@pasko70/pibo 1.1.0 → 1.3.0

package/dist/auth/better-auth.js

@@ -5,6 +5,7 @@ import { betterAuth } from "better-auth";
 import { getMigrations } from "better-auth/db/migration";
 import { bearer } from "better-auth/plugins";
 import { loadPiboConfig } from "../config/config.js";
+import { piboHomePath } from "../core/pibo-home.js";
 import { createForbiddenAuthError, createUnauthenticatedError } from "./types.js";
 const SESSION_EXPIRES_IN_SECONDS = 60 * 60 * 24 * 90;
 const SESSION_UPDATE_AGE_SECONDS = 60 * 60;
@@ -63,7 +64,7 @@ export function createBetterAuthService(options = {}) {
     const googleClientSecret = requiredOption(options.googleClientSecret ?? authConfig?.googleClientSecret, "auth.googleClientSecret");
     const secret = requiredSecret(options.secret ?? authConfig?.secret);
     const allowedEmails = requiredAllowedEmails(options, authConfig?.allowedEmails);
-    const database = createDatabase(options.databasePath ?? authConfig?.databasePath ?? ".pibo/auth.sqlite");
+    const database = createDatabase(options.databasePath ?? authConfig?.databasePath ?? piboHomePath("auth.sqlite"));
     const trustedOrigins = options.trustedOrigins ?? authConfig?.trustedOrigins;
     const authOptions = {
         appName: "Pibo",

