@pentoshi/clai 4.11.21 → 4.11.23

package/dist/ui-core/commands/key-commands.js

@@ -1,6 +1,3 @@
-/**
- * Credential management: /set, /unset, /keys, /info (multi-key per provider).
- */
 import { getProvider } from "../../llm/router.js";
 import { assertProvider, getProviderInfoText, maskSecret, normalizeEndpointUrl, } from "../../llm/provider.js";
 import { appendProviderEndpoint, getConfig, getProviderEndpoints, providerUsesEndpoints, setProviderEndpoints, updateConfig } from "../../store/config.js";
@@ -8,6 +5,11 @@ import { appendSearchProviderKey, getProviderKeys, getSearchProviderKeys, listPr
 import { searchProviderIds } from "../../tools/web/types.js";
 import { formatKeyStatus } from "../rendering/format-keys.js";
 import { notice, openEndpointsEditor, openSearchKeysEditor, resolveEditorRowsDetailed } from "./keys/editors.js";
+import { pollClineDeviceAuth, startClineDeviceAuth, } from "../../llm/cline-auth.js";
+import { codexKeyFromAccessToken, encodeCodexKey, pollCodexDeviceAuth, startCodexBrowserAuth, startCodexDeviceAuth, } from "../../llm/codex-auth.js";
+import { openSystemBrowser } from "../../mcp/auth/loopback.js";
+import { pollCopilotDeviceAuth, startCopilotDeviceAuth, } from "../../llm/copilot-auth.js";
+import { appendProviderKey, replaceProviderKey } from "../../store/keys.js";
 import { MAX_PROVIDER_KEYS } from "../../llm/key-rotation.js";
 const SEARCH_IDS = new Set(["brave", "tavily", "duckduckgo", "exa"]);
 async function getSearchKeyStatuses() {
@@ -114,7 +116,7 @@ async function openSetPicker(services) {
                         : `✓ ${count} keys`;
             const row = {
                 value: `llm:${status.provider}`,
-                label: `${status.provider} ${keyLabel}${status.active ? " (active)" : ""}`,
+                label: `${getProvider(status.provider).displayName} ${keyLabel}${status.active ? " (active)" : ""}`,
             };
             if (!status.endpoints)
                 return [row];
@@ -123,7 +125,7 @@ async function openSetPicker(services) {
                 row,
                 {
                     value: `endpoint:${status.provider}`,
-                    label: `${status.provider} endpoints ${urlCount === 0 ? "✗ none" : `✓ ${urlCount} URL${urlCount === 1 ? "" : "s"}`}`,
+                    label: `${getProvider(status.provider).displayName} endpoints ${urlCount === 0 ? "✗ none" : `✓ ${urlCount} URL${urlCount === 1 ? "" : "s"}`}`,
                     description: status.note ?? "endpoint URLs",
                 },
             ];
@@ -175,7 +177,7 @@ async function openUnsetPicker(services) {
                         : `✓ ${count} keys — reset all`;
             const row = {
                 value: `llm:${status.provider}`,
-                label: `${status.provider} ${keyLabel}${status.active ? " (active)" : ""}`,
+                label: `${getProvider(status.provider).displayName} ${keyLabel}${status.active ? " (active)" : ""}`,
             };
             if (!status.endpoints || status.endpoints.length === 0)
                 return [row];
@@ -183,7 +185,7 @@ async function openUnsetPicker(services) {
                 row,
                 {
                     value: `endpoint:${status.provider}`,
-                    label: `${status.provider} endpoints ✓ ${status.endpoints.length} URL${status.endpoints.length === 1 ? "" : "s"} — clear all`,
+                    label: `${getProvider(status.provider).displayName} endpoints ✓ ${status.endpoints.length} URL${status.endpoints.length === 1 ? "" : "s"} — clear all`,
                     description: status.note ?? "endpoint URLs",
                 },
             ];
@@ -215,7 +217,7 @@ async function openUnsetPicker(services) {
             else if (kind === "endpoint") {
                 const count = getProviderEndpoints(id).urls.length;
                 setProviderEndpoints(id, []);
-                notice(services, "info", `unset ${count} endpoint URL(s) for ${id}`);
+                notice(services, "info", `unset ${count} endpoint URL(s) for ${getProvider(id).displayName}`);
             }
             else
                 await unsetLlmKey(services, id);
@@ -247,7 +249,7 @@ async function appendLlmKey(services, id, keyVal) {
         const endpoint = normalizeEndpointUrl(keyVal.trim());
         try {
             const { endpoints, added } = appendProviderEndpoint(id, endpoint);
