@minniexcode/codex-switch 0.1.5 → 0.2.0

package/dist/runtime/copilot-token.js

@@ -0,0 +1,294 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setCopilotTokenExchangeImplementation = setCopilotTokenExchangeImplementation;
+exports.resetCopilotTokenExchangeImplementation = resetCopilotTokenExchangeImplementation;
+exports.getCopilotRequestHeaders = getCopilotRequestHeaders;
+exports.getGithubTokenPath = getGithubTokenPath;
+exports.readGithubToken = readGithubToken;
+exports.writeGithubToken = writeGithubToken;
+exports.startDeviceFlow = startDeviceFlow;
+exports.pollDeviceFlowToken = pollDeviceFlowToken;
+exports.exchangeForCopilotToken = exchangeForCopilotToken;
+exports.createTokenManager = createTokenManager;
+exports.createStaticTokenManager = createStaticTokenManager;
+const https = __importStar(require("node:https"));
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const crypto = __importStar(require("node:crypto"));
+const codex_paths_1 = require("../storage/codex-paths");
+const errors_1 = require("../domain/errors");
+const GITHUB_OAUTH_CLIENT_ID = "Iv1.b507a08c87ecfe98";
+const GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
+const GITHUB_ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
+const COPILOT_TOKEN_URL = "https://api.github.com/copilot_internal/v2/token";
+const EDITOR_VERSION = "vscode/1.100.0";
+const COPILOT_CHAT_VERSION = "copilot-chat/0.30.0";
+const USER_AGENT = "GitHubCopilotChat/0.30.0";
+let exchangeImplementation = null;
+function setCopilotTokenExchangeImplementation(impl) {
+    exchangeImplementation = impl;
+}
+function resetCopilotTokenExchangeImplementation() {
+    exchangeImplementation = null;
+}
+const SESSION_ID = crypto.randomUUID();
+const MACHINE_ID = crypto.randomBytes(32).toString("hex");
+function getCopilotRequestHeaders(copilotToken, requestId) {
+    return {
+        "authorization": `Bearer ${copilotToken}`,
+        "content-type": "application/json",
+        "copilot-integration-id": "vscode-chat",
+        "editor-version": EDITOR_VERSION,
+        "editor-plugin-version": COPILOT_CHAT_VERSION,
+        "user-agent": USER_AGENT,
+        "openai-intent": "conversation-panel",
+        "x-interaction-type": "conversation-panel",
+        "x-github-api-version": "2026-01-09",
+        "x-request-id": requestId ?? crypto.randomUUID(),
+        "vscode-sessionid": SESSION_ID,
+        "vscode-machineid": MACHINE_ID,
+    };
+}
+function getGithubTokenPath(toolHomeDir) {
+    const home = (0, codex_paths_1.resolveCodexSwitchHome)(toolHomeDir);
+    return path.join(home, "github-token");
+}
+function readGithubToken(toolHomeDir) {
+    const tokenPath = getGithubTokenPath(toolHomeDir);
+    if (!fs.existsSync(tokenPath)) {
+        return null;
+    }
+    return fs.readFileSync(tokenPath, "utf8").trim();
+}
+function writeGithubToken(token, toolHomeDir) {
+    const tokenPath = getGithubTokenPath(toolHomeDir);
+    fs.mkdirSync(path.dirname(tokenPath), { recursive: true });
+    fs.writeFileSync(tokenPath, token, "utf8");
+}
+async function startDeviceFlow() {
+    const body = `client_id=${GITHUB_OAUTH_CLIENT_ID}&scope=read:user`;
+    const response = await httpsPost(GITHUB_DEVICE_CODE_URL, body, {
+        "content-type": "application/x-www-form-urlencoded",
+        "accept": "application/json",
+    });
+    if (!response.ok) {
+        throw (0, errors_1.cliError)("GITHUB_DEVICE_FLOW_FAILED", `GitHub device flow initiation failed: ${response.status}`, {
+            status: response.status,
+            body: response.body,
+        });
+    }
+    const data = JSON.parse(response.body);
+    return {
+        userCode: String(data.user_code ?? ""),
+        verificationUri: String(data.verification_uri ?? "https://github.com/login/device"),
+        deviceCode: String(data.device_code ?? ""),
+        interval: Number(data.interval ?? 5),
+        expiresIn: Number(data.expires_in ?? 900),
+    };
+}
+async function pollDeviceFlowToken(deviceCode, interval, expiresIn) {
+    const deadline = Date.now() + expiresIn * 1000;
+    let pollInterval = interval;
+    while (Date.now() < deadline) {
+        await sleep(pollInterval * 1000);
+        const body = `client_id=${GITHUB_OAUTH_CLIENT_ID}&device_code=${deviceCode}&grant_type=urn:ietf:params:oauth:grant-type:device_code`;
+        const response = await httpsPost(GITHUB_ACCESS_TOKEN_URL, body, {
+            "content-type": "application/x-www-form-urlencoded",
+            "accept": "application/json",
+        });
+        if (!response.ok) {
+            continue;
+        }
+        const data = JSON.parse(response.body);
+        if (data.access_token && typeof data.access_token === "string") {
+            return data.access_token;
+        }
+        const error = String(data.error ?? "");
+        if (error === "authorization_pending") {
+            continue;
+        }
+        if (error === "slow_down") {
+            pollInterval += 5;
+            continue;
+        }
+        if (error === "expired_token" || error === "access_denied") {
+            throw (0, errors_1.cliError)("GITHUB_DEVICE_FLOW_FAILED", `GitHub device flow failed: ${error}`, { error });
+        }
+    }
+    throw (0, errors_1.cliError)("GITHUB_DEVICE_FLOW_FAILED", "GitHub device flow timed out waiting for user authorization.", {});
+}
+async function exchangeForCopilotToken(githubPat) {
