@remodex/rmx 1.0.2

package/src/oauth/local-token-detect.ts

@@ -0,0 +1,121 @@
+/**
+ * Local token auto-detection — reads an existing Grok CLI credential (~/.grok/auth.json).
+ * Read-only: never writes to external credential stores.
+ * Ported from jawcode packages/ai/src/utils/oauth/local-token-detect.ts (xAI portion).
+ */
+import { execSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import type { OAuthCredentials } from "./types";
+
+const XAI_AUTH_KEY_PREFIX = "https://auth.x.ai::";
+const CLAUDE_KEYCHAIN_SERVICE = "Claude Code-credentials";
+
+export function detectGrokCliToken(): OAuthCredentials | null {
+  const authPath = join(process.env.HOME ?? homedir(), ".grok", "auth.json");
+  if (!existsSync(authPath)) return null;
+
+  try {
+    const raw = JSON.parse(readFileSync(authPath, "utf8")) as Record<string, Record<string, unknown>>;
+
+    const entry = Object.entries(raw).find(([key]) => key.startsWith(XAI_AUTH_KEY_PREFIX))?.[1];
+    if (!entry?.key || !entry?.refresh_token) return null;
+
+    const accessToken = entry.key as string;
+    const refreshToken = entry.refresh_token as string;
+    const expiresAt = entry.expires_at ? new Date(entry.expires_at as string).getTime() : 0;
+
+    return {
+      refresh: refreshToken,
+      access: accessToken,
+      expires: expiresAt,
+      accountId: entry.user_id as string | undefined,
+      email: entry.email as string | undefined,
+      source: "local-cli",
+    };
+  } catch {
+    return null;
+  }
+}
+
+export function hasComparableGrokIdentity(stored: OAuthCredentials, disk: OAuthCredentials): boolean {
+  return Boolean((stored.accountId && disk.accountId) || (stored.email && disk.email));
+}
+
+export function isSameGrokIdentity(stored: OAuthCredentials, disk: OAuthCredentials): boolean {
+  if (stored.accountId && disk.accountId) return stored.accountId === disk.accountId;
+  if (stored.email && disk.email) return stored.email.toLowerCase() === disk.email.toLowerCase();
+  return false;
+}
+
+export function shouldAdoptGrokGeneration(
+  stored: OAuthCredentials,
+  disk: OAuthCredentials,
+  now = Date.now(),
+  refreshSkewMs = 60_000,
+): boolean {
+  if (disk.expires <= now + refreshSkewMs) return false;
+  const bothExpiriesExist = stored.expires > 0 && disk.expires > 0;
+  if (bothExpiriesExist) return disk.expires >= stored.expires;
+  return true;
+}
+
+/** Claude Code config dir: `CLAUDE_CONFIG_DIR` override, else `~/.claude`. */
+function claudeConfigDir(): string {
+  const explicit = process.env.CLAUDE_CONFIG_DIR?.trim();
+  return explicit ? explicit : join(homedir(), ".claude");
+}
+
+/** Read the Claude Code OAuth credential from the macOS Keychain (darwin only). */
+function readClaudeKeychain(): string | null {
+  if (process.platform !== "darwin") return null;
+  try {
+    return execSync(`security find-generic-password -s "${CLAUDE_KEYCHAIN_SERVICE}" -w`, {
+      encoding: "utf8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"],
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Read the Claude Code credential file (`<config-dir>/.credentials.json`).
+ * Claude Code writes this on Linux/Windows (and on macOS when the Keychain is
+ * unavailable); it carries the same `claudeAiOauth` payload as the Keychain item.
+ * Exported for tests.
+ */
+export function readClaudeCredentialsFile(): string | null {
+  const path = join(claudeConfigDir(), ".credentials.json");
+  try {
+    if (!existsSync(path)) return null;
+    return readFileSync(path, "utf8").trim();
+  } catch {
+    return null;
+  }
+}
+
+/** Keychain first on macOS, then the cross-platform credentials file. */
+function readClaudeSecureStorage(): string | null {
+  // An explicit config-dir override identifies a separate Claude installation/profile.
+  // Do not let the default macOS Keychain entry shadow that requested credential file.
+  if (process.env.CLAUDE_CONFIG_DIR?.trim()) return readClaudeCredentialsFile() ?? readClaudeKeychain();
+  return readClaudeKeychain() ?? readClaudeCredentialsFile();
+}
+
+export function parseClaudeOauthPayload(raw: string): OAuthCredentials | null {
+  try {
+    const data = JSON.parse(raw) as { claudeAiOauth?: { accessToken?: string; refreshToken?: string; expiresAt?: number } };
+    const o = data.claudeAiOauth;
+    if (!o?.accessToken || !o?.refreshToken) return null;
+    return { access: o.accessToken, refresh: o.refreshToken, expires: o.expiresAt ?? 0, source: "local-cli" };
+  } catch {
+    return null;
+  }
+}
+
+export function detectClaudeCodeToken(): OAuthCredentials | null {
+  const raw = readClaudeSecureStorage();
+  if (!raw) return null;
+  return parseClaudeOauthPayload(raw);
+}