-            notice(services, "info", `${added ? "saved" : "activated"} ${id} endpoint #${endpoints.activeIndex + 1}/${endpoints.urls.length} → ${endpoint}`);
+            notice(services, "info", `${added ? "saved" : "activated"} ${getProvider(id).displayName} endpoint #${endpoints.activeIndex + 1}/${endpoints.urls.length} → ${endpoint}`);
         }
         catch (error) {
             notice(services, "warn", error instanceof Error ? error.message : String(error));
@@ -255,10 +257,11 @@ async function appendLlmKey(services, id, keyVal) {
         return;
     }
     const key = keyVal.trim();
+    const label = getProvider(id).displayName;
     if (!getProvider(id).validateKey(key)) {
         notice(services, "warn", providerUsesEndpoints(id)
-            ? `invalid value for ${id} · expected a key/token, or an https:// URL to add an endpoint`
-            : `invalid API key format for ${id}`);
+            ? `invalid value for ${label} · expected a key/token, or an https:// URL to add an endpoint`
+            : `invalid API key format for ${label}`);
         return;
     }
     const { appendProviderKey } = await import("../../store/keys.js");
@@ -266,8 +269,8 @@ async function appendLlmKey(services, id, keyVal) {
     const multi = await getProviderKeys(id);
     const count = multi.source === "env" ? 1 : multi.keys.length;
     notice(services, "info", count > 1
-        ? `added ${id} ${maskSecret(key)} · ${count} keys total`
-        : `saved ${id} ${maskSecret(key)}`);
+        ? `added ${label} ${maskSecret(key)} · ${count} keys total`
+        : `saved ${label} ${maskSecret(key)}`);
 }
 async function setSearchKey(services, id, keyVal) {
     if (id === "duckduckgo") {
@@ -309,14 +312,488 @@ async function unsetLlmKey(services, id) {
         notice(services, "info", "ollama does not store an API key");
         return;
     }
+    const label = getProvider(id).displayName;
     const multi = await getProviderKeys(id);
     const storedCount = multi.source === "env" ? 0 : multi.keys.length;
     if (storedCount === 0) {
-        notice(services, "warn", `${id} has no key to unset`);
+        notice(services, "warn", `${label} has no key to unset`);
         return;
     }
     await unsetProviderSecret(id);
-    notice(services, "info", storedCount > 1 ? `unset all ${storedCount} keys for ${id}` : `unset ${id}`);
+    notice(services, "info", storedCount > 1 ? `unset all ${storedCount} keys for ${label}` : `unset ${label}`);
+}
+export async function runClineAuthForUI(services) {
+    let start;
+    try {
+        start = await startClineDeviceAuth();
+    }
+    catch (error) {
+        notice(services, "warn", `could not start Cline sign-in: ${error instanceof Error ? error.message : String(error)}`);
+        return undefined;
+    }
+    services.overlay.openPager("Cline sign-in", [
+        "Authenticate Cline on any device:",
+        "",
+        `  ${start.verificationUrl}`,
+        "",
+        `  Code: ${start.userCode}`,
+        "",
+        "Approve in your browser — clai will continue automatically.",
+        "(close this and press Ctrl-C to cancel)",
+    ].join("\n"), undefined, undefined, "plain");
+    const waiting = services.toast.info("waiting for Cline approval…", {
+        sticky: true,
+    });
+    try {
+        const tokens = await pollClineDeviceAuth(start);
+        services.toast.dismiss(waiting);
+        notice(services, "info", "Cline authenticated");
+        return tokens;
+    }
+    catch (error) {
+        services.toast.dismiss(waiting);
+        notice(services, "warn", `Cline sign-in failed: ${error instanceof Error ? error.message : String(error)}`);
+        return undefined;
+    }
+}
+async function clineAddAccount(services) {
+    const tokens = await runClineAuthForUI(services);
+    if (!tokens) {
+        notice(services, "info", "cancelled");
+        return undefined;
+    }
+    return tokens;
+}
+async function promptCodexApiKey(services) {
+    const answer = await services.overlay.openSecret({
+        title: "ChatGPT Subscription access token",
+        prompt: "Paste a ChatGPT access token (JWT from auth.openai.com) or an existing `codex:` key:",
+    });
+    const value = answer?.trim();
+    if (!value)
+        return undefined;
+    const key = codexKeyFromAccessToken(value) ?? (value.startsWith("codex:") ? value : undefined);
+    if (!key) {
+        notice(services, "warn", "invalid ChatGPT token — expected a JWT containing the chatgpt account id");
