@goodandready/dsh-subscriptions 0.4.15 → 0.4.16

package/lib/vendors/codex.js

@@ -10,6 +10,12 @@ export const id = 'codex'
 const AUTH = 'https://auth.openai.com/oauth/authorize'
 const TOKEN = 'https://auth.openai.com/oauth/token'
 const USAGE = 'https://chatgpt.com/backend-api/wham/usage'
+// #90: device-code login (headless). OpenAI mints an authorization_code +
+// code_verifier server-side; we finish with the normal PKCE exchange.
+const DEVICE_USERCODE_URL = 'https://auth.openai.com/api/accounts/deviceauth/usercode'
+const DEVICE_TOKEN_URL = 'https://auth.openai.com/api/accounts/deviceauth/token'
+export const DEVICE_AUTH_URL = 'https://auth.openai.com/codex/device'
+const DEVICE_REDIRECT_URI = 'https://auth.openai.com/deviceauth/callback'
 const SCOPE = 'openid profile email offline_access api.connectors.read api.connectors.invoke'
 const INSTRUCTIONS = 'You are a coding assistant using a ChatGPT Codex subscription.'
 
@@ -82,6 +88,45 @@ export async function exchangeCode(cfg, pkce, code, fetchImpl) {
   return decorate(tokenBlobFromOAuth(json), json)
 }
 
+export async function deviceStart(cfg, fetchImpl) {
+  const impl = fetchImpl || fetch
+  const res = await impl(DEVICE_USERCODE_URL, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+    body: JSON.stringify({ client_id: cfg.clientId }),
+  })
+  if (!res.ok) throw httpError(res.status, await res.text().catch(() => ''), 'DEVICE')
+  const json = await readJson(res)
+  if (!json || typeof json.user_code !== 'string' || typeof json.device_auth_id !== 'string') {
+    throw httpError(502, 'device auth response is incomplete', 'DEVICE')
+  }
+  return {
+    userCode: json.user_code,
+    deviceAuthId: json.device_auth_id,
+    intervalMs: Math.max(parseInt(json.interval, 10) || 5, 1) * 1000,
+    authUrl: DEVICE_AUTH_URL,
+  }
+}
+
+export async function devicePoll(cfg, session, fetchImpl) {
+  const impl = fetchImpl || fetch
+  const res = await impl(DEVICE_TOKEN_URL, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+    body: JSON.stringify({ device_auth_id: session.deviceAuthId, user_code: session.userCode }),
+  })
+  // 403/404 = not confirmed yet (matches reference implementations)
+  if (res.status === 403 || res.status === 404) return { status: 'pending' }
+  if (!res.ok) throw httpError(res.status, await res.text().catch(() => ''), 'DEVICE')
+  const json = await readJson(res)
+  if (!json || typeof json.authorization_code !== 'string' || typeof json.code_verifier !== 'string') {
+    throw httpError(502, 'device auth token response is incomplete', 'DEVICE')
+  }
+  const deviceCfg = { ...cfg, redirectUri: DEVICE_REDIRECT_URI }
+  const blob = await exchangeCode(deviceCfg, { verifier: json.code_verifier }, json.authorization_code, impl)
+  return { status: 'authorized', blob }
+}
+
 export async function refresh(cfg, blob, fetchImpl) {
   const json = await formTokenRequest(TOKEN, {
     grant_type: 'refresh_token',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.4.15",
+  "version": "0.4.16",
   "description": "Use ChatGPT Codex, Claude, Grok, and Antigravity subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",
@@ -51,13 +51,17 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-llm": "^0.1.0-rc.6",
     "@deepseek-ai/dsh-credentials": "^0.1.0-rc.6",
     "@deepseek-ai/dsh-host-webserver": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-llm": "^0.1.0-rc.6",
     "@deepseek-ai/dsh-settings": "^0.1.0-rc.6",
     "@deepseek-ai/schemastery": "^3.18.1"
   },
   "publishConfig": {
     "access": "public"
+  },
+  "dependencies": {
+    "socks": "^2.8.9",
+    "undici": "^8.10.1"
   }
 }