json(401, { error: 'unauthorized' })
-      const method = url.slice('/rpc/'.length)
-      const body = await readBody(req)
-      const params = JSON.parse(body || '{}') as Record<string, unknown>
-      if (method === 'pending-notifications') {
-        const messages = options.drain(
-          Number(params.lastReceivedId ?? 0),
-          typeof params.sessionId === 'string' ? params.sessionId : undefined,
-        )
-        return json(200, { messages })
-      }
-      if (method === 'apply') {
-        const result = await options.apply(params as unknown as ApplyRequest)
-        return json(200, result)
-      }
-      return json(404, { error: 'unknown method' })
-    } catch (error) {
-      json(500, {
-        error: error instanceof Error ? error.message : String(error),
-      })
-    }
-  }
-
-  const port = await new Promise<number>((resolve, reject) => {
-    server.on('error', reject)
-    server.listen(0, '127.0.0.1', () => {
-      const addr = server.address()
-      if (addr && typeof addr === 'object') resolve(addr.port)
-      else reject(new Error('no port'))
-    })
-  })
-  server.unref()
-  if (options.sweepRoot) {
-    try {
-      await sweepRpcState(options.sweepRoot, options.dir)
-    } catch (error) {
-      log.warn('rpc state sweep failed', {
-        pid: process.pid,
-        error: error instanceof Error ? error.message : String(error),
-      })
-    }
-  }
-  try {
-    await writePortFile(
-      options.dir,
-      { port, token, pid: process.pid },
-      { secureDir: options.secureDir },
-    )
-    log.debug('rpc server pid', {
-      pid: process.pid,
-      rpcPort: port,
-    })
-  } catch (error) {
-    await new Promise<void>((resolve) => server.close(() => resolve()))
-    throw error
-  }
-
-  return {
-    port,
-    token,
-    async stop() {
-      await new Promise<void>((resolve) => server.close(() => resolve()))
-      await unlink(join(options.dir, `port-${process.pid}.json`)).catch(
-        () => {},
-      )
-    },
-  }
-}