@giovannijecha/jecode 0.1.8 → 0.2.0

package/dist/credential-commands.js

@@ -1,7 +1,9 @@
-// Credential command flows shared by setup and provider selection.
+// Credential command flows shared by settings and provider selection.
 import { heading } from "./tui/picker.js";
 import { EMPTY } from "./tui/editor.js";
 import { PROVIDERS } from "./providers/index.js";
+import { openAIAccountHint } from "./openai-account.js";
+import { ensureOpenAIAccount, openAIAccountCommand, } from "./openai-account-command.js";
 import { credentialSource, forgetSaved, hasSaved, hold, keep, storeLabel, } from "./credentials.js";
 /** Ask for a key, then ask separately whether it may be written to disk. */
 export async function askForKey(name, host, pal) {
@@ -31,21 +33,20 @@ export async function askForKey(name, host, pal) {
     });
     if (index === 0) {
         hold(name, value);
-        host.emit({ kind: "notice", text: "credential available for this session", tone: "info" });
+        host.emit({ kind: "notice", text: "API key ready · this session", tone: "info" });
         return true;
     }
     if (index === 1) {
         try {
             await keep(name, value);
-            host.emit({ kind: "notice", text: `credential saved · ${storeLabel()}`, tone: "info" });
+            host.emit({ kind: "notice", text: "API key saved", tone: "info" });
             return true;
         }
         catch (error) {
-            host.emit({ kind: "notice", text: `could not save credential · ${error.message}`, tone: "error" });
+            host.emit({ kind: "notice", text: `could not save API key · ${error.message}`, tone: "error" });
             return false;
         }
     }
-    host.emit({ kind: "notice", text: "credential discarded", tone: "warn" });
     return false;
 }
 export async function credentialsCommand(session, host) {
@@ -53,10 +54,12 @@ export async function credentialsCommand(session, host) {
     if (choose === undefined)
         return;
     const index = await choose({
-        title: heading("credential", "values are never shown", session.palette),
+        title: heading("authentication", "secrets are never shown", session.palette),
         options: PROVIDERS.map((provider) => ({
-            label: provider.keyVar,
-            hint: credentialSource(provider.keyVar) ?? "missing",
+            label: provider.auth.kind === "api-key" ? provider.auth.keyVar : `${provider.auth.label} account`,
+            hint: provider.auth.kind === "api-key"
+                ? credentialSource(provider.auth.keyVar) ?? "missing"
+                : openAIAccountHint(),
         })),
         index: Math.max(0, PROVIDERS.findIndex((provider) => provider.id === session.provider.id)),
     });
@@ -65,12 +68,16 @@ export async function credentialsCommand(session, host) {
     const provider = PROVIDERS[index];
     if (provider === undefined)
         return;
-    const name = provider.keyVar;
+    if (provider.auth.kind === "oauth") {
+        await openAIAccountCommand(session, host);
+        return;
+    }
+    const name = provider.auth.keyVar;
     const source = credentialSource(name);
     if (source === "environment") {
         host.emit({
             kind: "notice",
-            text: `${name} comes from the environment · update it outside jecode and restart`,
+            text: `${name} comes from the environment · restart after changing it`,
             tone: "info",
         });
         if (hasSaved(name))
@@ -80,14 +87,13 @@ export async function credentialsCommand(session, host) {
     const actions = [
         { label: source === undefined ? "add credential" : "replace credential", key: "r" },
         ...(hasSaved(name) ? [{ label: "forget saved copy", hint: storeLabel(), key: "f" }] : []),
-        { label: "close", key: "c" },
     ];
     const action = await choose({
         title: heading(name, source ?? "missing", session.palette),
         options: actions,
         index: 0,
     });
-    if (action === undefined || action === actions.length - 1)
+    if (action === undefined)
         return;
     if (actions[action]?.key === "f") {
         await forget(name, host);
@@ -95,6 +101,26 @@ export async function credentialsCommand(session, host) {
     }
     await askForKey(name, host, session.palette);
 }
+/** Offer the authentication flow owned by a provider, if that is its blocker. */
+export async function ensureProviderAuthentication(provider, session, host) {
+    const blocked = provider.blocked();
+    if (blocked === undefined)
+        return true;
+    if (provider.auth.kind === "oauth") {
+        return provider.auth.account === "openai-codex"
+            ? ensureOpenAIAccount(session, host)
+            : false;
+    }
+    if (!blocked.startsWith(`${provider.auth.keyVar} `)) {
+        host.emit({ kind: "notice", text: blocked, tone: "error" });
+        return false;
+    }
+    await askForKey(provider.auth.keyVar, host, session.palette);
+    return provider.blocked() === undefined;
+}
+export function authenticationNeed(provider) {
+    return provider.auth.kind === "oauth" ? `${provider.auth.label} sign-in` : "an API key";
+}
 async function offerForget(name, session, host, hint) {
     if (host.choose === undefined)
         return;
@@ -114,12 +140,12 @@ async function forget(name, host) {
         const removed = await forgetSaved(name);
         host.emit({
             kind: "notice",
-            text: removed ? "saved credential removed" : "no saved credential to remove",
+            text: removed ? "API key removed" : "no saved API key",
             tone: removed ? "info" : "warn",
         });
     }
     catch (error) {
-        host.emit({ kind: "notice", text: `could not forget: ${error.message}`, tone: "error" });
+        host.emit({ kind: "notice", text: `could not remove API key · ${error.message}`, tone: "error" });
     }
 }
 function chooser(host) {