package/dist/auth/login-actions.js

@@ -0,0 +1,251 @@
+import { AuthStorage } from "@mariozechner/pi-coding-agent";
+import { randomBytes } from "node:crypto";
+const OPENAI_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+const OPENAI_AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize";
+const OPENAI_ISSUER_URL = "https://auth.openai.com";
+const OPENAI_DEVICE_USER_CODE_URL = `${OPENAI_ISSUER_URL}/api/accounts/deviceauth/usercode`;
+const OPENAI_DEVICE_TOKEN_URL = `${OPENAI_ISSUER_URL}/api/accounts/deviceauth/token`;
+const OPENAI_DEVICE_VERIFICATION_URL = `${OPENAI_ISSUER_URL}/codex/device`;
+const OPENAI_TOKEN_URL = "https://auth.openai.com/oauth/token";
+const OPENAI_REDIRECT_URI = "http://localhost:1455/auth/callback";
+const OPENAI_DEVICE_REDIRECT_URI = `${OPENAI_ISSUER_URL}/deviceauth/callback`;
+const OPENAI_SCOPE = "openid profile email offline_access";
+const OPENAI_JWT_CLAIM_PATH = "https://api.openai.com/auth";
+const OPENAI_DEVICE_LOGIN_TIMEOUT_MS = 15 * 60 * 1000;
+function base64urlEncode(bytes) {
+    let binary = "";
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+async function generatePKCE() {
+    const verifierBytes = new Uint8Array(32);
+    crypto.getRandomValues(verifierBytes);
+    const verifier = base64urlEncode(verifierBytes);
+    const encoder = new TextEncoder();
+    const data = encoder.encode(verifier);
+    const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+    const challenge = base64urlEncode(new Uint8Array(hashBuffer));
+    return { verifier, challenge };
+}
+const pendingLogins = new Map();
+function createAuthStorage() {
+    return AuthStorage.create();
+}
+function decodeJwt(token) {
+    try {
+        const parts = token.split(".");
+        if (parts.length !== 3)
+            return null;
+        const payload = parts[1] ?? "";
+        const decoded = atob(payload);
+        return JSON.parse(decoded);
+    }
+    catch {
+        return null;
+    }
+}
+function getOpenAiAccountId(accessToken) {
+    const payload = decodeJwt(accessToken);
+    const auth = payload?.[OPENAI_JWT_CLAIM_PATH];
+    const accountId = auth?.chatgpt_account_id;
+    return typeof accountId === "string" && accountId.length > 0 ? accountId : null;
+}
+function requirePendingLogin(state, provider) {
+    const pending = pendingLogins.get(state);
+    if (!pending) {
+        throw new Error("Invalid or expired login state. Start a new login flow with /login-start.");
+    }
+    if (pending.provider !== provider) {
+        throw new Error(`Login state mismatch: expected provider "${pending.provider}", got "${provider}".`);
+    }
+    // Expire after 10 minutes
+    if (Date.now() - pending.createdAt > 10 * 60 * 1000) {
+        pendingLogins.delete(state);
+        throw new Error("Login state expired. Start a new login flow with /login-start.");
+    }
+    return pending;
+}
+async function readResponseText(response) {
+    return await response.text().catch(() => "");
+}
+function parseDeviceIntervalMs(value) {
+    const parsed = typeof value === "number" ? value : Number.parseInt(value ?? "", 10);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed * 1000 : 5000;
+}
+async function startOpenAiDeviceLogin(provider) {
+    const response = await fetch(OPENAI_DEVICE_USER_CODE_URL, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ client_id: OPENAI_CLIENT_ID }),
+    });
+    if (!response.ok) {
+        const text = await readResponseText(response);
+        const suffix = text ? ` ${text}` : "";
+        if (response.status === 404) {
+            throw new Error(`OpenAI device code login is not enabled for this account or Codex server.${suffix}`);
+        }
+        throw new Error(`OpenAI device code request failed: ${response.status}${suffix}`);
+    }
+    const json = (await response.json());
+    const deviceAuthId = json.device_auth_id;
+    const userCode = json.user_code ?? json.usercode;
+    if (!deviceAuthId || !userCode) {
+        throw new Error("Invalid device code response from OpenAI");
+    }
+    const state = randomBytes(16).toString("hex");
+    pendingLogins.set(state, {
+        type: "device",
+        deviceAuthId,
+        userCode,
+        intervalMs: parseDeviceIntervalMs(json.interval),
+        state,
+        provider,
+        createdAt: Date.now(),
+    });
+    return {
+        type: "device_code",
+        url: OPENAI_DEVICE_VERIFICATION_URL,
+        verificationUrl: OPENAI_DEVICE_VERIFICATION_URL,
+        userCode,
+        state,
+        provider,
+        instructions: "Open the URL in any browser, enter the one-time code, finish sign-in, then return here and complete login.",
+    };
+}
+async function pollOpenAiDeviceAuthorization(pending) {
+    const startedAt = Date.now();
+    while (Date.now() - startedAt < OPENAI_DEVICE_LOGIN_TIMEOUT_MS) {
+        const response = await fetch(OPENAI_DEVICE_TOKEN_URL, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                device_auth_id: pending.deviceAuthId,
+                user_code: pending.userCode,
+            }),
+        });
+        if (response.ok) {
+            const json = (await response.json());
+            if (!json.authorization_code || !json.code_verifier) {
+                throw new Error("Invalid device authorization response from OpenAI");
+            }
+            return json;
+        }
+        if (response.status !== 403 && response.status !== 404) {