+        return undefined;
+    }
+    return key;
+}
+function pickCodexAuthMethod(services) {
+    return new Promise((resolve) => {
+        const opened = services.overlay.openPicker({
+            title: "ChatGPT Subscription sign-in method",
+            options: [
+                {
+                    value: "browser",
+                    label: "Sign in with ChatGPT (browser)",
+                    description: "opens auth.openai.com in your browser",
+                },
+                {
+                    value: "headless",
+                    label: "Sign in with ChatGPT (headless)",
+                    description: "device code — works on remote/SSH machines",
+                },
+                {
+                    value: "apikey",
+                    label: "Manually enter access token / API key",
+                    description: "paste an existing Chatgpt Subscription token",
+                },
+            ],
+        }, (value) => {
+            services.overlay.close();
+            resolve(value);
+        });
+        if (!opened)
+            resolve(undefined);
+    });
+}
+export async function runCodexAuthForUI(services) {
+    const method = await pickCodexAuthMethod(services);
+    if (method === "headless")
+        return runCodexDeviceAuthForUI(services);
+    if (method === "apikey") {
+        const key = await promptCodexApiKey(services);
+        return key
+            ? { manualKey: key, accessToken: "", accountId: "" }
+            : undefined;
+    }
+    if (method !== "browser")
+        return undefined;
+    let handle;
+    try {
+        handle = await startCodexBrowserAuth();
+    }
+    catch {
+        return runCodexDeviceAuthForUI(services);
+    }
+    services.overlay.openPager("ChatGPT Subscription sign-in", [
+        "Opening ChatGPT sign-in in your browser…",
+        "",
+        `  ${handle.url}`,
+        "",
+        "Log in with your ChatGPT account in the browser tab that opens.",
+        "clai will continue automatically once authorization completes.",
+        "(close this and press Ctrl-C to cancel)",
+    ].join("\n"), undefined, undefined, "plain");
+    const waiting = services.toast.info("waiting for ChatGPT approval…", {
+        sticky: true,
+    });
+    try {
+        await openSystemBrowser(handle.url).catch(() => { });
+        const credential = await handle.waitForCredential();
+        services.toast.dismiss(waiting);
+        notice(services, "info", "ChatGPT Subscription authenticated");
+        return credential;
+    }
+    catch (error) {
+        services.toast.dismiss(waiting);
+        notice(services, "warn", `ChatGPT Subscription sign-in failed: ${error instanceof Error ? error.message : String(error)}`);
+        return undefined;
+    }
+}
+export async function runCodexDeviceAuthForUI(services) {
+    let start;
+    try {
+        start = await startCodexDeviceAuth();
+    }
+    catch (error) {
+        notice(services, "warn", `could not start ChatGPT Subscription sign-in: ${error instanceof Error ? error.message : String(error)}`);
+        return undefined;
+    }
+    services.overlay.openPager("ChatGPT Subscription sign-in", [
+        "Authenticate ChatGPT Subscription on any device:",
+        "",
+        `  ${start.verificationUrl}`,
+        "",
+        `  Code: ${start.userCode}`,
+        "",
+        "Approve in your browser — clai will continue automatically.",
+        "(close this and press Ctrl-C to cancel)",
+    ].join("\n"), undefined, undefined, "plain");
+    const waiting = services.toast.info("waiting for ChatGPT approval…", {
+        sticky: true,
+    });
+    try {
+        const credential = await pollCodexDeviceAuth(start);
+        services.toast.dismiss(waiting);
+        notice(services, "info", "ChatGPT Subscription authenticated");
+        return credential;
+    }
+    catch (error) {
+        services.toast.dismiss(waiting);
+        notice(services, "warn", `ChatGPT Subscription sign-in failed: ${error instanceof Error ? error.message : String(error)}`);
+        return undefined;
+    }
+}
+export async function runCopilotAuthForUI(services) {
+    let start;
+    try {
+        start = await startCopilotDeviceAuth();
+    }
+    catch (error) {
+        notice(services, "warn", `could not start Github Copilot sign-in: ${error instanceof Error ? error.message : String(error)}`);
