@zhihaohong52/sonata 0.4.0

package/dist/native/claude-shim.js

@@ -0,0 +1,228 @@
+import { spawnSync } from 'node:child_process';
+import { closeSync, copyFileSync, existsSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, realpathSync, statSync, unlinkSync, writeFileSync, writeSync, } from 'node:fs';
+import { join } from 'node:path';
+/**
+ * Remote Control (control-from-phone via claude.ai/code) is gated inside Claude
+ * Code itself by `isFirstPartyAnthropicBaseUrl`: the literal ANTHROPIC_BASE_URL
+ * string must host-equal api.anthropic.com, and no credential combination lifts
+ * that — ANTHROPIC_UNIX_SOCKET trips the auth gate ("requires claude.ai
+ * subscription auth") and CLAUDE_CODE_OAUTH_TOKEN trips a stronger one
+ * ("setup-token tokens are inference-only"). Verified against 2.1.241.
+ *
+ * Sonata's router forwards claude-* requests to the real API unmodified, so the
+ * only thing standing between a routed session and Remote Control is that
+ * client-side string comparison. This module builds a private clone of the
+ * installed claude binary with the host check short-circuited to true, and
+ * launches that clone from `sonata code`.
+ *
+ * The clone is a copy (cp -c, APFS-friendly) of the versioned binary under
+ * ~/.local/share/claude/versions/, so the user's own `claude` — and every
+ * session outside sonata — keeps running the stock binary. The patch is
+ * same-length, applied to the clone only, and re-signed ad hoc because macOS
+ * arm64 refuses to exec binaries whose signature no longer matches their
+ * content.
+ */
+const HOST_CHECK = 'return["api.anthropic.com"].includes(';
+const PATCH_MARKER = 'sonata-rc-host-check';
+/**
+ * Rewrites `return["api.anthropic.com"].includes(<ident>)` into a constant
+ * `true` of exactly the same byte length, so every offset after the patch site
+ * stays put. Returns null when the shape is not found — a future Claude Code
+ * that restructures the check must fail loudly here rather than produce a
+ * silently unpatched clone.
+ */
+export function patchHostCheck(binary) {
+    const anchor = Buffer.from(HOST_CHECK, 'utf8');
+    const offset = binary.indexOf(anchor);
+    if (offset < 0)
+        return null;
+    // Sanity: this lives at the end of `let t=new URL(e).host;<here>` — refuse to
+    // patch an unrelated occurrence of the anchor string.
+    if (binary.subarray(Math.max(0, offset - 6), offset).toString('latin1') !== '.host;') {
+        return null;
+    }
+    // Consume the identifier and the closing paren: HOST_CHECK ends mid-statement.
+    let end = offset + anchor.length;
+    while (end < binary.length && binary[end] !== 0x29 /* ) */)
+        end += 1;
+    if (end >= binary.length)
+        return null;
+    end += 1;
+    const length = end - offset;
+    const replacement = truePaddedTo(length);
+    if (!replacement)
+        return null;
+    const patched = Buffer.from(binary);
+    replacement.copy(patched, offset);
+    return { patched, offset, length };
+}
+/** `return!0` padded out to `length` bytes with a comment carrying the marker. */
+function truePaddedTo(length) {
+    const head = Buffer.from(`return!0/*${PATCH_MARKER}`, 'utf8');
+    if (head.length + 2 > length)
+        return null;
+    return Buffer.concat([head, Buffer.alloc(length - head.length - 2, 0x78 /* x */), Buffer.from('*/', 'utf8')]);
+}
+/**
+ * Finds the real claude executable behind the many shims a machine may carry
+ * (cmux wrappers, npm launchers). Only the native install — versioned
+ * self-contained binaries under ~/.local/share/claude/versions/ — can be
+ * cloned-and-patched; anything else returns null and sonata code falls back to
+ * plain `claude` with Remote Control off.
