@cortexkit/pi-openai-auth 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ex Machina
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,37 @@
+# @cortexkit/pi-openai-auth
+
+Pi package for CortexKit OpenAI Codex OAuth support. It overrides Pi's built-in `openai-codex` provider with a CortexKit provider extension backed by Pi's OpenAI Codex Responses transport and OAuth primitives.
+
+The Pi provider catalog includes `gpt-5.5`, `gpt-5.4`, `gpt-5.4-mini`, and `gpt-5.3-codex-spark`.
+
+This package is part of the CortexKit OpenAI Auth monorepo, which supports both OpenCode (`@cortexkit/opencode-openai-auth`) and Pi (`@cortexkit/pi-openai-auth`).
+
+## Install
+
+Install with Pi's package manager:
+
+```bash
+pi install npm:@cortexkit/pi-openai-auth@0.1.0
+```
+
+For an unpinned install:
+
+```bash
+pi install npm:@cortexkit/pi-openai-auth
+```
+
+To try it for one run without changing Pi settings:
+
+```bash
+pi -e npm:@cortexkit/pi-openai-auth
+```
+
+Restart Pi after installing, then authenticate through Pi's normal login flow:
+
+```text
+/login openai-codex
+```
+
+## License
+
+MIT

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+import type { ExtensionAPI } from '@earendil-works/pi-coding-agent';
+export default function cortexKitPiOpenAIAuth(pi: ExtensionAPI): void;

package/dist/index.js

@@ -0,0 +1,167 @@
+import { createAssistantMessageEventStream, streamSimpleOpenAICodexResponses, } from '@earendil-works/pi-ai';
+import { loginOpenAICodex, refreshOpenAICodexToken, } from '@earendil-works/pi-ai/oauth';
+import { RawWebSocket } from "./raw-ws-node.js";
+const BASE_URL = 'https://chatgpt.com/backend-api';
+class PiRawCodexWebSocket extends RawWebSocket {
+    constructor(url, options) {
+        const headers = options && typeof options === 'object' && !Array.isArray(options)
+            ? (options.headers ?? {})
+            : {};
+        super(String(url), headers);
+    }
+}
+let rawWebSocketInstallCount = 0;
+let originalWebSocket;
+function installRawCodexWebSocket() {
+    const global = globalThis;
+    if (rawWebSocketInstallCount === 0) {
+        originalWebSocket = global.WebSocket;
+        global.WebSocket = PiRawCodexWebSocket;
+    }
+    rawWebSocketInstallCount++;
+    return () => {
+        rawWebSocketInstallCount = Math.max(0, rawWebSocketInstallCount - 1);
+        if (rawWebSocketInstallCount === 0) {
+            if (global.WebSocket === PiRawCodexWebSocket) {
+                global.WebSocket = originalWebSocket;
+            }
+            originalWebSocket = undefined;
+        }
+    };
+}
+const OPENAI_CODEX_MODELS = [
+    {
+        id: 'gpt-5.5',
+        name: 'GPT-5.5',
+        api: 'openai-codex-responses',
+        provider: 'openai-codex',
+        baseUrl: BASE_URL,
+        reasoning: true,
+        thinkingLevelMap: { xhigh: 'xhigh', minimal: 'low' },
+        input: ['text', 'image'],
+        cost: { input: 5, output: 30, cacheRead: 0.5, cacheWrite: 0 },
+        contextWindow: 272_000,
+        maxTokens: 128_000,
+    },
+    {
+        id: 'gpt-5.4',
+        name: 'GPT-5.4',
+        api: 'openai-codex-responses',
+        provider: 'openai-codex',
+        baseUrl: BASE_URL,
+        reasoning: true,
+        thinkingLevelMap: { xhigh: 'xhigh', minimal: 'low' },
+        input: ['text', 'image'],
+        cost: { input: 2.5, output: 15, cacheRead: 0.25, cacheWrite: 0 },
+        contextWindow: 272_000,
+        maxTokens: 128_000,
+    },
+    {
+        id: 'gpt-5.4-mini',
+        name: 'GPT-5.4 mini',
+        api: 'openai-codex-responses',
+        provider: 'openai-codex',
+        baseUrl: BASE_URL,
+        reasoning: true,
+        thinkingLevelMap: { xhigh: 'xhigh', minimal: 'low' },
+        input: ['text', 'image'],
+        cost: { input: 0.75, output: 4.5, cacheRead: 0.075, cacheWrite: 0 },
+        contextWindow: 272_000,
+        maxTokens: 128_000,
+    },
+    {
+        id: 'gpt-5.3-codex-spark',
