@visual-z/xeno 0.1.0

package/src/runtime/oauth.ts

@@ -0,0 +1,759 @@
+/**
+ * Subscription OAuth: PKCE, authorization-code exchange, refresh, identity.
+ *
+ * Ported from pi (earendil-works/pi, MIT) — packages/ai/src/auth/oauth/pkce.ts
+ * and packages/ai/src/auth/oauth/anthropic.ts / openai-codex.ts / github-copilot.ts.
+ *
+ * D18 is the one place this is NOT a port: Anthropic OAuth requests send
+ * `Authorization: Bearer` and `anthropic-beta: oauth-2025-04-20`, identify as
+ * `xeno/<version>`, and never as `claude-cli`. A subscription endpoint that
+ * rejects an honest User-Agent is reported, not papered over.
+ *
+ * Tokens, refresh tokens and `code_verifier` stay out of errors and logs.
+ * Failures name the HTTP status, never the body that might echo a secret.
+ */
+
+import { createServer, type Server } from "node:http";
+import { pollDeviceCode } from "./oauth-device.ts";
+
+/** Matches package.json. Sent as User-Agent so the server can see who we are (D18). */
+export const XENO_VERSION = "0.1.0";
+
+/**
+ * Minutes subtracted from server expiry so a request issued at the edge
+ * refreshes first. Copied from pi's Anthropic client; a zero margin fails
+ * at the boundary, which is the request that most needed to succeed.
+ */
+export const OAUTH_EXPIRY_MARGIN_MS = 5 * 60 * 1000;
+
+export const SUBSCRIPTION_NOTICE =
+  "This uses first-party client credentials. The terms-of-service risk is on your account, not this project.";
+
+export const SUBSCRIPTION_OPTIONS = [
+  { id: "claude-pro", provider: "anthropic", label: "Claude Pro/Max" },
+  { id: "codex", provider: "openai", label: "ChatGPT Plus/Pro (Codex)" },
+  { id: "github-copilot", provider: "github-copilot", label: "GitHub Copilot" },
+] as const;
+
+export type SubscriptionId = (typeof SUBSCRIPTION_OPTIONS)[number]["id"];
+
+export interface OAuthCredential {
+  type: "oauth";
+  access: string;
+  refresh: string;
+  expires: number;
+  accountId?: string;
+  enterpriseUrl?: string;
+}
+
+export interface PkcePair {
+  verifier: string;
+  challenge: string;
+}
+
+/** Call signature only — `typeof fetch` also has `preconnect`, which a test spy does not. */
+export type OAuthFetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+
+export type CallbackOutcome = { ok: true; code: string } | { ok: false; reason: string };
+
+export interface CallbackServer {
+  readonly host: string;
+  readonly port: number;
+  waitForCode(): Promise<CallbackOutcome>;
+  close(): Promise<void>;
+}
+
+export interface RefreshEffects {
+  fetch: OAuthFetch;
+  now: () => number;
+  signal?: AbortSignal;
+}
+
+export interface OAuthInteraction {
+  notify: (message: string) => void;
+  prompt: (message: string, signal: AbortSignal) => Promise<string>;
+  fetch: OAuthFetch;
+  signal: AbortSignal;
+  now?: () => number;
+  openBrowser?: (url: string) => void;
+}
+
+const decode = (s: string) => atob(s);
+// First-party client IDs, stored the same way pi stores them. They are not
+// credentials we were issued; the ToS risk is the user's. See the card.
