@giovannijecha/jecode 0.1.9 → 0.2.1

package/dist/oauth-http.js

@@ -0,0 +1,114 @@
+// A narrow HTTP boundary for OAuth authority requests.
+//
+// These requests never redirect, never retry, and never retain an unbounded
+// response. Authorization codes and refresh tokens must not leak into errors.
+const AUTH_ORIGIN = "https://auth.openai.com";
+const TIMEOUT_MS = 15_000;
+const MAX_BODY_CHARS = 64_000;
+export async function oauthRequest(url, body, signal, accepted = [200]) {
+    const target = new URL(url);
+    if (target.origin !== AUTH_ORIGIN || target.username !== "" || target.password !== "") {
+        throw new Error("OAuth request target is not allowed");
+    }
+    const timeout = new AbortController();
+    const timer = setTimeout(() => timeout.abort(new Error("OpenAI sign-in timed out")), TIMEOUT_MS);
+    const combined = signal === undefined
+        ? timeout.signal
+        : AbortSignal.any([signal, timeout.signal]);
+    const secrets = bodySecrets(body);
+    let response;
+    let text;
+    try {
+        response = await fetch(target, {
+            method: "POST",
+            headers: { "content-type": body.contentType, accept: "application/json" },
+            body: body.contentType === "application/json"
+                ? JSON.stringify(body.value)
+                : body.value.toString(),
+            cache: "no-store",
+            redirect: "manual",
+            signal: combined,
+        });
+        if (response.status >= 300 && response.status < 400) {
+            await response.body?.cancel().catch(() => undefined);
+            throw new Error(`OpenAI sign-in redirect rejected (${response.status})`);
+        }
+        text = await boundedText(response);
+    }
+    catch (error) {
+        if (timeout.signal.aborted)
+            throw timeout.signal.reason;
+        if (signal?.aborted === true)
+            throw abortReason(signal);
+        if (error instanceof Error && error.message.startsWith("OpenAI sign-in"))
+            throw error;
+        const detail = error instanceof Error ? error.message : String(error);
+        throw new Error(`OpenAI sign-in network error: ${detail}`);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+    const value = parse(text);
+    if (!accepted.includes(response.status)) {
+        throw new Error(`OpenAI sign-in failed (${response.status})${errorDetail(value, secrets)}`);
+    }
+    return { status: response.status, value };
+}
+async function boundedText(response) {
+    if (response.body === null)
+        return "";
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    let text = "";
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                return text + decoder.decode();
+            text += decoder.decode(value, { stream: true });
+            if (text.length > MAX_BODY_CHARS) {
+                await reader.cancel().catch(() => undefined);
+                throw new Error("OpenAI sign-in returned too much data");
+            }
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+}
+function parse(text) {
+    if (text.trim() === "")
+        return {};
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new Error("OpenAI sign-in returned an invalid response");
+    }
+}
+function errorDetail(value, secrets) {
+    if (!record(value))
+        return "";
+    const detail = [value["error_description"], value["message"], value["error"]]
+        .find((entry) => typeof entry === "string");
+    if (typeof detail !== "string" || detail.trim() === "")
+        return "";
+    let safe = detail.replace(/[\r\n]+/g, " ");
+    for (const secret of secrets)
+        safe = safe.replaceAll(secret, "[credential redacted]");
+    return ` · ${safe.slice(0, 300)}`;
+}
+function bodySecrets(body) {
+    const values = body.contentType === "application/x-www-form-urlencoded"
+        ? [...body.value.values()]
+        : record(body.value)
+            ? Object.values(body.value).filter((value) => typeof value === "string")
+            : [];
+    return values.filter((value) => value.length >= 8);
+}
+function abortReason(signal) {
+    return signal.reason instanceof Error ? signal.reason : new Error("cancelled");
+}
+function record(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/dist/openai-account-command.js

