@giovannijecha/jecode 0.1.9 → 0.2.1

package/README.md

@@ -25,7 +25,7 @@
   <a href="https://github.com/giovannijecha/jecode/releases">Releases</a>
 </p>
 
-> Jecode is an early 0.1.x release. The core loop is usable today; commands and
+> Jecode is an early 0.2.x release. The core loop is usable today; commands and
 > terminal interactions may still evolve before 1.0.
 
 ## Why Jecode
@@ -36,8 +36,8 @@
   diffs, approvals, reasoning, and status all share one full-screen TUI.
 - **Permission-aware.** Reads stay transparent; dangerous actions ask first.
   Session approvals can be reviewed and revoked.
-- **Provider-neutral.** Use Anthropic, OpenAI, or a local/remote Ollama server
-  without changing the workflow.
+- **Provider-neutral.** Use Anthropic or OpenAI API keys, a ChatGPT account, or
+  a local/remote Ollama server without changing the workflow.
 - **Lean by construction.** Jecode installs as plain JavaScript, runs on
   Node.js 22.18+ (22.x) or Node.js 24+, executes no installation scripts, and
   has zero third-party runtime dependencies.
@@ -145,15 +145,27 @@ published package runs no compilation or installation scripts.
 ## First session
 
 Jecode opens on an empty composer instead of forcing a setup wizard. Type
-**/settings** when you are ready to choose a provider, select a model, and add a
-credential. A credential can remain in memory for the current session or be
-saved explicitly under **~/.jecode**; it is never stored in the workspace.
+**/settings** when you are ready to choose a provider, select a model, and
+configure authentication. An API key can remain in memory for the current
+session or be saved explicitly under **~/.jecode**; it is never stored in the
+workspace.
 
-| Provider | Credential | Notes |
+| Provider ID | Authentication | Notes |
 |---|---|---|
-| Anthropic | ANTHROPIC_API_KEY | Cloud |
-| OpenAI | OPENAI_API_KEY | Cloud |
-| Ollama | OLLAMA_API_KEY for Cloud/remote | Cloud with a key, local without one |
+| anthropic | ANTHROPIC_API_KEY | Anthropic API |
+| openai | OPENAI_API_KEY | OpenAI API |
+| openai-codex | ChatGPT OAuth | Experimental; uses eligible ChatGPT Codex access |
+| ollama | OLLAMA_API_KEY for Cloud/remote | Cloud with a key, local without one |
+
+Choose **openai-codex** to sign in on OpenAI's website without pasting a key.
+Jecode offers a local browser callback and a device-code flow; WSL and remote
+terminals default to the device code. The connection is saved only after the
+flow completes. Availability and usage limits are determined by the ChatGPT
+account and plan, not by OpenAI API credits. This integration is experimental
+and is not an endorsement of Jecode by OpenAI.
+
+Anthropic remains API-key only. Jecode does not reuse a Claude consumer
+subscription or copy credentials from another client.
 
 Choose **cloud**, **local**, or a custom endpoint from the Ollama connection row
 in **/settings**. Existing users with an Ollama API key automatically use
@@ -166,11 +178,11 @@ Type **/** to open searchable command completion inside the composer.
 
 | Command | What it does |
 |---|---|
-| /settings | Manage provider, connection, model, limits, motion, and credentials |
+| /settings | Manage provider, connection, model, limits, motion, and authentication |
 | /effort | Change and save reasoning effort directly |
 | /providers | Switch the provider for the next turn |
 | /models | Search the live model catalogue |
-| /credentials | Add, replace, inspect, or forget saved credentials |
+| /credentials | Manage API keys and the connected ChatGPT account |
 | /permissions | Manage session tool access and remembered approvals |
 | /new | Start a clean conversation and reset session tool permissions |
 | /export | Save a timestamped Markdown transcript in the launch directory |
@@ -207,14 +219,16 @@ settings, built-in defaults.
 | --ollama-host | OLLAMA_HOST | Cloud with an Ollama key, local without one |
 | --root | — | Current directory |
 | --effort | JECODE_EFFORT | high |
-| --max-tokens | JECODE_MAX_TOKENS | 64000 |
+| --max-tokens | JECODE_MAX_TOKENS | 64000; not sent by openai-codex |
 | --max-steps | JECODE_MAX_STEPS | 40 |
 | --reduced-motion | JECODE_REDUCED_MOTION=1 | Off |
 | --auto-approve | JECODE_AUTO_APPROVE=1 | Off |
 
 Persistent preferences live in **~/.jecode/settings.json**. Explicitly saved
-credentials live in **~/.jecode/credentials.json** with owner-only permissions
-where the operating system supports them. Environment credentials always win.
+API keys live in **~/.jecode/credentials.json**; the ChatGPT OAuth account lives
+separately in **~/.jecode/accounts.json**. Both secret stores use owner-only
+permissions where the operating system supports them. Environment API keys
+always win.
 