+        name: 'GPT-5.3 Codex Spark',
+        api: 'openai-codex-responses',
+        provider: 'openai-codex',
+        baseUrl: BASE_URL,
+        reasoning: true,
+        thinkingLevelMap: { xhigh: 'xhigh', minimal: 'low' },
+        input: ['text'],
+        cost: { input: 1.75, output: 14, cacheRead: 0.175, cacheWrite: 0 },
+        contextWindow: 128_000,
+        maxTokens: 128_000,
+    },
+];
+async function loginOpenAI(callbacks) {
+    return loginOpenAICodex({
+        onAuth: callbacks.onAuth,
+        onPrompt: callbacks.onPrompt,
+        onProgress: callbacks.onProgress,
+        onManualCodeInput: callbacks.onManualCodeInput,
+        originator: 'pi',
+    });
+}
+async function refreshOpenAI(credentials) {
+    return refreshOpenAICodexToken(credentials.refresh);
+}
+function streamOpenAI(model, context, options) {
+    const outer = createAssistantMessageEventStream();
+    const restoreWebSocket = installRawCodexWebSocket();
+    let inner;
+    try {
+        inner = streamSimpleOpenAICodexResponses(model, context, options);
+    }
+    catch (error) {
+        restoreWebSocket();
+        throw error;
+    }
+    void (async () => {
+        try {
+            for await (const event of inner) {
+                outer.push(event);
+            }
+            outer.end();
+        }
+        catch (error) {
+            outer.push({
+                type: 'error',
+                reason: 'error',
+                error: {
+                    role: 'assistant',
+                    content: [],
+                    api: model.api,
+                    provider: model.provider,
+                    model: model.id,
+                    usage: {
+                        input: 0,
+                        output: 0,
+                        cacheRead: 0,
+                        cacheWrite: 0,
+                        totalTokens: 0,
+                        cost: {
+                            input: 0,
+                            output: 0,
+                            cacheRead: 0,
+                            cacheWrite: 0,
+                            total: 0,
+                        },
+                    },
+                    stopReason: 'error',
+                    errorMessage: error instanceof Error ? error.message : String(error),
+                    timestamp: Date.now(),
+                },
+            });
+            outer.end();
+        }
+        finally {
+            restoreWebSocket();
+        }
+    })();
+    return outer;
+}
+export default function cortexKitPiOpenAIAuth(pi) {
+    pi.registerProvider('openai-codex', {
+        name: 'OpenAI Codex (CortexKit OAuth)',
+        baseUrl: BASE_URL,
+        api: 'openai-codex-responses',
+        models: OPENAI_CODEX_MODELS,
+        oauth: {
+            name: 'ChatGPT Plus/Pro (CortexKit)',
+            login: loginOpenAI,
+            refreshToken: refreshOpenAI,
+            getApiKey: (credentials) => credentials.access,
+        },
+        streamSimple: streamOpenAI,
+    });
+}

package/dist/raw-ws-node.d.ts

@@ -0,0 +1,27 @@
+type Listener = (event: unknown) => void;
+export declare class RawWebSocket {
+    url: string;
+    readyState: number;
+    private socket;
+    private listeners;
+    private rxBuffer;
+    private handshakeDone;
+    private expectedAccept;
+    private fragOpcode;
+    private fragChunks;
+    constructor(url: string, headers: Record<string, string>);
+    addEventListener(type: string, fn: Listener, _opts?: {
+        once?: boolean;
+    }): void;
+    removeEventListener(type: string, fn: Listener): void;
+    private emit;
+    private connect;
+    private onData;
+    private drainFrames;
+    private handleFrame;
+    send(data: string): void;
+    private writeFrame;
+    close(): void;
+    private log;
+}
+export {};

package/dist/raw-ws-node.js

@@ -0,0 +1,328 @@
+// Hand-rolled WebSocket client over raw TCP/TLS sockets.