+const ANTHROPIC_CLIENT_ID = decode("OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl");
+const COPILOT_CLIENT_ID = decode("SXYxLmI1MDdhMDhjODdlY2ZlOTg=");
+const OPENAI_CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+
+const ANTHROPIC_AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
+const ANTHROPIC_TOKEN_URL = "https://platform.claude.com/v1/oauth/token";
+export const ANTHROPIC_CALLBACK_PORT = 53692;
+export const ANTHROPIC_CALLBACK_PATH = "/callback";
+export const ANTHROPIC_REDIRECT_URI = `http://localhost:${ANTHROPIC_CALLBACK_PORT}${ANTHROPIC_CALLBACK_PATH}`;
+const ANTHROPIC_SCOPES =
+  "org:create_api_key user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload";
+
+const OPENAI_AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize";
+const OPENAI_TOKEN_URL = "https://auth.openai.com/oauth/token";
+export const OPENAI_CALLBACK_PORT = 1455;
+export const OPENAI_CALLBACK_PATH = "/auth/callback";
+export const OPENAI_REDIRECT_URI = `http://localhost:${OPENAI_CALLBACK_PORT}${OPENAI_CALLBACK_PATH}`;
+const OPENAI_SCOPE = "openid profile email offline_access";
+const OPENAI_JWT_CLAIM = "https://api.openai.com/auth";
+
+export function isSubscriptionLogin(id: string): boolean {
+  return SUBSCRIPTION_OPTIONS.some((o) => o.id === id);
+}
+
+export function subscriptionById(id: string): (typeof SUBSCRIPTION_OPTIONS)[number] | undefined {
+  return SUBSCRIPTION_OPTIONS.find((o) => o.id === id);
+}
+
+export function expiryFromExpiresIn(expiresIn: number, now: number): number {
+  return now + expiresIn * 1000 - OAUTH_EXPIRY_MARGIN_MS;
+}
+
+function base64urlEncode(bytes: Uint8Array): string {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+
+/**
+ * Generate PKCE code verifier and challenge.
+ * Ported from pi (earendil-works/pi, MIT) — packages/ai/src/auth/oauth/pkce.ts
+ */
+export async function generatePKCE(): Promise<PkcePair> {
+  const verifierBytes = new Uint8Array(32);
+  crypto.getRandomValues(verifierBytes);
+  const verifier = base64urlEncode(verifierBytes);
+  const data = new TextEncoder().encode(verifier);
+  const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+  const challenge = base64urlEncode(new Uint8Array(hashBuffer));
+  return { verifier, challenge };
+}
+
+/** Independent of the PKCE verifier so the verifier is never printed in the URL. */
+export function generateState(): string {
+  const bytes = new Uint8Array(16);
+  crypto.getRandomValues(bytes);
+  return base64urlEncode(bytes);
+}
+
+export function anthropicOAuthHeaders(): Record<string, string> {
+  return {
+    "user-agent": `xeno/${XENO_VERSION}`,
+    "anthropic-beta": "oauth-2025-04-20",
+  };
+}
+
+export async function dispatchAnthropicOAuthRequest(
+  accessToken: string,
+  opts: { fetch: OAuthFetch; url: string },
+): Promise<Response> {
+  return opts.fetch(opts.url, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${accessToken}`,
+      ...anthropicOAuthHeaders(),
+    },
+  });
+}
+
+export function anthropicAuthorizeUrl(opts: { challenge: string; state: string }): string {
+  const params = new URLSearchParams({
+    code: "true",
+    client_id: ANTHROPIC_CLIENT_ID,
+    response_type: "code",
+    redirect_uri: ANTHROPIC_REDIRECT_URI,
+    scope: ANTHROPIC_SCOPES,
+    code_challenge: opts.challenge,
+    code_challenge_method: "S256",
+    state: opts.state,
+  });
+  return `${ANTHROPIC_AUTHORIZE_URL}?${params.toString()}`;
+}
+
+export function openaiCodexAuthorizeUrl(opts: { challenge: string; state: string }): string {
+  const url = new URL(OPENAI_AUTHORIZE_URL);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("client_id", OPENAI_CODEX_CLIENT_ID);
+  url.searchParams.set("redirect_uri", OPENAI_REDIRECT_URI);
+  url.searchParams.set("scope", OPENAI_SCOPE);
+  url.searchParams.set("code_challenge", opts.challenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  url.searchParams.set("state", opts.state);
+  url.searchParams.set("id_token_add_organizations", "true");
+  url.searchParams.set("codex_cli_simplified_flow", "true");
+  url.searchParams.set("originator", "xeno");
+  return url.toString();
+}
+
+function htmlPage(title: string, body: string): string {
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8"/><title>${title}</title></head><body><h1>${title}</h1><p>${body}</p></body></html>`;
+}
+
+export async function startCallbackServer(opts: {
+  expectedState: string;
+  host: string;
+  port: number;
+  path: string;
+}): Promise<CallbackServer> {
+  // Binding anything other than loopback would expose the authorization code
+  // to the local network. localhost is refused too: it can resolve to ::1
+  // and listen on every interface depending on the stack.