@@ -0,0 +1,124 @@
+// Interactive ChatGPT account management for the OpenAI Codex provider.
+import { openAICodexAccount } from "./accounts.js";
+import { headlessEnvironment, openExternal } from "./external-browser.js";
+import { openAIAccountHint, removeOpenAIAccount, saveOpenAIAccount, } from "./openai-account.js";
+import { beginBrowserLogin, beginDeviceLogin, } from "./openai-oauth.js";
+import { heading } from "./tui/picker.js";
+const DEFAULT_DEPENDENCIES = {
+    beginBrowser: beginBrowserLogin,
+    beginDevice: beginDeviceLogin,
+    openUrl: openExternal,
+    headless: headlessEnvironment,
+};
+export async function openAIAccountCommand(session, host, dependencies = DEFAULT_DEPENDENCIES) {
+    if (host.choose === undefined)
+        return false;
+    const connected = openAICodexAccount() !== undefined;
+    const actions = connected
+        ? [
+            { label: "reconnect ChatGPT", hint: "replace the current sign-in", key: "r" },
+            { label: "sign out", hint: "remove the saved account", key: "s" },
+        ]
+        : [{ label: "connect ChatGPT", hint: "sign in with OpenAI", key: "c" }];
+    const action = await host.choose({
+        title: heading("ChatGPT", openAIAccountHint(), session.palette),
+        options: actions,
+        index: 0,
+    });
+    if (action === undefined)
+        return false;
+    if (connected && actions[action]?.key === "s") {
+        const result = await removeOpenAIAccount(host.signal);
+        host.emit({
+            kind: "notice",
+            text: result.revokeFailed ? "ChatGPT disconnected · remote sign-out could not be confirmed" : "ChatGPT disconnected",
+            tone: result.revokeFailed ? "warn" : "info",
+        });
+        return result.removed;
+    }
+    return connectOpenAIAccount(session, host, dependencies);
+}
+export async function ensureOpenAIAccount(session, host, dependencies = DEFAULT_DEPENDENCIES) {
+    if (openAICodexAccount() !== undefined)
+        return true;
+    return connectOpenAIAccount(session, host, dependencies);
+}
+async function connectOpenAIAccount(session, host, dependencies) {
+    if (host.choose === undefined)
+        return false;
+    const methods = [
+        { label: "sign in with browser", hint: "desktop terminal", key: "b" },
+        { label: "sign in with device code", hint: "WSL, SSH, or headless", key: "d" },
+    ];
+    const choice = await host.choose({
+        title: heading("connect ChatGPT", "OpenAI OAuth", session.palette),
+        description: "Choose the flow for this terminal. Your password stays on OpenAI's website.",
+        options: methods,
+        index: dependencies.headless() ? 1 : 0,
+    });
+    if (choice === undefined)
+        return false;
+    host.status?.("Starting ChatGPT sign-in");
+    let login;
+    try {
+        login = choice === 1
+            ? await dependencies.beginDevice(host.signal)
+            : await dependencies.beginBrowser();
+    }
+    finally {
+        host.status?.(undefined);
+    }
+    return waitForLogin(login, session, host, dependencies.openUrl);
+}
+async function waitForLogin(login, session, host, openUrl) {
+    if (host.choose === undefined)
+        return false;
+    const local = new AbortController();
+    const signal = host.signal === undefined
+        ? local.signal
+        : AbortSignal.any([host.signal, local.signal]);
+    const completion = login.complete(signal).then((account) => ({ kind: "account", account }), (error) => ({ kind: "error", error: error }));
+    await openUrl(login.url);
+    try {
+        while (true) {
+            const selection = host.choose(waitingPicker(login, session));
+            const outcome = await Promise.race([
+                completion,
+                selection.then((index) => ({ kind: "selection", index })),
+            ]);
+            if (outcome.kind === "account") {
+                host.dismiss?.();
+                await saveOpenAIAccount(outcome.account, host.signal);
+                host.emit({ kind: "notice", text: "ChatGPT connected", tone: "info" });
+                return true;
+            }
+            if (outcome.kind === "error") {
+                host.dismiss?.();
+                throw outcome.error;
+            }
+            if (outcome.index === 0) {
+                await openUrl(login.url);
+                continue;
+            }
+            local.abort(new Error("ChatGPT sign-in cancelled"));
+            return false;
+        }
+    }
+    finally {
+        await login.close();
+    }
+}
+function waitingPicker(login, session) {
+    const detail = login.code === undefined
+        ? "Finish sign-in in your browser. Jecode will continue automatically."
+        : `Enter ${login.code} on OpenAI's device page. Jecode will continue automatically.`;
+    return {
+        title: heading("ChatGPT sign-in", login.code ?? "waiting for browser", session.palette),
+        description: detail,
+        options: [
+            { label: "open browser again", key: "o" },
+            { label: "cancel sign-in", key: "c" },
+        ],
+        index: 0,
+    };
+}

