@giovannijecha/jecode 0.1.9 → 0.2.0

package/README.md

@@ -25,7 +25,7 @@
   <a href="https://github.com/giovannijecha/jecode/releases">Releases</a>
 </p>
 
-> Jecode is an early 0.1.x release. The core loop is usable today; commands and
+> Jecode is an early 0.2.x release. The core loop is usable today; commands and
 > terminal interactions may still evolve before 1.0.
 
 ## Why Jecode
@@ -36,8 +36,8 @@
   diffs, approvals, reasoning, and status all share one full-screen TUI.
 - **Permission-aware.** Reads stay transparent; dangerous actions ask first.
   Session approvals can be reviewed and revoked.
-- **Provider-neutral.** Use Anthropic, OpenAI, or a local/remote Ollama server
-  without changing the workflow.
+- **Provider-neutral.** Use Anthropic or OpenAI API keys, a ChatGPT account, or
+  a local/remote Ollama server without changing the workflow.
 - **Lean by construction.** Jecode installs as plain JavaScript, runs on
   Node.js 22.18+ (22.x) or Node.js 24+, executes no installation scripts, and
   has zero third-party runtime dependencies.
@@ -145,15 +145,27 @@ published package runs no compilation or installation scripts.
 ## First session
 
 Jecode opens on an empty composer instead of forcing a setup wizard. Type
-**/settings** when you are ready to choose a provider, select a model, and add a
-credential. A credential can remain in memory for the current session or be
-saved explicitly under **~/.jecode**; it is never stored in the workspace.
+**/settings** when you are ready to choose a provider, select a model, and
+configure authentication. An API key can remain in memory for the current
+session or be saved explicitly under **~/.jecode**; it is never stored in the
+workspace.
 
-| Provider | Credential | Notes |
+| Provider ID | Authentication | Notes |
 |---|---|---|
-| Anthropic | ANTHROPIC_API_KEY | Cloud |
-| OpenAI | OPENAI_API_KEY | Cloud |
-| Ollama | OLLAMA_API_KEY for Cloud/remote | Cloud with a key, local without one |
+| anthropic | ANTHROPIC_API_KEY | Anthropic API |
+| openai | OPENAI_API_KEY | OpenAI API |
+| openai-codex | ChatGPT OAuth | Experimental; uses eligible ChatGPT Codex access |
+| ollama | OLLAMA_API_KEY for Cloud/remote | Cloud with a key, local without one |
+
+Choose **openai-codex** to sign in on OpenAI's website without pasting a key.
+Jecode offers a local browser callback and a device-code flow; WSL and remote
+terminals default to the device code. The connection is saved only after the
+flow completes. Availability and usage limits are determined by the ChatGPT
+account and plan, not by OpenAI API credits. This integration is experimental
+and is not an endorsement of Jecode by OpenAI.
+
+Anthropic remains API-key only. Jecode does not reuse a Claude consumer
+subscription or copy credentials from another client.
 
 Choose **cloud**, **local**, or a custom endpoint from the Ollama connection row
 in **/settings**. Existing users with an Ollama API key automatically use
@@ -166,11 +178,11 @@ Type **/** to open searchable command completion inside the composer.
 
 | Command | What it does |
 |---|---|
-| /settings | Manage provider, connection, model, limits, motion, and credentials |
+| /settings | Manage provider, connection, model, limits, motion, and authentication |
 | /effort | Change and save reasoning effort directly |
 | /providers | Switch the provider for the next turn |
 | /models | Search the live model catalogue |
-| /credentials | Add, replace, inspect, or forget saved credentials |
+| /credentials | Manage API keys and the connected ChatGPT account |
 | /permissions | Manage session tool access and remembered approvals |
 | /new | Start a clean conversation and reset session tool permissions |
 | /export | Save a timestamped Markdown transcript in the launch directory |
@@ -207,14 +219,16 @@ settings, built-in defaults.
 | --ollama-host | OLLAMA_HOST | Cloud with an Ollama key, local without one |
 | --root | — | Current directory |
 | --effort | JECODE_EFFORT | high |
-| --max-tokens | JECODE_MAX_TOKENS | 64000 |
+| --max-tokens | JECODE_MAX_TOKENS | 64000; not sent by openai-codex |
 | --max-steps | JECODE_MAX_STEPS | 40 |
 | --reduced-motion | JECODE_REDUCED_MOTION=1 | Off |
 | --auto-approve | JECODE_AUTO_APPROVE=1 | Off |
 
