@giovannijecha/jecode 0.1.8 → 0.2.0

package/README.md

@@ -3,11 +3,7 @@
 </p>
 
 <p align="center">
-  <picture>
-    <source media="(prefers-color-scheme: dark)" srcset="docs/assets/brand/wordmark-light.svg">
-    <source media="(prefers-color-scheme: light)" srcset="docs/assets/brand/wordmark-dark.svg">
-    <img src="docs/assets/brand/wordmark-dark.svg" width="280" alt="Jecode">
-  </picture>
+  <img src="docs/assets/brand/wordmark-steel.svg" width="280" alt="Jecode">
 </p>
 
 <p align="center"><strong>Your code. Your loop.</strong></p>
@@ -29,7 +25,7 @@
   <a href="https://github.com/giovannijecha/jecode/releases">Releases</a>
 </p>
 
-> Jecode is an early 0.1.x release. The core loop is usable today; commands and
+> Jecode is an early 0.2.x release. The core loop is usable today; commands and
 > terminal interactions may still evolve before 1.0.
 
 ## Why Jecode
@@ -40,8 +36,8 @@
   diffs, approvals, reasoning, and status all share one full-screen TUI.
 - **Permission-aware.** Reads stay transparent; dangerous actions ask first.
   Session approvals can be reviewed and revoked.
-- **Provider-neutral.** Use Anthropic, OpenAI, or a local/remote Ollama server
-  without changing the workflow.
+- **Provider-neutral.** Use Anthropic or OpenAI API keys, a ChatGPT account, or
+  a local/remote Ollama server without changing the workflow.
 - **Lean by construction.** Jecode installs as plain JavaScript, runs on
   Node.js 22.18+ (22.x) or Node.js 24+, executes no installation scripts, and
   has zero third-party runtime dependencies.
@@ -149,15 +145,27 @@ published package runs no compilation or installation scripts.
 ## First session
 
 Jecode opens on an empty composer instead of forcing a setup wizard. Type
-**/settings** when you are ready to choose a provider, select a model, and add a
-credential. A credential can remain in memory for the current session or be
-saved explicitly under **~/.jecode**; it is never stored in the workspace.
+**/settings** when you are ready to choose a provider, select a model, and
+configure authentication. An API key can remain in memory for the current
+session or be saved explicitly under **~/.jecode**; it is never stored in the
+workspace.
 
-| Provider | Credential | Notes |
+| Provider ID | Authentication | Notes |
 |---|---|---|
-| Anthropic | ANTHROPIC_API_KEY | Cloud |
-| OpenAI | OPENAI_API_KEY | Cloud |
-| Ollama | OLLAMA_API_KEY for Cloud/remote | Cloud with a key, local without one |
+| anthropic | ANTHROPIC_API_KEY | Anthropic API |
+| openai | OPENAI_API_KEY | OpenAI API |
+| openai-codex | ChatGPT OAuth | Experimental; uses eligible ChatGPT Codex access |
+| ollama | OLLAMA_API_KEY for Cloud/remote | Cloud with a key, local without one |
+
+Choose **openai-codex** to sign in on OpenAI's website without pasting a key.
+Jecode offers a local browser callback and a device-code flow; WSL and remote
+terminals default to the device code. The connection is saved only after the
+flow completes. Availability and usage limits are determined by the ChatGPT
+account and plan, not by OpenAI API credits. This integration is experimental
+and is not an endorsement of Jecode by OpenAI.
+
+Anthropic remains API-key only. Jecode does not reuse a Claude consumer
+subscription or copy credentials from another client.
 