package/dist/openai-account.js

@@ -0,0 +1,94 @@
+// The live ChatGPT account: persistence, proactive refresh, and logout.
+import { openAICodexAccount, updateOpenAICodexAccount } from "./accounts.js";
+import { refreshOpenAITokens, revokeOpenAITokens } from "./openai-oauth.js";
+const REFRESH_EARLY_MS = 5 * 60_000;
+let refreshing;
+export function openAIAccountHint() {
+    const account = openAICodexAccount();
+    if (account === undefined)
+        return "not connected";
+    const identity = account.email ?? "connected";
+    return account.plan === undefined ? identity : `${identity} · ${account.plan}`;
+}
+export async function saveOpenAIAccount(account, signal) {
+    await updateOpenAICodexAccount(async () => account, signal);
+}
+export async function removeOpenAIAccount(signal) {
+    let account;
+    await updateOpenAICodexAccount(async (current) => {
+        account = current;
+        return undefined;
+    }, signal);
+    if (account === undefined)
+        return { removed: false, revokeFailed: false };
+    let revokeFailed = false;
+    try {
+        await revokeOpenAITokens(account, signal);
+    }
+    catch {
+        revokeFailed = true;
+    }
+    return { removed: true, revokeFailed };
+}
+export async function openAIAuthorization(forceToken, signal, onStatus) {
+    const account = openAICodexAccount();
+    if (account === undefined)
+        throw new Error("ChatGPT account is not connected");
+    const mustRefresh = forceToken !== undefined || expiresSoon(account);
+    const ready = mustRefresh
+        ? await refreshAccount(forceToken, signal, onStatus)
+        : account;
+    return { accessToken: ready.accessToken, accountId: ready.accountId };
+}
+async function refreshAccount(forceToken, signal, onStatus) {
+    if (refreshing !== undefined)
+        return abortable(refreshing, signal);
+    if (signal?.aborted === true)
+        throw abortReason(signal);
+    onStatus?.("Refreshing ChatGPT sign-in");
+    const task = updateOpenAICodexAccount(async (current) => {
+        if (current === undefined)
+            throw new Error("ChatGPT account is not connected");
+        if (forceToken !== undefined && current.accessToken !== forceToken)
+            return current;
+        if (forceToken === undefined && !expiresSoon(current))
+            return current;
+        return refreshOpenAITokens(current);
+    }).then((account) => {
+        if (account === undefined)
+            throw new Error("ChatGPT account is not connected");
+        return account;
+    });
+    refreshing = task;
+    void task.then(() => {
+        if (refreshing === task)
+            refreshing = undefined;
+    }, () => {
+        if (refreshing === task)
+            refreshing = undefined;
+    });
+    return abortable(task, signal);
+}
+function expiresSoon(account) {
+    return account.expiresAt - Date.now() <= REFRESH_EARLY_MS;
+}
+function abortable(promise, signal) {
+    if (signal === undefined)
+        return promise;
+    if (signal.aborted)
+        return Promise.reject(abortReason(signal));
+    return new Promise((resolve, reject) => {
+        const onAbort = () => reject(abortReason(signal));
+        signal.addEventListener("abort", onAbort, { once: true });
+        promise.then((value) => {
+            signal.removeEventListener("abort", onAbort);
+            resolve(value);
+        }, (error) => {
+            signal.removeEventListener("abort", onAbort);
+            reject(error);
+        });
+    });
+}
+function abortReason(signal) {
+    return signal.reason instanceof Error ? signal.reason : new Error("cancelled");
+}