+  if (opts.host !== "127.0.0.1") {
+    throw new Error("OAuth callback must bind 127.0.0.1");
+  }
+
+  let settle: ((value: CallbackOutcome) => void) | undefined;
+  const waitForCodePromise = new Promise<CallbackOutcome>((resolve) => {
+    let settled = false;
+    settle = (value) => {
+      if (settled) return;
+      settled = true;
+      resolve(value);
+    };
+  });
+
+  const server: Server = createServer((req, res) => {
+    try {
+      const url = new URL(req.url ?? "", "http://127.0.0.1");
+      if (url.pathname !== opts.path) {
+        res.writeHead(404, { "Content-Type": "text/html; charset=utf-8" });
+        res.end(htmlPage("Not found", "Callback route not found."));
+        return;
+      }
+      const error = url.searchParams.get("error");
+      if (error) {
+        res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+        res.end(htmlPage("Authentication failed", "The provider returned an error."));
+        return;
+      }
+      const state = url.searchParams.get("state");
+      const code = url.searchParams.get("code");
+      if (!code || !state) {
+        res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+        res.end(htmlPage("Authentication failed", "Missing code or state."));
+        return;
+      }
+      if (state !== opts.expectedState) {
+        // CSRF: any local process can POST here. Rejecting is the whole point
+        // of state. Do not settle waitForCode with this code.
+        res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+        res.end(htmlPage("Authentication failed", "State mismatch."));
+        return;
+      }
+      res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+      res.end(htmlPage("Authentication successful", "You can close this window."));
+      settle?.({ ok: true, code });
+    } catch {
+      res.writeHead(500, { "Content-Type": "text/plain; charset=utf-8" });
+      res.end("Internal error");
+    }
+  });
+
+  await new Promise<void>((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(opts.port, opts.host, () => resolve());
+  });
+
+  const addr = server.address();
+  if (addr === null || typeof addr === "string") {
+    server.close();
+    throw new Error("OAuth callback server has no address");
+  }
+
+  let closed = false;
+  const close = (): Promise<void> => {
+    if (closed) return Promise.resolve();
+    closed = true;
+    settle?.({ ok: false, reason: "cancelled" });
+    return new Promise((resolve) => {
+      server.close(() => resolve());
+    });
+  };
+
+  return {
+    host: opts.host,
+    port: addr.port,
+    waitForCode: () => waitForCodePromise,
+    close,
+  };
+}
+
+async function readJson(
+  fetchImpl: OAuthFetch,
+  url: string,
+  init: RequestInit,
+): Promise<{ ok: true; json: unknown } | { ok: false; status: number }> {
+  const response = await fetchImpl(url, init);
+  if (!response.ok) return { ok: false, status: response.status };
+  try {
+    return { ok: true, json: await response.json() };
+  } catch {
+    return { ok: false, status: response.status };
+  }
+}
+
+function asRecord(value: unknown): Record<string, unknown> | null {
+  return typeof value === "object" && value !== null ? (value as Record<string, unknown>) : null;
+}
+
+function tokenFields(json: unknown): { access: string; refresh: string; expiresIn: number } | null {
+  const rec = asRecord(json);
+  if (rec === null) return null;
+  const access = rec["access_token"];
+  const refresh = rec["refresh_token"];
+  const expiresIn = rec["expires_in"];
+  if (typeof access !== "string" || typeof refresh !== "string" || typeof expiresIn !== "number") {
+    return null;
+  }
+  return { access, refresh, expiresIn };
+}
+
+export async function exchangeAnthropicCode(opts: {
+  code: string;
+  state: string;
+  verifier: string;
+  redirectUri: string;
+  fetch: OAuthFetch;
+  signal?: AbortSignal;
+  now?: () => number;
+}): Promise<OAuthCredential> {
+  const init: RequestInit = {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Accept: "application/json" },
+    body: JSON.stringify({
+      grant_type: "authorization_code",
+      client_id: ANTHROPIC_CLIENT_ID,
+      code: opts.code,
+      state: opts.state,
+      redirect_uri: opts.redirectUri,
+      code_verifier: opts.verifier,
+    }),
+  };
