@cortexkit/opencode-openai-auth 0.7.2 → 0.9.0

package/src/tui-compiled/shared/internal.ts

@@ -0,0 +1,6 @@
+// Generated by scripts/build-tui.ts. Do not edit.
+export * from './logger.ts'
+export * from './paths.ts'
+export * from './refresh-file-lock.ts'
+export * from './util/error.ts'
+export * from './util/open-url.ts'

package/src/{logger.ts → tui-compiled/shared/logger.ts}

@@ -5,10 +5,8 @@ import {
   renameSync,
   statSync,
 } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
 
-type Level = 'error' | 'warn' | 'info' | 'debug' | 'trace'
+export type Level = 'error' | 'warn' | 'info' | 'debug' | 'trace'
 const ORDER: Record<Level, number> = {
   error: 0,
   warn: 1,
@@ -16,23 +14,63 @@ const ORDER: Record<Level, number> = {
   debug: 3,
   trace: 4,
 }
-const isTestEnv = process.env.NODE_ENV === 'test'
 const MAX_BYTES = 5 * 1024 * 1024
 
-function logFile(): string {
-  return (
-    process.env.OPENCODE_OPENAI_AUTH_LOG_FILE ??
-    join(tmpdir(), 'opencode-openai-auth.log')
-  )
-}
+/**
+ * Where lines are written, and the level floor, as the host supplied them.
+ *
+ * Both start unset. A host decides where its log lives — that decision reads
+ * host environment variables and host directories, neither of which belongs in
+ * shared code — and calls `initLogger` before it runs any command. Until then
+ * every `log.*` call is a silent no-op: throwing would turn the first command a
+ * host forgot to wire into a crash, and buffering would hold credential-bearing
+ * lines for an init that may never arrive.
+ */
+let logFileSource: string | (() => string) | undefined
+let initLevelSource: Level | (() => Level | undefined) | undefined
 let runtimeLevel: Level | undefined
+
+export interface InitLoggerOptions {
+  /**
+   * Path of the file lines are appended to, or a function returning it.
+   *
+   * A function is what a host passes when its destination can move while the
+   * process runs — an operator or a test changing the variable that names the
+   * log file expects the next line to land in the new file, and a value
+   * captured once at init would keep writing to the old one.
+   */
+  file: string | (() => string)
+  /** Level floor applied when no `setLogLevel` call has overridden it. */
+  level?: Level | (() => Level | undefined)
+}
+
+/**
+ * Point the logger at a host's file and level. Idempotent: calling it again
+ * replaces both. A runtime level installed by `setLogLevel` is deliberately
+ * left alone, because it is the operator's explicit choice and outranks the
+ * floor a host computed at start-up.
+ */
+export function initLogger(options: InitLoggerOptions): void {
+  logFileSource = options.file
+  initLevelSource = options.level
+}
+
 export function setLogLevel(l: Level | undefined) {
   if (l === undefined || l in ORDER) runtimeLevel = l
 }
+
+function logFilePath(): string | undefined {
+  if (logFileSource === undefined) return undefined
+  const resolved =
+    typeof logFileSource === 'function' ? logFileSource() : logFileSource
+  return resolved || undefined
+}
+
 function configuredLevel(): Level {
   if (runtimeLevel) return runtimeLevel
-  const env = process.env.OPENCODE_OPENAI_AUTH_LOG_LEVEL as Level | undefined
-  if (env && env in ORDER) return env
+  const floor =
+    typeof initLevelSource === 'function' ? initLevelSource() : initLevelSource
+  if (floor && floor in ORDER) return floor
   return 'info'
 }
 
