@megacode/cli 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Michal Jach
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,268 @@
+# megacode
+
+A minimal coding agent harness for multiple providers and models. It uses the official Anthropic, OpenAI and Google GenAI SDKs. Requires Node ≥ 22.14.
+
+```sh
+npm install -g @megacode/cli
+
+megacode                         # interactive TUI
+megacode "fix the failing test"  # one-shot, plain output
+cat error.log | megacode "why does this fail?"
+megacode -m openai:gpt-5
+megacode -m gemini:gemini-2.5-pro
+megacode -m ollama:qwen3:8b
+megacode -m openrouter:anthropic/claude-sonnet-5
+megacode -w                      # work in a new git worktree
+megacode -w fix-auth "fix login" # named worktree, one-shot
+```
+
+## Providers
+
+Run `/login` to connect a provider. Where a provider supports browser sign-in, it's offered first:
+
+| Provider   | Sign-in options                                                                 |
+| ---------- | ------------------------------------------------------------------------------- |
+| OpenAI     | **Sign in with ChatGPT** (uses your Plus/Pro/Business plan), or an API key      |
+| OpenRouter | **Sign in with OpenRouter** (OAuth; creates a key for megacode), or an API key  |
+| Anthropic  | API key, or **Anthropic CLI** (`ant auth login`, which the SDK picks up)        |
+| Others     | API key, or a server URL for Ollama / LM Studio / custom endpoints              |
+
+Credentials are verified (by fetching the model list) and saved to `~/.megacode/auth.json` (mode 600). ChatGPT tokens refresh automatically. `/logout` removes saved credentials. On first run with nothing configured, the login dialog opens by itself. An environment variable, if set, takes precedence over anything saved. Set `$BROWSER` to control how sign-in URLs are opened; the URL is also shown in the dialog.
+
+"Sign in with ChatGPT" uses the same OAuth client and backend as OpenAI's Codex CLI. That backend isn't a documented public API, so it may change without notice. Claude Pro/Max subscriptions can't be used: Anthropic doesn't permit third-party tools to use Claude.ai logins.
+
+`/model` lists every model from every connected provider, fetched live. Type to filter, then press enter. Anything unlisted can be used as `provider:model`. The last model you pick is remembered.
+
+| Provider     | Env                                       | Notes                            |
+| ------------ | ----------------------------------------- | -------------------------------- |
+| `anthropic`  | `ANTHROPIC_API_KEY`                       | default: `claude-opus-5`         |
+| `openai`     | `OPENAI_API_KEY`                          | default: `gpt-5`                 |
+| `gemini`     | `GEMINI_API_KEY`                          | default: `gemini-2.5-pro`        |
+| `openrouter` | `OPENROUTER_API_KEY`                      | OpenAI-compatible                |
+| `groq`       | `GROQ_API_KEY`                            | OpenAI-compatible                |
+| `deepseek`   | `DEEPSEEK_API_KEY`                        | OpenAI-compatible                |
+| `ollama`     | –                                         | `localhost:11434`                |
+| `lmstudio`   | –                                         | `localhost:1234`                 |
+| `compat`     | `OPENAI_COMPAT_BASE_URL`, `OPENAI_COMPAT_API_KEY` | any other OpenAI-compatible server |
+
+`MEGACODE_MODEL` overrides the default model. Switching models mid-conversation keeps the history. `MEGACODE_CONFIG_DIR` moves everything megacode saves (credentials, settings, history, MCP servers) out of `~/.megacode`.
+
+## Interactive UI
+
+When the model needs clarification, it can call `ask_questions` to open an interactive questionnaire (up to eight questions). Choose a suggested answer with arrow keys and Enter, or choose **Other** to type your own; questions without options accept text directly. Review all answers before submitting, or start over. **Esc** or **Ctrl+C** cancels and interrupts the turn without submitting partial answers. Questions always require your input, even in bypass mode. In one-shot/plain mode, the tool tells the model to ask in text instead of waiting for an interactive form.
+
+Code changes and code blocks look like Claude Code's: edits show one line-number column with removed lines on red, added lines on green (the changed words brighter) and highlighted context; new files list their lines. Highlighting uses Shiki's TextMate grammars with Claude Code's Monokai-style colors; grammars load in the background, and unknown languages and Markdown stay plain.