+ */
+export function resolveNativeClaude(home, env = process.env) {
+    const override = env.SONATA_CLAUDE_BIN;
+    if (override && existsSync(override))
+        return { path: realpathSync(override) };
+    const binLink = join(home, '.local', 'bin', 'claude');
+    if (existsSync(binLink)) {
+        try {
+            const real = realpathSync(binLink);
+            if (real.includes(`${sep()}versions${sep()}`))
+                return { path: real };
+        }
+        catch {
+            // Unreadable link: fall through to the versions directory.
+        }
+    }
+    const versionsDir = join(home, '.local', 'share', 'claude', 'versions');
+    if (!existsSync(versionsDir))
+        return null;
+    const versions = readdirSync(versionsDir)
+        .filter((name) => /^\d+\.\d+\.\d+$/.test(name))
+        .sort(compareSemver);
+    const newest = versions.at(-1);
+    return newest ? { path: join(versionsDir, newest) } : null;
+}
+function sep() {
+    return process.platform === 'win32' ? '\\' : '/';
+}
+function compareSemver(a, b) {
+    const pa = a.split('.').map(Number);
+    const pb = b.split('.').map(Number);
+    for (let i = 0; i < 3; i += 1) {
+        if ((pa[i] ?? 0) !== (pb[i] ?? 0))
+            return (pa[i] ?? 0) - (pb[i] ?? 0);
+    }
+    return 0;
+}
+export function shimDir(home) {
+    return join(home, '.config', 'sonata', 'claude-shim');
+}
+function defaultSign(path) {
+    if (process.platform !== 'darwin')
+        return;
+    const result = spawnSync('codesign', ['--force', '--sign', '-', path], { stdio: 'ignore' });
+    if (result.status !== 0) {
+        throw new Error(`codesign failed for ${path} — macOS will refuse to exec an unsigned modified binary`);
+    }
+}
+/**
+ * Returns the path to a patched clone of the native claude binary, building it
+ * when the source version changed. Null means "cannot provide" — caller falls
+ * back to the stock binary and Remote Control stays off, exactly as before this
+ * module existed.
+ */
+export function ensureRemoteControlCapableClaude(deps) {
+    const resolved = resolveNativeClaude(deps.home, deps.env);
+    if (!resolved)
+        return null;
+    const source = resolved.path;
+    const version = source.split(sep()).at(-1) ?? 'claude';
+    const clonePath = join(shimDir(deps.home), version);
+    const metaPath = `${clonePath}.json`;
+    const stat = statSync(source);
+    if (existsSync(clonePath) && existsSync(metaPath)) {
+        try {
+            const meta = JSON.parse(readFileSync(metaPath, 'utf8'));
+            if (meta.sourceSize === stat.size &&
+                meta.sourceMtimeMs === stat.mtimeMs &&
+                statSync(clonePath).size === stat.size &&
+                probeMarker(clonePath, meta)) {
+                return clonePath;
+            }
+        }
+        catch {
+            // Corrupt meta or clone: rebuild below.
+        }
+    }
+    mkdirSync(shimDir(deps.home), { recursive: true });
+    // cp -c uses APFS cloning where available; a plain copy is the fallback
+    // elsewhere. Either way the clone diverges from the stock binary only at the
+    // patched statement.
+    const cloned = spawnSync('cp', ['-c', source, clonePath], { stdio: 'ignore' });
+    if (cloned.status !== 0 || !existsSync(clonePath)) {
+        try {
+            if (existsSync(clonePath))
+                unlinkSync(clonePath);
+            copyFileSync(source, clonePath);
+        }
+        catch (error) {
+            deps.log?.(`sonata: could not clone ${source}: ${error.message}`);
+            return null;
+        }
+    }
+    const binary = readFileSync(source);
+    const result = patchHostCheck(binary);
+    if (!result) {
+        // Leave no unpatched clone lying around to be mistaken for a good one.
+        try {
+            if (existsSync(clonePath))
+                unlinkSync(clonePath);
+            if (existsSync(metaPath))
+                unlinkSync(metaPath);
+        }
+        catch {
+            // Best-effort cleanup.