+            const text = await readResponseText(response);
+            throw new Error(`OpenAI device authorization failed: ${response.status}${text ? ` ${text}` : ""}`);
+        }
+        await new Promise((resolve) => setTimeout(resolve, pending.intervalMs));
+    }
+    throw new Error("OpenAI device authorization timed out after 15 minutes.");
+}
+async function exchangeOpenAiAuthorizationCode(code, verifier, redirectUri) {
+    const response = await fetch(OPENAI_TOKEN_URL, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+            grant_type: "authorization_code",
+            client_id: OPENAI_CLIENT_ID,
+            code,
+            code_verifier: verifier,
+            redirect_uri: redirectUri,
+        }),
+    });
+    if (!response.ok) {
+        const text = await readResponseText(response);
+        throw new Error(`Token exchange failed: ${response.status} ${text}`);
+    }
+    const json = (await response.json());
+    if (!json.access_token || !json.refresh_token || typeof json.expires_in !== "number") {
+        throw new Error("Invalid token response from OpenAI");
+    }
+    return { accessToken: json.access_token, refreshToken: json.refresh_token, expiresIn: json.expires_in };
+}
+export async function startLogin(provider) {
+    if (provider === "openai-codex") {
+        return await startOpenAiDeviceLogin(provider);
+    }
+    if (provider === "openai-codex-browser") {
+        const { verifier, challenge } = await generatePKCE();
+        const state = randomBytes(16).toString("hex");
+        const url = new URL(OPENAI_AUTHORIZE_URL);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("client_id", OPENAI_CLIENT_ID);
+        url.searchParams.set("redirect_uri", OPENAI_REDIRECT_URI);
+        url.searchParams.set("scope", OPENAI_SCOPE);
+        url.searchParams.set("code_challenge", challenge);
+        url.searchParams.set("code_challenge_method", "S256");
+        url.searchParams.set("state", state);
+        url.searchParams.set("id_token_add_organizations", "true");
+        url.searchParams.set("codex_cli_simplified_flow", "true");
+        url.searchParams.set("originator", "pibo");
+        pendingLogins.set(state, { type: "browser", verifier, state, provider, createdAt: Date.now() });
+        return {
+            url: url.toString(),
+            state,
+            provider,
+            instructions: "Open the URL in your browser, complete login, then paste the authorization code (or full redirect URL) via /login-complete.",
+        };
+    }
+    throw new Error(`OAuth login start not supported for provider "${provider}". Supported: openai-codex.`);
+}
+export async function completeLogin(provider, code, state) {
+    if (provider === "openai-codex") {
+        const pending = requirePendingLogin(state, provider);
+        if (pending.type !== "device") {
+            throw new Error("Login flow mismatch. Start a new OpenAI device login.");
+        }
+        const deviceResult = await pollOpenAiDeviceAuthorization(pending);
+        const tokenResult = await exchangeOpenAiAuthorizationCode(deviceResult.authorization_code, deviceResult.code_verifier, OPENAI_DEVICE_REDIRECT_URI);
+        const accountId = getOpenAiAccountId(tokenResult.accessToken);
+        const authStorage = createAuthStorage();
+        authStorage.set(provider, {
+            type: "oauth",
+            access: tokenResult.accessToken,
+            refresh: tokenResult.refreshToken,
+            expires: Date.now() + tokenResult.expiresIn * 1000,
+            accountId: accountId ?? undefined,
+        });
+        pendingLogins.delete(state);
+        return { success: true, provider, accountId };
+    }
+    if (provider === "openai-codex-browser") {
+        if (!code)
+            throw new Error("login.complete requires params.code");
+        const pending = requirePendingLogin(state, provider);
+        pendingLogins.delete(state);
+        if (pending.type !== "browser") {
+            throw new Error("Login flow mismatch. Start a new OpenAI browser login.");
+        }
+        const tokenResult = await exchangeOpenAiAuthorizationCode(code, pending.verifier, OPENAI_REDIRECT_URI);
+        const accountId = getOpenAiAccountId(tokenResult.accessToken);
+        const authStorage = createAuthStorage();
+        authStorage.set("openai-codex", {
+            type: "oauth",
+            access: tokenResult.accessToken,
+            refresh: tokenResult.refreshToken,
+            expires: Date.now() + tokenResult.expiresIn * 1000,
+            accountId: accountId ?? undefined,
+        });
+        return { success: true, provider: "openai-codex", accountId };
+    }
+    throw new Error(`OAuth login complete not supported for provider "${provider}". Supported: openai-codex.`);
+}
+export function setApiKey(provider, apiKey) {
+    const authStorage = createAuthStorage();
+    authStorage.set(provider, { type: "api_key", key: apiKey });
+    return { success: true, provider };
+}
+export function getLoginStatus(provider) {
+    const authStorage = createAuthStorage();
+    if (provider) {
+        return [{ id: provider, provider, ...authStorage.getAuthStatus(provider) }];
+    }
+    return authStorage.list().map((p) => ({ id: p, provider: p, ...authStorage.getAuthStatus(p) }));
+}
+export function removeLogin(provider) {
+    const authStorage = createAuthStorage();
+    authStorage.logout(provider);
+    return { success: true, provider };
+}