 Persistent preferences live in **~/.jecode/settings.json**. Explicitly saved
-credentials live in **~/.jecode/credentials.json** with owner-only permissions
-where the operating system supports them. Environment credentials always win.
+API keys live in **~/.jecode/credentials.json**; the ChatGPT OAuth account lives
+separately in **~/.jecode/accounts.json**. Both secret stores use owner-only
+permissions where the operating system supports them. Environment API keys
+always win.
 
 Jecode has one interface theme: dark Steel. **NO_COLOR** is supported for
 terminals and pipelines that disable colour.
@@ -244,6 +258,9 @@ untrusted data.
   commands receive no credential-like environment variables, and recognized
   credential values are redacted before tool output reaches the model, screen,
   history, or export.
+- ChatGPT OAuth uses PKCE and an exact loopback callback or the OpenAI device
+  flow. Refresh-token rotation is serialized across Jecode processes; OAuth
+  tokens are withheld and redacted like API keys.
 - Terminal control characters are neutralized before rendering.
 - Remote Ollama endpoints require HTTPS. Provider HTTP redirects are rejected
   rather than followed across an implicit trust boundary.

package/dist/account-lock.js

@@ -0,0 +1,112 @@
+// A tiny cross-process lock for rotating OAuth credentials.
+//
+// Refresh tokens may rotate after one use. Two Jecode processes refreshing
+// the same account concurrently would make one of them persist a dead token,
+// so account mutations serialize through an atomic lock directory.
+import { mkdir, open, readFile, rename, rmdir, stat, unlink } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import * as path from "node:path";
+const WAIT_MS = 50;
+const WAIT_LIMIT_MS = 20_000;
+const STALE_MS = 60_000;
+export async function withAccountLock(accountFile, body, signal) {
+    throwIfAborted(signal);
+    const directory = `${accountFile}.lock`;
+    const token = `${process.pid}:${randomUUID()}`;
+    const started = Date.now();
+    while (!(await acquire(directory, token))) {
+        if (signal?.aborted === true)
+            throw abortReason(signal);
+        if (Date.now() - started >= WAIT_LIMIT_MS) {
+            throw new Error("timed out waiting for the account store");
+        }
+        await recoverStale(directory);
+        await wait(WAIT_MS, signal);
+    }
+    try {
+        throwIfAborted(signal);
+        return await body();
+    }
+    finally {
+        await release(directory, token);
+    }
+}
+async function acquire(directory, token) {
+    let created = false;
+    try {
+        await mkdir(directory, { mode: 0o700 });
+        created = true;
+        const owner = await open(path.join(directory, "owner"), "wx", 0o600);
+        try {
+            await owner.writeFile(token, "utf8");
+            await owner.sync();
+        }
+        finally {
+            await owner.close();
+        }
+        return true;
+    }
+    catch (error) {
+        if (!created && error.code === "EEXIST")
+            return false;
+        if (created)
+            await removeLock(directory);
+        throw error;
+    }
+}
+async function recoverStale(directory) {
+    try {
+        const details = await stat(directory);
+        if (Date.now() - details.mtimeMs < STALE_MS)
+            return;
+        const quarantined = `${directory}.${randomUUID()}.stale`;
+        await rename(directory, quarantined);
+        await unlink(path.join(quarantined, "owner")).catch(() => undefined);
+        await rmdir(quarantined).catch(() => undefined);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code !== "ENOENT" && code !== "EACCES" && code !== "EPERM")
+            throw error;
+    }
+}
+async function release(directory, token) {
+    try {
+        const owner = path.join(directory, "owner");
+        if ((await readFile(owner, "utf8")) !== token)
+            return;
+        await unlink(owner);
+        await rmdir(directory);
+    }
+    catch {
+        // A recovered stale lock or an already-removed directory is no longer ours.
+    }
+}
+async function removeLock(directory) {
+    await unlink(path.join(directory, "owner")).catch(() => undefined);
+    await rmdir(directory).catch(() => undefined);
+}
+function wait(ms, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal?.aborted === true) {
+            reject(abortReason(signal));
+            return;
+        }
+        const timer = setTimeout(() => {
+            signal?.removeEventListener("abort", onAbort);
+            resolve();
+        }, ms);
+        const onAbort = () => {
+            clearTimeout(timer);
+            reject(signal === undefined ? new Error("cancelled") : abortReason(signal));
+        };
+        signal?.addEventListener("abort", onAbort, { once: true });
+    });
+}
+function abortReason(signal) {
+    return signal.reason instanceof Error ? signal.reason : new Error("cancelled");
+}
+function throwIfAborted(signal) {
+    if (signal?.aborted === true)
+        throw abortReason(signal);
+}