+        }
+        deps.log?.(`sonata: ${version} no longer contains the known Remote Control gate; leaving it intact`);
+        return null;
+    }
+    const fd = openSync(clonePath, 'r+');
+    try {
+        const statement = result.patched.subarray(result.offset, result.offset + result.length);
+        writeSync(fd, statement, 0, statement.length, result.offset);
+    }
+    finally {
+        closeQuietly(fd);
+    }
+    const sign = deps.sign ?? defaultSign;
+    try {
+        sign(clonePath);
+    }
+    catch (error) {
+        deps.log?.(`sonata: ${error.message}`);
+        return null;
+    }
+    const meta = {
+        sourceSize: stat.size,
+        sourceMtimeMs: stat.mtimeMs,
+        offset: result.offset,
+        length: result.length,
+    };
+    writeFileSync(metaPath, JSON.stringify(meta));
+    return clonePath;
+}
+function probeMarker(path, meta) {
+    const fd = openSync(path, 'r');
+    try {
+        const buffer = Buffer.alloc(meta.length);
+        const read = readSync(fd, buffer, 0, buffer.length, meta.offset);
+        return read === buffer.length && buffer.toString('latin1').startsWith('return!0/*');
+    }
+    catch {
+        return false;
+    }
+    finally {
+        closeQuietly(fd);
+    }
+}
+function closeQuietly(fd) {
+    try {
+        closeSync(fd);
+    }
+    catch {
+        // Already closed or invalid: nothing to salvage.
+    }
+}
+//# sourceMappingURL=claude-shim.js.map

package/dist/native/claude-shim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-shim.js","sourceRoot":"","sources":["../../src/native/claude-shim.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EACL,SAAS,EACT,YAAY,EACZ,UAAU,EACV,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,UAAU,EACV,aAAa,EACb,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,UAAU,GAAG,uCAAuC,CAAC;AAC3D,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAW5C;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5B,8EAA8E;IAC9E,sDAAsD;IACtD,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;QACrF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+EAA+E;IAC/E,IAAI,GAAG,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IACjC,OAAO,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,OAAO;QAAE,GAAG,IAAI,CAAC,CAAC;IACrE,IAAI,GAAG,IAAI,MAAM,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACtC,GAAG,IAAI,CAAC,CAAC;IAET,MAAM,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC;IAC5B,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAE9B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAClC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACrC,CAAC;AAED,kFAAkF;AAClF,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,YAAY,EAAE,EAAE,MAAM,CAAC,CAAC;IAC9D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,MAAM;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AAChH,CAAC;AAMD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,MAAyB,OAAO,CAAC,GAAG;IACpF,MAAM,QAAQ,GAAG,GAAG,CAAC,iBAAiB,CAAC;IACvC,IAAI,QAAQ,IAAI,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;IAE9E,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IACtD,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,GAAG,EAAE,WAAW,GAAG,EAAE,EAAE,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACvE,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;QAC7D,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACxE,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC;SACtC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SAC9C,IAAI,CAAC,aAAa,CAAC,CAAC;IACvB,MAAM,MAAM,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC;AAED,SAAS,GAAG;IACV,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;AACnD,CAAC;AAED,SAAS,aAAa,CAAC,CAAS,EAAE,CAAS;IACzC,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAiBD,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO;IAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC5F,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,0DAA0D,CAAC,CAAC;IACzG,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gCAAgC,CAAC,IAAc;IAC7D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1D,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC;IACvD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