package/src/oauth/log.ts

@@ -0,0 +1,48 @@
+// src/oauth/log.ts
+import { maskAccountId } from "../lib/privacy";
+
+/** Normalize camelCase / snake_case / kebab-case field names before secret checks. */
+function normalizeFieldKey(key: string): string {
+  return key
+    .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
+    .replace(/-/g, "_")
+    .toLowerCase();
+}
+
+const FORBIDDEN_NORMALIZED = new Set([
+  "access",
+  "refresh",
+  "authorization",
+  "code",
+  "token",
+  "access_token",
+  "refresh_token",
+  "id_token",
+  "client_secret",
+  "oauth_code",
+  "clientsecret",
+]);
+
+function isForbiddenFieldKey(key: string): boolean {
+  const normalized = normalizeFieldKey(key);
+  if (FORBIDDEN_NORMALIZED.has(normalized)) return true;
+  if (normalized.endsWith("_token") || normalized.endsWith("_secret") || normalized.endsWith("_code")) {
+    return true;
+  }
+  return false;
+}
+
+export function logOAuthEvent(
+  event: string,
+  fields: { provider: string; accountId?: string; [key: string]: unknown },
+): void {
+  const parts = [`[Remodex] ${event}`, `provider=${fields.provider}`];
+  if (fields.accountId) parts.push(`account=${maskAccountId(fields.accountId)}`);
+  for (const [key, value] of Object.entries(fields)) {
+    if (key === "provider" || key === "accountId") continue;
+    if (isForbiddenFieldKey(key)) continue;
+    if (value === undefined) continue;
+    parts.push(`${key}=${String(value)}`);
+  }
+  console.info(parts.join(" "));
+}