package/dist/accounts.js

@@ -0,0 +1,100 @@
+// OAuth accounts persisted under ~/.jecode, apart from API keys.
+import { chmod, mkdir } from "node:fs/promises";
+import { readFileSync } from "node:fs";
+import * as path from "node:path";
+import { atomicWrite } from "./atomic.js";
+import { withAccountLock } from "./account-lock.js";
+import { userDataLabel, userDataPath } from "./user-data.js";
+let cached;
+export function openAICodexAccount() {
+    const account = store().accounts["openai-codex"];
+    return account === undefined ? undefined : { ...account };
+}
+export function accountValues() {
+    const account = store().accounts["openai-codex"];
+    return account === undefined ? [] : [account.accessToken, account.refreshToken];
+}
+export function accountsPath() {
+    return userDataPath("accounts.json");
+}
+export function accountsLabel() {
+    return userDataLabel("accounts.json");
+}
+export async function updateOpenAICodexAccount(change, signal) {
+    const file = accountsPath();
+    const directory = path.dirname(file);
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    if (process.platform !== "win32")
+        await chmod(directory, 0o700);
+    return withAccountLock(file, async () => {
+        const current = readStore(file);
+        const next = await change(current.accounts["openai-codex"]);
+        const accounts = { ...current.accounts };
+        if (next === undefined)
+            delete accounts["openai-codex"];
+        else
+            accounts["openai-codex"] = { ...next };
+        const updated = { version: 1, accounts };
+        await atomicWrite(file, `${JSON.stringify(updated, null, 2)}\n`, { mode: 0o600 });
+        cached = updated;
+        return next === undefined ? undefined : { ...next };
+    }, signal);
+}
+export function reloadAccounts() {
+    cached = undefined;
+}
+function store() {
+    if (cached === undefined)
+        cached = readStore(accountsPath());
+    return cached;
+}
+function readStore(file) {
+    try {
+        const parsed = JSON.parse(readFileSync(file, "utf8"));
+        return normalize(parsed);
+    }
+    catch {
+        return { version: 1, accounts: {} };
+    }
+}
+function normalize(value) {
+    if (!record(value) || value["version"] !== 1 || !record(value["accounts"])) {
+        return { version: 1, accounts: {} };
+    }
+    const account = normalizeOpenAI(value["accounts"]["openai-codex"]);
+    return {
+        version: 1,
+        accounts: account === undefined ? {} : { "openai-codex": account },
+    };
+}
+function normalizeOpenAI(value) {
+    if (!record(value))
+        return undefined;
+    const accessToken = nonempty(value["accessToken"]);
+    const refreshToken = nonempty(value["refreshToken"]);
+    const accountId = nonempty(value["accountId"]);
+    const expiresAt = value["expiresAt"];
+    if (accessToken === undefined ||
+        refreshToken === undefined ||
+        accountId === undefined ||
+        typeof expiresAt !== "number" ||
+        !Number.isSafeInteger(expiresAt) ||
+        expiresAt <= 0)
+        return undefined;
+    const email = nonempty(value["email"]);
+    const plan = nonempty(value["plan"]);
+    return {
+        accessToken,
+        refreshToken,
+        expiresAt,
+        accountId,
+        ...(email === undefined ? {} : { email }),
+        ...(plan === undefined ? {} : { plan }),
+    };
+}
+function nonempty(value) {
+    return typeof value === "string" && value.trim() !== "" ? value : undefined;
+}
+function record(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/dist/cli-info.js