,GAAG,SAAS,OAAO,CAAC;IAErC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9B,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAa,CAAC;YACpE,IACE,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC,IAAI;gBAC7B,IAAI,CAAC,aAAa,KAAK,IAAI,CAAC,OAAO;gBACnC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;gBACtC,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,EAC5B,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wCAAwC;QAC1C,CAAC;IACH,CAAC;IAED,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEnD,wEAAwE;IACxE,6EAA6E;IAC7E,qBAAqB;IACrB,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC/E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC;YACH,IAAI,UAAU,CAAC,SAAS,CAAC;gBAAE,UAAU,CAAC,SAAS,CAAC,CAAC;YACjD,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,EAAE,CAAC,2BAA2B,MAAM,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7E,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,uEAAuE;QACvE,IAAI,CAAC;YACH,IAAI,UAAU,CAAC,SAAS,CAAC;gBAAE,UAAU,CAAC,SAAS,CAAC,CAAC;YACjD,IAAI,UAAU,CAAC,QAAQ,CAAC;gBAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,uBAAuB;QACzB,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,OAAO,sEAAsE,CAAC,CAAC;QACrG,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QACxF,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC;IACtC,IAAI,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,GAAG,EAAE,CAAC,WAAY,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GAAa;QACrB,UAAU,EAAE,IAAI,CAAC,IAAI;QACrB,aAAa,EAAE,IAAI,CAAC,OAAO;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC;IACF,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,IAAc;IAC/C,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACjE,OAAO,IAAI,KAAK,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,EAAU;IAC9B,IAAI,CAAC;QACH,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,iDAAiD;IACnD,CAAC;AACH,CAAC"}

package/dist/native/codex-auth.js

@@ -0,0 +1,177 @@
+/**
+ * Bridges a `codex login` credential into the shape LiteLLM's `chatgpt`
+ * provider reads.
+ *
+ * Codex stores its ChatGPT OAuth tokens nested under `tokens`; LiteLLM expects
+ * them flat, alongside an `expires_at` it would otherwise have to derive. The
+ * two formats are otherwise the same credential, so this is a re-shaping, not a
+ * copy of a secret into a new trust domain — the file is written 0600 into
+ * serve's own temp directory and removed when serve stops.
+ *
+ * Nothing here logs a token. Callers that report health use `codexAuthReport`,
+ * which carries no secret material.
+ */
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+export function codexAuthPath(home) {
+    return join(home, '.codex', 'auth.json');
+}
+export function opencodeAuthPath(home) {
+    return join(home, '.local', 'share', 'opencode', 'auth.json');
+}
+/**
+ * The OAuth app both codex and opencode use for a ChatGPT login.
+ *
+ * Checked before treating an opencode `openai` entry as a ChatGPT credential:
+ * that key could in principle hold some other OpenAI OAuth grant, and handing a
+ * non-subscription token to the chatgpt provider would fail in the confusing
+ * way this whole module exists to avoid.
+ */
+export const CHATGPT_CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann';
+/** The `exp` claim of a JWT, without verifying the signature. */
+export function jwtExpiry(token) {
+    const payload = token.split('.')[1];
+    if (payload === undefined)
+        return undefined;
+    try {
+        const padded = payload.padEnd(payload.length + ((4 - (payload.length % 4)) % 4), '=');
+        const claims = JSON.parse(Buffer.from(padded, 'base64url').toString('utf8'));
+        if (claims === null || typeof claims !== 'object')
+            return undefined;
+        const exp = claims.exp;
+        return typeof exp === 'number' ? exp : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function str(value) {
+    return typeof value === 'string' && value.trim() !== '' ? value : undefined;
+}
+/**
+ * The flattened credential, or null when codex is not logged in with a
+ * subscription. A refresh token alone is enough for LiteLLM to mint a new
+ * access token, so an expired access token is not fatal here.