 Jecode has one interface theme: dark Steel. **NO_COLOR** is supported for
 terminals and pipelines that disable colour.
@@ -241,9 +255,13 @@ untrusted data.
 - Dangerous tools ask by default unless explicitly allowed for the session in
   **/permissions** or the process started with **--auto-approve**.
 - Credential fields are masked and excluded from transcripts. Approved shell
-  commands receive no credential-like environment variables, and recognized
-  credential values are redacted before tool output reaches the model, screen,
-  history, or export.
+  commands receive no secret-bearing environment variables; `SSH_AUTH_SOCK`
+  is preserved so Git and SSH can use the user's agent, which means an approved
+  command can request that agent to authenticate. Recognized credential values
+  are redacted before tool output reaches the model, screen, history, or export.
+- ChatGPT OAuth uses PKCE and an exact loopback callback or the OpenAI device
+  flow. Refresh-token rotation is serialized across Jecode processes; OAuth
+  tokens are withheld and redacted like API keys.
 - Terminal control characters are neutralized before rendering.
 - Remote Ollama endpoints require HTTPS. Provider HTTP redirects are rejected
   rather than followed across an implicit trust boundary.

package/dist/account-lock.js

@@ -0,0 +1,112 @@
+// A tiny cross-process lock for rotating OAuth credentials.
+//
+// Refresh tokens may rotate after one use. Two Jecode processes refreshing
+// the same account concurrently would make one of them persist a dead token,
+// so account mutations serialize through an atomic lock directory.
+import { mkdir, open, readFile, rename, rmdir, stat, unlink } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import * as path from "node:path";
+const WAIT_MS = 50;
+const WAIT_LIMIT_MS = 20_000;
+const STALE_MS = 60_000;
+export async function withAccountLock(accountFile, body, signal) {
+    throwIfAborted(signal);
+    const directory = `${accountFile}.lock`;
+    const token = `${process.pid}:${randomUUID()}`;
+    const started = Date.now();
+    while (!(await acquire(directory, token))) {
+        if (signal?.aborted === true)
+            throw abortReason(signal);
+        if (Date.now() - started >= WAIT_LIMIT_MS) {
+            throw new Error("timed out waiting for the account store");
+        }
+        await recoverStale(directory);
+        await wait(WAIT_MS, signal);
+    }
+    try {
+        throwIfAborted(signal);
+        return await body();
+    }
+    finally {
+        await release(directory, token);
+    }
+}
+async function acquire(directory, token) {
+    let created = false;
+    try {
+        await mkdir(directory, { mode: 0o700 });
+        created = true;
+        const owner = await open(path.join(directory, "owner"), "wx", 0o600);
+        try {
+            await owner.writeFile(token, "utf8");
+            await owner.sync();
+        }
+        finally {
+            await owner.close();
+        }
+        return true;
+    }
+    catch (error) {
+        if (!created && error.code === "EEXIST")
+            return false;
+        if (created)
+            await removeLock(directory);
+        throw error;
+    }
+}
+async function recoverStale(directory) {
+    try {
+        const details = await stat(directory);
+        if (Date.now() - details.mtimeMs < STALE_MS)
+            return;
+        const quarantined = `${directory}.${randomUUID()}.stale`;
+        await rename(directory, quarantined);
+        await unlink(path.join(quarantined, "owner")).catch(() => undefined);
+        await rmdir(quarantined).catch(() => undefined);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code !== "ENOENT" && code !== "EACCES" && code !== "EPERM")
+            throw error;
+    }
+}
+async function release(directory, token) {
+    try {
+        const owner = path.join(directory, "owner");
+        if ((await readFile(owner, "utf8")) !== token)
+            return;
+        await unlink(owner);
+        await rmdir(directory);
+    }
+    catch {
+        // A recovered stale lock or an already-removed directory is no longer ours.
+    }
+}
+async function removeLock(directory) {
+    await unlink(path.join(directory, "owner")).catch(() => undefined);
+    await rmdir(directory).catch(() => undefined);
+}
+function wait(ms, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal?.aborted === true) {
+            reject(abortReason(signal));
+            return;
+        }
+        const timer = setTimeout(() => {
+            signal?.removeEventListener("abort", onAbort);
+            resolve();
+        }, ms);
+        const onAbort = () => {
+            clearTimeout(timer);
+            reject(signal === undefined ? new Error("cancelled") : abortReason(signal));
+        };
+        signal?.addEventListener("abort", onAbort, { once: true });
+    });
+}
+function abortReason(signal) {
+    return signal.reason instanceof Error ? signal.reason : new Error("cancelled");
+}
+function throwIfAborted(signal) {
+    if (signal?.aborted === true)
+        throw abortReason(signal);
+}