@@ -8,10 +8,10 @@ Usage:
 
 Options:
   --root <path>          workspace root (default: current directory)
-  --provider <id>        anthropic, openai, or ollama
+  --provider <id>        anthropic, openai, openai-codex, or ollama
   --model <id>           model for the selected provider
   --ollama-host <url>    Ollama Cloud, local, or custom endpoint
-  --effort <level>       low, medium, high, or max
+  --effort <level>       low, medium, high, xhigh, or max
   --max-tokens <number>  output-token ceiling
   --max-steps <number>   tool-loop ceiling
   --reduced-motion       disable animated terminal states

package/dist/commands.js

@@ -24,7 +24,7 @@ export const COMMANDS = [
     { name: "permissions", blurb: "manage session tool access" },
     { name: "settings", blurb: "change and save jecode defaults" },
     { name: "effort", blurb: "set the reasoning effort" },
-    { name: "credentials", blurb: "inspect, replace, or forget API keys" },
+    { name: "credentials", blurb: "manage API keys and connected accounts" },
     { name: "models", blurb: "pick a model, from what the provider offers" },
     { name: "providers", blurb: "pick a provider" },
 ];

package/dist/controller.js

@@ -29,6 +29,9 @@ export async function runTurn(history, options, events, signal) {
             onStatus: (status) => events.onStatus?.(status),
         });
         const calls = assistant.content.filter(isToolCall);
+        if (assistant.content.length === 0) {
+            throw new Error(`${options.provider.id} completed without an answer or tool call`);
+        }
         if (calls.length > MAX_TOOL_CALLS_PER_STEP) {
             throw new Error(`provider returned ${calls.length} tool calls in one step (maximum ${MAX_TOOL_CALLS_PER_STEP})`);
         }

package/dist/credential-commands.js

@@ -2,6 +2,8 @@
 import { heading } from "./tui/picker.js";
 import { EMPTY } from "./tui/editor.js";
 import { PROVIDERS } from "./providers/index.js";
+import { openAIAccountHint } from "./openai-account.js";
+import { ensureOpenAIAccount, openAIAccountCommand, } from "./openai-account-command.js";
 import { credentialSource, forgetSaved, hasSaved, hold, keep, storeLabel, } from "./credentials.js";
 /** Ask for a key, then ask separately whether it may be written to disk. */
 export async function askForKey(name, host, pal) {
@@ -52,10 +54,12 @@ export async function credentialsCommand(session, host) {
     if (choose === undefined)
         return;
     const index = await choose({
-        title: heading("credential", "values are never shown", session.palette),
+        title: heading("authentication", "secrets are never shown", session.palette),
         options: PROVIDERS.map((provider) => ({
-            label: provider.keyVar,
-            hint: credentialSource(provider.keyVar) ?? "missing",
+            label: provider.auth.kind === "api-key" ? provider.auth.keyVar : `${provider.auth.label} account`,
+            hint: provider.auth.kind === "api-key"
+                ? credentialSource(provider.auth.keyVar) ?? "missing"
+                : openAIAccountHint(),
         })),
         index: Math.max(0, PROVIDERS.findIndex((provider) => provider.id === session.provider.id)),
     });
@@ -64,7 +68,11 @@ export async function credentialsCommand(session, host) {
     const provider = PROVIDERS[index];
     if (provider === undefined)
         return;
-    const name = provider.keyVar;
+    if (provider.auth.kind === "oauth") {
+        await openAIAccountCommand(session, host);
+        return;
+    }
+    const name = provider.auth.keyVar;
     const source = credentialSource(name);
     if (source === "environment") {
         host.emit({
@@ -93,6 +101,26 @@ export async function credentialsCommand(session, host) {
     }
     await askForKey(name, host, session.palette);
 }
+/** Offer the authentication flow owned by a provider, if that is its blocker. */
+export async function ensureProviderAuthentication(provider, session, host) {
+    const blocked = provider.blocked();
+    if (blocked === undefined)
+        return true;
+    if (provider.auth.kind === "oauth") {
+        return provider.auth.account === "openai-codex"
+            ? ensureOpenAIAccount(session, host)
+            : false;
+    }
+    if (!blocked.startsWith(`${provider.auth.keyVar} `)) {
+        host.emit({ kind: "notice", text: blocked, tone: "error" });
+        return false;
+    }
+    await askForKey(provider.auth.keyVar, host, session.palette);
+    return provider.blocked() === undefined;
+}
+export function authenticationNeed(provider) {
+    return provider.auth.kind === "oauth" ? `${provider.auth.label} sign-in` : "an API key";
+}
 async function offerForget(name, session, host, hint) {
     if (host.choose === undefined)
         return;