+ */
+export function readCodexOAuth(home) {
+    let raw;
+    try {
+        raw = JSON.parse(readFileSync(codexAuthPath(home), 'utf8'));
+    }
+    catch {
+        return null;
+    }
+    if (raw === null || typeof raw !== 'object')
+        return null;
+    const tokens = raw.tokens;
+    if (tokens === null || typeof tokens !== 'object')
+        return null;
+    const t = tokens;
+    const accessToken = str(t.access_token);
+    if (accessToken === undefined)
+        return null;
+    return {
+        access_token: accessToken,
+        refresh_token: str(t.refresh_token),
+        id_token: str(t.id_token),
+        expires_at: jwtExpiry(accessToken),
+        account_id: str(t.account_id),
+    };
+}
+/** The `client_id` claim of a JWT, used to identify which OAuth app issued it. */
+function jwtClientId(token) {
+    const payload = token.split('.')[1];
+    if (payload === undefined)
+        return undefined;
+    try {
+        const padded = payload.padEnd(payload.length + ((4 - (payload.length % 4)) % 4), '=');
+        const claims = JSON.parse(Buffer.from(padded, 'base64url').toString('utf8'));
+        if (claims === null || typeof claims !== 'object')
+            return undefined;
+        const id = claims.client_id;
+        return typeof id === 'string' ? id : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The ChatGPT credential opencode stores under `openai`.
+ *
+ * opencode writes `{type: "oauth", access, refresh, expires, accountId}` — the
+ * same subscription credential codex holds, under different field names. It is
+ * NOT an API key: `opencodeKeys` is right to skip it, because handing it to a
+ * gateway as a bearer produces a 429 from the metered API after the token has
+ * already authenticated.
+ */
+export function readOpencodeChatGptOAuth(home) {
+    let raw;
+    try {
+        raw = JSON.parse(readFileSync(opencodeAuthPath(home), 'utf8'));
+    }
+    catch {
+        return null;
+    }
+    if (raw === null || typeof raw !== 'object')
+        return null;
+    const entry = raw.openai;
+    if (entry === null || typeof entry !== 'object')
+        return null;
+    const e = entry;
+    if (e.type !== 'oauth')
+        return null;
+    const accessToken = str(e.access);
+    if (accessToken === undefined)
+        return null;
+    if (jwtClientId(accessToken) !== CHATGPT_CLIENT_ID)
+        return null;
+    // opencode records `expires` in milliseconds; the JWT is authoritative.
+    const expires = typeof e.expires === 'number' ? Math.floor(e.expires / 1000) : undefined;
+    return {
+        access_token: accessToken,
+        refresh_token: str(e.refresh),
+        expires_at: jwtExpiry(accessToken) ?? expires,
+        account_id: str(e.accountId),
+    };
+}
+/**
+ * A ChatGPT credential from whichever harness has one.
+ *
+ * codex is preferred only because it is the harness the gateway is usually
+ * named after; either file yields the same subscription.
+ */
+export function readChatGptOAuth(home, source) {
+    if (source === 'codex')
+        return readCodexOAuth(home);
+    if (source === 'opencode')
+        return readOpencodeChatGptOAuth(home);
+    return readCodexOAuth(home) ?? readOpencodeChatGptOAuth(home);
+}
+/** Health information about the codex credential, carrying no secret material. */
+export function codexAuthReport(home, now = Date.now()) {
+    const fromCodex = readCodexOAuth(home);
+    const record = fromCodex ?? readOpencodeChatGptOAuth(home);
+    if (record === null) {
+        return {
+            present: false,
+            problem: 'no ChatGPT login found in codex or opencode — run `codex login`',
+        };
+    }
+    const source = fromCodex === null ? 'opencode' : 'codex';
+    let mode;
+    if (source === 'codex') {
+        try {
+            const raw = JSON.parse(readFileSync(codexAuthPath(home), 'utf8'));
+            mode = str(raw?.auth_mode);
+        }
+        catch { /* the record parsed, so this is only the label */ }
+    }
+    const expired = record.expires_at !== undefined && now / 1000 >= record.expires_at;
+    // LiteLLM refreshes on demand, so an expired access token with a refresh
+    // token is healthy; without one it needs a fresh login.