@@ -47,12 +85,19 @@ function isSecretKey(key: string): boolean {
   // needed for debugging — so it is intentionally NOT redacted by name. The genuine
   // ChatGPT id is kept out of logs at the source instead.
   if (k === 'chatgptaccountid') return true
+  // Operator identity carried on a served vault credential. These arrived with
+  // the client widening that added `accountId`/`email`/`orgName`/`projectId`;
+  // they are personal data with no diagnostic value, so they never reach a log
+  // file. The structural guard is not logging a served credential wholesale —
+  // this list only closes the fields that exist today.
+  if (k === 'email' || k === 'orgname' || k === 'organizationname') return true
   if (k.includes('apikey')) return true
   if (k.endsWith('secret') || k.endsWith('password')) return true
   if (k.endsWith('token') && !k.endsWith('tokens')) return true
   return false
 }
-const TOKEN_VALUE = /\b(Bearer\s+[\w.-]+|sk-[\w-]+|eyJ[\w.-]+)\b/g
+const TOKEN_VALUE =
+  /\b(Bearer\s+[\w.-]+|sk-[\w-]+|eyJ[\w.-]+)\b|ckh_[A-Za-z0-9_-]{20,}/g
 export function redact(value: unknown): unknown {
   return redactInner(value, new WeakSet<object>())
 }
@@ -123,9 +168,8 @@ function chmodPrivate(path: string) {
     /* never throw */
   }
 }
-function rotateIfNeeded() {
+function rotateIfNeeded(f: string) {
   try {
-    const f = logFile()
     if (!(existsSync(f) && statSync(f).size > MAX_BYTES)) return
     for (let i = ROTATE_KEEP - 1; i >= 1; i--) {
       if (existsSync(`${f}.${i}`)) {
@@ -141,13 +185,19 @@ function rotateIfNeeded() {
     /* never throw */
   }
 }
-function flush() {
+
+/**
+ * Write whatever is buffered. Safe to call synchronously from a process-exit
+ * handler, which is how each host drains the buffer on shutdown.
+ */
+export function flushLogs() {
   if (!buffer.length) return
+  const file = logFilePath()
   const text = buffer.join('')
   buffer = []
+  if (!file) return
   try {
-    rotateIfNeeded()
-    const file = logFile()
+    rotateIfNeeded(file)
     if (existsSync(file)) chmodPrivate(file)
     appendFileSync(file, text, { encoding: 'utf8', mode: 0o600 })
   } catch {
@@ -158,10 +208,9 @@ function schedule() {
   if (!timer)
     timer = setTimeout(() => {
       timer = undefined
-      flush()
+      flushLogs()
     }, 500)
 }
-if (!isTestEnv) process.on('exit', flush)
 
 function safeSerialize(data: unknown): string {
   try {
@@ -172,13 +221,16 @@ function safeSerialize(data: unknown): string {
 }
 
 function emit(channel: string, level: Level, message: string, data?: unknown) {
+  // No destination means no host has initialised the logger. Drop the line
+  // rather than buffering it: see the note on logFileSource above.
+  if (logFileSource === undefined) return
   if (ORDER[level] > ORDER[configuredLevel()]) return
   const line =
-    `[${new Date().toISOString()}] ${level.toUpperCase()} [${channel}] ${message}` +
+    `[${new Date().toISOString()}] ${level.toUpperCase()} [${channel}] ${redactStrings(message)}` +
     (data === undefined ? '' : safeSerialize(data)) +
     '\n'
   buffer.push(line)
-  if (buffer.length >= 50) flush()
+  if (buffer.length >= 50) flushLogs()
   else schedule()
 }
 
@@ -192,5 +244,21 @@ export function createLogger(channel: string) {
   }
 }
 export async function flushForTest() {
-  flush()
+  flushLogs()
+}
+
+/**
+ * Return the logger to its uninitialised state. Only a test needs this: a
+ * single process runs every test file, so a file path left over from one test
+ * would keep a later "logger was never initialised" case writing lines.
+ */
+export function resetLoggerForTest() {
+  buffer = []
+  if (timer) {
+    clearTimeout(timer)
+    timer = undefined
+  }
+  logFileSource = undefined
+  initLevelSource = undefined
+  runtimeLevel = undefined
 }