package/src/oauth/login-cli.ts

@@ -0,0 +1,163 @@
+import * as readline from "node:readline";
+import { openUrl } from "../lib/open-url";
+import { loadConfig, saveConfig } from "../config";
+import { findLiveProxy, probeHostname } from "../server/proxy-liveness";
+import { isPublicOAuthProvider, listOAuthProviders, runLogin } from "./index";
+import { KEY_LOGIN_PROVIDERS, isKeyLoginProvider, validateApiKey, type KeyLoginProvider } from "./key-providers";
+import type { OcxProviderConfig } from "../types";
+import { configuredAdminToken } from "../lib/admin-secrets";
+import { codexAccountNamespaceProviderCollisionError } from "../codex/account-namespace-match";
+
+export function runningProxyUpdateHeaders(): Headers {
+  const headers = new Headers({ "Content-Type": "application/json" });
+  const adminToken = configuredAdminToken();
+  if (adminToken) headers.set("X-OpenCodex-API-Key", adminToken);
+  return headers;
+}
+
+/** Push the new provider into a running proxy's live config so it routes without a restart. */
+export async function notifyRunningProxy(name: string, provider: unknown): Promise<void> {
+  // Identity-checked runtime-port lookup: reaches a fallback-port proxy and avoids
+  // posting credentials-adjacent config to whatever else answers on config.port.
+  const live = await findLiveProxy();
+  if (!live) return;
+  try {
+    await fetch(`http://${probeHostname(live.hostname)}:${live.port}/api/providers`, {
+      method: "POST",
+      headers: runningProxyUpdateHeaders(),
+      body: JSON.stringify({ name, provider }),
+    });
+  } catch {
+    /* proxy unreachable; disk config loads on next start */
+  }
+}
+
+/**
+ * After `runLogin()` has persisted the merged provider (including preserved apiKey /
+ * apiKeyPool / authMode), push that on-disk entry into a running proxy.
+ *
+ * Must not send `OAUTH_PROVIDERS[name].providerConfig`: POST /api/providers replaces the
+ * live entry and saves it, which would drop the preserved key billing state.
+ */
+export async function notifyRunningProxyAfterOAuthLogin(name: string): Promise<void> {
+  const provider = loadConfig().providers[name];
+  if (!provider) return;
+  await notifyRunningProxy(name, provider);
+}
+
+export async function handleLogin(provider?: string): Promise<void> {
+  const name = (provider ?? "").trim().toLowerCase();
+  if (isPublicOAuthProvider(name)) return handleOAuthLogin(name);
+  if (isKeyLoginProvider(name)) return handleKeyLogin(name);
+  console.error(
+    `Usage: rmx login <provider>\n` +
+      `  OAuth login:   ${listOAuthProviders().join(", ")}\n` +
+      `  API-key login: ${Object.keys(KEY_LOGIN_PROVIDERS).join(", ")}`,
+  );
+  process.exit(1);
+}
+
+async function handleOAuthLogin(name: string): Promise<void> {
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    await runLogin(name, {
+      onAuth: ({ url, instructions }) => {
+        console.log(`\n🔐 Opening browser for ${name} login...\n${url}\n`);
+        if (instructions) console.log(instructions);
+        openUrl(url);
+      },
+      onProgress: (m) => console.log(`   ${m}`),
+      onManualCodeInput: () =>
+        new Promise((res) => rl.question("Paste redirect URL or code (or wait for browser): ", res)),
+    });
+  } finally {
+    rl.close();
+  }
+  await notifyRunningProxyAfterOAuthLogin(name);
+  console.log(`\n✅ Logged in to ${name}. Try: rmx sync`);
+}
+
+export function providerConfigFromKeyLoginProvider(def: KeyLoginProvider, key: string, baseUrlOverride?: string): OcxProviderConfig {
+  return {
+    adapter: def.adapter,
+    baseUrl: baseUrlOverride ?? def.baseUrl,
+    apiKey: key,
+    ...(def.apiKeyTransport !== undefined ? { apiKeyTransport: def.apiKeyTransport } : {}),
+    ...(def.defaultModel ? { defaultModel: def.defaultModel } : {}),
+    ...(def.models ? { models: [...def.models] } : {}),
+    ...(def.contextWindow !== undefined ? { contextWindow: def.contextWindow } : {}),
+    ...(def.modelContextWindows ? { modelContextWindows: { ...def.modelContextWindows } } : {}),
+    ...(def.modelMaxInputTokens ? { modelMaxInputTokens: { ...def.modelMaxInputTokens } } : {}),
+    ...(def.defaultMaxOutputTokens !== undefined ? { defaultMaxOutputTokens: def.defaultMaxOutputTokens } : {}),
+    ...(def.modelMaxOutputTokens ? { modelMaxOutputTokens: { ...def.modelMaxOutputTokens } } : {}),