package/dist/accounts.js

@@ -0,0 +1,100 @@
+// OAuth accounts persisted under ~/.jecode, apart from API keys.
+import { chmod, mkdir } from "node:fs/promises";
+import { readFileSync } from "node:fs";
+import * as path from "node:path";
+import { atomicWrite } from "./atomic.js";
+import { withAccountLock } from "./account-lock.js";
+import { userDataLabel, userDataPath } from "./user-data.js";
+let cached;
+export function openAICodexAccount() {
+    const account = store().accounts["openai-codex"];
+    return account === undefined ? undefined : { ...account };
+}
+export function accountValues() {
+    const account = store().accounts["openai-codex"];
+    return account === undefined ? [] : [account.accessToken, account.refreshToken];
+}
+export function accountsPath() {
+    return userDataPath("accounts.json");
+}
+export function accountsLabel() {
+    return userDataLabel("accounts.json");
+}
+export async function updateOpenAICodexAccount(change, signal) {
+    const file = accountsPath();
+    const directory = path.dirname(file);
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    if (process.platform !== "win32")
+        await chmod(directory, 0o700);
+    return withAccountLock(file, async () => {
+        const current = readStore(file);
+        const next = await change(current.accounts["openai-codex"]);
+        const accounts = { ...current.accounts };
+        if (next === undefined)
+            delete accounts["openai-codex"];
+        else
+            accounts["openai-codex"] = { ...next };
+        const updated = { version: 1, accounts };
+        await atomicWrite(file, `${JSON.stringify(updated, null, 2)}\n`, { mode: 0o600 });
+        cached = updated;
+        return next === undefined ? undefined : { ...next };
+    }, signal);
+}
+export function reloadAccounts() {
+    cached = undefined;
+}
+function store() {
+    if (cached === undefined)
+        cached = readStore(accountsPath());
+    return cached;
+}
+function readStore(file) {
+    try {
+        const parsed = JSON.parse(readFileSync(file, "utf8"));
+        return normalize(parsed);
+    }
+    catch {
+        return { version: 1, accounts: {} };
+    }
+}
+function normalize(value) {
+    if (!record(value) || value["version"] !== 1 || !record(value["accounts"])) {
+        return { version: 1, accounts: {} };
+    }
+    const account = normalizeOpenAI(value["accounts"]["openai-codex"]);
+    return {
+        version: 1,
+        accounts: account === undefined ? {} : { "openai-codex": account },
+    };
+}
+function normalizeOpenAI(value) {
+    if (!record(value))
+        return undefined;
+    const accessToken = nonempty(value["accessToken"]);
+    const refreshToken = nonempty(value["refreshToken"]);
+    const accountId = nonempty(value["accountId"]);
+    const expiresAt = value["expiresAt"];
+    if (accessToken === undefined ||
+        refreshToken === undefined ||
+        accountId === undefined ||
+        typeof expiresAt !== "number" ||
+        !Number.isSafeInteger(expiresAt) ||
+        expiresAt <= 0)
+        return undefined;
+    const email = nonempty(value["email"]);
+    const plan = nonempty(value["plan"]);
+    return {
+        accessToken,
+        refreshToken,
+        expiresAt,
+        accountId,
+        ...(email === undefined ? {} : { email }),
+        ...(plan === undefined ? {} : { plan }),
+    };
+}
+function nonempty(value) {
+    return typeof value === "string" && value.trim() !== "" ? value : undefined;
+}
+function record(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/dist/cli-info.js

@@ -8,10 +8,10 @@ Usage:
 