package/dist/credential-safety.js

@@ -1,5 +1,6 @@
 // The shell needs a useful process environment, not the application's secrets.
 import { credentialValues } from "./credentials.js";
+import { accountValues } from "./accounts.js";
 const REDACTED = "[credential redacted]";
 const SENSITIVE_ENVIRONMENT_NAME = /(?:^|_)(?:API_?KEY|ACCESS_?KEY|PRIVATE_?KEY|KEY|TOKEN|SECRET|PASSWORD|PASSWD|PASS|PWD|CREDENTIALS?|AUTH|JWT|COOKIE|PAT)(?:_|$)/i;
 const COMPACT_SENSITIVE_ENVIRONMENT_NAME = /^(?:PGPASSWORD)$/i;
@@ -60,7 +61,7 @@ function sensitiveEnvironmentName(name) {
         COMPACT_SENSITIVE_ENVIRONMENT_NAME.test(normalized));
 }
 function secrets(source) {
-    const values = new Set(credentialValues());
+    const values = new Set([...credentialValues(), ...accountValues()]);
     for (const [name, value] of Object.entries(source)) {
         if (value !== undefined && value !== "" && sensitiveEnvironment(name, value))
             values.add(value);

package/dist/external-browser.js

@@ -0,0 +1,53 @@
+// Open one HTTPS URL without involving a shell or interpolating commands.
+import { spawn } from "node:child_process";
+import { readFileSync } from "node:fs";
+export async function openExternal(url) {
+    const target = new URL(url);
+    if (target.protocol !== "https:")
+        throw new Error("only HTTPS links may be opened");
+    const command = browserCommand(target.href);
+    if (command === undefined)
+        return false;
+    return new Promise((resolve) => {
+        const child = spawn(command.file, command.args, {
+            detached: true,
+            stdio: "ignore",
+            windowsHide: true,
+        });
+        child.once("error", () => resolve(false));
+        child.once("spawn", () => {
+            child.unref();
+            resolve(true);
+        });
+    });
+}
+function browserCommand(url) {
+    if (process.platform === "win32") {
+        return { file: "rundll32.exe", args: ["url.dll,FileProtocolHandler", url] };
+    }
+    if (process.platform === "darwin")
+        return { file: "open", args: [url] };
+    if (isWsl())
+        return { file: "explorer.exe", args: [url] };
+    return { file: "xdg-open", args: [url] };
+}
+export function headlessEnvironment() {
+    if (isWsl() || process.env["SSH_CONNECTION"] !== undefined || process.env["SSH_TTY"] !== undefined) {
+        return true;
+    }
+    return process.platform === "linux" &&
+        process.env["DISPLAY"] === undefined &&
+        process.env["WAYLAND_DISPLAY"] === undefined;
+}
+function isWsl() {
+    if (process.platform !== "linux")
+        return false;
+    if (process.env["WSL_DISTRO_NAME"] !== undefined || process.env["WSL_INTEROP"] !== undefined)
+        return true;
+    try {
+        return /microsoft/i.test(readFileSync("/proc/version", "utf8"));
+    }
+    catch {
+        return false;
+    }
+}