 Choose **cloud**, **local**, or a custom endpoint from the Ollama connection row
 in **/settings**. Existing users with an Ollama API key automatically use
@@ -170,16 +178,15 @@ Type **/** to open searchable command completion inside the composer.
 
 | Command | What it does |
 |---|---|
-| /settings | Manage provider, connection, model, limits, motion, and credentials |
+| /settings | Manage provider, connection, model, limits, motion, and authentication |
 | /effort | Change and save reasoning effort directly |
 | /providers | Switch the provider for the next turn |
 | /models | Search the live model catalogue |
-| /credentials | Add, replace, inspect, or forget saved credentials |
-| /permissions | Review or revoke remembered session approvals |
-| /usage | Show normalized token usage |
-| /new | Start a clean in-memory conversation |
+| /credentials | Manage API keys and the connected ChatGPT account |
+| /permissions | Manage session tool access and remembered approvals |
+| /new | Start a clean conversation and reset session tool permissions |
 | /export | Save a timestamped Markdown transcript in the launch directory |
-| /help | Show commands and controls |
+| /help | Open a temporary keyboard reference in the composer dock |
 | /exit | Restore the terminal and exit |
 
 Useful controls:
@@ -196,7 +203,9 @@ Useful controls:
 The one-line footer keeps model, effort, and workspace on the left. Live work
 stays visible on the reasoning and tool rail; the right edge carries the
 interrupt hint, readiness guidance, and temporary feedback without polluting
-the transcript.
+the transcript. Slash commands never append content to the conversation or its
+Markdown export; **/help** closes with **Esc**, and token accounting remains
+internal to the active session.
 
 ## Configuration
 
@@ -210,14 +219,16 @@ settings, built-in defaults.
 | --ollama-host | OLLAMA_HOST | Cloud with an Ollama key, local without one |
 | --root | — | Current directory |
 | --effort | JECODE_EFFORT | high |
-| --max-tokens | JECODE_MAX_TOKENS | 64000 |
+| --max-tokens | JECODE_MAX_TOKENS | 64000; not sent by openai-codex |
 | --max-steps | JECODE_MAX_STEPS | 40 |
 | --reduced-motion | JECODE_REDUCED_MOTION=1 | Off |
 | --auto-approve | JECODE_AUTO_APPROVE=1 | Off |
 
 Persistent preferences live in **~/.jecode/settings.json**. Explicitly saved
-credentials live in **~/.jecode/credentials.json** with owner-only permissions
-where the operating system supports them. Environment credentials always win.
+API keys live in **~/.jecode/credentials.json**; the ChatGPT OAuth account lives
+separately in **~/.jecode/accounts.json**. Both secret stores use owner-only
+permissions where the operating system supports them. Environment API keys
+always win.
 
 Jecode has one interface theme: dark Steel. **NO_COLOR** is supported for
 terminals and pipelines that disable colour.
@@ -241,12 +252,15 @@ untrusted data.
 
 - Tool paths are confined to the selected workspace. Writes reject symlink and
   junction components, then revalidate the boundary during atomic replacement.
-- Dangerous tools require approval unless the process was started with
-  **--auto-approve**.
+- Dangerous tools ask by default unless explicitly allowed for the session in
+  **/permissions** or the process started with **--auto-approve**.
 - Credential fields are masked and excluded from transcripts. Approved shell
   commands receive no credential-like environment variables, and recognized
   credential values are redacted before tool output reaches the model, screen,
   history, or export.
+- ChatGPT OAuth uses PKCE and an exact loopback callback or the OpenAI device
+  flow. Refresh-token rotation is serialized across Jecode processes; OAuth
+  tokens are withheld and redacted like API keys.
 - Terminal control characters are neutralized before rendering.
 - Remote Ollama endpoints require HTTPS. Provider HTTP redirects are rejected
   rather than followed across an implicit trust boundary.