+
+Successful `edit_file` and `write_file` calls show persistent, syntax-highlighted diffs in the conversation in every permission mode, including automatically accepted edits. Previews include old/new line numbers, nearby context, and red `-` / green `+` markers. Ask-mode approvals use the same preview; overwriting a file shows both removals and additions. Long previews are explicitly truncated to 60 diff lines and 240 characters per source line; very large or expensive diffs show an omission notice. These are interactive previews of built-in file tools, not a live Git diff viewer (shell/MCP edits aren't tracked).
+
+| Key                        | Action                                                        |
+| -------------------------- | ------------------------------------------------------------- |
+| `enter`                    | send (while a turn runs, the message is queued)               |
+| `ctrl+s`                   | send queued messages now (interrupts the running turn)        |
+| `\` + `enter`, `option+enter` | newline                                                    |
+| `↑` / `↓`                  | prompt history (saved in `~/.megacode/history.json`)          |
+| `/`                        | commands: `/model`, `/effort`, `/config`, `/mcp`, `/skills`, `/worktree`, `/login`, `/logout`, `/clear`, `/usage`, `/help`, `/exit` |
+| `?`                        | shortcut help                                                 |
+| `esc`                      | interrupt the running turn, or clear the input                |
+| `shift+tab`                | cycle permission mode: ask → accept edits → bypass (default)  |
+| `ctrl+a` `ctrl+e` `ctrl+u` `ctrl+k` `ctrl+w` | readline-style editing                      |
+| `ctrl+c`                   | interrupt, clear input, or exit (press twice)                 |
+
+## Settings
+
+`/effort` opens an effort picker, or use `/effort low`, `/effort medium`, `/effort high`, or `/effort default` directly. The selection is saved to `~/.megacode/settings.json` and applies starting with the next turn (including future sessions). `default` preserves provider defaults (medium for ChatGPT). Explicit levels use OpenAI's reasoning effort, Anthropic's output effort, or Gemini's thinking level (Gemini 3) / token budget (1,024 / 8,192 / 24,576 for older models). Not every model or compatible server supports these controls or every level; use `default` if the provider rejects the setting.
+
+`/config` opens a settings menu; changes apply immediately and are saved to `~/.megacode/settings.json`.
+
+| Setting                    | Default   | Options                                       |
+| -------------------------- | --------- | --------------------------------------------- |
+| Model                      | –         | opens the model picker                        |
+| Permission mode            | bypass    | ask · accept edits · bypass (also the session's current mode) |
+| Max steps per turn         | 50        | 25 · 50 · 100 · 200                           |
+| Shell command timeout      | 2m        | 30s · 2m · 5m · 10m                           |
+| Max tool output            | 12k chars | 6k · 12k · 30k · 100k                         |
+| Load AGENTS.md / CLAUDE.md | on        | on · off                                      |
+| Worktree base              | default branch | default branch (origin/HEAD) · current commit |
+| Save prompt history        | on        | on · off                                      |
+| Prompt autocomplete       | on        | on · off                                      |
+
+Prompt autocomplete suggests a next prompt based on the current conversation and recent tool results, displayed as dimmed inline text after a turn finishes. **Tab** accepts without sending; **Enter** sends only text you've entered or accepted. Typing a different prompt hides the suggestion. Suggestions use an additional, tool-free request to the selected model (normal provider costs apply, tokens count toward `/usage`); they never execute actions or change conversation history. Failures silently leave the prompt unchanged. Toggle **Prompt autocomplete** in `/config`, or set `"promptAutocomplete": false` in `~/.megacode/settings.json` to disable requests and suggestions. Slash-command completion remains available independently.
+
+## Skills
+
+Skills are reusable instructions in a `SKILL.md` file, optionally accompanied by scripts, references, or other assets. Install from a local directory or a GitHub repository:
+
+```sh
+megacode skills install ./my-skill
+megacode skills install owner/repository
+megacode skills install https://github.com/owner/repository --global
+megacode skills list
+```
+
+In the TUI, use `/skills` to list skills and `/skills install <source> [--global]` to install them. Local paths containing spaces can be quoted. No provider login is required for the standalone CLI commands.
+
+- Installs go to `.megacode/skills/<name>` in the current working directory, or `~/.megacode/skills/<name>` with `--global`. Project skills override global skills with the same name. Worktrees use their own working directory's skills.