package/dist/credential-safety.js

@@ -1,5 +1,6 @@
 // The shell needs a useful process environment, not the application's secrets.
 import { credentialValues } from "./credentials.js";
+import { accountValues } from "./accounts.js";
 const REDACTED = "[credential redacted]";
 const SENSITIVE_ENVIRONMENT_NAME = /(?:^|_)(?:API_?KEY|ACCESS_?KEY|PRIVATE_?KEY|KEY|TOKEN|SECRET|PASSWORD|PASSWD|PASS|PWD|CREDENTIALS?|AUTH|JWT|COOKIE|PAT)(?:_|$)/i;
 const COMPACT_SENSITIVE_ENVIRONMENT_NAME = /^(?:PGPASSWORD)$/i;
@@ -60,7 +61,7 @@ function sensitiveEnvironmentName(name) {
         COMPACT_SENSITIVE_ENVIRONMENT_NAME.test(normalized));
 }
 function secrets(source) {
-    const values = new Set(credentialValues());
+    const values = new Set([...credentialValues(), ...accountValues()]);
     for (const [name, value] of Object.entries(source)) {
         if (value !== undefined && value !== "" && sensitiveEnvironment(name, value))
             values.add(value);

package/dist/external-browser.js

@@ -0,0 +1,53 @@
+// Open one HTTPS URL without involving a shell or interpolating commands.
+import { spawn } from "node:child_process";
+import { readFileSync } from "node:fs";
+export async function openExternal(url) {
+    const target = new URL(url);
+    if (target.protocol !== "https:")
+        throw new Error("only HTTPS links may be opened");
+    const command = browserCommand(target.href);
+    if (command === undefined)
+        return false;
+    return new Promise((resolve) => {
+        const child = spawn(command.file, command.args, {
+            detached: true,
+            stdio: "ignore",
+            windowsHide: true,
+        });
+        child.once("error", () => resolve(false));
+        child.once("spawn", () => {
+            child.unref();
+            resolve(true);
+        });
+    });
+}
+function browserCommand(url) {
+    if (process.platform === "win32") {
+        return { file: "rundll32.exe", args: ["url.dll,FileProtocolHandler", url] };
+    }
+    if (process.platform === "darwin")
+        return { file: "open", args: [url] };
+    if (isWsl())
+        return { file: "explorer.exe", args: [url] };
+    return { file: "xdg-open", args: [url] };
+}
+export function headlessEnvironment() {
+    if (isWsl() || process.env["SSH_CONNECTION"] !== undefined || process.env["SSH_TTY"] !== undefined) {
+        return true;
+    }
+    return process.platform === "linux" &&
+        process.env["DISPLAY"] === undefined &&
+        process.env["WAYLAND_DISPLAY"] === undefined;
+}
+function isWsl() {
+    if (process.platform !== "linux")
+        return false;
+    if (process.env["WSL_DISTRO_NAME"] !== undefined || process.env["WSL_INTEROP"] !== undefined)
+        return true;
+    try {
+        return /microsoft/i.test(readFileSync("/proc/version", "utf8"));
+    }
+    catch {
+        return false;
+    }
+}