package/dist/account-lock.js

@@ -0,0 +1,112 @@
+// A tiny cross-process lock for rotating OAuth credentials.
+//
+// Refresh tokens may rotate after one use. Two Jecode processes refreshing
+// the same account concurrently would make one of them persist a dead token,
+// so account mutations serialize through an atomic lock directory.
+import { mkdir, open, readFile, rename, rmdir, stat, unlink } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import * as path from "node:path";
+const WAIT_MS = 50;
+const WAIT_LIMIT_MS = 20_000;
+const STALE_MS = 60_000;
+export async function withAccountLock(accountFile, body, signal) {
+    throwIfAborted(signal);
+    const directory = `${accountFile}.lock`;
+    const token = `${process.pid}:${randomUUID()}`;
+    const started = Date.now();
+    while (!(await acquire(directory, token))) {
+        if (signal?.aborted === true)
+            throw abortReason(signal);
+        if (Date.now() - started >= WAIT_LIMIT_MS) {
+            throw new Error("timed out waiting for the account store");
+        }
+        await recoverStale(directory);
+        await wait(WAIT_MS, signal);
+    }
+    try {
+        throwIfAborted(signal);
+        return await body();
+    }
+    finally {
+        await release(directory, token);
+    }
+}
+async function acquire(directory, token) {
+    let created = false;
+    try {
+        await mkdir(directory, { mode: 0o700 });
+        created = true;
+        const owner = await open(path.join(directory, "owner"), "wx", 0o600);
+        try {
+            await owner.writeFile(token, "utf8");
+            await owner.sync();
+        }
+        finally {
+            await owner.close();
+        }
+        return true;
+    }
+    catch (error) {
+        if (!created && error.code === "EEXIST")
+            return false;
+        if (created)
+            await removeLock(directory);
+        throw error;
+    }
+}
+async function recoverStale(directory) {
+    try {
+        const details = await stat(directory);
+        if (Date.now() - details.mtimeMs < STALE_MS)
+            return;
+        const quarantined = `${directory}.${randomUUID()}.stale`;
+        await rename(directory, quarantined);
+        await unlink(path.join(quarantined, "owner")).catch(() => undefined);
+        await rmdir(quarantined).catch(() => undefined);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code !== "ENOENT" && code !== "EACCES" && code !== "EPERM")
+            throw error;
+    }
+}
+async function release(directory, token) {
+    try {
+        const owner = path.join(directory, "owner");
+        if ((await readFile(owner, "utf8")) !== token)
+            return;
+        await unlink(owner);
+        await rmdir(directory);
+    }
+    catch {
+        // A recovered stale lock or an already-removed directory is no longer ours.
+    }
+}
+async function removeLock(directory) {
+    await unlink(path.join(directory, "owner")).catch(() => undefined);
+    await rmdir(directory).catch(() => undefined);
+}
+function wait(ms, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal?.aborted === true) {
+            reject(abortReason(signal));
+            return;
+        }
+        const timer = setTimeout(() => {
+            signal?.removeEventListener("abort", onAbort);
+            resolve();
+        }, ms);
+        const onAbort = () => {
+            clearTimeout(timer);
+            reject(signal === undefined ? new Error("cancelled") : abortReason(signal));
+        };
+        signal?.addEventListener("abort", onAbort, { once: true });
+    });
+}
+function abortReason(signal) {
+    return signal.reason instanceof Error ? signal.reason : new Error("cancelled");
+}
+function throwIfAborted(signal) {
+    if (signal?.aborted === true)
+        throw abortReason(signal);
+}