package/dist/oauth-http.js

@@ -0,0 +1,114 @@
+// A narrow HTTP boundary for OAuth authority requests.
+//
+// These requests never redirect, never retry, and never retain an unbounded
+// response. Authorization codes and refresh tokens must not leak into errors.
+const AUTH_ORIGIN = "https://auth.openai.com";
+const TIMEOUT_MS = 15_000;
+const MAX_BODY_CHARS = 64_000;
+export async function oauthRequest(url, body, signal, accepted = [200]) {
+    const target = new URL(url);
+    if (target.origin !== AUTH_ORIGIN || target.username !== "" || target.password !== "") {
+        throw new Error("OAuth request target is not allowed");
+    }
+    const timeout = new AbortController();
+    const timer = setTimeout(() => timeout.abort(new Error("OpenAI sign-in timed out")), TIMEOUT_MS);
+    const combined = signal === undefined
+        ? timeout.signal
+        : AbortSignal.any([signal, timeout.signal]);
+    const secrets = bodySecrets(body);
+    let response;
+    let text;
+    try {
+        response = await fetch(target, {
+            method: "POST",
+            headers: { "content-type": body.contentType, accept: "application/json" },
+            body: body.contentType === "application/json"
+                ? JSON.stringify(body.value)
+                : body.value.toString(),
+            cache: "no-store",
+            redirect: "manual",
+            signal: combined,
+        });
+        if (response.status >= 300 && response.status < 400) {
+            await response.body?.cancel().catch(() => undefined);
+            throw new Error(`OpenAI sign-in redirect rejected (${response.status})`);
+        }
+        text = await boundedText(response);
+    }
+    catch (error) {
+        if (timeout.signal.aborted)
+            throw timeout.signal.reason;
+        if (signal?.aborted === true)
+            throw abortReason(signal);
+        if (error instanceof Error && error.message.startsWith("OpenAI sign-in"))
+            throw error;
+        const detail = error instanceof Error ? error.message : String(error);
+        throw new Error(`OpenAI sign-in network error: ${detail}`);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+    const value = parse(text);
+    if (!accepted.includes(response.status)) {
+        throw new Error(`OpenAI sign-in failed (${response.status})${errorDetail(value, secrets)}`);
+    }
+    return { status: response.status, value };
+}
+async function boundedText(response) {
+    if (response.body === null)
+        return "";
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    let text = "";
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                return text + decoder.decode();
+            text += decoder.decode(value, { stream: true });
+            if (text.length > MAX_BODY_CHARS) {
+                await reader.cancel().catch(() => undefined);
+                throw new Error("OpenAI sign-in returned too much data");
+            }
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+}
+function parse(text) {
+    if (text.trim() === "")
+        return {};
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new Error("OpenAI sign-in returned an invalid response");
+    }
+}
+function errorDetail(value, secrets) {
+    if (!record(value))
+        return "";
+    const detail = [value["error_description"], value["message"], value["error"]]
+        .find((entry) => typeof entry === "string");
+    if (typeof detail !== "string" || detail.trim() === "")
+        return "";
+    let safe = detail.replace(/[\r\n]+/g, " ");
+    for (const secret of secrets)
+        safe = safe.replaceAll(secret, "[credential redacted]");
+    return ` · ${safe.slice(0, 300)}`;
+}
+function bodySecrets(body) {
+    const values = body.contentType === "application/x-www-form-urlencoded"
+        ? [...body.value.values()]
+        : record(body.value)
+            ? Object.values(body.value).filter((value) => typeof value === "string")
+            : [];
+    return values.filter((value) => value.length >= 8);
+}
+function abortReason(signal) {
+    return signal.reason instanceof Error ? signal.reason : new Error("cancelled");
+}
+function record(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/dist/openai-account-command.js