+        return undefined;
+    }
+    services.overlay.openPager("Github Copilot sign-in", [
+        "Authenticate Github Copilot on any device:",
+        "",
+        `  ${start.verificationUrl}`,
+        "",
+        `  Code: ${start.userCode}`,
+        "",
+        "Approve in your browser — clai will continue automatically.",
+        "(close this and press Ctrl-C to cancel)",
+    ].join("\n"), undefined, undefined, "plain");
+    const waiting = services.toast.info("waiting for Github Copilot approval…", {
+        sticky: true,
+    });
+    try {
+        const token = await pollCopilotDeviceAuth(start);
+        services.toast.dismiss(waiting);
+        notice(services, "info", "Github Copilot authenticated");
+        return token;
+    }
+    catch (error) {
+        services.toast.dismiss(waiting);
+        notice(services, "warn", `Github Copilot sign-in failed: ${error instanceof Error ? error.message : String(error)}`);
+        return undefined;
+    }
+}
+async function loadClineKeys() {
+    const multi = await getProviderKeys("cline");
+    return {
+        keys: multi.source === "env" ? [] : multi.keys,
+        activeIndex: multi.source === "env" ? 0 : multi.activeIndex,
+    };
+}
+async function storeClineAccount(services, tokens) {
+    if (tokens.refreshToken || tokens.expiresAt !== undefined) {
+        await appendProviderKey("cline", tokens.accessToken, {
+            ...(tokens.refreshToken ? { refreshToken: tokens.refreshToken } : {}),
+            ...(tokens.expiresAt !== undefined ? { expiresAt: tokens.expiresAt } : {}),
+        });
+    }
+    else {
+        await appendProviderKey("cline", tokens.accessToken);
+    }
+    notice(services, "info", `added Cline account ${maskSecret(tokens.accessToken)}`);
+}
+async function refreshClineAccount(services, oldValue) {
+    const tokens = await runClineAuthForUI(services);
+    if (!tokens) {
+        notice(services, "info", "cancelled");
+        return;
+    }
+    const replaced = await replaceProviderKey("cline", oldValue, tokens.accessToken, {
+        ...(tokens.refreshToken ? { refreshToken: tokens.refreshToken } : {}),
+        ...(tokens.expiresAt !== undefined ? { expiresAt: tokens.expiresAt } : {}),
+    });
+    if (!replaced) {
+        notice(services, "warn", "Cline account was not found");
+        return;
+    }
+    notice(services, "info", `refreshed Cline account ${maskSecret(tokens.accessToken)}`);
+}
+async function saveClineKeys(services, answer, keys, activeIndex) {
+    const byId = new Map(keys.map((key) => [key.id, key.value]));
+    const detailed = resolveEditorRowsDetailed(answer.rows, byId);
+    const resolved = detailed.map((row) => row.value);
+    if (resolved.length === 0) {
+        await unsetProviderSecret("cline");
+        notice(services, "info", "unset all keys for cline");
+        return;
+    }
+    for (const key of resolved) {
+        if (!getProvider("cline").validateKey(key)) {
+            notice(services, "warn", "invalid Cline token");
+            return;
+        }
+    }
+    if (resolved.length > MAX_PROVIDER_KEYS) {
+        notice(services, "warn", `at most ${MAX_PROVIDER_KEYS} Cline accounts`);
+        return;
+    }
+    await setProviderKeys("cline", resolved, answer.activeIndex ?? activeIndex, detailed.filter((row) => row.disabled).map((row) => row.value));
+    const index = answer.activeIndex ?? activeIndex;
+    notice(services, "info", resolved.length === 1
+        ? `saved cline · ${maskSecret(resolved[0])}`
+        : `saved cline · ${resolved.length} accounts · active: #${index + 1}`);
+}
+async function openClineKeysFlow(services) {
+    let { keys, activeIndex } = await loadClineKeys();
+    for (;;) {
+        services.overlay.close();
+        const answer = await services.overlay.openKeysEditor({
+            provider: "cline",
+            heading: "CLINE ACCOUNTS",
+            itemLabel: "account",
+            addViaPicker: true,
+            refreshable: true,
+            initialKeys: keys.map((key) => ({
+                id: key.id,
+                masked: maskSecret(key.value),
+                disabled: key.disabled === true,
+            })),
+            activeIndex,
+        });
+        if (!answer) {
+            notice(services, "info", "cancelled");
+            return;
+        }
+        if (answer.action === "reset") {
+            await unsetProviderSecret("cline");