 Options:
   --root <path>          workspace root (default: current directory)
-  --provider <id>        anthropic, openai, or ollama
+  --provider <id>        anthropic, openai, openai-codex, or ollama
   --model <id>           model for the selected provider
   --ollama-host <url>    Ollama Cloud, local, or custom endpoint
-  --effort <level>       low, medium, high, or max
+  --effort <level>       low, medium, high, xhigh, or max
   --max-tokens <number>  output-token ceiling
   --max-steps <number>   tool-loop ceiling
   --reduced-motion       disable animated terminal states

package/dist/commands.js

@@ -24,7 +24,7 @@ export const COMMANDS = [
     { name: "permissions", blurb: "manage session tool access" },
     { name: "settings", blurb: "change and save jecode defaults" },
     { name: "effort", blurb: "set the reasoning effort" },
-    { name: "credentials", blurb: "inspect, replace, or forget API keys" },
+    { name: "credentials", blurb: "manage API keys and connected accounts" },
     { name: "models", blurb: "pick a model, from what the provider offers" },
     { name: "providers", blurb: "pick a provider" },
 ];

package/dist/controller.js

@@ -14,6 +14,7 @@ export const MAX_TOOL_CALLS_PER_STEP = 32;
 export async function runTurn(history, options, events, signal) {
     const specs = toolSpecs(options.tools);
     for (let step = 0; step < options.maxSteps; step++) {
+        throwIfAborted(signal);
         events.onStep?.(step + 1, options.maxSteps);
         // The message is displayed as it streams; what comes back here is the
         // assembled version, which exists to be appended to the history.
@@ -28,7 +29,11 @@ export async function runTurn(history, options, events, signal) {
             onStream: (event) => events.onStream(event),
             onStatus: (status) => events.onStatus?.(status),
         });
+        throwIfAborted(signal);
         const calls = assistant.content.filter(isToolCall);
+        if (assistant.content.length === 0) {
+            throw new Error(`${options.provider.id} completed without an answer or tool call`);
+        }
         if (calls.length > MAX_TOOL_CALLS_PER_STEP) {
             throw new Error(`provider returned ${calls.length} tool calls in one step (maximum ${MAX_TOOL_CALLS_PER_STEP})`);
         }
@@ -41,14 +46,33 @@ export async function runTurn(history, options, events, signal) {
         // but every result from this step goes back in a SINGLE message. Splitting
         // them teaches the model to stop batching its calls.
         const results = [];
-        for (let index = 0; index < calls.length; index++) {
-            const call = calls[index];
-            events.onToolProgress?.(index + 1, calls.length);
-            const preview = await look(call, options);
-            events.onToolCall(call, preview);
-            const { result, summary } = await settle(call, options, events, signal, preview);
-            events.onToolResult(call, result, summary);
-            results.push(result);
+        const announced = new Set();
+        try {
+            for (let index = 0; index < calls.length; index++) {
+                throwIfAborted(signal);
+                const call = calls[index];
+                events.onToolProgress?.(index + 1, calls.length);
+                const preview = await look(call, options, signal);
+                throwIfAborted(signal);
+                events.onToolCall(call, preview);
+                announced.add(call.id);
+                const { result, summary } = await settle(call, options, events, signal, preview);
+                events.onToolResult(call, result, summary);
+                results.push(result);
+            }
+        }
+        catch (error) {
+            if (signal?.aborted !== true)
+                throw error;
+            for (const call of calls.slice(results.length)) {
+                const interrupted = refuse(call, "interrupted before completion", "interrupted");
+                if (announced.has(call.id)) {
+                    events.onToolResult(call, interrupted.result, interrupted.summary);
+                }
+                results.push(interrupted.result);
+            }
+            history.push({ role: "user", content: results });
+            throw abortReason(signal);
         }
         history.push({ role: "user", content: results });
     }
@@ -59,9 +83,13 @@ async function settle(call, options, events, signal, preview) {
     if (tool === undefined) {
         return refuse(call, `no such tool: ${call.name}`, "unknown tool");
     }
-    if (tool.dangerous && !(await events.approve(call))) {
+    throwIfAborted(signal);
+    const approved = !tool.dangerous || await events.approve(call);
+    throwIfAborted(signal);
+    if (!approved) {
         return refuse(call, "the user declined this call — ask them how to proceed", "declined");
     }
+    throwIfAborted(signal);
     return runTool(tool, call, {
         ...options.toolContext,
         signal,
@@ -82,14 +110,21 @@ function refuse(call, reason, summary) {
  * file, a match that is not there — is simply no preview. Nothing about the
  * turn depends on it, because it exists for the user, not for the model.
  */
-async function look(call, options) {
+async function look(call, options, signal) {
     const tool = findTool(options.tools, call.name);
     if (tool?.preview === undefined)
         return undefined;
     try {
-        return await tool.preview(call.input, options.toolContext);
+        return await tool.preview(call.input, { ...options.toolContext, signal });
     }
     catch {
         return undefined;
     }
 }
+function throwIfAborted(signal) {
+    if (signal?.aborted === true)
+        throw abortReason(signal);
+}
+function abortReason(signal) {
+    return signal.reason instanceof Error ? signal.reason : new Error("interrupted");
+}