+    if (exchangeImplementation) {
+        return exchangeImplementation(githubPat);
+    }
+    const response = await httpsGet(COPILOT_TOKEN_URL, {
+        "authorization": `token ${githubPat}`,
+        "content-type": "application/json",
+        "accept": "application/json",
+        "editor-version": EDITOR_VERSION,
+        "editor-plugin-version": COPILOT_CHAT_VERSION,
+        "user-agent": USER_AGENT,
+        "x-github-api-version": "2026-01-09",
+    });
+    if (!response.ok) {
+        if (response.status === 401) {
+            throw (0, errors_1.cliError)("COPILOT_AUTH_REQUIRED", "GitHub token is invalid or expired. Run `codexs login copilot` to re-authenticate.", {
+                status: response.status,
+            });
+        }
+        throw (0, errors_1.cliError)("COPILOT_TOKEN_EXCHANGE_FAILED", `Failed to exchange GitHub token for Copilot token: HTTP ${response.status}`, {
+            status: response.status,
+            body: response.body,
+        });
+    }
+    const data = JSON.parse(response.body);
+    const token = String(data.token ?? "");
+    if (!token) {
+        throw (0, errors_1.cliError)("COPILOT_TOKEN_EXCHANGE_FAILED", "Copilot token exchange returned empty token.", { data });
+    }
+    const endpoints = data.endpoints;
+    const apiBaseUrl = String(endpoints?.api ?? "https://api.githubcopilot.com");
+    return {
+        token,
+        expiresAt: Number(data.expires_at ?? Date.now() / 1000 + 1800),
+        apiBaseUrl: apiBaseUrl.replace(/\/$/, ""),
+        refreshIn: Number(data.refresh_in ?? 1500),
+    };
+}
+function createTokenManager(githubPat) {
+    let currentToken = null;
+    let refreshTimer = null;
+    let refreshing = null;
+    async function refresh() {
+        currentToken = await exchangeForCopilotToken(githubPat);
+        scheduleRefresh();
+    }
+    function scheduleRefresh() {
+        if (refreshTimer) {
+            clearTimeout(refreshTimer);
+        }
+        const delayMs = Math.max((currentToken.refreshIn - 60) * 1000, 30000);
+        refreshTimer = setTimeout(() => {
+            refreshing = refresh().catch(() => {
+                // retry after 30s on failure
+                refreshTimer = setTimeout(() => { refreshing = refresh(); }, 30000);
+            });
+        }, delayMs);
+        refreshTimer.unref();
+    }
+    return {
+        async getToken() {
+            if (!currentToken || Date.now() / 1000 >= currentToken.expiresAt - 60) {
+                if (!refreshing) {
+                    refreshing = refresh();
+                }
+                await refreshing;
+                refreshing = null;
+            }
+            return currentToken.token;
+        },
+        getApiBaseUrl() {
+            return currentToken?.apiBaseUrl ?? "https://api.githubcopilot.com";
+        },
+        invalidate() {
+            currentToken = null;
+        },
+        stop() {
+            if (refreshTimer) {
+                clearTimeout(refreshTimer);
+                refreshTimer = null;
+            }
+        },
+    };
+}
+function createStaticTokenManager(token) {
+    return {
+        async getToken() {
+            return token;
+        },
+        getApiBaseUrl() {
+            return "https://api.githubcopilot.com";
+        },
+        invalidate() { },
+        stop() { },
+    };
+}
+function httpsPost(url, body, headers) {
+    return new Promise((resolve, reject) => {
+        const parsed = new URL(url);
+        const req = https.request({
+            hostname: parsed.hostname,
+            port: parsed.port || 443,
+            path: parsed.pathname + parsed.search,
+            method: "POST",
+            headers: { ...headers, "content-length": Buffer.byteLength(body).toString() },
+        }, (res) => {
+            const chunks = [];
+            res.on("data", (chunk) => chunks.push(chunk));
+            res.on("end", () => {
+                const responseBody = Buffer.concat(chunks).toString("utf8");
+                resolve({ ok: res.statusCode >= 200 && res.statusCode < 300, status: res.statusCode, body: responseBody });
+            });
+        });
+        req.on("error", reject);
+        req.write(body);
+        req.end();
+    });
+}
+function httpsGet(url, headers) {
+    return new Promise((resolve, reject) => {
+        const parsed = new URL(url);
+        const req = https.request({
+            hostname: parsed.hostname,
+            port: parsed.port || 443,
+            path: parsed.pathname + parsed.search,
+            method: "GET",
+            headers,
+        }, (res) => {
+            const chunks = [];
+            res.on("data", (chunk) => chunks.push(chunk));
+            res.on("end", () => {
+                const responseBody = Buffer.concat(chunks).toString("utf8");
+                resolve({ ok: res.statusCode >= 200 && res.statusCode < 300, status: res.statusCode, body: responseBody });
+            });
+        });
+        req.on("error", reject);
+        req.end();
+    });
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}

package/docs/Design/codex-switch-v0.2.0-design.md

@@ -0,0 +1,56 @@
+# codex-switch v0.2.0 Design
+
+`0.2.0` is a major architecture release that replaces the Copilot SDK-based authentication and runtime model with a direct GitHub device-flow token exchange and HTTP proxy bridge.