+            notice(services, "info", "unset all keys for cline");
+            return;
+        }
+        if (answer.action === "pick") {
+            const tokens = await clineAddAccount(services);
+            if (tokens)
+                await storeClineAccount(services, tokens);
+            ({ keys, activeIndex } = await loadClineKeys());
+            continue;
+        }
+        if (answer.action === "refresh") {
+            const selected = keys.find((key) => key.id === answer.slotId);
+            if (selected) {
+                await refreshClineAccount(services, selected.value);
+            }
+            else {
+                notice(services, "warn", "Cline account was not found");
+            }
+            ({ keys, activeIndex } = await loadClineKeys());
+            continue;
+        }
+        await saveClineKeys(services, answer, keys, activeIndex);
+        return;
+    }
+}
+async function loadOAuthKeys(provider) {
+    const multi = await getProviderKeys(provider);
+    return {
+        keys: multi.source === "env" ? [] : multi.keys,
+        activeIndex: multi.source === "env" ? 0 : multi.activeIndex,
+    };
+}
+async function saveOAuthKeys(services, provider, answer, keys, activeIndex) {
+    const label = getProvider(provider).displayName;
+    const byId = new Map(keys.map((key) => [key.id, key.value]));
+    const detailed = resolveEditorRowsDetailed(answer.rows, byId);
+    const resolved = detailed.map((row) => row.value);
+    if (resolved.length === 0) {
+        await unsetProviderSecret(provider);
+        notice(services, "info", `unset all keys for ${label}`);
+        return;
+    }
+    for (const key of resolved) {
+        if (!getProvider(provider).validateKey(key)) {
+            notice(services, "warn", `invalid ${label} token`);
+            return;
+        }
+    }
+    if (resolved.length > MAX_PROVIDER_KEYS) {
+        notice(services, "warn", `at most ${MAX_PROVIDER_KEYS} ${label} accounts`);
+        return;
+    }
+    await setProviderKeys(provider, resolved, answer.activeIndex ?? activeIndex, detailed.filter((row) => row.disabled).map((row) => row.value));
+    const index = answer.activeIndex ?? activeIndex;
+    notice(services, "info", resolved.length === 1
+        ? `saved ${label} · ${maskSecret(resolved[0])}`
+        : `saved ${label} · ${resolved.length} accounts · active: #${index + 1}`);
+}
+async function openCodexKeysFlow(services) {
+    let { keys, activeIndex } = await loadOAuthKeys("codex");
+    for (;;) {
+        services.overlay.close();
+        const answer = await services.overlay.openKeysEditor({
+            provider: "codex",
+            heading: "CHATGPT SUBSCRIPTION ACCOUNTS",
+            itemLabel: "account",
+            addViaPicker: true,
+            refreshable: true,
+            initialKeys: keys.map((key) => ({
+                id: key.id,
+                masked: maskSecret(key.value),
+                disabled: key.disabled === true,
+            })),
+            activeIndex,
+        });
+        if (!answer) {
+            notice(services, "info", "cancelled");
+            return;
+        }
+        if (answer.action === "reset") {
+            await unsetProviderSecret("codex");
+            notice(services, "info", "unset all keys for Chatgpt Subscription");
+            return;
+        }
+        if (answer.action === "pick") {
+            const credential = await runCodexAuthForUI(services);
+            const manualKey = credential?.manualKey;
+            if (credential) {
+                const key = manualKey ?? encodeCodexKey(credential);
+                await appendProviderKey("codex", key);
+                notice(services, "info", `added ChatGPT Subscription account ${maskSecret(key)}`);
+            }
+            else {
+                notice(services, "info", "cancelled");
+            }
+            ({ keys, activeIndex } = await loadOAuthKeys("codex"));
+            continue;
+        }
+        if (answer.action === "refresh") {
+            const selected = keys.find((key) => key.id === answer.slotId);
+            if (selected) {
+                const credential = await runCodexAuthForUI(services);
+                const manualKey = credential?.manualKey;
+                if (credential) {
+                    const key = manualKey ?? encodeCodexKey(credential);
+                    const replaced = await replaceProviderKey("codex", selected.value, key);