+  if (opts.signal !== undefined) init.signal = opts.signal;
+  const got = await readJson(opts.fetch, ANTHROPIC_TOKEN_URL, init);
+  if (!got.ok) throw new Error(`Anthropic token exchange failed (HTTP ${got.status})`);
+  const fields = tokenFields(got.json);
+  if (fields === null) throw new Error("Anthropic token exchange returned an unexpected body");
+  const now = opts.now ?? Date.now;
+  return {
+    type: "oauth",
+    access: fields.access,
+    refresh: fields.refresh,
+    expires: expiryFromExpiresIn(fields.expiresIn, now()),
+  };
+}
+
+async function refreshAnthropic(
+  refreshToken: string,
+  opts: RefreshEffects,
+): Promise<{ ok: true; credential: OAuthCredential } | { ok: false; reason: string }> {
+  const init: RequestInit = {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Accept: "application/json" },
+    body: JSON.stringify({
+      grant_type: "refresh_token",
+      client_id: ANTHROPIC_CLIENT_ID,
+      refresh_token: refreshToken,
+    }),
+  };
+  if (opts.signal !== undefined) init.signal = opts.signal;
+  const got = await readJson(opts.fetch, ANTHROPIC_TOKEN_URL, init);
+  if (!got.ok) return { ok: false, reason: `HTTP ${got.status}` };
+  const fields = tokenFields(got.json);
+  if (fields === null) return { ok: false, reason: "unexpected body" };
+  return {
+    ok: true,
+    credential: {
+      type: "oauth",
+      access: fields.access,
+      refresh: fields.refresh,
+      expires: expiryFromExpiresIn(fields.expiresIn, opts.now()),
+    },
+  };
+}
+
+export async function exchangeOpenAICode(opts: {
+  code: string;
+  verifier: string;
+  redirectUri: string;
+  fetch: OAuthFetch;
+  signal?: AbortSignal;
+  now?: () => number;
+}): Promise<OAuthCredential> {
+  const init: RequestInit = {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "authorization_code",
+      client_id: OPENAI_CODEX_CLIENT_ID,
+      code: opts.code,
+      code_verifier: opts.verifier,
+      redirect_uri: opts.redirectUri,
+    }),
+  };
+  if (opts.signal !== undefined) init.signal = opts.signal;
+  const got = await readJson(opts.fetch, OPENAI_TOKEN_URL, init);
+  if (!got.ok) throw new Error(`OpenAI Codex token exchange failed (HTTP ${got.status})`);
+  const fields = tokenFields(got.json);
+  if (fields === null) throw new Error("OpenAI Codex token exchange returned an unexpected body");
+  return credentialsFromOpenAIToken(fields, opts.now ?? Date.now);
+}
+
+async function refreshOpenAI(
+  refreshToken: string,
+  opts: RefreshEffects,
+): Promise<{ ok: true; credential: OAuthCredential } | { ok: false; reason: string }> {
+  const init: RequestInit = {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: refreshToken,
+      client_id: OPENAI_CODEX_CLIENT_ID,
+    }),
+  };
+  if (opts.signal !== undefined) init.signal = opts.signal;
+  const got = await readJson(opts.fetch, OPENAI_TOKEN_URL, init);
+  if (!got.ok) return { ok: false, reason: `HTTP ${got.status}` };
+  const fields = tokenFields(got.json);
+  if (fields === null) return { ok: false, reason: "unexpected body" };
+  try {
+    return { ok: true, credential: credentialsFromOpenAIToken(fields, opts.now) };
+  } catch {
+    return { ok: false, reason: "token missing account id" };
+  }
+}
+
+function credentialsFromOpenAIToken(
+  fields: { access: string; refresh: string; expiresIn: number },
+  now: () => number,
+): OAuthCredential {
+  const accountId = accountIdFromJwt(fields.access);
+  const cred: OAuthCredential = {
+    type: "oauth",
+    access: fields.access,
+    refresh: fields.refresh,
+    expires: expiryFromExpiresIn(fields.expiresIn, now()),
+  };
+  if (accountId !== null) return { ...cred, accountId };
+  throw new Error("OpenAI Codex token missing account id");
+}
+
+function accountIdFromJwt(token: string): string | null {
+  try {
+    const parts = token.split(".");
+    const payload = parts[1];
+    if (parts.length !== 3 || payload === undefined) return null;
+    const json = JSON.parse(atob(payload)) as unknown;
+    const rec = asRecord(json);
+    const auth = rec === null ? null : asRecord(rec[OPENAI_JWT_CLAIM]);
+    const id = auth?.["chatgpt_account_id"];
+    return typeof id === "string" && id.length > 0 ? id : null;
+  } catch {
+    return null;
+  }
+}
+
+async function refreshCopilot(
+  githubToken: string,
+  opts: RefreshEffects,