package/dist/credential-commands.js

@@ -2,6 +2,8 @@
 import { heading } from "./tui/picker.js";
 import { EMPTY } from "./tui/editor.js";
 import { PROVIDERS } from "./providers/index.js";
+import { openAIAccountHint } from "./openai-account.js";
+import { ensureOpenAIAccount, openAIAccountCommand, } from "./openai-account-command.js";
 import { credentialSource, forgetSaved, hasSaved, hold, keep, storeLabel, } from "./credentials.js";
 /** Ask for a key, then ask separately whether it may be written to disk. */
 export async function askForKey(name, host, pal) {
@@ -52,10 +54,12 @@ export async function credentialsCommand(session, host) {
     if (choose === undefined)
         return;
     const index = await choose({
-        title: heading("credential", "values are never shown", session.palette),
+        title: heading("authentication", "secrets are never shown", session.palette),
         options: PROVIDERS.map((provider) => ({
-            label: provider.keyVar,
-            hint: credentialSource(provider.keyVar) ?? "missing",
+            label: provider.auth.kind === "api-key" ? provider.auth.keyVar : `${provider.auth.label} account`,
+            hint: provider.auth.kind === "api-key"
+                ? credentialSource(provider.auth.keyVar) ?? "missing"
+                : openAIAccountHint(),
         })),
         index: Math.max(0, PROVIDERS.findIndex((provider) => provider.id === session.provider.id)),
     });
@@ -64,7 +68,11 @@ export async function credentialsCommand(session, host) {
     const provider = PROVIDERS[index];
     if (provider === undefined)
         return;
-    const name = provider.keyVar;
+    if (provider.auth.kind === "oauth") {
+        await openAIAccountCommand(session, host);
+        return;
+    }
+    const name = provider.auth.keyVar;
     const source = credentialSource(name);
     if (source === "environment") {
         host.emit({
@@ -93,6 +101,26 @@ export async function credentialsCommand(session, host) {
     }
     await askForKey(name, host, session.palette);
 }
+/** Offer the authentication flow owned by a provider, if that is its blocker. */
+export async function ensureProviderAuthentication(provider, session, host) {
+    const blocked = provider.blocked();
+    if (blocked === undefined)
+        return true;
+    if (provider.auth.kind === "oauth") {
+        return provider.auth.account === "openai-codex"
+            ? ensureOpenAIAccount(session, host)
+            : false;
+    }
+    if (!blocked.startsWith(`${provider.auth.keyVar} `)) {
+        host.emit({ kind: "notice", text: blocked, tone: "error" });
+        return false;
+    }
+    await askForKey(provider.auth.keyVar, host, session.palette);
+    return provider.blocked() === undefined;
+}
+export function authenticationNeed(provider) {
+    return provider.auth.kind === "oauth" ? `${provider.auth.label} sign-in` : "an API key";
+}
 async function offerForget(name, session, host, hint) {
     if (host.choose === undefined)
         return;