+- A source can be a single skill directory or a repository containing multiple skills; all discovered skills are installed. GitHub installs require Git and clone the default branch. Branch/subdirectory URLs and non-GitHub remotes aren't supported. Private repositories require existing Git credentials; installation doesn't prompt for login.
+- Installed metadata is available starting with the next turn. The agent reads a skill's full instructions only when relevant or requested by name. `/skills` also reports invalid installed skills, which are skipped during discovery.
+- Existing installs are never overwritten. To remove or reinstall a skill, remove its installation directory first. Installs are copies, not links; source changes aren't automatically synced.
+- **Only install skills you trust.** Installation copies files but never runs skill scripts. Skills can instruct the agent to run commands later, under the session's normal permissions. Symlinks and special files are rejected; `.git`, `node_modules`, and `.megacode` are excluded. Each skill is limited to 50 MiB and 10,000 entries.
+
+A skill needs YAML frontmatter with a unique lowercase, hyphenated name (up to 64 characters) and a description (up to 1,024 characters):
+
+```markdown
+---
+name: review-tests
+description: Review test coverage and suggest missing regression tests.
+---
+Read the changed code and its tests. Identify missing regression coverage.
+Consult references/checklist.md when needed.
+```
+
+## MCP servers
+
+`/mcp` lists your [MCP](https://modelcontextprotocol.io) servers with their status and tools, and lets you add, reconnect, disable or remove them. Servers are saved in `~/.megacode/mcp.json`, in the same format Claude Code and Claude Desktop use, so existing entries can be pasted in:
+
+```json
+{
+  "mcpServers": {
+    "filesystem": { "command": "npx", "args": ["-y", "@modelcontextprotocol/server-filesystem", "/Users/me/projects"] },
+    "github": { "command": "github-mcp-server", "args": ["stdio"], "env": { "GITHUB_PERSONAL_ACCESS_TOKEN": "…" } },
+    "docs": { "type": "http", "url": "https://example.com/mcp", "headers": { "Authorization": "Bearer …" } }
+  }
+}
+```
+
+- Transports: `stdio` (local command; it inherits your environment plus `env`), `http` (streamable HTTP) and `sse`. Add `"disabled": true` to keep a server configured but off.
+- Servers connect in the background at startup; failures are reported and shown in `/mcp`. Tools that servers add or remove while running are picked up.
+- Tools appear to the model as `mcp__<server>__<tool>` and go through the same approval as shell commands (asked in ask / accept-edits mode, automatic in bypass). Server instructions are added to the system prompt.
+- Not supported yet: OAuth sign-in for remote servers (use a header with a token), project-level `.mcp.json`, and MCP resources and prompts.
+
+## Worktrees
+
+Like Claude Code, megacode can work in a separate git worktree so the agent's changes stay off your checkout. Worktrees live in `<repo>/.megacode/worktrees/<name>` (hidden from `git status`) on a branch named `worktree-<name>`, branched from the remote's default branch or your current commit (see `/config`).
+
+- `megacode -w [name]` starts in a worktree, creating it if needed (random name if omitted). The argument after `-w` is taken as the name if it looks like one (letters, digits, `-`, `_`); otherwise it's part of the prompt.
+- `/worktree` opens a menu to create a worktree, switch between them, or return to the main checkout (keeping or removing the worktree). `/worktree <name>` switches directly.
+- Exiting while in a worktree asks whether to keep it or remove it along with its branch, showing any uncommitted files and unmerged commits that removal would discard.
+- In one-shot mode there's no one to ask: a worktree created by that run and left untouched is removed; anything else is kept.
+
+## Tools
+
+`read_file`, `view_image`, `write_file`, `edit_file`, `bash`, `list_files`, `grep`. `view_image` sends local PNG, JPEG, GIF, or WebP files (up to 5 MiB) to a vision-capable model, so you can provide a screenshot path without attaching it manually. Tools run without asking by default (bypass mode; change it in `/config`). `-a/--ask` starts in ask mode, where writes, edits and shell commands open an approval dialog: yes, always for this session, or no (esc), which stops the turn so you can redirect. In one-shot mode with `-a` and no terminal, approvals are refused. If `AGENTS.md` or `CLAUDE.md` exists in the working directory, it is added to the system prompt (unless turned off in `/config`).
+
+### Token-efficient context
+
+File reads default to 200 lines and a 12,000-character budget, with an exact continuation offset. Lines are never silently cut (a single oversized line can exceed the budget). Scope searches and read only the ranges you need.
