@giovannijecha/jecode 0.1.9 → 0.2.1

package/dist/openai-oauth.js

@@ -0,0 +1,203 @@
+// OpenAI's ChatGPT OAuth protocol, implemented with Node primitives only.
+//
+// This module owns the authority handshake. It does not know about the TUI or
+// persist anything; callers decide when an explicitly completed login becomes
+// an account on disk.
+import { createHash, randomBytes } from "node:crypto";
+import { oauthRequest } from "./oauth-http.js";
+import { OPENAI_CALLBACK_PATH, openAICallback } from "./openai-oauth-callback.js";
+import { openAIAccountFromTokens, openAITokenReply, } from "./openai-oauth-tokens.js";
+const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+const AUTHORITY = "https://auth.openai.com";
+const AUTHORIZE = `${AUTHORITY}/oauth/authorize`;
+const TOKEN = `${AUTHORITY}/oauth/token`;
+const REVOKE = `${AUTHORITY}/oauth/revoke`;
+const DEVICE_CODE = `${AUTHORITY}/api/accounts/deviceauth/usercode`;
+const DEVICE_POLL = `${AUTHORITY}/api/accounts/deviceauth/token`;
+const DEVICE_VERIFY = `${AUTHORITY}/codex/device`;
+const DEVICE_REDIRECT = `${AUTHORITY}/deviceauth/callback`;
+const LOGIN_LIMIT_MS = 15 * 60_000;
+export async function beginBrowserLogin() {
+    const verifier = randomBytes(64).toString("base64url");
+    const challenge = createHash("sha256").update(verifier).digest("base64url");
+    const state = randomBytes(32).toString("base64url");
+    const callback = await openAICallback(state);
+    const redirectUri = `http://localhost:${callback.port}${OPENAI_CALLBACK_PATH}`;
+    const authorize = new URL(AUTHORIZE);
+    authorize.search = new URLSearchParams({
+        response_type: "code",
+        client_id: CLIENT_ID,
+        redirect_uri: redirectUri,
+        scope: "openid profile email offline_access",
+        code_challenge: challenge,
+        code_challenge_method: "S256",
+        state,
+        id_token_add_organizations: "true",
+        codex_cli_simplified_flow: "true",
+        originator: "jecode",
+    }).toString();
+    return {
+        url: authorize.href,
+        async complete(signal) {
+            try {
+                const code = await abortable(callback.code, signal);
+                const account = openAIAccountFromTokens(await exchange({
+                    authorizationCode: code,
+                    verifier,
+                    redirectUri,
+                }, signal));
+                await callback.respond(true);
+                return account;
+            }
+            catch (error) {
+                await callback.respond(false);
+                throw error;
+            }
+            finally {
+                await callback.close();
+            }
+        },
+        close: callback.close,
+    };
+}
+export async function beginDeviceLogin(signal) {
+    const start = await oauthRequest(DEVICE_CODE, { contentType: "application/json", value: { client_id: CLIENT_ID } }, signal);
+    const value = record(start.value) ? start.value : {};
+    const deviceAuthId = required(value["device_auth_id"], "device authorization id");
+    const code = required(value["user_code"] ?? value["usercode"], "device code");
+    const interval = intervalSeconds(value["interval"]);
+    return {
+        url: DEVICE_VERIFY,
+        code,
+        async complete(waitSignal) {
+            const combined = combine(signal, waitSignal);
+            const pending = await pollDevice(deviceAuthId, code, interval, combined);
+            return openAIAccountFromTokens(await exchange(pending, combined));
+        },
+        close: async () => { },
+    };
+}
+export async function refreshOpenAITokens(account, signal) {
+    const response = await oauthRequest(TOKEN, {
+        contentType: "application/json",
+        value: {
+            client_id: CLIENT_ID,
+            grant_type: "refresh_token",
+            refresh_token: account.refreshToken,
+        },
+    }, signal);
+    const token = openAITokenReply(response.value, account.refreshToken);
+    const refreshed = openAIAccountFromTokens(token);
+    if (refreshed.accountId !== account.accountId) {