package/dist/oauth-http.js

@@ -0,0 +1,114 @@
+// A narrow HTTP boundary for OAuth authority requests.
+//
+// These requests never redirect, never retry, and never retain an unbounded
+// response. Authorization codes and refresh tokens must not leak into errors.
+const AUTH_ORIGIN = "https://auth.openai.com";
+const TIMEOUT_MS = 15_000;
+const MAX_BODY_CHARS = 64_000;
+export async function oauthRequest(url, body, signal, accepted = [200]) {
+    const target = new URL(url);
+    if (target.origin !== AUTH_ORIGIN || target.username !== "" || target.password !== "") {
+        throw new Error("OAuth request target is not allowed");
+    }
+    const timeout = new AbortController();
+    const timer = setTimeout(() => timeout.abort(new Error("OpenAI sign-in timed out")), TIMEOUT_MS);
+    const combined = signal === undefined
+        ? timeout.signal
+        : AbortSignal.any([signal, timeout.signal]);
+    const secrets = bodySecrets(body);
+    let response;
+    let text;
+    try {
+        response = await fetch(target, {
+            method: "POST",
+            headers: { "content-type": body.contentType, accept: "application/json" },
+            body: body.contentType === "application/json"
+                ? JSON.stringify(body.value)
+                : body.value.toString(),
+            cache: "no-store",
+            redirect: "manual",
+            signal: combined,
+        });
+        if (response.status >= 300 && response.status < 400) {
+            await response.body?.cancel().catch(() => undefined);
+            throw new Error(`OpenAI sign-in redirect rejected (${response.status})`);
+        }
+        text = await boundedText(response);
+    }
+    catch (error) {
+        if (timeout.signal.aborted)
+            throw timeout.signal.reason;
+        if (signal?.aborted === true)
+            throw abortReason(signal);
+        if (error instanceof Error && error.message.startsWith("OpenAI sign-in"))
+            throw error;
+        const detail = error instanceof Error ? error.message : String(error);
+        throw new Error(`OpenAI sign-in network error: ${detail}`);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+    const value = parse(text);
+    if (!accepted.includes(response.status)) {
+        throw new Error(`OpenAI sign-in failed (${response.status})${errorDetail(value, secrets)}`);
+    }
+    return { status: response.status, value };
+}
+async function boundedText(response) {
+    if (response.body === null)
+        return "";
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    let text = "";
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                return text + decoder.decode();
+            text += decoder.decode(value, { stream: true });
+            if (text.length > MAX_BODY_CHARS) {
+                await reader.cancel().catch(() => undefined);
+                throw new Error("OpenAI sign-in returned too much data");
+            }
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+}
+function parse(text) {
+    if (text.trim() === "")
+        return {};
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new Error("OpenAI sign-in returned an invalid response");
+    }
+}
+function errorDetail(value, secrets) {
+    if (!record(value))
+        return "";
+    const detail = [value["error_description"], value["message"], value["error"]]
+        .find((entry) => typeof entry === "string");
+    if (typeof detail !== "string" || detail.trim() === "")
+        return "";
+    let safe = detail.replace(/[\r\n]+/g, " ");
+    for (const secret of secrets)
+        safe = safe.replaceAll(secret, "[credential redacted]");
+    return ` · ${safe.slice(0, 300)}`;
+}
+function bodySecrets(body) {
+    const values = body.contentType === "application/x-www-form-urlencoded"
+        ? [...body.value.values()]
+        : record(body.value)
+            ? Object.values(body.value).filter((value) => typeof value === "string")
+            : [];
+    return values.filter((value) => value.length >= 8);
+}
+function abortReason(signal) {
+    return signal.reason instanceof Error ? signal.reason : new Error("cancelled");
+}
+function record(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}