+
+Long shell, search, listing and MCP results show the first and last halves of the "Max tool output" budget (12,000 characters by default, so 6,000 each; see `/config`). Full output is saved in a private `megacode-output-*` directory under the OS temporary directory, with a path the agent can read/search. Exit status stays visible, and a non-zero exit marks the result as an error. These logs may contain sensitive command output; remove them when no longer needed (they are not automatically deleted by megacode). Listings capped at 1,000 entries explicitly request a narrower glob.
+
+Conversation history, project instructions, and provider-native reasoning/signatures are retained; there is no lossy automatic history summarization. Existing provider prompt caching remains enabled where supported.
+
+## Layout
+
+The code follows a ports-and-adapters layout with one dependency rule: `core/` imports nothing outside itself, `adapters/` implement core's ports, and `ui/` sits on top. `composition.ts` is the only place that wires adapters into the core.
+
+```
+src/
+  cli.tsx             entry: flags, TUI or plain mode
+  args.ts             command-line parsing
+  composition.ts      composition root: builds the Agent from adapters
+  core/               domain and use cases; no SDKs, I/O or UI
+    agent.ts          agent loop: model turn → run tools → repeat (emits events)
+    conversation.ts   provider-neutral message format
+    provider.ts       Provider port, turn request/result, effort, "provider:model" specs
+    tools.ts          Tool and ToolSource ports, approvals, questionnaires
+    settings.ts       settings, defaults, permission modes
+    prompts.ts        system prompt composition
+    suggestion.ts     next-prompt suggestions
+  adapters/
+    storage.ts        JSON files in the config folder (~/.megacode or $MEGACODE_CONFIG_DIR)
+    settings.ts       settings.json
+    project.ts        working directory and AGENTS.md / CLAUDE.md for the system prompt
+    accounts.ts       /login and /logout use cases: verify, save, remove credentials
+    providers/
+      catalog.ts      known providers and OpenAI-compatible presets
+      credentials.ts  credential precedence (env, saved, ChatGPT, local, ant profile)
+      registry.ts     provider factory and cache, model lists, model resolution
+      anthropic.ts    Messages API (streaming)
+      openai.ts       Chat Completions (streaming), also used for compatible APIs
+      chatgpt.ts      Responses API adapter for ChatGPT sign-in
+      gemini.ts       @google/genai (streaming)
+      shared.ts       tool-argument parsing, fallback call ids, data URLs
+      usage.ts        /usage: account limits and balances
+    auth/
+      store.ts        auth.json
+      oauth.ts        PKCE, local callback server, browser launch
+      chatgpt.ts      Sign in with ChatGPT, token refresh, usage API
+      openrouter.ts   OpenRouter OAuth
+      anthropic.ts    Anthropic CLI login and profile detection
+    tools/
+      index.ts        built-in ToolSource: lookup, validation, error handling
+      validation.ts   argument checks from each tool's JSON schema
+      files.ts        read / write / edit / list files
+      image.ts        view_image: bounded read, format detection
+      shell.ts        bash, grep
+      questions.ts    ask_questions tool and input validation
+      output.ts       output budgets, temp-file spill, paged file reads
+    mcp/
+      manager.ts      MCP connections, offered to the agent as a ToolSource
+      config.ts       mcp.json, server drafts, command-line splitting
+      transport.ts    stdio / HTTP / SSE transports
+      results.ts      tool results as text
+    git/worktree.ts   git worktree create / list / status / remove
+  lib/async.ts        withTimeout
+  ui/                 Ink (React) TUI and plain output
+    App.tsx           layout, dialogs, keyboard shortcuts, command context
+    commands.ts       slash command registry (name, description, handler)
+    session.ts        AgentSession: turns, queue, interrupts, approvals, questionnaires (no React)
+    hooks/
+      useAgentSession.ts   React binding for AgentSession
+      useWorktree.ts       entering and leaving worktrees
+      useStreamedText.ts   streamed-text buffering
+      usePromptSuggestion.ts
+    plain.ts          one-shot / piped output
+    Transcript.tsx    transcript items, streamed text, diff previews
+    PromptInput.tsx   multi-line editor, history, slash menu
+    StatusLine.tsx    mode, cwd, model, tokens
+    ApprovalDialog.tsx  tool permission prompt
+    ModelPicker.tsx   searchable live model list
+    LoginDialog.tsx   provider login / logout
+    loginFlow.ts      /login steps, back navigation, error messages
+    ConfigMenu.tsx    /config settings menu
+    EffortPicker.tsx  /effort menu
+    WorktreeMenu.tsx  /worktree menu, exit prompt
+    McpMenu.tsx       /mcp server list, add wizard, details
+    mcpWizard.ts      /mcp add wizard steps and validation
+    Questionnaire.tsx ask_questions form
+    Dialog.tsx        the frame every dialog uses
+    Select.tsx, TextField.tsx, KeyList.tsx, Spinner.tsx, Help.tsx   small building blocks
+    syntax.ts         syntax highlighting (Shiki grammars, Claude Code colors)
+    diff.ts           diff model: rows, word-level changes, plain-text rendering
+    DiffLines.tsx     diff rows in the TUI
+    format.ts         Markdown rendering, tool labels, previews
+test/                 node:test suites (npm test); e2e.test.mjs runs the CLI against a fake model server
+```
+
+Conversation history is stored in a neutral format (`core/conversation.ts`). Each assistant turn also keeps the provider's native content. That content is sent back verbatim to the same provider, so Anthropic thinking blocks and Gemini thought signatures are preserved. When you switch providers, the next one gets the neutral text and tool calls instead.