package/src/tui-compiled/shared/paths.ts

@@ -0,0 +1,33 @@
+/**
+ * Pure path values shared by every host.
+ *
+ * Nothing here reads an environment variable or knows where a host keeps its
+ * configuration. A host resolves its own two file paths and hands them to the
+ * store as an `AccountPaths`; the only thing that must not drift between hosts
+ * is the file name itself, which is why the constants live here rather than in
+ * each host's own resolver.
+ */
+
+import { basename, dirname, join } from 'node:path'
+
+export const ACCOUNT_FILE_NAME = 'openai-auth.json'
+export const ACCOUNT_STATE_FILE_NAME = 'openai-auth-state.json'
+
+/**
+ * The config file and the runtime-state file a store operation reads and writes.
+ *
+ * Both are required. A store function never derives one from the other, because
+ * a host may point its state file somewhere the derivation would not reach and
+ * a silently derived path would lock one file while writing another.
+ */
+export interface AccountPaths {
+  configPath: string
+  statePath: string
+}
+
+/** Derive the state-file path from the config path without reading env vars. */
+export function deriveStatePath(configPath: string): string {
+  return basename(configPath) === ACCOUNT_FILE_NAME
+    ? join(dirname(configPath), ACCOUNT_STATE_FILE_NAME)
+    : `${configPath}.state.json`
+}

package/src/{core → tui-compiled/shared}/refresh-file-lock.ts

@@ -1,7 +1,6 @@
 import { randomUUID } from 'node:crypto'
 import { mkdir, readFile, rename, rm, stat, writeFile } from 'node:fs/promises'
 import { dirname, join } from 'node:path'
-import { getAccountStoragePath } from './account-paths'
 
 const setRefreshLockRenewalTimeout = globalThis.setTimeout.bind(globalThis)
 const clearRefreshLockRenewalTimeout = globalThis.clearTimeout.bind(globalThis)
@@ -18,7 +17,12 @@ export function isLostMarkerRaceError(error: unknown): boolean {
 export async function acquireRefreshFileLock(options: {
   name: string
   ttlMs: number
-  path?: string
+  /**
+   * File the lock is named after. Required: the lock and the write it guards
+   * must target the same file, and a default resolved in here could only ever
+   * be one host's path.
+   */
+  path: string
   now?: () => number
   renew?: boolean
   renewIntervalMs?: number
@@ -37,8 +41,7 @@ export async function acquireRefreshFileLock(options: {
       | 'release-owner-confirmed',
   ) => void | Promise<void>
 }): Promise<{ release: () => Promise<void> } | null> {
-  const accountPath = options.path ?? getAccountStoragePath()
-  const lockPath = `${accountPath}.${options.name}.lock`
+  const lockPath = `${options.path}.${options.name}.lock`
   const legacyOwnerPath = join(lockPath, 'owner.json')
   const ownerId = randomUUID()
   const now = options.now ?? Date.now

package/dist/cli.d.ts

@@ -1,2 +0,0 @@
-#!/usr/bin/env node
-export { openUrl as openBrowserForLogin } from './util/open-url';