+                    if (!replaced) {
+                        notice(services, "warn", "ChatGPT Subscription account was not found");
+                    }
+                    else {
+                        notice(services, "info", `refreshed ChatGPT Subscription account ${maskSecret(key)}`);
+                    }
+                }
+                else {
+                    notice(services, "info", "cancelled");
+                }
+            }
+            else {
+                notice(services, "warn", "ChatGPT Subscription account was not found");
+            }
+            ({ keys, activeIndex } = await loadOAuthKeys("codex"));
+            continue;
+        }
+        await saveOAuthKeys(services, "codex", answer, keys, activeIndex);
+        return;
+    }
+}
+async function openCopilotKeysFlow(services) {
+    let { keys, activeIndex } = await loadOAuthKeys("copilot");
+    for (;;) {
+        services.overlay.close();
+        const answer = await services.overlay.openKeysEditor({
+            provider: "copilot",
+            heading: "GITHUB COPILOT ACCOUNTS",
+            itemLabel: "account",
+            addViaPicker: true,
+            refreshable: true,
+            initialKeys: keys.map((key) => ({
+                id: key.id,
+                masked: maskSecret(key.value),
+                disabled: key.disabled === true,
+            })),
+            activeIndex,
+        });
+        if (!answer) {
+            notice(services, "info", "cancelled");
+            return;
+        }
+        if (answer.action === "reset") {
+            await unsetProviderSecret("copilot");
+            notice(services, "info", "unset all keys for Github Copilot");
+            return;
+        }
+        if (answer.action === "pick") {
+            const token = await runCopilotAuthForUI(services);
+            if (token) {
+                await appendProviderKey("copilot", token);
+                notice(services, "info", `added Github Copilot account ${maskSecret(token)}`);
+            }
+            else {
+                notice(services, "info", "cancelled");
+            }
+            ({ keys, activeIndex } = await loadOAuthKeys("copilot"));
+            continue;
+        }
+        if (answer.action === "refresh") {
+            const selected = keys.find((key) => key.id === answer.slotId);
+            if (selected) {
+                const token = await runCopilotAuthForUI(services);
+                if (token) {
+                    const replaced = await replaceProviderKey("copilot", selected.value, token);
+                    if (!replaced) {
+                        notice(services, "warn", "Github Copilot account was not found");
+                    }
+                    else {
+                        notice(services, "info", `refreshed Github Copilot account ${maskSecret(token)}`);
+                    }
+                }
+                else {
+                    notice(services, "info", "cancelled");
+                }
+            }
+            else {
+                notice(services, "warn", "Github Copilot account was not found");
+            }
+            ({ keys, activeIndex } = await loadOAuthKeys("copilot"));
+            continue;
+        }
+        await saveOAuthKeys(services, "copilot", answer, keys, activeIndex);
+        return;
+    }
 }
 export async function openLlmKeysEditor(services, id) {
     if (id === "ollama") {
@@ -333,6 +810,18 @@ export async function openLlmKeysEditor(services, id) {
         notice(services, "info", `saved ollama host → ${host.trim()}`);
         return;
     }
+    if (id === "cline") {
+        await openClineKeysFlow(services);
+        return;
+    }
+    if (id === "codex") {
+        await openCodexKeysFlow(services);
+        return;
+    }
+    if (id === "copilot") {
+        await openCopilotKeysFlow(services);
+        return;
+    }
     if (providerUsesEndpoints(id)) {
         await openEndpointsEditor(services, id);
     }
@@ -359,6 +848,8 @@ export async function openLlmKeysEditor(services, id) {
         notice(services, "info", `unset all keys for ${id}`);
         return;
     }
+    if (answer.action === "refresh")
+        return;
     const byId = new Map(stored.map((key) => [key.id, key.value]));
     const detailed = resolveEditorRowsDetailed(answer.rows, byId);
     const resolved = detailed.map((row) => row.value);