@@ -0,0 +1,124 @@
+// Interactive ChatGPT account management for the OpenAI Codex provider.
+import { openAICodexAccount } from "./accounts.js";
+import { headlessEnvironment, openExternal } from "./external-browser.js";
+import { openAIAccountHint, removeOpenAIAccount, saveOpenAIAccount, } from "./openai-account.js";
+import { beginBrowserLogin, beginDeviceLogin, } from "./openai-oauth.js";
+import { heading } from "./tui/picker.js";
+const DEFAULT_DEPENDENCIES = {
+    beginBrowser: beginBrowserLogin,
+    beginDevice: beginDeviceLogin,
+    openUrl: openExternal,
+    headless: headlessEnvironment,
+};
+export async function openAIAccountCommand(session, host, dependencies = DEFAULT_DEPENDENCIES) {
+    if (host.choose === undefined)
+        return false;
+    const connected = openAICodexAccount() !== undefined;
+    const actions = connected
+        ? [
+            { label: "reconnect ChatGPT", hint: "replace the current sign-in", key: "r" },
+            { label: "sign out", hint: "remove the saved account", key: "s" },
+        ]
+        : [{ label: "connect ChatGPT", hint: "sign in with OpenAI", key: "c" }];
+    const action = await host.choose({
+        title: heading("ChatGPT", openAIAccountHint(), session.palette),
+        options: actions,
+        index: 0,
+    });
+    if (action === undefined)
+        return false;
+    if (connected && actions[action]?.key === "s") {
+        const result = await removeOpenAIAccount(host.signal);
+        host.emit({
+            kind: "notice",
+            text: result.revokeFailed ? "ChatGPT disconnected · remote sign-out could not be confirmed" : "ChatGPT disconnected",
+            tone: result.revokeFailed ? "warn" : "info",
+        });
+        return result.removed;
+    }
+    return connectOpenAIAccount(session, host, dependencies);
+}
+export async function ensureOpenAIAccount(session, host, dependencies = DEFAULT_DEPENDENCIES) {
+    if (openAICodexAccount() !== undefined)
+        return true;
+    return connectOpenAIAccount(session, host, dependencies);
+}
+async function connectOpenAIAccount(session, host, dependencies) {
+    if (host.choose === undefined)
+        return false;
+    const methods = [
+        { label: "sign in with browser", hint: "desktop terminal", key: "b" },
+        { label: "sign in with device code", hint: "WSL, SSH, or headless", key: "d" },
+    ];
+    const choice = await host.choose({
+        title: heading("connect ChatGPT", "OpenAI OAuth", session.palette),
+        description: "Choose the flow for this terminal. Your password stays on OpenAI's website.",
+        options: methods,
+        index: dependencies.headless() ? 1 : 0,
+    });
+    if (choice === undefined)
+        return false;
+    host.status?.("Starting ChatGPT sign-in");
+    let login;
+    try {
+        login = choice === 1
+            ? await dependencies.beginDevice(host.signal)
+            : await dependencies.beginBrowser();
+    }
+    finally {
+        host.status?.(undefined);
+    }
+    return waitForLogin(login, session, host, dependencies.openUrl);
+}
+async function waitForLogin(login, session, host, openUrl) {
+    if (host.choose === undefined)
+        return false;
+    const local = new AbortController();
+    const signal = host.signal === undefined
+        ? local.signal
+        : AbortSignal.any([host.signal, local.signal]);
+    const completion = login.complete(signal).then((account) => ({ kind: "account", account }), (error) => ({ kind: "error", error: error }));
+    await openUrl(login.url);
+    try {
+        while (true) {
+            const selection = host.choose(waitingPicker(login, session));
+            const outcome = await Promise.race([
+                completion,
+                selection.then((index) => ({ kind: "selection", index })),
+            ]);
+            if (outcome.kind === "account") {
+                host.dismiss?.();
+                await saveOpenAIAccount(outcome.account, host.signal);
+                host.emit({ kind: "notice", text: "ChatGPT connected", tone: "info" });
+                return true;
+            }
+            if (outcome.kind === "error") {
+                host.dismiss?.();
+                throw outcome.error;
+            }
+            if (outcome.index === 0) {
+                await openUrl(login.url);
+                continue;
+            }
+            local.abort(new Error("ChatGPT sign-in cancelled"));
+            return false;
+        }
+    }
+    finally {
+        await login.close();
+    }
+}
+function waitingPicker(login, session) {
+    const detail = login.code === undefined
+        ? "Finish sign-in in your browser. Jecode will continue automatically."
+        : `Enter ${login.code} on OpenAI's device page. Jecode will continue automatically.`;
+    return {
+        title: heading("ChatGPT sign-in", login.code ?? "waiting for browser", session.palette),
+        description: detail,
+        options: [
+            { label: "open browser again", key: "o" },
+            { label: "cancel sign-in", key: "c" },
+        ],
+        index: 0,
+    };
+}