+        throw new Error("OpenAI refreshed a different ChatGPT account · sign in again");
+    }
+    return {
+        ...refreshed,
+        ...(refreshed.email === undefined && account.email !== undefined ? { email: account.email } : {}),
+        ...(refreshed.plan === undefined && account.plan !== undefined ? { plan: account.plan } : {}),
+    };
+}
+export async function revokeOpenAITokens(account, signal) {
+    await oauthRequest(REVOKE, {
+        contentType: "application/json",
+        value: {
+            token: account.refreshToken,
+            token_type_hint: "refresh_token",
+            client_id: CLIENT_ID,
+        },
+    }, signal);
+}
+async function exchange(code, signal) {
+    const response = await oauthRequest(TOKEN, {
+        contentType: "application/x-www-form-urlencoded",
+        value: new URLSearchParams({
+            grant_type: "authorization_code",
+            client_id: CLIENT_ID,
+            code: code.authorizationCode,
+            code_verifier: code.verifier,
+            redirect_uri: code.redirectUri,
+        }),
+    }, signal);
+    return openAITokenReply(response.value);
+}
+async function pollDevice(deviceAuthId, userCode, interval, signal) {
+    const started = Date.now();
+    while (Date.now() - started < LOGIN_LIMIT_MS) {
+        const response = await oauthRequest(DEVICE_POLL, {
+            contentType: "application/json",
+            value: { device_auth_id: deviceAuthId, user_code: userCode },
+        }, signal, [200, 403, 404]);
+        if (response.status === 200) {
+            const value = record(response.value) ? response.value : {};
+            return {
+                authorizationCode: required(value["authorization_code"], "authorization code"),
+                verifier: required(value["code_verifier"], "code verifier"),
+                redirectUri: DEVICE_REDIRECT,
+            };
+        }
+        await sleep(interval * 1_000, signal);
+    }
+    throw new Error("ChatGPT device sign-in timed out after 15 minutes");
+}
+function intervalSeconds(value) {
+    const parsed = typeof value === "string" ? Number(value.trim()) : value;
+    return typeof parsed === "number" && Number.isFinite(parsed)
+        ? Math.max(1, Math.min(30, Math.floor(parsed)))
+        : 5;
+}
+function required(value, label) {
+    const found = optional(value);
+    if (found === undefined)
+        throw new Error(`OpenAI sign-in returned no ${label}`);
+    return found;
+}
+function optional(value) {
+    return typeof value === "string" && value !== "" ? value : undefined;
+}
+function record(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function combine(left, right) {
+    if (left === undefined)
+        return right;
+    if (right === undefined)
+        return left;
+    return AbortSignal.any([left, right]);
+}
+function abortable(promise, signal) {
+    if (signal === undefined)
+        return promise;
+    if (signal.aborted)
+        return Promise.reject(abortReason(signal));
+    return new Promise((resolve, reject) => {
+        const onAbort = () => reject(abortReason(signal));
+        signal.addEventListener("abort", onAbort, { once: true });
+        promise.then((value) => {
+            signal.removeEventListener("abort", onAbort);
+            resolve(value);
+        }, (error) => {
+            signal.removeEventListener("abort", onAbort);
+            reject(error);
+        });
+    });
+}
+function sleep(ms, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal?.aborted === true) {
+            reject(abortReason(signal));
+            return;
+        }
+        const timer = setTimeout(() => {
+            signal?.removeEventListener("abort", onAbort);
+            resolve();
+        }, ms);
+        const onAbort = () => {
+            clearTimeout(timer);
+            reject(signal === undefined ? new Error("cancelled") : abortReason(signal));
+        };
+        signal?.addEventListener("abort", onAbort, { once: true });
+    });
+}
+function abortReason(signal) {
+    return signal.reason instanceof Error ? signal.reason : new Error("cancelled");
+}