+
+Tools return structured results; a file edit reports the change (`file`, `before`, `after`), and only the UI turns it into a colored diff, so nothing display-only reaches the model.
+
+To add a provider, implement the `Provider` port (`core/provider.ts`) in `src/adapters/providers/`, add it to `catalog.ts`, and construct it in `registry.ts`. To add a tool source, implement `ToolSource` (`core/tools.ts`) and combine it in `composition.ts`.
+
+## Harness benchmark
+
+See [bench/README.md](bench/README.md) for fixed coding tasks, independent grading, same-model comparisons with other CLI harnesses, and local megacode results.
+
+```sh
+npm run bench -- --model openai:gpt-6-astra --repeats 5
+```
+
+## Development
+
+```sh
+npm install
+npm start               # runs src/cli.tsx via tsx
+npm test                # unit and UI rendering tests in test/
+npm run typecheck
+npm run build           # compiles to dist/, which is what gets published
+```

package/dist/adapters/accounts.js

@@ -0,0 +1,34 @@
+import { withTimeout } from "../lib/async.js";
+import { removeCredentials, saveCredentials } from "./auth/store.js";
+import { envKeyName, providerInfo } from "./providers/catalog.js";
+import { createProvider, resetProvider } from "./providers/registry.js";
+// Account use cases behind /login and /logout. The UI collects input; this decides what gets stored.
+const VERIFY_TIMEOUT = 20_000;
+/** Checks a key and/or endpoint by listing models, then saves it. Throws (saving nothing) if it doesn't work. */
+export async function verifyAndSaveKey(name, input) {
+    const apiKey = input.apiKey || undefined;
+    const baseURL = input.baseURL || undefined;
+    await withTimeout(createProvider(name, { apiKey, baseURL, source: "saved" }).listModels(), VERIFY_TIMEOUT);
+    // Don't pin the default endpoint, so a later change to the default still applies.
+    saveCredentials(name, { apiKey, baseURL: baseURL !== providerInfo(name).baseURL ? baseURL : undefined });
+    resetProvider(name);
+}
+/** "Sign in with ChatGPT" replaces any saved OpenAI API key. */
+export function saveChatGPTLogin(tokens) {
+    saveCredentials("openai", { chatgpt: tokens });
+    resetProvider("openai");
+}
+/** With credentials in place, how many models the provider offers. Throws if they don't work. */
+export async function countModels(name) {
+    resetProvider(name);
+    return (await withTimeout(createProvider(name).listModels(), VERIFY_TIMEOUT)).length;
+}
+/** Removes saved credentials and says what happened, including an env var that still applies. */
+export function logout(name) {
+    if (!removeCredentials(name))
+        return { ok: false, message: `No saved credentials for ${name}.` };
+    resetProvider(name);
+    const info = providerInfo(name);
+    const env = envKeyName(info);
+    return { ok: true, message: `Removed saved credentials for ${info.label}${env ? ` ($${env} is still set in your environment)` : ""}.` };
+}

package/dist/adapters/auth/anthropic.js

@@ -0,0 +1,36 @@
+import { spawn } from "node:child_process";
+import { existsSync, readdirSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+/** Thrown by loginAnthropicCLI when the `ant` binary isn't on PATH. */
+export class AntNotInstalledError extends Error {
+    constructor() {
+        super("The Anthropic CLI isn't installed. Install it with `brew install anthropics/tap/ant`, or paste an API key.");
+    }
+}
+const antConfigDir = () => process.env.ANTHROPIC_CONFIG_DIR ??