package/dist/auth/openai-codex-usage.js

@@ -0,0 +1,147 @@
+import { AuthStorage } from "@mariozechner/pi-coding-agent";
+const OPENAI_CODEX_PROVIDER = "openai-codex";
+const OPENAI_CODEX_USAGE_URL = "https://chatgpt.com/backend-api/wham/usage";
+const OPENAI_JWT_CLAIM_PATH = "https://api.openai.com/auth";
+function isRecord(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function stringValue(value) {
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+function numberValue(value) {
+    return typeof value === "number" && Number.isFinite(value) ? value : undefined;
+}
+function objectValue(value) {
+    return isRecord(value) ? value : undefined;
+}
+function optionalBoxedObject(value) {
+    if (isRecord(value))
+        return value;
+    return undefined;
+}
+function getField(obj, snake, camel) {
+    return obj[snake] ?? obj[camel];
+}
+function decodeJwt(token) {
+    try {
+        const payload = token.split(".")[1];
+        if (!payload)
+            return undefined;
+        const normalized = payload.replace(/-/g, "+").replace(/_/g, "/");
+        const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "=");
+        const decoded = Buffer.from(padded, "base64").toString("utf8");
+        const parsed = JSON.parse(decoded);
+        return isRecord(parsed) ? parsed : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function getOpenAiAccountId(accessToken, storedAccountId) {
+    const stored = stringValue(storedAccountId);
+    if (stored)
+        return stored;
+    const payload = decodeJwt(accessToken);
+    const auth = payload ? objectValue(payload[OPENAI_JWT_CLAIM_PATH]) : undefined;
+    return auth ? stringValue(auth.chatgpt_account_id) : undefined;
+}
+function formatLimitLabel(window, fallback) {
+    const seconds = numberValue(getField(window, "limit_window_seconds", "limitWindowSeconds"));
+    if (!seconds || seconds <= 0)
+        return fallback;
+    const minutes = Math.round(seconds / 60);
+    if (minutes % (7 * 24 * 60) === 0)
+        return `${minutes / (7 * 24 * 60)}w`;
+    if (minutes % (24 * 60) === 0)
+        return `${minutes / (24 * 60)}d`;
+    if (minutes % 60 === 0)
+        return `${minutes / 60}h`;
+    return `${minutes}m`;
+}
+function normalizeWindow(value, fallbackLabel) {
+    const window = optionalBoxedObject(value);
+    if (!window)
+        return undefined;
+    const usedPercent = numberValue(getField(window, "used_percent", "usedPercent"));
+    if (usedPercent === undefined)
+        return undefined;
+    const seconds = numberValue(getField(window, "limit_window_seconds", "limitWindowSeconds"));
+    const resetAt = numberValue(getField(window, "reset_at", "resetAt"));
+    return {
+        label: `${formatLimitLabel(window, fallbackLabel)} limit`,
+        usedPercent,
+        remainingPercent: Math.max(0, Math.min(100, 100 - usedPercent)),
+        windowMinutes: seconds && seconds > 0 ? Math.round(seconds / 60) : undefined,
+        resetsAt: resetAt ? new Date(resetAt * 1000).toISOString() : undefined,
+    };
+}
+function normalizeRateLimit(rateLimit) {
+    if (!rateLimit)
+        return [];
+    return [
+        normalizeWindow(getField(rateLimit, "primary_window", "primaryWindow"), "5h"),
+        normalizeWindow(getField(rateLimit, "secondary_window", "secondaryWindow"), "weekly"),
+    ].filter((entry) => Boolean(entry));
+}
+function normalizeCredits(value) {
+    const credits = objectValue(value);
+    if (!credits)
+        return undefined;
+    if (credits.has_credits !== true && credits.hasCredits !== true)
+        return undefined;
+    return {
+        unlimited: credits.unlimited === true,
+        balance: stringValue(credits.balance),
+    };
+}
+function normalizeUsagePayload(payload) {
+    if (!isRecord(payload))
+        return undefined;
+    const planType = stringValue(getField(payload, "plan_type", "planType"));
+    const limits = normalizeRateLimit(objectValue(getField(payload, "rate_limit", "rateLimit")));
+    const additional = getField(payload, "additional_rate_limits", "additionalRateLimits");
+    if (Array.isArray(additional)) {
+        for (const item of additional) {
+            const detail = objectValue(item);
+            const rateLimit = detail ? objectValue(getField(detail, "rate_limit", "rateLimit")) : undefined;
+            const limitName = detail ? stringValue(getField(detail, "limit_name", "limitName")) : undefined;
+            for (const window of normalizeRateLimit(rateLimit)) {
+                limits.push(limitName ? { ...window, label: `${limitName} ${window.label}` } : window);
+            }
+        }
+    }
+    const credits = normalizeCredits(getField(payload, "credits", "credits"));
+    if (limits.length === 0 && !credits)
+        return undefined;
+    return {
+        provider: OPENAI_CODEX_PROVIDER,
+        planType,
+        limits,
+        credits,
+        fetchedAt: new Date().toISOString(),
+    };
+}
+export async function getOpenAiCodexProviderUsageForActiveModel(activeModel) {
+    if (activeModel?.provider !== OPENAI_CODEX_PROVIDER)
+        return undefined;
+    const authStorage = AuthStorage.create();
+    const credential = authStorage.get(OPENAI_CODEX_PROVIDER);
+    if (credential?.type !== "oauth")
+        return undefined;
+    const accessToken = await authStorage.getApiKey(OPENAI_CODEX_PROVIDER, { includeFallback: false });
+    if (!accessToken)
+        return undefined;
+    const headers = {
+        Authorization: `Bearer ${accessToken}`,
+        "User-Agent": "codex-cli",
+    };
+    const accountId = getOpenAiAccountId(accessToken, credential.accountId);
+    if (accountId)
+        headers["ChatGPT-Account-Id"] = accountId;
+    const response = await fetch(OPENAI_CODEX_USAGE_URL, { headers });
+    if (!response.ok) {
+        const text = await response.text().catch(() => "");
+        throw new Error(`OpenAI Codex usage request failed: ${response.status}${text ? ` ${text}` : ""}`);
+    }
+    return normalizeUsagePayload(await response.json());
+}

package/dist/bin/rg.js

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+import { spawn } from "node:child_process";
+import { rgPath } from "@vscode/ripgrep";
+const child = spawn(rgPath, process.argv.slice(2), { stdio: "inherit" });
+child.on("error", (error) => {
+    console.error(`rg: ${error.message}`);
+    process.exit(1);
+});
+child.on("exit", (code, signal) => {
+    if (signal) {
+        process.kill(process.pid, signal);
+        return;
+    }
+    process.exit(code ?? 1);
+});