package/dist/provider-commands.js

@@ -2,8 +2,10 @@
 import { heading } from "./tui/picker.js";
 import { PROVIDERS } from "./providers/index.js";
 import { readSettings } from "./settings.js";
-import { askForKey } from "./credential-commands.js";
+import { authenticationNeed, ensureProviderAuthentication, } from "./credential-commands.js";
 import { providerFailure } from "./provider-errors.js";
+import { providerLabel } from "./provider-label.js";
+import { compatibleEffort } from "./effort.js";
 /**
  * The provider menu.
  *
@@ -34,32 +36,22 @@ export async function providersCommand(session, host, behavior = {}) {
     // Picking the provider already in use is not a no-op when it cannot run:
     // it is how the user asks to fix the reason it cannot.
     if (chosen.id === session.provider.id) {
-        const blocked = chosen.blocked();
-        if (blocked !== undefined) {
-            if (!isCredentialBlocker(chosen, blocked)) {
-                host.emit({ kind: "notice", text: blocked, tone: "error" });
-                return false;
-            }
-            await askForKey(chosen.keyVar, host, session.palette);
-            if (chosen.blocked() !== undefined)
-                return false;
-        }
-        return true;
+        if (!(await ensureProviderAuthentication(chosen, session, host)))
+            return false;
+        return session.model === ""
+            ? modelsCommand(session, host, { announce: false, save: behavior.save })
+            : true;
     }
     // A provider that cannot run is worth one offer to fix it, here, rather
     // than a note telling the user to leave and export something.
     const blocked = chosen.blocked();
     if (blocked !== undefined) {
-        if (!isCredentialBlocker(chosen, blocked)) {
-            host.emit({ kind: "notice", text: blocked, tone: "error" });
-            return false;
-        }
-        await askForKey(chosen.keyVar, host, session.palette);
+        await ensureProviderAuthentication(chosen, session, host);
         const still = chosen.blocked();
         if (still !== undefined) {
             host.emit({
                 kind: "notice",
-                text: `${providerName(chosen.id)} still needs an API key · provider unchanged`,
+                text: `${providerLabel(chosen.id)} still needs ${authenticationNeed(chosen)} · provider unchanged`,
                 tone: "warn",
             });
             return false;
@@ -70,6 +62,7 @@ export async function providersCommand(session, host, behavior = {}) {
         model: session.model,
         providerId: session.config.providerId,
         configModel: session.config.model,
+        effort: session.config.effort,
     };
     session.provider = chosen;
     // The model belonged to the old provider. Carrying it across would send
@@ -77,16 +70,31 @@ export async function providersCommand(session, host, behavior = {}) {
     session.model = readSettings().models?.[chosen.id] ?? chosen.defaultModel;
     session.config.providerId = chosen.id;
     session.config.model = session.model;
+    if (session.model === "") {
+        if (!(await modelsCommand(session, host, { announce: false, save: false }))) {
+            restoreProvider(session, before);
+            return false;
+        }
+    }
+    else {
+        const alignment = await alignEffort(session, host);
+        if (!alignment.ok) {
+            restoreProvider(session, before);
+            return false;
+        }
+    }
     if (behavior.save !== false) {
         const saved = readSettings();
         const models = { ...saved.models };
         if (session.model !== "")
             models[chosen.id] = session.model;
-        if (!(await saveDefaults(host, { provider: chosen.id, models }))) {
-            session.provider = before.provider;
-            session.model = before.model;
-            session.config.providerId = before.providerId;
-            session.config.model = before.configModel;
+        const patch = {
+            provider: chosen.id,
+            models,
+            ...(session.config.effort === before.effort ? {} : { effort: session.config.effort }),
+        };
+        if (!(await saveDefaults(host, patch))) {
+            restoreProvider(session, before);
             return false;
         }
     }
@@ -111,16 +119,12 @@ export async function modelsCommand(session, host, behavior = {}) {
     // to pick a model, and "go and export a variable" is not an answer.
     const blocked = provider.blocked();
     if (blocked !== undefined) {
-        if (!isCredentialBlocker(provider, blocked)) {
-            host.emit({ kind: "notice", text: blocked, tone: "error" });
-            return false;
-        }
-        await askForKey(provider.keyVar, host, session.palette);
+        await ensureProviderAuthentication(provider, session, host);
         const still = provider.blocked();
         if (still !== undefined) {
             host.emit({
                 kind: "notice",
-                text: `${providerName(provider.id)} still needs an API key`,
+                text: `${providerLabel(provider.id)} still needs ${authenticationNeed(provider)}`,
                 tone: "warn",
             });
             return false;
@@ -158,15 +162,31 @@ export async function modelsCommand(session, host, behavior = {}) {
     const chosen = ids[index];
     if (chosen === undefined)
         return false;
-    const before = { model: session.model, configModel: session.config.model };
+    const before = {
+        model: session.model,
+        configModel: session.config.model,
+        effort: session.config.effort,
+    };
     session.model = chosen;
     session.config.model = chosen;
+    const alignment = await alignEffort(session, host);
+    if (!alignment.ok) {
+        session.model = before.model;
+        session.config.model = before.configModel;
+        session.config.effort = before.effort;
+        return false;
+    }
     if (behavior.save !== false) {
         const saved = readSettings();
         const models = { ...saved.models, [provider.id]: chosen };
-        if (!(await saveDefaults(host, { models }))) {
+        const patch = {
+            models,
+            ...(session.config.effort === before.effort ? {} : { effort: session.config.effort }),
+        };
+        if (!(await saveDefaults(host, patch))) {
             session.model = before.model;
             session.config.model = before.configModel;
+            session.config.effort = before.effort;
             return false;
         }
     }
@@ -175,19 +195,40 @@ export async function modelsCommand(session, host, behavior = {}) {
     }
     return true;
 }
-/** The way to put a menu up, or nothing — and the reason, already said. */
+function restoreProvider(session, before) {
+    session.provider = before.provider;
+    session.model = before.model;
+    session.config.providerId = before.providerId;
+    session.config.model = before.configModel;
+    session.config.effort = before.effort;
+}
+async function alignEffort(session, host) {
+    if (session.provider.efforts === undefined)
+        return { ok: true };
+    let supported;
+    try {
+        supported = await session.provider.efforts(session.model, host.signal, (status) => host.status?.(status));
+    }
+    catch (error) {
+        host.emit({
+            kind: "notice",
+            text: providerFailure(session.provider, error, true),
+            tone: "error",
+        });
+        return { ok: false };
+    }
+    const adjusted = compatibleEffort(session.config.effort, supported);
+    if (adjusted === undefined || adjusted === session.config.effort)
+        return { ok: true };
+    session.config.effort = adjusted;
+    return { ok: true, adjusted };
+}
 function chooser(host) {
     if (host.choose === undefined) {
         host.emit({ kind: "notice", text: "that command needs the screen", tone: "warn" });
     }
     return host.choose;
 }
-function providerName(id) {
-    return id === "" ? "Provider" : `${id[0]?.toUpperCase() ?? ""}${id.slice(1)}`;
-}
-function isCredentialBlocker(provider, blocked) {
-    return blocked.startsWith(`${provider.keyVar} `);
-}
 async function saveDefaults(host, patch) {
     if (host.saveSettings === undefined)
         return true;