+    (process.platform === "win32" ? path.join(process.env.APPDATA ?? "", "Anthropic") : path.join(os.homedir(), ".config", "anthropic"));
+/** True if `ant auth login` has stored credentials the Anthropic SDK will pick up. */
+export function hasAntProfile() {
+    const dir = path.join(antConfigDir(), "credentials");
+    try {
+        return existsSync(dir) && readdirSync(dir).some((f) => f.endsWith(".json"));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Runs `ant auth login` (Anthropic CLI browser sign-in). The SDK reads the resulting profile,
+ * so megacode stores nothing itself. Each line of the CLI's output goes to `onOutput`.
+ */
+export function loginAnthropicCLI(onOutput, signal) {
+    return new Promise((resolve, reject) => {
+        const child = spawn("ant", ["auth", "login"], { stdio: ["ignore", "pipe", "pipe"], signal });
+        const onData = (d) => d.toString().split("\n").filter(Boolean).forEach(onOutput);
+        child.stdout.on("data", onData);
+        child.stderr.on("data", onData);
+        child.on("error", (e) => reject(e.code === "ENOENT" ? new AntNotInstalledError() : e.name === "AbortError" ? new Error("Sign-in cancelled") : e));
+        child.on("close", (code) => (code === 0 ? resolve() : reject(new Error(`ant auth login exited with code ${code}`))));
+    });
+}

package/dist/adapters/auth/chatgpt.js

@@ -0,0 +1,100 @@
+import { callbackServer, jwtClaims, openBrowser, pkce } from "./oauth.js";
+import { saveCredentials, savedCredentials } from "./store.js";
+// "Sign in with ChatGPT": the OAuth client and backend used by OpenAI's Codex CLI
+// (github.com/openai/codex, codex-rs/login). Requests are billed to the user's ChatGPT plan.
+// This backend is not a documented public API and may change.
+// The env overrides exist for testing against a local mock.
+const ISSUER = process.env.MEGACODE_CHATGPT_ISSUER ?? "https://auth.openai.com";
+const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+const PORT = 1455; // the redirect URI registered for this client
+const REDIRECT_URI = `http://127.0.0.1:${PORT}/auth/callback`;
+export const CHATGPT_BASE_URL = process.env.MEGACODE_CHATGPT_BASE_URL ?? "https://chatgpt.com/backend-api/codex";
+const ORIGINATOR = "codex_cli_rs";
+/** Headers the ChatGPT backend expects on every request. */
+export const chatGPTHeaders = (t) => ({ "ChatGPT-Account-ID": t.accountId, originator: ORIGINATOR });
+function toTokens(res, prev) {
+    const id = res.id_token ? jwtClaims(res.id_token) : {};
+    const access = jwtClaims(res.access_token);
+    const auth = id["https://api.openai.com/auth"] ?? access["https://api.openai.com/auth"] ?? {};
+    return {
+        access: res.access_token,
+        refresh: res.refresh_token ?? prev?.refresh ?? "",
+        expires: access.exp ? access.exp * 1000 : Date.now() + (res.expires_in ?? 3600) * 1000,
+        accountId: auth.chatgpt_account_id ?? prev?.accountId ?? "",
+        email: id.email ?? id["https://api.openai.com/profile"]?.email ?? prev?.email,
+        plan: auth.chatgpt_plan_type ?? prev?.plan,
+    };
+}
+async function tokenRequest(body, format) {
+    const res = await fetch(`${ISSUER}/oauth/token`, {
+        method: "POST",
+        headers: { "content-type": format === "json" ? "application/json" : "application/x-www-form-urlencoded" },
+        body: format === "json" ? JSON.stringify(body) : new URLSearchParams(body).toString(),
+    });
+    if (!res.ok)
+        throw new Error(`Token request failed (${res.status}): ${(await res.text()).slice(0, 200)}`);
+    return res.json();
+}
+function authorizeUrl(challenge, state) {
+    const url = new URL(`${ISSUER}/oauth/authorize`);
+    const params = {
+        response_type: "code",
+        client_id: CLIENT_ID,
+        redirect_uri: REDIRECT_URI,
+        scope: "openid profile email offline_access",
+        code_challenge: challenge,
+        code_challenge_method: "S256",
+        state,
+        id_token_add_organizations: "true",
+        codex_cli_simplified_flow: "true",
+        originator: ORIGINATOR,