package/dist/cli.js

@@ -1,15 +0,0 @@
-#!/usr/bin/env node
-import{J as C,K as E,L as X,r as $,y as q,z as B}from"./index-cfjed1st.js";import{ua as Y}from"./index-8f1200qx.js";import"./index-nrvjr97q.js";import{Ka as Z}from"./index-zxqb5ydj.js";import{execFileSync as U}from"node:child_process";function V(z,K=process.platform,H=U){try{if(K==="win32"){H("cmd",["/c","start","",z],{stdio:"ignore",timeout:3000});return}H(K==="darwin"?"open":"xdg-open",[z],{stdio:"ignore",timeout:3000})}catch{}}function W(){console.log(`Usage:
-  npx @cortexkit/opencode-openai-auth login [--label <name>] [--headless]
-  npx @cortexkit/opencode-openai-auth list
-  npx @cortexkit/opencode-openai-auth remove <id>
-
-Fallback accounts are stored in:
-  ${Y()}`)}function P(z){let K=[],H={};for(let N=0;N<z.length;N++){let j=z[N];if(!j)continue;if(j.startsWith("--")){let J=j.slice(2),D=z[N+1];if(D&&!D.startsWith("--"))H[J]=D,N++;else H[J]=!0}else K.push(j)}return{positional:K,flags:H}}async function R(){let{positional:z,flags:K}=P(process.argv.slice(2)),[H,...N]=z;if(!H||H==="help")W(),process.exit(0);switch(H){case"login":{let j=typeof K.label==="string"?K.label:void 0,J=Boolean(K.headless);try{$(j)}catch(G){console.error(`
-Error: ${G instanceof Error?G.message:String(G)}`),process.exit(1)}let{url:D,instructions:M,completion:T}=await B({label:j,headless:J});if(console.log(`
-Open this URL in your browser and complete sign-in:
-`),console.log(`${D}
-`),M)console.log(`${M}
-`);V(D);let O=await T,Q=!1;if(await X((G)=>{if(O.accountId&&G.mainAccountId&&O.accountId===G.mainAccountId)return Q=!0,G;return q(G.accounts,O),G}),Q)console.error(`
-Error: that account is already your main (same ChatGPT account).`),console.error("A self-fallback would retry on the account that just returned 429."),process.exit(1);if(console.log(`
-✓ Added account ${O.id}`),O.label)console.log(`  Label: ${O.label}`);break}case"list":{let j=await E();if(!j||j.accounts.length===0)console.log("No fallback accounts configured.");else for(let J of j.accounts){let D=J.label,M=[`  ${J.id}`];if(D)M.push(`(${D})`);M.push(J.enabled!==!1?"[enabled]":"[disabled]"),console.log(M.join(" "))}break}case"remove":{let j=N[0];if(!j)console.error("Error: remove requires an account ID."),W(),process.exit(1);let J=Y(),D=await C(J),M=D?D.has(j):!1,T=!1;if(await X((Q)=>{let G=Q.accounts.findIndex((L)=>L.id===j);if(G===-1)return Q;return Q.accounts.splice(G,1),T=!0,Q},J,{allowDrop:[j]}),!(T||M))console.error(`No account with id "${j}".`),process.exit(1);console.log(`Removed account ${j}.`);break}default:console.error(`Unknown command: ${H}`),W(),process.exit(1)}}if(Z.main==Z.module)R().catch((z)=>{console.error(z instanceof Error?z.message:String(z)),process.exit(1)});export{V as openBrowserForLogin};

package/dist/codex-http.d.ts

@@ -1,3 +0,0 @@
-export declare function hasWebSocketResponsesLiteMetadata(body: BodyInit | null | undefined): boolean;
-export declare function sanitizeHttpFallbackBody(body: BodyInit | null | undefined): string | ArrayBuffer | ArrayBufferView<ArrayBuffer> | Blob | FormData | ReadableStream<any> | URLSearchParams | null | undefined;
-export declare function sanitizeHttpFallbackInit(init: RequestInit | undefined): RequestInit | undefined;