package/dist/provider-label.js

@@ -0,0 +1,10 @@
+// Stable human-facing names for provider identifiers.
+export function providerLabel(id) {
+    switch (id) {
+        case "anthropic": return "Anthropic";
+        case "openai": return "OpenAI";
+        case "openai-codex": return "OpenAI Codex";
+        case "ollama": return "Ollama";
+        default: return id === "" ? "Provider" : `${id[0]?.toUpperCase() ?? ""}${id.slice(1)}`;
+    }
+}

package/dist/providers/anthropic-stream.js

@@ -13,7 +13,8 @@ export async function assembleAnthropic(events, onStream) {
     let stopReason;
     let stopDetails;
     let usage;
-    for await (const raw of events) {
+    let complete = false;
+    stream: for await (const raw of events) {
         const event = raw;
         switch (event.type) {
             case "message_start":
@@ -51,10 +52,15 @@ export async function assembleAnthropic(events, onStream) {
             case "error": {
                 throw new Error(`anthropic stream error: ${event.error?.message ?? "unspecified"}`);
             }
+            case "message_stop":
+                complete = true;
+                break stream;
             default:
-                break; // message_start, ping, message_stop: nothing to accumulate
+                break; // ping and unknown forward-compatible events
         }
     }
+    if (!complete)
+        throw new Error("anthropic stream ended before message_stop");
     const content = [...blocks.entries()]
         .sort(([a], [b]) => a - b)
         .map(([, block]) => block);