package/dist/accounts.js

@@ -0,0 +1,100 @@
+// OAuth accounts persisted under ~/.jecode, apart from API keys.
+import { chmod, mkdir } from "node:fs/promises";
+import { readFileSync } from "node:fs";
+import * as path from "node:path";
+import { atomicWrite } from "./atomic.js";
+import { withAccountLock } from "./account-lock.js";
+import { userDataLabel, userDataPath } from "./user-data.js";
+let cached;
+export function openAICodexAccount() {
+    const account = store().accounts["openai-codex"];
+    return account === undefined ? undefined : { ...account };
+}
+export function accountValues() {
+    const account = store().accounts["openai-codex"];
+    return account === undefined ? [] : [account.accessToken, account.refreshToken];
+}
+export function accountsPath() {
+    return userDataPath("accounts.json");
+}
+export function accountsLabel() {
+    return userDataLabel("accounts.json");
+}
+export async function updateOpenAICodexAccount(change, signal) {
+    const file = accountsPath();
+    const directory = path.dirname(file);
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    if (process.platform !== "win32")
+        await chmod(directory, 0o700);
+    return withAccountLock(file, async () => {
+        const current = readStore(file);
+        const next = await change(current.accounts["openai-codex"]);
+        const accounts = { ...current.accounts };
+        if (next === undefined)
+            delete accounts["openai-codex"];
+        else
+            accounts["openai-codex"] = { ...next };
+        const updated = { version: 1, accounts };
+        await atomicWrite(file, `${JSON.stringify(updated, null, 2)}\n`, { mode: 0o600 });
+        cached = updated;
+        return next === undefined ? undefined : { ...next };
+    }, signal);
+}
+export function reloadAccounts() {
+    cached = undefined;
+}
+function store() {
+    if (cached === undefined)
+        cached = readStore(accountsPath());
+    return cached;
+}
+function readStore(file) {
+    try {
+        const parsed = JSON.parse(readFileSync(file, "utf8"));
+        return normalize(parsed);
+    }
+    catch {
+        return { version: 1, accounts: {} };
+    }
+}
+function normalize(value) {
+    if (!record(value) || value["version"] !== 1 || !record(value["accounts"])) {
+        return { version: 1, accounts: {} };
+    }
+    const account = normalizeOpenAI(value["accounts"]["openai-codex"]);
+    return {
+        version: 1,
+        accounts: account === undefined ? {} : { "openai-codex": account },
+    };
+}
+function normalizeOpenAI(value) {
+    if (!record(value))
+        return undefined;
+    const accessToken = nonempty(value["accessToken"]);
+    const refreshToken = nonempty(value["refreshToken"]);
+    const accountId = nonempty(value["accountId"]);
+    const expiresAt = value["expiresAt"];
+    if (accessToken === undefined ||
+        refreshToken === undefined ||
+        accountId === undefined ||
+        typeof expiresAt !== "number" ||
+        !Number.isSafeInteger(expiresAt) ||
+        expiresAt <= 0)
+        return undefined;
+    const email = nonempty(value["email"]);
+    const plan = nonempty(value["plan"]);
+    return {
+        accessToken,
+        refreshToken,
+        expiresAt,
+        accountId,
+        ...(email === undefined ? {} : { email }),
+        ...(plan === undefined ? {} : { plan }),
+    };
+}
+function nonempty(value) {
+    return typeof value === "string" && value.trim() !== "" ? value : undefined;
+}
+function record(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/dist/cli-info.js

@@ -8,10 +8,10 @@ Usage:
 
 Options:
   --root <path>          workspace root (default: current directory)
-  --provider <id>        anthropic, openai, or ollama
+  --provider <id>        anthropic, openai, openai-codex, or ollama
   --model <id>           model for the selected provider
   --ollama-host <url>    Ollama Cloud, local, or custom endpoint
-  --effort <level>       low, medium, high, or max
+  --effort <level>       low, medium, high, xhigh, or max
   --max-tokens <number>  output-token ceiling
   --max-steps <number>   tool-loop ceiling
   --reduced-motion       disable animated terminal states