package/dist/openai-oauth-callback.js

@@ -0,0 +1,186 @@
+// Loopback callback used by the browser OAuth flow.
+import { timingSafeEqual } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { createServer } from "node:http";
+const CALLBACK_PORTS = [1455, 1457];
+export const OPENAI_CALLBACK_PATH = "/auth/callback";
+export async function openAICallback(state) {
+    let resolveCode = () => { };
+    let rejectCode = () => { };
+    const code = new Promise((resolve, reject) => {
+        resolveCode = resolve;
+        rejectCode = reject;
+    });
+    // A bad callback can arrive before the TUI starts awaiting `complete()`.
+    // Mark the rejection handled here while preserving it for the real waiter.
+    void code.catch(() => undefined);
+    let response;
+    let finished = false;
+    const handler = (request, outgoing) => {
+        if (finished) {
+            outgoing.writeHead(409).end("Sign-in already completed.");
+            return;
+        }
+        if (request.method !== "GET" || request.url === undefined || request.url.length > 4_096) {
+            outgoing.writeHead(400).end("Invalid sign-in callback.");
+            return;
+        }
+        const incoming = new URL(request.url, "http://localhost");
+        if (incoming.pathname !== OPENAI_CALLBACK_PATH) {
+            outgoing.writeHead(404).end("Not found.");
+            return;
+        }
+        const receivedState = incoming.searchParams.get("state");
+        // A stale browser tab or another local client can reach the fixed callback
+        // port. Reject that one request without letting it terminate this login.
+        if (!sameState(state, receivedState)) {
+            outgoing.writeHead(400, { "cache-control": "no-store" }).end("Invalid sign-in state.");
+            return;
+        }
+        finished = true;
+        response = outgoing;
+        const authError = incoming.searchParams.get("error_description") ?? incoming.searchParams.get("error");
+        const authorizationCode = incoming.searchParams.get("code");
+        if (authError !== null) {
+            rejectCode(new Error(`ChatGPT sign-in was rejected · ${authError.slice(0, 300)}`));
+        }
+        else if (authorizationCode === null || authorizationCode === "") {
+            rejectCode(new Error("ChatGPT sign-in returned no authorization code"));
+        }
+        else {
+            resolveCode(authorizationCode);
+        }
+    };
+    const listening = await firstAvailableServer(handler);
+    return {
+        port: listening.port,
+        code,
+        async respond(success) {
+            if (response === undefined || response.writableEnded)
+                return;
+            const flushed = new Promise((resolve) => {
+                response?.once("finish", resolve);
+                response?.once("close", resolve);
+            });
+            response.writeHead(success ? 200 : 400, {
+                "cache-control": "no-store",
+                connection: "close",
+                "content-security-policy": "default-src 'none'; img-src data:; style-src 'unsafe-inline'; script-src 'unsafe-inline'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'",
+                "content-type": "text/html; charset=utf-8",
+                "referrer-policy": "no-referrer",
+                "x-content-type-options": "nosniff",
+            });
+            response.end(resultPage(success));
+            await flushed;
+        },
+        close: () => closeServer(listening.server),
+    };
+}
+async function firstAvailableServer(handler) {
+    for (const port of CALLBACK_PORTS) {
+        const server = createServer(handler);
+        server.maxHeadersCount = 40;
+        server.headersTimeout = 5_000;
+        server.keepAliveTimeout = 500;
+        server.requestTimeout = 5_000;
+        try {
+            await listen(server, port);
+            return { server, port };
+        }
+        catch (error) {
+            await closeServer(server);
+            if (error.code !== "EADDRINUSE")
+                throw error;
+        }
+    }
+    throw new Error("ChatGPT sign-in could not open callback ports 1455 or 1457");
+}
+function listen(server, port) {
+    return new Promise((resolve, reject) => {
+        const onError = (error) => reject(error);
+        server.once("error", onError);
+        server.listen(port, "127.0.0.1", () => {
+            server.off("error", onError);
+            resolve();
+        });
+    });
+}
+function closeServer(server) {
+    return new Promise((resolve) => {
+        if (!server.listening) {
+            resolve();
+            return;
+        }
+        let settled = false;
+        let fallback;
+        const finish = () => {
+            if (settled)
+                return;
+            settled = true;
+            if (fallback !== undefined)
+                clearTimeout(fallback);
+            resolve();
+        };
+        fallback = setTimeout(() => {
+            server.closeAllConnections();
+            finish();
+        }, 500);
+        server.close(finish);
+        server.closeIdleConnections();
+    });
+}
+function resultPage(success) {
+    const title = success ? "Signed in to Jecode" : "Jecode sign-in failed";
+    const status = success ? "Authentication complete" : "Authentication stopped";
+    const detail = success
+        ? "Return to your terminal. Jecode will continue automatically."
+        : "Return to your terminal to see what stopped the connection.";
+    const state = success ? "success" : "failure";
+    return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <meta name="color-scheme" content="dark">
+  <title>${title}</title>
+  <style>
+    :root{--night:#000;--steel:#669bd2;--steel-soft:#8db4dd;--bright:#ebeff4;--danger:#e87070}
+    *{box-sizing:border-box}
+    body{margin:0;min-height:100vh;display:grid;place-items:center;background:var(--night);color:var(--steel-soft);font-family:"Segoe UI",system-ui,sans-serif}
+    main{width:min(34rem,calc(100vw - 3rem));padding:3rem 1.5rem;text-align:center}
+    img{display:block;width:clamp(7.5rem,20vw,10rem);height:auto;margin:0 auto 1.75rem;filter:drop-shadow(0 1.25rem 2rem rgba(102,155,210,.16))}
+    .rail{width:min(18rem,70vw);height:1px;margin:0 auto 1.5rem;background:linear-gradient(90deg,transparent,var(--steel),transparent)}
+    .status{margin:0 0 .75rem;color:var(--steel);font:600 .72rem/1.2 ui-monospace,"Cascadia Mono",monospace;letter-spacing:.14em;text-transform:uppercase}
+    h1{margin:0;color:var(--steel);font-size:clamp(2rem,6vw,3.25rem);font-weight:720;letter-spacing:-.04em;line-height:1.05}
+    p:last-of-type{max-width:30rem;margin:1.25rem auto 0;color:var(--steel-soft);font-size:1.05rem;line-height:1.6}
+    .failure h1,.failure .status{color:var(--danger)}
+    @media (prefers-reduced-motion:no-preference){main{animation:arrive .45s ease-out both}@keyframes arrive{from{opacity:0;transform:translateY(.6rem)}to{opacity:1;transform:none}}}
+  </style>
+</head>
+<body>
+  <main class="${state}">
+    <img src="${mascotDataUri()}" alt="Jeco, the Jecode gecko">
+    <div class="rail" aria-hidden="true"></div>
+    <p class="status">${status}</p>
+    <h1>${title}</h1>
+    <p>${detail}</p>
+  </main>
+  <script>history.replaceState(null,"","/auth/complete")</script>
+</body>
+</html>`;
+}
+let mascot;
+function mascotDataUri() {
+    if (mascot === undefined) {
+        const file = new URL("../docs/assets/brand/jeco-256.png", import.meta.url);
+        mascot = `data:image/png;base64,${readFileSync(file).toString("base64")}`;
+    }
+    return mascot;
+}
+function sameState(expected, received) {
+    if (received === null)
+        return false;
+    const left = Buffer.from(expected);
+    const right = Buffer.from(received);
+    return left.length === right.length && timingSafeEqual(left, right);
+}