+  enterpriseUrl?: string,
+): Promise<{ ok: true; credential: OAuthCredential } | { ok: false; reason: string }> {
+  const domain = enterpriseUrl && enterpriseUrl.length > 0 ? enterpriseUrl : "github.com";
+  const url = `https://api.${domain}/copilot_internal/v2/token`;
+  const init: RequestInit = {
+    headers: {
+      Accept: "application/json",
+      Authorization: `Bearer ${githubToken}`,
+    },
+  };
+  if (opts.signal !== undefined) init.signal = opts.signal;
+  const got = await readJson(opts.fetch, url, init);
+  if (!got.ok) return { ok: false, reason: `HTTP ${got.status}` };
+  const rec = asRecord(got.json);
+  const token = rec?.["token"];
+  const expiresAt = rec?.["expires_at"];
+  if (typeof token !== "string" || typeof expiresAt !== "number") {
+    return { ok: false, reason: "unexpected body" };
+  }
+  const cred: OAuthCredential = {
+    type: "oauth",
+    access: token,
+    refresh: githubToken,
+    expires: expiresAt * 1000 - OAUTH_EXPIRY_MARGIN_MS,
+  };
+  if (enterpriseUrl !== undefined && enterpriseUrl.length > 0) {
+    return { ok: true, credential: { ...cred, enterpriseUrl } };
+  }
+  return { ok: true, credential: cred };
+}
+
+export async function refreshOAuthCredential(
+  provider: string,
+  credential: OAuthCredential,
+  opts: RefreshEffects,
+): Promise<{ ok: true; credential: OAuthCredential } | { ok: false; reason: string }> {
+  switch (provider) {
+    case "anthropic":
+      return refreshAnthropic(credential.refresh, opts);
+    case "openai":
+      return refreshOpenAI(credential.refresh, opts);
+    case "github-copilot":
+      return refreshCopilot(credential.refresh, opts, credential.enterpriseUrl);
+    default:
+      return { ok: false, reason: `no oauth refresh for ${provider}` };
+  }
+}
+
+export function parseAuthorizationInput(input: string): { code?: string; state?: string } {
+  const value = input.trim();
+  if (!value) return {};
+  try {
+    const url = new URL(value);
+    const parsed: { code?: string; state?: string } = {};
+    const code = url.searchParams.get("code");
+    const state = url.searchParams.get("state");
+    if (code) parsed.code = code;
+    if (state) parsed.state = state;
+    return parsed;
+  } catch {
+    // not a URL
+  }
+  if (value.includes("#")) {
+    const [code, state] = value.split("#", 2);
+    const parsed: { code?: string; state?: string } = {};
+    if (code) parsed.code = code;
+    if (state) parsed.state = state;
+    return parsed;
+  }
+  if (value.includes("code=")) {
+    const params = new URLSearchParams(value);
+    const parsed: { code?: string; state?: string } = {};
+    const code = params.get("code");
+    const state = params.get("state");
+    if (code) parsed.code = code;
+    if (state) parsed.state = state;
+    return parsed;
+  }
+  return { code: value };
+}
+
+async function raceCode(
+  server: CallbackServer,
+  interaction: OAuthInteraction,
+  expectedState: string,
+): Promise<string> {
+  const manualAbort = new AbortController();
+  const onAbort = (): void => {
+    void server.close();
+  };
+  interaction.signal.addEventListener("abort", onAbort, { once: true });
+  if (interaction.signal.aborted) onAbort();
+  try {
+    const pastePromise = interaction
+      .prompt(
+        "Complete login in the browser, or paste the redirect URL here:",
+        manualAbort.signal,
+      )
+      .then((input) => ({ kind: "paste" as const, input }))
+      .catch((err: unknown) => ({ kind: "paste-error" as const, err }));
+    const callbackPromise = server.waitForCode().then((got) => ({ kind: "callback" as const, got }));
+    const first = await Promise.race([pastePromise, callbackPromise]);
+    if (first.kind === "callback" && first.got.ok) return first.got.code;
+    if (first.kind === "paste-error") {
+      throw first.err instanceof Error ? first.err : new Error("login cancelled");
+    }
+    if (first.kind === "paste") {
+      const parsed = parseAuthorizationInput(first.input);
+      if (parsed.state !== undefined && parsed.state !== expectedState) {
+        throw new Error("OAuth state mismatch");
+      }
+      if (!parsed.code) throw new Error("Missing authorization code");
+      return parsed.code;
+    }
+    // Callback settled without a code: wait for paste if it is still coming.