package/dist/commands.js

@@ -4,33 +4,27 @@
 // without asking the provider what it has — but none of them ever sends a
 // message. Provider and credential interaction lives in provider-commands.ts;
 // this file keeps command discovery, dispatch, and local session operations.
-import { heading } from "./tui/picker.js";
-import { modelsCommand, providersCommand, setupCommand } from "./provider-commands.js";
+import { modelsCommand, providersCommand } from "./provider-commands.js";
 import { credentialsCommand } from "./credential-commands.js";
+import { permissionsCommand } from "./permission-command.js";
 import { effortCommand, settingsCommand } from "./settings-command.js";
-import { emptyUsage, formatTokens } from "./usage.js";
+import { emptyUsage } from "./usage.js";
 /**
  * The commands, declared once.
  *
- * `/help` and the completion menu both read this list, so a command cannot
- * exist in the switch below and be missing from the two places that tell the
- * user it exists.
- *
  * Deliberately short. `/settings` owns persistent defaults; the narrower
- * provider, model, effort, credential, and setup commands remain useful direct
- * paths into the same interactions.
+ * provider, model, effort, and credential commands remain useful direct paths
+ * into the same interactions.
  */
 export const COMMANDS = [
-    { name: "help", blurb: "this list" },
+    { name: "help", blurb: "show keyboard controls" },
     { name: "exit", blurb: "exit and restore the terminal" },
-    { name: "new", blurb: "start a clean in-memory session" },
-    { name: "usage", blurb: "show token usage for this session" },
+    { name: "new", blurb: "start clean and reset tool permissions" },
     { name: "export", blurb: "save this transcript as Markdown" },
-    { name: "permissions", blurb: "review or revoke remembered approvals" },
+    { name: "permissions", blurb: "manage session tool access" },
     { name: "settings", blurb: "change and save jecode defaults" },
     { name: "effort", blurb: "set the reasoning effort" },
-    { name: "credentials", blurb: "inspect, replace, or forget API keys" },
-    { name: "setup", blurb: "make the current provider ready" },
+    { name: "credentials", blurb: "manage API keys and connected accounts" },
     { name: "models", blurb: "pick a model, from what the provider offers" },
     { name: "providers", blurb: "pick a provider" },
 ];
@@ -38,7 +32,16 @@ export async function handleCommand(line, session, host) {
     const [name] = line.slice(1).trim().split(/\s+/);
     switch (name) {
         case "help":
-            host.emit(help());
+            if (host.showHelp === undefined) {
+                host.emit({
+                    kind: "notice",
+                    text: "interactive help needs the TUI · run jecode --help for startup options",
+                    tone: "info",
+                });
+            }
+            else {
+                await host.showHelp();
+            }
             return "handled";
         case "exit":
             return "exit";
@@ -46,10 +49,7 @@ export async function handleCommand(line, session, host) {
             session.history.length = 0;
             session.usage = emptyUsage();
             host.reset?.();
-            host.emit({ kind: "notice", text: "new session · history, usage, and approvals cleared", tone: "info" });
-            return "handled";
-        case "usage":
-            host.emit(usage(session));
+            host.emit({ kind: "notice", text: "new session", tone: "info" });
             return "handled";
         case "export":
             if (host.exportTranscript === undefined) {
@@ -57,11 +57,11 @@ export async function handleCommand(line, session, host) {
             }
             else {
                 const saved = await host.exportTranscript();
-                host.emit({ kind: "notice", text: `transcript saved to ${saved}`, tone: "info" });
+                host.emit({ kind: "notice", text: `saved · ${saved}`, tone: "info" });
             }
             return "handled";
         case "permissions":
-            await permissions(session, host);
+            await permissionsCommand(session, host);
             return "handled";
         case "settings":
             await settingsCommand(session, host);
@@ -72,9 +72,6 @@ export async function handleCommand(line, session, host) {
         case "credentials":
             await credentialsCommand(session, host);
             return "handled";
-        case "setup":
-            await setupCommand(session, host);
-            return "handled";