+//
+// Purpose: native WebSocket implementations fix the HTTP upgrade header ORDER and
+// own the RFC 6455 frame codec, so they cannot speak the wire the way Codex's
+// Rust tokio-tungstenite client does. This client writes the upgrade bytes and
+// frames by hand, giving full control of header order + framing, which surfaces
+// Codex-style incremental streaming that native WebSocket implementations can
+// suppress.
+//
+// Used by the Pi package for Codex only. permessage-deflate is intentionally NOT
+// negotiated; plain text frames keep the codec simple.
+//
+// Implements only the subset of the WebSocket interface the plugin consumes:
+// addEventListener/removeEventListener for "open"|"message"|"error"|"close",
+// send(string), close(), and a `url` field. Text frames only on receive.
+import { connect as netConnect } from 'node:net';
+import { connect as tlsConnect } from 'node:tls';
+const WS_GUID = '258EAFA5-E914-47DA-95CA-C5AB0DC85B11';
+// Codex (tokio-tungstenite) application-header order. WS control headers
+// (host/connection/upgrade/sec-websocket-version/sec-websocket-key) are written
+// first by us in Codex's exact order; Sec-WebSocket-Extensions would go last but
+// we omit it (no permessage-deflate).
+const CODEX_APP_HEADER_ORDER = [
+    'chatgpt-account-id',
+    'authorization',
+    'user-agent',
+    'originator',
+    'openai-beta',
+    'version',
+    'x-codex-beta-features',
+    'x-codex-turn-metadata',
+    'x-client-request-id',
+    'session-id',
+    'thread-id',
+    'x-codex-window-id',
+];
+export class RawWebSocket {
+    url;
+    readyState = 0; // CONNECTING
+    socket;
+    listeners = {
+        open: new Set(),
+        message: new Set(),
+        error: new Set(),
+        close: new Set(),
+    };
+    rxBuffer = new Uint8Array(0);
+    handshakeDone = false;
+    expectedAccept = '';
+    // message reassembly across fragmented frames
+    fragOpcode = 0;
+    fragChunks = [];
+    constructor(url, headers) {
+        this.url = url;
+        void this.connect(url, headers);
+    }
+    addEventListener(type, fn, _opts) {
+        this.listeners[type]?.add(fn);
+    }
+    removeEventListener(type, fn) {
+        this.listeners[type]?.delete(fn);
+    }
+    emit(type, event) {
+        for (const fn of [...(this.listeners[type] ?? [])]) {
+            try {
+                fn(event);
+            }
+            catch {
+                // listener errors must not crash the socket loop
+            }
+        }
+    }
+    async connect(url, headers) {
+        const u = new URL(url.replace(/^ws:/, 'http:').replace(/^wss:/, 'https:'));
+        const host = u.hostname;
+        const port = u.port ? Number(u.port) : u.protocol === 'https:' ? 443 : 80;
+        const path = `${u.pathname}${u.search}`;
+        const keyBytes = crypto.getRandomValues(new Uint8Array(16));
+        const key = Buffer.from(keyBytes).toString('base64');
+        const acceptDigest = await crypto.subtle.digest('SHA-1', new TextEncoder().encode(key + WS_GUID));
+        this.expectedAccept = Buffer.from(new Uint8Array(acceptDigest)).toString('base64');
+        const lower = {};
+        for (const [k, v] of Object.entries(headers))
+            lower[k.toLowerCase()] = v;
+        // Build the upgrade in Codex's exact byte order.