+    };
+    for (const [k, v] of Object.entries(params))
+        url.searchParams.set(k, v);
+    return url.toString();
+}
+/** Browser sign-in with a ChatGPT account. `onUrl` gets the URL in case the browser doesn't open. */
+export async function loginChatGPT(onUrl, signal) {
+    const { verifier, challenge, state } = pkce();
+    const server = await callbackServer({ port: PORT, path: "/auth/callback", state, signal });
+    try {
+        const url = authorizeUrl(challenge, state);
+        onUrl(url);
+        openBrowser(url);
+        const code = await server.code;
+        const tokens = toTokens(await tokenRequest({ grant_type: "authorization_code", client_id: CLIENT_ID, code, redirect_uri: REDIRECT_URI, code_verifier: verifier }, "form"));
+        if (!tokens.accountId)
+            throw new Error("This account has no ChatGPT workspace. Use an API key instead.");
+        return tokens;
+    }
+    finally {
+        server.close();
+    }
+}
+/** Current tokens, refreshed (and re-saved) when they're about to expire or `force` is set. */
+export async function chatGPTTokens(force = false) {
+    const saved = savedCredentials("openai");
+    const tokens = saved?.chatgpt;
+    if (!tokens)
+        throw new Error("Not signed in with ChatGPT. Run /login.");
+    if (!force && tokens.expires > Date.now() + 60_000)
+        return tokens;
+    const refreshed = toTokens(await tokenRequest({ client_id: CLIENT_ID, grant_type: "refresh_token", refresh_token: tokens.refresh }, "json"), tokens);
+    saveCredentials("openai", { ...saved, chatgpt: refreshed });
+    return refreshed;
+}
+/** Live subscription limits from the same backend used by Codex. */
+export async function chatGPTUsage() {
+    const signal = AbortSignal.timeout(15_000);
+    const url = `${CHATGPT_BASE_URL.replace(/\/codex\/?$/, "")}/wham/usage`;
+    for (let attempt = 0; attempt < 2; attempt++) {
+        const t = await chatGPTTokens(attempt > 0);
+        const res = await fetch(url, { headers: { Authorization: `Bearer ${t.access}`, ...chatGPTHeaders(t) }, signal });
+        if (res.status === 401 && attempt === 0)
+            continue; // token revoked early: refresh once
+        if (!res.ok)
+            throw new Error(`Usage request failed (HTTP ${res.status}).${res.status === 401 || res.status === 403 ? " Run /login to update credentials." : ""}`);
+        return res.json();
+    }
+    throw new Error("Unable to fetch ChatGPT usage.");
+}

package/dist/adapters/auth/oauth.js

@@ -0,0 +1,68 @@
+import { spawn } from "node:child_process";
+import { createHash, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+const b64url = (buf) => buf.toString("base64url");
+export function pkce() {
+    const verifier = b64url(randomBytes(32));
+    return { verifier, challenge: b64url(createHash("sha256").update(verifier).digest()), state: b64url(randomBytes(16)) };
+}
+export function openBrowser(url) {
+    // $BROWSER is the usual override (and lets headless setups print or handle the URL).
+    const [cmd, args] = process.env.BROWSER
+        ? [process.env.BROWSER, [url]]
+        : process.platform === "darwin"
+            ? ["open", [url]]
+            : process.platform === "win32"
+                ? ["cmd", ["/c", "start", '""', url.replace(/&/g, "^&")]]
+                : ["xdg-open", [url]];
+    try {
+        spawn(cmd, args, { stdio: "ignore", detached: true }).on("error", () => { }).unref();
+    }
+    catch {
+        // the URL is also shown in the UI, so the user can open it by hand
+    }
+}
+const escapeHtml = (text) => text.replace(/[&<>"']/g, (char) => ({
+    "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;",
+})[char]);
+const PAGE = (title, body) => `<!doctype html><meta charset="utf-8"><title>${escapeHtml(title)}</title><body style="font:16px system-ui;display:grid;place-items:center;height:90vh"><div><h2>${escapeHtml(title)}</h2><p>${escapeHtml(body)}</p></div>`;
+/**
+ * Local HTTP server that receives the OAuth redirect (`?code=…&state=…`) on 127.0.0.1.