         case "models":
             await modelsCommand(session, host);
             return "handled";
@@ -82,89 +79,17 @@ export async function handleCommand(line, session, host) {
             await providersCommand(session, host);
             return "handled";
         default:
-            host.emit({ kind: "notice", text: `unknown command /${name ?? ""} — try /help`, tone: "warn" });
+            host.emit({
+                kind: "notice",
+                text: `unknown command /${name ?? ""} · type / to browse commands`,
+                tone: "warn",
+            });
             return "handled";
     }
 }
-function usage(session) {
-    const value = session.usage;
-    const rows = [
-        `  requests${String(value.requests).padStart(18)}`,
-        `  latest context${formatTokens(value.lastInputTokens).padStart(12)}`,
-        `  input${formatTokens(value.inputTokens).padStart(21)}`,
-        `  output${formatTokens(value.outputTokens).padStart(20)}`,
-    ];
-    if (value.cachedInputTokens > 0)
-        rows.push(`  cached input${formatTokens(value.cachedInputTokens).padStart(14)}`);
-    if (value.cacheWriteInputTokens > 0) {
-        rows.push(`  cache writes${formatTokens(value.cacheWriteInputTokens).padStart(14)}`);
-    }
-    if (value.reasoningTokens > 0)
-        rows.push(`  reasoning${formatTokens(value.reasoningTokens).padStart(17)}`);
-    return { kind: "list", items: rows.map((text) => ({ text, dim: false })) };
-}
-async function permissions(session, host) {
-    const choose = chooser(host);
-    if (choose === undefined)
-        return;
-    if (session.config.autoApprove) {
-        host.emit({
-            kind: "notice",
-            text: "--auto-approve is active · every dangerous call is allowed for this process",
-            tone: "warn",
-        });
-    }
-    const entries = host.permissions?.() ?? [];
-    if (entries.length === 0) {
-        host.emit({ kind: "notice", text: "no remembered session permissions", tone: "info" });
-        return;
-    }
-    const index = await choose({
-        title: heading("revoke permission", "applies only to this session", session.palette),
-        options: [
-            ...entries.map((entry) => ({ label: entry.label, hint: "revoke" })),
-            { label: "all remembered permissions", hint: "revoke all" },
-        ],
-        index: 0,
-    });
-    if (index === undefined)
-        return;
-    if (index === entries.length) {
-        host.revokePermission?.();
-        host.emit({ kind: "notice", text: "all remembered permissions revoked", tone: "info" });
-        return;
-    }
-    const entry = entries[index];
-    if (entry === undefined)
-        return;
-    host.revokePermission?.(entry.key);
-    host.emit({ kind: "notice", text: `revoked · ${entry.label}`, tone: "info" });
-}
 function chooser(host) {
     if (host.choose === undefined) {
         host.emit({ kind: "notice", text: "that command needs the screen", tone: "warn" });
     }
     return host.choose;
 }
-function help() {
-    const width = Math.max(...COMMANDS.map((c) => label(c).length));
-    return {
-        kind: "list",
-        items: [
-            ...COMMANDS.map((command) => ({
-                text: `  ${label(command).padEnd(width + 4)}${command.blurb}`,
-                dim: false,
-            })),
-            { text: "", dim: true },
-            { text: "  esc interrupts a running turn · ctrl+c exits", dim: true },
-            { text: "  wheel or pgup / pgdn scrolls · ctrl+l redraws", dim: true },
-            { text: "  ctrl+o expands the latest reasoning or tool details", dim: true },
-            { text: "  type in the model picker to filter · home/end jumps", dim: true },
-            { text: "  ↑↓ selects an open menu · tab completes · esc closes it", dim: true },
-            { text: "  enter selects or sends · alt+enter starts a new line", dim: true },
-        ],
-    };
-}
-function label(command) {
-    return `/${command.name}`;
-}

package/dist/controller.js

@@ -29,6 +29,9 @@ export async function runTurn(history, options, events, signal) {
             onStatus: (status) => events.onStatus?.(status),
         });
         const calls = assistant.content.filter(isToolCall);
+        if (assistant.content.length === 0) {
+            throw new Error(`${options.provider.id} completed without an answer or tool call`);
+        }
         if (calls.length > MAX_TOOL_CALLS_PER_STEP) {
             throw new Error(`provider returned ${calls.length} tool calls in one step (maximum ${MAX_TOOL_CALLS_PER_STEP})`);
         }