package/dist/openai-account.js

@@ -0,0 +1,91 @@
+// The live ChatGPT account: persistence, proactive refresh, and logout.
+import { openAICodexAccount, updateOpenAICodexAccount } from "./accounts.js";
+import { refreshOpenAITokens, revokeOpenAITokens } from "./openai-oauth.js";
+const REFRESH_EARLY_MS = 5 * 60_000;
+let refreshing;
+export function openAIAccountHint() {
+    const account = openAICodexAccount();
+    if (account === undefined)
+        return "not connected";
+    const identity = account.email ?? "connected";
+    return account.plan === undefined ? identity : `${identity} · ${account.plan}`;
+}
+export async function saveOpenAIAccount(account, signal) {
+    await updateOpenAICodexAccount(async () => account, signal);
+}
+export async function removeOpenAIAccount(signal) {
+    let account;
+    await updateOpenAICodexAccount(async (current) => {
+        account = current;
+        return undefined;
+    }, signal);
+    if (account === undefined)
+        return { removed: false, revokeFailed: false };
+    let revokeFailed = false;
+    try {
+        await revokeOpenAITokens(account, signal);
+    }
+    catch {
+        revokeFailed = true;
+    }
+    return { removed: true, revokeFailed };
+}
+export async function openAIAuthorization(forceToken, signal, onStatus) {
+    const account = openAICodexAccount();
+    if (account === undefined)
+        throw new Error("ChatGPT account is not connected");
+    const mustRefresh = forceToken !== undefined || expiresSoon(account);
+    const ready = mustRefresh
+        ? await refreshAccount(forceToken, signal, onStatus)
+        : account;
+    return { accessToken: ready.accessToken, accountId: ready.accountId };
+}
+async function refreshAccount(forceToken, signal, onStatus) {
+    if (refreshing !== undefined)
+        return abortable(refreshing, signal);
+    onStatus?.("Refreshing ChatGPT sign-in");
+    const task = updateOpenAICodexAccount(async (current) => {
+        if (current === undefined)
+            throw new Error("ChatGPT account is not connected");
+        if (forceToken !== undefined && current.accessToken !== forceToken)
+            return current;
+        if (forceToken === undefined && !expiresSoon(current))
+            return current;
+        return refreshOpenAITokens(current, signal);
+    }, signal).then((account) => {
+        if (account === undefined)
+            throw new Error("ChatGPT account is not connected");
+        return account;
+    });
+    refreshing = task;
+    try {
+        return await abortable(task, signal);
+    }
+    finally {
+        if (refreshing === task)
+            refreshing = undefined;
+    }
+}
+function expiresSoon(account) {
+    return account.expiresAt - Date.now() <= REFRESH_EARLY_MS;
+}
+function abortable(promise, signal) {
+    if (signal === undefined)
+        return promise;
+    if (signal.aborted)
+        return Promise.reject(abortReason(signal));
+    return new Promise((resolve, reject) => {
+        const onAbort = () => reject(abortReason(signal));
+        signal.addEventListener("abort", onAbort, { once: true });
+        promise.then((value) => {
+            signal.removeEventListener("abort", onAbort);
+            resolve(value);
+        }, (error) => {
+            signal.removeEventListener("abort", onAbort);
+            reject(error);
+        });
+    });
+}
+function abortReason(signal) {
+    return signal.reason instanceof Error ? signal.reason : new Error("cancelled");
+}