package/dist/commands.d.ts

@@ -1,88 +0,0 @@
-import { type loadAccounts as defaultLoadAccounts } from './core/accounts';
-import type { CacheKeepManager, CacheKeepWindow } from './core/cachekeep';
-import type { QuotaManager } from './core/quota-manager';
-import type { RefreshAllQuotaResult } from './core/refresh-all-quota';
-import { type RunResetCreditResult } from './core/reset-credits';
-import type { ApplyRequest, ApplyResult, CommandModalName, OpenDialogPayload } from './rpc/protocol';
-export declare const OPENAI_QUOTA_COMMAND_NAME = "openai-quota";
-export declare const OPENAI_ACCOUNT_COMMAND_NAME = "openai-account";
-export declare const OPENAI_ROUTING_COMMAND_NAME = "openai-routing";
-export declare const OPENAI_KILLSWITCH_COMMAND_NAME = "openai-killswitch";
-export declare const OPENAI_DUMP_COMMAND_NAME = "openai-dump";
-export declare const OPENAI_LOGGING_COMMAND_NAME = "openai-logging";
-export declare const OPENAI_CACHEKEEP_COMMAND_NAME = "openai-cachekeep";
-export declare const OPENAI_RESET_COMMAND_NAME = "openai-reset";
-export declare const MODAL_COMMANDS: CommandModalName[];
-export interface CommandContext {
-    accountStoragePath: string;
-    quotaManager: QuotaManager;
-    loadAccounts: typeof defaultLoadAccounts;
-    client: {
-        auth: {
-            set: (input: {
-                path: {
-                    id: string;
-                };
-                body: {
-                    type: string;
-                    access?: string;
-                    refresh: string;
-                    expires?: number;
-                };
-            }) => Promise<unknown>;
-        };
-    };
-    /** Session ID for pushNotification delivery. */
-    sessionId?: string;
-    /** If set, pushNotification is wired up and can deliver feedback to the user. */
-    notify?: (payload: OpenDialogPayload) => void;
-    /** Refresh the sidebar-state file so the TUI modal shows current data. */
-    refreshSidebar?: () => Promise<void>;
-    /** Actively poll wham/usage for all accounts (main + fallbacks). */
-    refreshAllQuota?: () => Promise<RefreshAllQuotaResult[]>;
-    /** Prompt-cache cachekeep manager. Set when the command is wired. */
-    cacheKeepManager?: CacheKeepManager | null;
-    /** Updates the live loader's persisted-enabled cachekeep gate. */
-    setCacheKeepEnabled?: (enabled: boolean) => void;
-    /** Updates the live loader's persisted-subagent cachekeep gate. */
-    setCacheKeepSubagents?: (enabled: boolean) => void;
-    /** Updates the live loader's main-agent idle-cap bypass gate. */
-    setCacheKeepSustain?: (enabled: boolean) => void;
-    /** Updates the live loader's clock-hour warm window. undefined = no window. */
-    setCacheKeepWindow?: (window: CacheKeepWindow | undefined) => void;
-    /** Clears only the sticky account assignment for one OpenCode session. */
-    clearStickyRouting?: (sessionId: string) => Promise<boolean>;
-    /** Resolves the current session's usable sticky account, if one exists. */
-    getStickyRouting?: (sessionId: string) => Promise<string | undefined>;
-    resolveResetTarget?: (accountKey: string) => Promise<ResetTargetIdentity>;
-    fetchImpl?: typeof fetch;
-    now?: () => number;
-    randomUUID?: () => string;
-    refreshResetTargetQuota?: (accountKey: string) => Promise<RefreshAllQuotaResult>;
-}
-export interface ResetTargetIdentity {
-    accountKey: string;
-    label: string;
-    accessToken: string;
-    chatgptAccountId?: string;
-}
-type ResetCommandContext = CommandContext & Required<Pick<CommandContext, 'resolveResetTarget' | 'fetchImpl' | 'now' | 'randomUUID' | 'refreshResetTargetQuota'>>;
-export declare function renderResetCoordinatorResult(result: RunResetCreditResult, ctx: ResetCommandContext, boundChatgptAccountId?: string): Promise<OpenDialogPayload>;
-/**
- * Strip credential-shaped fields from a dialog payload's knobs.
- *
- * Knobs are returned across the loopback RPC and JSON-serialized to the TUI, so
- * a knob is a published surface. Individual commands project their own knobs
- * deliberately (see accountKnob), but this is the boundary backstop: a future
- * command that returns a stored object directly cannot leak credentials even if
- * the projection is forgotten, because nothing credential-shaped survives here.
- *
- * Scrub rather than throw. A rejected dialog is a visible outage for a live
- * command, while a scrubbed one keeps working with the leak removed; the warning
- * is what gets the projection fixed. Recurses into nested objects and arrays,
- * since the account list arrives as an array of records.
- */
-export declare function scrubKnobs(value: unknown, path: string, found: string[]): unknown;
-export declare function buildDialogPayload(command: CommandModalName, args: string, ctx: CommandContext): Promise<OpenDialogPayload>;
-export declare function applyCommand(request: ApplyRequest, ctx: CommandContext): Promise<ApplyResult>;
-export {};