+        const lines = [
+            `GET ${path} HTTP/1.1`,
+            `Host: ${host}`,
+            `Connection: Upgrade`,
+            `Upgrade: websocket`,
+            `Sec-WebSocket-Version: 13`,
+            `Sec-WebSocket-Key: ${key}`,
+        ];
+        for (const name of CODEX_APP_HEADER_ORDER) {
+            if (lower[name] !== undefined)
+                lines.push(`${canonical(name)}: ${lower[name]}`);
+        }
+        for (const [k, v] of Object.entries(headers)) {
+            if (!CODEX_APP_HEADER_ORDER.includes(k.toLowerCase()) &&
+                k.toLowerCase() !== 'content-length') {
+                lines.push(`${k}: ${v}`);
+            }
+        }
+        const request = `${lines.join('\r\n')}\r\n\r\n`;
+        try {
+            void this.log('connect_start', {
+                host,
+                port,
+                tls: u.protocol === 'https:',
+            });
+            const onOpen = () => {
+                this.socket?.write(request);
+            };
+            const socket = u.protocol === 'https:'
+                ? tlsConnect({ host, port, servername: host }, onOpen)
+                : netConnect({ host, port }, onOpen);
+            this.socket = socket;
+            socket.on('data', (data) => {
+                this.onData(typeof data === 'string' ? Buffer.from(data, 'binary') : data);
+            });
+            socket.on('error', (e) => {
+                this.readyState = 3;
+                const message = e instanceof Error ? e.message : String(e);
+                void this.log('socket_error', { message });
+                this.emit('error', { message });
+            });
+            socket.on('close', (hadError) => {
+                this.readyState = 3;
+                void this.log('socket_close', { hadError });
+                this.emit('close', { code: 1006, reason: 'socket closed' });
+            });
+        }
+        catch (e) {
+            this.readyState = 3;
+            void this.log('connect_exception', {
+                message: e instanceof Error ? e.message : String(e),
+            });
+            this.emit('error', {
+                message: e instanceof Error ? e.message : String(e),
+            });
+        }
+    }
+    onData(d) {
+        this.rxBuffer = concat(this.rxBuffer, d);
+        if (!this.handshakeDone) {
+            const text = Buffer.from(this.rxBuffer).toString('latin1');
+            const idx = text.indexOf('\r\n\r\n');
+            if (idx === -1)
+                return;
+            const headerText = text.slice(0, idx);
+            const statusLine = headerText.split('\r\n')[0] ?? '';
+            const acceptMatch = headerText.match(/sec-websocket-accept:\s*(\S+)/i);
+            if (!statusLine.includes(' 101')) {
+                this.readyState = 3;
+                this.socket?.destroy?.();
+                void this.log('upgrade_failed', { statusLine });
+                this.emit('error', { message: `WS upgrade failed: ${statusLine}` });
+                return;
+            }
+            if (!acceptMatch || acceptMatch[1] !== this.expectedAccept) {
+                this.readyState = 3;
+                this.socket?.destroy?.();
+                void this.log('accept_mismatch', { statusLine });
+                this.emit('error', {
+                    message: 'WS upgrade Sec-WebSocket-Accept mismatch',
+                });
+                return;
+            }
+            this.handshakeDone = true;
+            this.readyState = 1;
+            this.rxBuffer = this.rxBuffer.slice(idx + 4);
+            void this.log('open', { statusLine });
+            this.emit('open', {});
+        }
+        this.drainFrames();
+    }
+    drainFrames() {
+        // RFC 6455 frame parsing for server->client (never masked).