package/dist/providers/anthropic.js

@@ -9,25 +9,33 @@
 import { postSse } from "./http.js";
 import { listModels } from "./catalog.js";
 import { keyFor } from "../credentials.js";
+import { EFFORTS, requireSupportedEffort } from "../effort.js";
 import { assembleAnthropic } from "./anthropic-stream.js";
 import { fromWireResponse, stopNotice, toWireMessage, toWireTool } from "./anthropic-wire.js";
 const ENDPOINT = "https://api.anthropic.com/v1/messages";
 const MODELS = "https://api.anthropic.com/v1/models?limit=100";
 const API_VERSION = "2023-06-01";
 const KEY = "ANTHROPIC_API_KEY";
-// Adaptive thinking and `output_config.effort` exist on the 4.6-and-later
-// families only. Older models reject both with a 400, so `/model claude-haiku-4-5`
-// would fail on send if the request shape were fixed. It follows the model.
-const ADAPTIVE = /^claude-(fable-5|opus-(5|4-[678])|sonnet-(5|4-6))/;
+const ADAPTIVE = /^claude-(?:fable-5|mythos-(?:5|preview)|opus-(?:5|4-[678])|sonnet-(?:5|4-6))(?:-|$)/;
+const MAX_WITHOUT_XHIGH = ["low", "medium", "high", "max"];
+const ANTHROPIC_45_EFFORTS = ["low", "medium", "high"];
 export function supportsAdaptiveThinking(model) {
     return ADAPTIVE.test(model);
 }
+export function anthropicEfforts(model) {
+    if (/^claude-(?:(?:opus|sonnet)-4-6|mythos-preview)(?:-|$)/.test(model)) {
+        return MAX_WITHOUT_XHIGH;
+    }
+    if (/^claude-opus-4-5(?:-|$)/.test(model))
+        return ANTHROPIC_45_EFFORTS;
+    return supportsAdaptiveThinking(model) ? EFFORTS : [];
+}
 export const anthropic = {
     id: "anthropic",
     // Sonnet is the default because it is the one that can be left running.
     // Opus via `--model claude-opus-5`, Haiku via `--model claude-haiku-4-5`.
     defaultModel: "claude-sonnet-5",
-    keyVar: KEY,
+    auth: { kind: "api-key", keyVar: KEY },
     blocked() {
         return apiKey() === undefined ? `${KEY} is not set` : undefined;
     },
@@ -36,6 +44,9 @@ export const anthropic = {
     models(signal, onStatus) {
         return listModels(MODELS, headers(requireKey()), signal, onStatus);
     },
+    async efforts(model) {
+        return anthropicEfforts(model);
+    },
     location: () => "cloud",
     async send(req) {
         const key = requireKey();
@@ -49,7 +60,12 @@ export const anthropic = {
         };
         if (supportsAdaptiveThinking(req.model)) {
             body["thinking"] = { type: "adaptive", display: "summarized" };
-            body["output_config"] = { effort: req.effort };
+        }
+        const efforts = anthropicEfforts(req.model);
+        if (efforts.length > 0) {
+            body["output_config"] = {
+                effort: requireSupportedEffort(req.model, req.effort, efforts),
+            };
         }
         const events = await postSse(ENDPOINT, headers(key), body, req.signal, req.onStatus);
         const data = await assembleAnthropic(events, req.onStream);

package/dist/providers/index.js

@@ -1,7 +1,8 @@
 import { anthropic } from "./anthropic.js";
 import { openai } from "./openai.js";
+import { openaiCodex } from "./openai-codex.js";
 import { configureOllama, ollama } from "./ollama.js";
-export const PROVIDERS = [anthropic, openai, ollama];
+export const PROVIDERS = [anthropic, openai, openaiCodex, ollama];
 export function providerNames() {
     return PROVIDERS.map((provider) => provider.id);
 }

package/dist/providers/ollama-stream.js

@@ -51,6 +51,9 @@ export async function assembleOllama(events, onStream) {
             calls.set(index, call);
         }
     }
+    if (finishReason === undefined) {
+        throw new Error("ollama stream ended before a finish reason");
+    }
     const toolCalls = [...calls.entries()]
         .sort(([a], [b]) => a - b)
         // Not every server sends an id, and the loop needs one to pair the result

package/dist/providers/ollama.js

@@ -25,7 +25,7 @@ export function ollamaConnection() {
 export const ollama = {
     id: "ollama",
     defaultModel: "",
-    keyVar: KEY,
+    auth: { kind: "api-key", keyVar: KEY },
     // The only provider whose key is conditional: a daemon on this machine is
     // reached over loopback and asks for nothing, so demanding a key there
     // would be an invented requirement.
@@ -45,6 +45,9 @@ export const ollama = {
         const at = endpoint();
         return listModels(`${at.baseUrl}/v1/models`, headers(at), signal, onStatus);
     },
+    async efforts() {
+        return [];
+    },
     location: () => {
         try {
             return endpoint().loopback ? "local" : "cloud";