package/dist/openai-oauth-tokens.js

@@ -0,0 +1,65 @@
+// Validate OAuth token responses and extract the ChatGPT account claims.
+const CLAIMS = "https://api.openai.com/auth";
+export function openAITokenReply(value, previousRefresh) {
+    if (!record(value))
+        throw new Error("OpenAI sign-in returned an invalid token response");
+    const accessToken = required(value["access_token"], "access token");
+    const refreshToken = optional(value["refresh_token"]) ?? previousRefresh;
+    const expiresIn = value["expires_in"];
+    if (refreshToken === undefined)
+        throw new Error("OpenAI sign-in did not return a refresh token");
+    if (typeof expiresIn !== "number" || !Number.isFinite(expiresIn) || expiresIn <= 0) {
+        throw new Error("OpenAI sign-in did not return a valid token lifetime");
+    }
+    const idToken = optional(value["id_token"]);
+    return {
+        accessToken,
+        refreshToken,
+        expiresAt: Date.now() + Math.floor(expiresIn * 1_000),
+        ...(idToken === undefined ? {} : { idToken }),
+    };
+}
+export function openAIAccountFromTokens(token) {
+    const access = jwt(token.accessToken);
+    const identity = token.idToken === undefined ? undefined : jwt(token.idToken);
+    const auth = record(access[CLAIMS]) ? access[CLAIMS] : {};
+    const accountId = optional(auth["chatgpt_account_id"]) ?? optional(identity?.["chatgpt_account_id"]);
+    if (accountId === undefined)
+        throw new Error("OpenAI sign-in did not identify a ChatGPT account");
+    const email = optional(identity?.["email"]);
+    const plan = optional(auth["chatgpt_plan_type"]) ?? optional(identity?.["chatgpt_plan_type"]);
+    return {
+        accessToken: token.accessToken,
+        refreshToken: token.refreshToken,
+        expiresAt: token.expiresAt,
+        accountId,
+        ...(email === undefined ? {} : { email }),
+        ...(plan === undefined ? {} : { plan }),
+    };
+}
+function jwt(token) {
+    const part = token.split(".")[1];
+    if (part === undefined)
+        throw new Error("OpenAI sign-in returned an unreadable token");
+    try {
+        const value = JSON.parse(Buffer.from(part, "base64url").toString("utf8"));
+        if (!record(value))
+            throw new Error("invalid payload");
+        return value;
+    }
+    catch {
+        throw new Error("OpenAI sign-in returned an unreadable token");
+    }
+}
+function required(value, label) {
+    const found = optional(value);
+    if (found === undefined)
+        throw new Error(`OpenAI sign-in returned no ${label}`);
+    return found;
+}
+function optional(value) {
+    return typeof value === "string" && value !== "" ? value : undefined;
+}
+function record(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}