+        for (;;) {
+            const buf = this.rxBuffer;
+            if (buf.length < 2)
+                return;
+            const b0 = buf[0];
+            const b1 = buf[1];
+            const fin = (b0 & 0x80) !== 0;
+            const opcode = b0 & 0x0f;
+            const masked = (b1 & 0x80) !== 0;
+            let len = b1 & 0x7f;
+            let offset = 2;
+            if (len === 126) {
+                if (buf.length < 4)
+                    return;
+                len = (buf[2] << 8) | buf[3];
+                offset = 4;
+            }
+            else if (len === 127) {
+                if (buf.length < 10)
+                    return;
+                len = 0;
+                for (let i = 0; i < 8; i++)
+                    len = len * 256 + buf[2 + i];
+                offset = 10;
+            }
+            if (masked)
+                offset += 4; // shouldn't happen server->client
+            if (buf.length < offset + len)
+                return;
+            const payload = buf.slice(offset, offset + len);
+            this.rxBuffer = buf.slice(offset + len);
+            this.handleFrame(fin, opcode, payload);
+        }
+    }
+    handleFrame(fin, opcode, payload) {
+        if (opcode === 0x9) {
+            // ping -> pong (echo payload), masked
+            this.writeFrame(0xa, payload);
+            return;
+        }
+        if (opcode === 0xa)
+            return; // pong
+        if (opcode === 0x8) {
+            // close
+            let code = 1005;
+            let reason = '';
+            if (payload.length >= 2) {
+                code = (payload[0] << 8) | payload[1];
+                reason = Buffer.from(payload.slice(2)).toString('utf-8');
+            }
+            this.readyState = 3;
+            try {
+                this.socket?.end();
+            }
+            catch {
+                /* ignore */
+            }
+            this.emit('close', { code, reason });
+            return;
+        }
+        // data frame: 0x1 text, 0x2 binary, 0x0 continuation
+        if (opcode === 0x1 || opcode === 0x2) {
+            this.fragOpcode = opcode;
+            this.fragChunks = [payload];
+        }
+        else if (opcode === 0x0) {
+            this.fragChunks.push(payload);
+        }
+        if (!fin)
+            return;
+        const full = concatAll(this.fragChunks);
+        this.fragChunks = [];
+        if (this.fragOpcode === 0x1) {
+            const text = Buffer.from(full).toString('utf-8');
+            this.emit('message', { data: text });
+        }
+    }
+    send(data) {
+        if (this.readyState !== 1)
+            return;
+        this.writeFrame(0x1, new TextEncoder().encode(data));
+    }
+    writeFrame(opcode, payload) {
+        const len = payload.length;
+        const mask = crypto.getRandomValues(new Uint8Array(4));
+        let header;
+        if (len < 126)
+            header = [0x80 | opcode, 0x80 | len];
+        else if (len < 65536)
+            header = [0x80 | opcode, 0x80 | 126, (len >> 8) & 0xff, len & 0xff];
+        else {
+            header = [0x80 | opcode, 0x80 | 127];
+            for (let i = 7; i >= 0; i--)
+                header.push((len / 2 ** (8 * i)) & 0xff);
+        }
+        const masked = new Uint8Array(len);
+        for (let i = 0; i < len; i++)
+            masked[i] = payload[i] ^ mask[i % 4];
+        const frame = new Uint8Array(header.length + 4 + len);
+        frame.set(header, 0);
+        frame.set(mask, header.length);
+        frame.set(masked, header.length + 4);
+        try {
+            this.socket?.write(frame);
+        }
+        catch {
+            /* socket gone */
+        }
+    }
+    close() {
+        if (this.readyState === 3)
+            return;
+        this.readyState = 2;
+        try {
+            this.writeFrame(0x8, new Uint8Array([0x03, 0xe8])); // 1000
+            this.socket?.end();
+        }
+        catch {
+            /* ignore */
+        }
+        this.readyState = 3;
+    }
+    log(event, data) {
+        void event;
+        void data;
+        return Promise.resolve();
+    }
+}
+function canonical(lower) {
+    // Match Codex's header casing for the few that aren't all-lowercase on the wire.
+    return lower;
+}
+function concat(a, b) {
+    const out = new Uint8Array(a.length + b.length);
+    out.set(a, 0);
+    out.set(b, a.length);
+    return out;
+}
+function concatAll(parts) {
+    let total = 0;
+    for (const p of parts)
+        total += p.length;
+    const out = new Uint8Array(total);
+    let off = 0;
+    for (const p of parts) {
+        out.set(p, off);
+        off += p.length;
+    }
+    return out;
+}

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "@cortexkit/pi-openai-auth",
+  "version": "0.1.0",
+  "license": "MIT",
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/cortexkit/openai-auth.git",
+    "directory": "packages/pi"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "keywords": [
+    "pi-package"
+  ],
+  "pi": {
+    "extensions": [
+      "./dist/index.js"
+    ]
+  },
+  "scripts": {
+    "build": "rm -rf dist && tsc -p tsconfig.build.json",
+    "typecheck": "tsc",
+    "types": "tsc",
+    "prepublishOnly": "bun run build"
+  },
+  "peerDependencies": {
+    "@earendil-works/pi-ai": "*",
+    "@earendil-works/pi-coding-agent": "*",
+    "@earendil-works/pi-tui": "*"
+  }
+}