package/dist/config.d.ts

@@ -1,47 +0,0 @@
-export declare const DEFAULT_CODEX_API_ENDPOINT = "https://chatgpt.com/backend-api/codex/responses";
-/** Shape of ~/.config/opencode/openai-auth.json (all fields optional). */
-export interface OpenAIAuthConfig {
-    /** Inject the native web_search tool to keep the Codex prompt cache stable. Default true. */
-    webSearch?: boolean;
-    /** Use the WebSocket transport for /responses instead of plain HTTP. Default false. */
-    webSockets?: boolean;
-    /** Use the hand-rolled raw TCP/TLS WebSocket client (incremental streaming). Default false. */
-    rawWebSocket?: boolean;
-    /** Use Codex's Responses Lite request shape. Default false. */
-    responsesLite?: boolean;
-    /** Dump final Codex request bodies for cache debugging. Default false. */
-    dump?: boolean | {
-        enabled?: boolean;
-    };
-    /** Directory for request dumps. Defaults to the OS temp directory. */
-    dumpDir?: string;
-    /** Codex-compatible Responses endpoint. Defaults to ChatGPT's Codex backend. */
-    codexApiEndpoint?: string;
-}
-export interface ResolvedSettings {
-    webSearch: boolean;
-    webSockets: boolean;
-    rawWebSocket: boolean;
-    responsesLite: boolean;
-    dump: boolean;
-    dumpDir: string;
-    codexApiEndpoint: string;
-}
-export declare function getConfigDir(): string;
-export declare function getConfigPath(): string;
-/**
- * Resolved settings, memoized per process.
- *
- * Env and the config file are read once because neither changes under a running
- * process — except through a command that writes the config itself. Those
- * commands must call `refreshSettings()`, or the process keeps serving the
- * values it read at startup while the file on disk says otherwise.
- */
-export declare function getSettings(): ResolvedSettings;
-/**
- * Drop the memoized settings after a command writes the config file, so the
- * running process picks the change up without a restart.
- */
-export declare function refreshSettings(): ResolvedSettings;
-/** Test-only: drop the memoized settings so a later getSettings() re-reads env + config. */
-export declare function resetSettingsForTest(): void;

package/dist/core/account-paths.d.ts

@@ -1,25 +0,0 @@
-/**
- * Where the account store lives.
- *
- * This is the ONLY definition. It used to be duplicated verbatim in both
- * `accounts.ts` and `refresh-file-lock.ts`, because `accounts.ts` imports the
- * lock and the reverse import would have been a cycle. Two copies of a path
- * resolver is a bad trade for that: the lock and the write must agree on the
- * exact file, and if the copies ever drifted, a writer would take a lock on one
- * path while writing another — mutual exclusion silently lost on a file holding
- * credentials. Nothing would fail a test, since each copy works on its own.
- *
- * This module imports nothing from either side, so both can depend on it.
- */
-export declare const ACCOUNT_FILE_NAME = "openai-auth.json";
-export declare const ACCOUNT_STATE_FILE_NAME = "openai-auth-state.json";
-export declare function getAccountStoragePath(): string;
-/** Derive the state-file path from the config path without reading env vars. */
-export declare function deriveStatePath(configPath: string): string;
-/**
- * Detect path aliases without requiring either file to exist. This is defense
- * in depth: hardlinks and bind mounts can still make distinct paths share a
- * file, because neither is distinguishable through pathname identity.
- */
-export declare function accountPathsCollide(configPath: string, statePath: string, platform?: NodeJS.Platform): boolean;
-export declare function getAccountStatePath(configPath?: string): string;