+
+## Architecture Changes
+
+### Authentication: SDK-based to Device-Flow Token
+
+- The Copilot SDK (`@github/copilot-sdk`) is no longer required for authentication or session management.
+- Authentication is now handled via GitHub OAuth Device Flow (`login copilot`), which produces a GitHub personal access token stored at `<toolHomeDir>/github-token`.
+- The GitHub PAT is exchanged for a short-lived Copilot API token via `POST /copilot_internal/v2/token` before every bridge start or switch operation.
+- `TokenManager` handles background token refresh and expiry-aware caching with a new `invalidate()` method for forced refresh on upstream 401 responses.
+
+### Bridge: SDK Session to HTTP Proxy
+
+- The bridge worker (`copilot-http-bridge-worker.ts`) is now a pure HTTP reverse proxy between the local OpenAI-compatible surface and `api.githubcopilot.com`.
+- Copilot token lifecycle (exchange, refresh, invalidation) is managed inside the worker via `createTokenManager`.
+- On upstream 401, the worker invalidates its cached token and retries once with a freshly exchanged token.
+- A `createStaticTokenManager` variant supports test scenarios where the exchange should be bypassed (`CODEX_SWITCH_BRIDGE_COPILOT_TOKEN` env var).
+
+### Path Resolution: toolHomeDir Propagation
+
+- `toolHomeDir` is now explicitly threaded through all functions that read the GitHub token: `switchProvider`, `startBridge`, `getStatus`, `runDoctor`, and the bridge worker spawn.
+- The bridge worker receives the correct `toolHomeDir` (not `runtimeDir`) via `CODEX_SWITCH_TOOL_HOME_DIR`, ensuring the token is found at `<toolHomeDir>/github-token` rather than a nested runtime subdirectory.
+- `readGithubToken(toolHomeDir?)` resolves the home directory in a consistent order: explicit arg, `CODEXS_HOME` env var, then `~/.config/codex-switch`.
+
+### Provider Runtime Kind
+
+- New providers created via `add --copilot` now use `kind: "copilot-http-proxy"` instead of `kind: "copilot-sdk-bridge"`.
+- Both kinds are accepted by `isCopilotBridgeProvider` for backward compatibility with existing provider files.
+- The distinction is cosmetic; both route through the same HTTP bridge worker.
+
+### Status Contract
+
+- `getStatus` output `copilotSdk` field is simplified to `{ installed: boolean, source: string }` reflecting the presence of a GitHub token rather than an SDK install.
+- `copilotAuth` reflects the token exchange readiness rather than SDK session health.
+- Legacy fields (`installDir`, `packageName`, `packageVersion`) are removed from the status contract.
+
+## Test Infrastructure
+
+- `setCopilotTokenExchangeImplementation` / `resetCopilotTokenExchangeImplementation` provide an in-process mock for the Copilot token exchange, enabling offline test execution.
+- The bridge worker supports `CODEX_SWITCH_BRIDGE_COPILOT_TOKEN` env var to skip the real exchange in spawned child processes during tests.
+- Integration tests that previously relied on fake SDK mock responses now verify state and configuration correctness without making HTTP requests through the bridge (bridge request handling is covered by `copilot-bridge-contract.spec.js`).
+
+## Breaking Changes
+
+- `copilotSdk` status output no longer includes `installDir`, `packageName`, or `packageVersion`.
+- Provider `runtimeKind` for newly-created Copilot providers is `"copilot-http-proxy"` instead of `"copilot-sdk-bridge"`.
+- `switchProvider` requires `toolHomeDir` to be passed explicitly when operating outside the default env-var-resolved home.
+- The Copilot SDK (`@github/copilot-sdk`) is no longer a runtime dependency for authentication flows.
+
+## Non-Goals
+
+- The Copilot SDK is not removed from the repository; existing workflows that depend on it for non-auth purposes remain unchanged.
+- No migration of existing `copilot-sdk-bridge` provider records to `copilot-http-proxy`; both are accepted.
+- No changes to direct (non-Copilot) provider workflows.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@minniexcode/codex-switch",
-  "version": "0.1.5",
+  "version": "0.2.0",
   "description": "Local-first CLI for managing and switching Codex provider/model-provider routing.",
   "license": "MIT",
   "type": "commonjs",