+    ...(def.modelInputModalities ? { modelInputModalities: cloneRecordOfArrays(def.modelInputModalities) } : {}),
+    ...(def.reasoningEfforts ? { reasoningEfforts: [...def.reasoningEfforts] } : {}),
+    ...(def.modelReasoningEfforts ? { modelReasoningEfforts: cloneRecordOfArrays(def.modelReasoningEfforts) } : {}),
+    ...(def.reasoningEffortMap ? { reasoningEffortMap: { ...def.reasoningEffortMap } } : {}),
+    ...(def.modelReasoningEffortMap ? { modelReasoningEffortMap: cloneNestedRecord(def.modelReasoningEffortMap) } : {}),
+    ...(def.noVisionModels ? { noVisionModels: [...def.noVisionModels] } : {}),
+    ...(def.noReasoningModels ? { noReasoningModels: [...def.noReasoningModels] } : {}),
+    ...(def.noTemperatureModels ? { noTemperatureModels: [...def.noTemperatureModels] } : {}),
+    ...(def.noTopPModels ? { noTopPModels: [...def.noTopPModels] } : {}),
+    ...(def.noPenaltyModels ? { noPenaltyModels: [...def.noPenaltyModels] } : {}),
+    ...(def.autoToolChoiceOnlyModels ? { autoToolChoiceOnlyModels: [...def.autoToolChoiceOnlyModels] } : {}),
+    ...(def.preserveReasoningContentModels ? { preserveReasoningContentModels: [...def.preserveReasoningContentModels] } : {}),
+    ...(def.escapeBuiltinToolNames !== undefined ? { escapeBuiltinToolNames: def.escapeBuiltinToolNames } : {}),
+  };
+}
+
+async function handleKeyLogin(name: string): Promise<void> {
+  const def = KEY_LOGIN_PROVIDERS[name];
+  const preflightConfig = loadConfig();
+  const namespaceCollision = codexAccountNamespaceProviderCollisionError(preflightConfig.codexAccountNamespaces, name);
+  if (namespaceCollision) {
+    console.error(`Error: ${namespaceCollision}.`);
+    process.exit(1);
+  }
+  console.log(`\n🔑 ${def.label} — opening ${def.dashboardUrl} so you can create/copy an API key...`);
+  openUrl(def.dashboardUrl);
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  const key = (await new Promise<string>((res) => rl.question(`Paste your ${def.label} API key: `, res))).trim();
+  // Template URL with placeholders needs resolution before saving.
+  let baseUrl = def.baseUrl;
+  if (/\{[^}]*\}/.test(baseUrl)) {
+    const resolved = (await new Promise<string>((res) => rl.question(`Your endpoint URL (${baseUrl}): `, res))).trim();
+    if (!resolved) {
+      rl.close();
+      console.error("A resolved URL is required — replace the {placeholder} with your actual value.");
+      process.exit(1);
+    }
+    baseUrl = resolved;
+  }
+  rl.close();
+  if (!key) {
+    console.error("No key entered.");
+    process.exit(1);
+  }
+  process.stdout.write("   validating… ");
+  const valid = await validateApiKey(name, { ...def, baseUrl }, key);
+  console.log(valid === true ? "valid ✅" : valid === false ? "INVALID ❌" : "couldn't validate (may still work)");
+  if (valid === false) {
+    console.error("Provider rejected the key. Not saved.");
+    process.exit(1);
+  }
+  const provider = providerConfigFromKeyLoginProvider(def, key, baseUrl);
+  const config = loadConfig();
+  const commitCollision = codexAccountNamespaceProviderCollisionError(config.codexAccountNamespaces, name);
+  if (commitCollision) {
+    console.error(`Error: ${commitCollision}.`);
+    process.exit(1);
+  }
+  config.providers[name] = provider;
+  saveConfig(config);
+  await notifyRunningProxy(name, provider);
+  console.log(`✅ ${def.label} added. Try: rmx sync`);
+}
+
+function cloneRecordOfArrays(input: Record<string, string[]>): Record<string, string[]> {
+  return Object.fromEntries(Object.entries(input).map(([key, value]) => [key, [...value]]));
+}
+
+function cloneNestedRecord(input: Record<string, Record<string, string>>): Record<string, Record<string, string>> {
+  return Object.fromEntries(Object.entries(input).map(([key, value]) => [key, { ...value }]));
+}

package/src/oauth/pkce.ts

@@ -0,0 +1,15 @@
+/**
+ * Generate PKCE code verifier and challenge (S256).
+ * Ported verbatim from jawcode packages/ai/src/utils/oauth/pkce.ts.
+ */
+export async function generatePKCE(): Promise<{ verifier: string; challenge: string }> {
+  const verifierBytes = new Uint8Array(96);
+  crypto.getRandomValues(verifierBytes);
+  const verifier = Buffer.from(verifierBytes).toString("base64url");
+
+  const data = new TextEncoder().encode(verifier);
+  const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+  const challenge = Buffer.from(hashBuffer).toString("base64url");
+
+  return { verifier, challenge };
+}