+ * Call `close()` when done; `code` rejects on error, state mismatch or abort.
+ */
+export async function callbackServer(opts) {
+    let resolveCode;
+    let rejectCode;
+    const code = new Promise((res, rej) => ((resolveCode = res), (rejectCode = rej)));
+    code.catch(() => { }); // handled by the caller
+    const server = createServer((req, res) => {
+        const url = new URL(req.url ?? "/", "http://127.0.0.1");
+        if (url.pathname !== opts.path)
+            return res.writeHead(404).end();
+        const error = url.searchParams.get("error_description") ?? url.searchParams.get("error");
+        const got = url.searchParams.get("code");
+        if (error || !got || (opts.state && url.searchParams.get("state") !== opts.state)) {
+            res.writeHead(400, { "content-type": "text/html" }).end(PAGE("Sign-in failed", error ?? "Invalid response. Try again from megacode."));
+            return rejectCode(new Error(error ?? "Invalid OAuth callback"));
+        }
+        res.writeHead(200, { "content-type": "text/html" }).end(PAGE("Signed in ✔", "You can close this tab and return to megacode."));
+        resolveCode(got);
+    });
+    await new Promise((resolve, reject) => {
+        server.once("error", (e) => reject(e.code === "EADDRINUSE" ? new Error(`Port ${opts.port} is in use. Close other sign-in windows and retry.`) : e));
+        server.listen(opts.port, "127.0.0.1", resolve);
+    });
+    const port = server.address().port;
+    const close = () => server.close();
+    opts.signal.addEventListener("abort", () => rejectCode(new Error("Sign-in cancelled")), { once: true });
+    return { port, code, close };
+}
+/** Decode a JWT payload without verifying it (we only read our own tokens' claims). */
+export function jwtClaims(token) {
+    try {
+        return JSON.parse(Buffer.from(token.split(".")[1], "base64url").toString("utf8"));
+    }
+    catch {
+        return {};
+    }
+}

package/dist/adapters/auth/openrouter.js

@@ -0,0 +1,27 @@
+import { callbackServer, openBrowser, pkce } from "./oauth.js";
+/** OpenRouter's OAuth PKCE flow for apps: returns a regular OpenRouter API key. */
+export async function loginOpenRouter(onUrl, signal) {
+    const { verifier, challenge } = pkce();
+    const server = await callbackServer({ port: 0, path: "/callback", signal });
+    try {
+        const url = new URL("https://openrouter.ai/auth");
+        url.searchParams.set("callback_url", `http://localhost:${server.port}/callback`);
+        url.searchParams.set("code_challenge", challenge);
+        url.searchParams.set("code_challenge_method", "S256");
+        onUrl(url.toString());
+        openBrowser(url.toString());
+        const code = await server.code;
+        const res = await fetch("https://openrouter.ai/api/v1/auth/keys", {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ code, code_verifier: verifier, code_challenge_method: "S256" }),
+            signal,
+        });
+        if (!res.ok)
+            throw new Error(`OpenRouter key exchange failed (${res.status})`);
+        return (await res.json()).key;
+    }
+    finally {
+        server.close();
+    }
+}

package/dist/adapters/auth/store.js

@@ -0,0 +1,25 @@
+import { readJson, writeJson } from "../storage.js";
+const FILE = "auth.json";
+const load = () => readJson(FILE, {});
+const save = (auth) => writeJson(FILE, auth, { secret: true });
+export const savedCredentials = (provider) => load()[provider];
+export const savedProviders = () => Object.keys(load());
+/** Replaces a provider's saved credentials; empty credentials remove the entry. */
+export function saveCredentials(provider, creds) {
+    const auth = load();
+    const entry = Object.fromEntries(Object.entries(creds).filter(([, v]) => v));
+    if (Object.keys(entry).length)
+        auth[provider] = entry;
+    else
+        delete auth[provider];
+    save(auth);
+}
+/** Returns false if nothing was saved for the provider. */
+export function removeCredentials(provider) {
+    const auth = load();
+    if (!auth[provider])
+        return false;
+    delete auth[provider];
+    save(auth);
+    return true;
+}