package/dist/credential-safety.js

@@ -1,8 +1,15 @@
 // The shell needs a useful process environment, not the application's secrets.
 import { credentialValues } from "./credentials.js";
+import { accountValues } from "./accounts.js";
 const REDACTED = "[credential redacted]";
 const SENSITIVE_ENVIRONMENT_NAME = /(?:^|_)(?:API_?KEY|ACCESS_?KEY|PRIVATE_?KEY|KEY|TOKEN|SECRET|PASSWORD|PASSWD|PASS|PWD|CREDENTIALS?|AUTH|JWT|COOKIE|PAT)(?:_|$)/i;
 const COMPACT_SENSITIVE_ENVIRONMENT_NAME = /^(?:PGPASSWORD)$/i;
+const SAFE_ENVIRONMENT_NAMES = new Set([
+    "SSH_AUTH_SOCK",
+    "PWD",
+    "OLDPWD",
+    "PASSWORD_STORE_DIR",
+]);
 /** Preserve ordinary tool configuration while withholding credential-like values. */
 export function shellEnvironment(source = process.env) {
     const environment = {};
@@ -56,11 +63,13 @@ function sensitiveEnvironmentName(name) {
         .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
         .replace(/[^a-z0-9]+/gi, "_")
         .replace(/^_+|_+$/g, "");
+    if (SAFE_ENVIRONMENT_NAMES.has(normalized.toUpperCase()))
+        return false;
     return (SENSITIVE_ENVIRONMENT_NAME.test(normalized) ||
         COMPACT_SENSITIVE_ENVIRONMENT_NAME.test(normalized));
 }
 function secrets(source) {
-    const values = new Set(credentialValues());
+    const values = new Set([...credentialValues(), ...accountValues()]);
     for (const [name, value] of Object.entries(source)) {
         if (value !== undefined && value !== "" && sensitiveEnvironment(name, value))
             values.add(value);

package/dist/effort.js

@@ -0,0 +1,25 @@
+// One ordered vocabulary for reasoning depth. Providers expose the subset a
+// selected model accepts; this module only validates and reconciles that data.
+export const EFFORTS = ["low", "medium", "high", "xhigh", "max"];
+export function isEffort(value) {
+    return typeof value === "string" && EFFORTS.includes(value);
+}
+export function requireSupportedEffort(model, requested, supported) {
+    if (supported.includes(requested))
+        return requested;
+    const choices = supported.length === 0 ? "none" : supported.join(", ");
+    throw new Error(`${model} does not support effort "${requested}" (available: ${choices})`);
+}
+/** Keep the requested depth when possible, otherwise choose the nearest lower level. */
+export function compatibleEffort(requested, supported) {
+    if (supported.length === 0)
+        return undefined;
+    if (supported.includes(requested))
+        return requested;
+    const requestedIndex = EFFORTS.indexOf(requested);
+    const candidates = EFFORTS.filter((value) => supported.includes(value));
+    if (requestedIndex < 0)
+        return candidates[0];
+    return [...candidates].reverse().find((value) => EFFORTS.indexOf(value) < requestedIndex)
+        ?? candidates[0];
+}

package/dist/external-browser.js

@@ -0,0 +1,53 @@
+// Open one HTTPS URL without involving a shell or interpolating commands.
+import { spawn } from "node:child_process";
+import { readFileSync } from "node:fs";
+export async function openExternal(url) {
+    const target = new URL(url);
+    if (target.protocol !== "https:")
+        throw new Error("only HTTPS links may be opened");
+    const command = browserCommand(target.href);
+    if (command === undefined)
+        return false;
+    return new Promise((resolve) => {
+        const child = spawn(command.file, command.args, {
+            detached: true,
+            stdio: "ignore",
+            windowsHide: true,
+        });
+        child.once("error", () => resolve(false));
+        child.once("spawn", () => {
+            child.unref();
+            resolve(true);
+        });
+    });
+}
+function browserCommand(url) {
+    if (process.platform === "win32") {
+        return { file: "rundll32.exe", args: ["url.dll,FileProtocolHandler", url] };
+    }
+    if (process.platform === "darwin")
+        return { file: "open", args: [url] };
+    if (isWsl())
+        return { file: "explorer.exe", args: [url] };
+    return { file: "xdg-open", args: [url] };
+}
+export function headlessEnvironment() {
+    if (isWsl() || process.env["SSH_CONNECTION"] !== undefined || process.env["SSH_TTY"] !== undefined) {
+        return true;
+    }
+    return process.platform === "linux" &&
+        process.env["DISPLAY"] === undefined &&
+        process.env["WAYLAND_DISPLAY"] === undefined;
+}
+function isWsl() {
+    if (process.platform !== "linux")
+        return false;
+    if (process.env["WSL_DISTRO_NAME"] !== undefined || process.env["WSL_INTEROP"] !== undefined)
+        return true;
+    try {
+        return /microsoft/i.test(readFileSync("/proc/version", "utf8"));
+    }
+    catch {
+        return false;
+    }
+}