+    const paste = await pastePromise;
+    if (paste.kind === "paste-error") {
+      throw paste.err instanceof Error ? paste.err : new Error("login cancelled");
+    }
+    const parsed = parseAuthorizationInput(paste.input);
+    if (parsed.state !== undefined && parsed.state !== expectedState) {
+      throw new Error("OAuth state mismatch");
+    }
+    if (!parsed.code) throw new Error("Missing authorization code");
+    return parsed.code;
+  } finally {
+    interaction.signal.removeEventListener("abort", onAbort);
+    manualAbort.abort();
+    await server.close();
+  }
+}
+
+function tryOpen(url: string, openBrowser?: (url: string) => void): void {
+  if (openBrowser) {
+    openBrowser(url);
+    return;
+  }
+  try {
+    Bun.spawn(["open", url], { stdout: "ignore", stderr: "ignore", stdin: "ignore" });
+  } catch {
+    // Headless or remote: the printed URL is the fallback.
+  }
+}
+
+export async function loginAnthropic(interaction: OAuthInteraction): Promise<OAuthCredential> {
+  const pkce = await generatePKCE();
+  const state = generateState();
+  const url = anthropicAuthorizeUrl({ challenge: pkce.challenge, state });
+  const server = await startCallbackServer({
+    expectedState: state,
+    host: "127.0.0.1",
+    port: ANTHROPIC_CALLBACK_PORT,
+    path: ANTHROPIC_CALLBACK_PATH,
+  });
+  interaction.notify(url);
+  interaction.notify("If the browser is on another machine, paste the final redirect URL.");
+  tryOpen(url, interaction.openBrowser);
+  const code = await raceCode(server, interaction, state);
+  const exchange: Parameters<typeof exchangeAnthropicCode>[0] = {
+    code,
+    state,
+    verifier: pkce.verifier,
+    redirectUri: ANTHROPIC_REDIRECT_URI,
+    fetch: interaction.fetch,
+    signal: interaction.signal,
+  };
+  if (interaction.now !== undefined) exchange.now = interaction.now;
+  return exchangeAnthropicCode(exchange);
+}
+
+export async function loginOpenAICodex(interaction: OAuthInteraction): Promise<OAuthCredential> {
+  const pkce = await generatePKCE();
+  const state = generateState();
+  const url = openaiCodexAuthorizeUrl({ challenge: pkce.challenge, state });
+  const server = await startCallbackServer({
+    expectedState: state,
+    host: "127.0.0.1",
+    port: OPENAI_CALLBACK_PORT,
+    path: OPENAI_CALLBACK_PATH,
+  });
+  interaction.notify(url);
+  interaction.notify("If the browser is on another machine, paste the final redirect URL.");
+  tryOpen(url, interaction.openBrowser);
+  const code = await raceCode(server, interaction, state);
+  const exchange: Parameters<typeof exchangeOpenAICode>[0] = {
+    code,
+    verifier: pkce.verifier,
+    redirectUri: OPENAI_REDIRECT_URI,
+    fetch: interaction.fetch,
+    signal: interaction.signal,
+  };
+  if (interaction.now !== undefined) exchange.now = interaction.now;
+  return exchangeOpenAICode(exchange);
+}
+
+export async function loginGitHubCopilot(interaction: OAuthInteraction): Promise<OAuthCredential> {
+  const init: RequestInit = {
+    method: "POST",
+    headers: {
+      Accept: "application/json",
+      "Content-Type": "application/x-www-form-urlencoded",
+    },
+    body: new URLSearchParams({
+      client_id: COPILOT_CLIENT_ID,
+      scope: "read:user",
+    }),
+    signal: interaction.signal,
+  };
+  const started = await readJson(interaction.fetch, "https://github.com/login/device/code", init);
+  if (!started.ok) throw new Error(`GitHub device code request failed (HTTP ${started.status})`);
+  const rec = asRecord(started.json);
+  const deviceCode = rec?.["device_code"];
+  const userCode = rec?.["user_code"];
+  const verificationUri = rec?.["verification_uri"];
+  const interval = rec?.["interval"];
+  const expiresIn = rec?.["expires_in"];
+  if (
+    typeof deviceCode !== "string" ||
+    typeof userCode !== "string" ||
+    typeof verificationUri !== "string" ||
+    typeof expiresIn !== "number"
+  ) {
+    throw new Error("GitHub device code response was incomplete");
+  }
+  let parsedUri: URL;
+  try {
+    parsedUri = new URL(verificationUri);
+  } catch {
+    throw new Error("Untrusted verification_uri in device code response");
+  }
+  if (parsedUri.protocol !== "https:" && parsedUri.protocol !== "http:") {
+    throw new Error("Untrusted verification_uri in device code response");
+  }
+  interaction.notify(`Open ${parsedUri.href} and enter code: ${userCode}`);
+  const pollOpts: Parameters<typeof pollDeviceCode<string>>[0] = {
+    expiresInSeconds: expiresIn,
+    waitBeforeFirstPoll: true,
+    signal: interaction.signal,
+    poll: async () => {
+      const tokenInit: RequestInit = {
+        method: "POST",
+        headers: {
+          Accept: "application/json",
+          "Content-Type": "application/x-www-form-urlencoded",
+        },
+        body: new URLSearchParams({
+          client_id: COPILOT_CLIENT_ID,
+          device_code: deviceCode,
+          grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+        }),
+        signal: interaction.signal,
+      };
+      const raw = await readJson(interaction.fetch, "https://github.com/login/oauth/access_token", tokenInit);
+      if (!raw.ok) return { status: "failed", message: `GitHub device token failed (HTTP ${raw.status})` };
+      const body = asRecord(raw.json);
+      if (body !== null && typeof body["access_token"] === "string") {
+        return { status: "complete", value: body["access_token"] };
+      }
+      const err = body?.["error"];
+      if (err === "authorization_pending") return { status: "pending" };
+      if (err === "slow_down") {
+        const next = body?.["interval"];
+        return typeof next === "number" ? { status: "slow_down", intervalSeconds: next } : { status: "slow_down" };
+      }
+      if (typeof err === "string") return { status: "failed", message: `Device flow failed: ${err}` };
+      return { status: "failed", message: "Invalid device token response" };
+    },
+  };
+  if (typeof interval === "number") pollOpts.intervalSeconds = interval;
+  const githubToken = await pollDeviceCode(pollOpts);
+  const refreshed = await refreshCopilot(githubToken, {
+    fetch: interaction.fetch,
+    now: interaction.now ?? Date.now,
+    signal: interaction.signal,
+  });
+  if (!refreshed.ok) throw new Error(`GitHub Copilot token exchange failed (${refreshed.reason})`);
+  return refreshed.credential;
+}
+
+export async function loginSubscription(
+  id: SubscriptionId,
+  interaction: OAuthInteraction,
+): Promise<{ provider: string; credential: OAuthCredential }> {
+  switch (id) {
+    case "claude-pro":
+      return { provider: "anthropic", credential: await loginAnthropic(interaction) };
+    case "codex":
+      return { provider: "openai", credential: await loginOpenAICodex(interaction) };
+    case "github-copilot":
+      return { provider: "github-copilot", credential: await loginGitHubCopilot(interaction) };
+    default: {
+      const never: never = id;
+      throw new Error(`unknown subscription login: ${String(never)}`);
+    }
+  }
+}