+    const problem = expired && record.refresh_token === undefined
+        ? `token expired and no refresh token — run \`${source === 'codex' ? 'codex login' : 'opencode auth login'}\``
+        : undefined;
+    return { present: true, source, mode, expiresAt: record.expires_at, expired, problem };
+}
+//# sourceMappingURL=codex-auth.js.map

package/dist/native/codex-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-auth.js","sourceRoot":"","sources":["../../src/native/codex-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAuBjC,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,8BAA8B,CAAC;AAEhE,iEAAiE;AACjE,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACtF,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACtF,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACpE,MAAM,GAAG,GAAI,MAAkC,CAAC,GAAG,CAAC;QACpD,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,GAAG,CAAC,KAAc;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,MAAM,GAAI,GAA+B,CAAC,MAAM,CAAC;IACvD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,CAAC,GAAG,MAAiC,CAAC;IAE5C,MAAM,WAAW,GAAG,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACxC,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAE3C,OAAO;QACL,YAAY,EAAE,WAAW;QACzB,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC;QACnC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;QACzB,UAAU,EAAE,SAAS,CAAC,WAAW,CAAC;QAClC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACtF,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACtF,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACpE,MAAM,EAAE,GAAI,MAAkC,CAAC,SAAS,CAAC;QACzD,OAAO,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,KAAK,GAAI,GAA+B,CAAC,MAAM,CAAC;IACtD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAEpC,MAAM,WAAW,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,WAAW,CAAC,WAAW,CAAC,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAEhE,wEAAwE;IACxE,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEzF,OAAO;QACL,YAAY,EAAE,WAAW;QACzB,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;QAC7B,UAAU,EAAE,SAAS,CAAC,WAAW,CAAC,IAAI,OAAO;QAC7C,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;KAC7B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,MAA6B;IAE7B,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,MAAM,KAAK,UAAU;QAAE,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC;IACjE,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC;AAChE,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IACpE,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,SAAS,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAC3D,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,iEAAiE;SAC3E,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAyB,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;IAE/E,IAAI,IAAwB,CAAC;IAC7B,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YAC3E,IAAI,GAAG,GAAG,CAAE,GAA+B,EAAE,SAAS,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC,CAAC,kDAAkD,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,GAAG,GAAG,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC;IACnF,yEAAyE;IACzE,wDAAwD;IACxD,MAAM,OAAO,GAAG,OAAO,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS;QAC3D,CAAC,CAAC,8CAA8C,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,qBAAqB,IAAI;QAC9G,CAAC,CAAC,SAAS,CAAC;IAEd,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACzF,CAAC"}

package/dist/native/copilot-auth.js

@@ -0,0 +1,105 @@
+/**
+ * Bridges opencode's GitHub Copilot login into LiteLLM's `github_copilot`
+ * provider.
+ *
+ * opencode stores `{type: "oauth", access: "gho_…", refresh, expires}` under
+ * `github-copilot`. That `gho_` value is a GitHub OAuth token, **not** a
+ * Copilot API key: it has to be exchanged at
+ * `api.github.com/copilot_internal/v2/token` for a short-lived key. LiteLLM's
+ * provider performs that exchange and caches the result, reading the GitHub
+ * token from a plain-text `access-token` file in `GITHUB_COPILOT_TOKEN_DIR`.
+ *
+ * So `opencodeKeys` is right to skip this entry — handing a `gho_` token to a
+ * gateway as a bearer would fail. It just must not be invisible, which is what
+ * this module fixes.
+ *
+ * Nothing here logs a token.
+ */
+import { readFileSync } from 'node:fs';
+import { opencodeAuthPath } from './codex-auth.js';
+function str(value) {
+    return typeof value === 'string' && value.trim() !== '' ? value : undefined;
+}
+function copilotEntry(home) {
+    let raw;
+    try {
+        raw = JSON.parse(readFileSync(opencodeAuthPath(home), 'utf8'));
+    }
+    catch {
+        return null;
+    }
+    if (raw === null || typeof raw !== 'object')
+        return null;
+    const entry = raw['github-copilot'];
+    if (entry === null || typeof entry !== 'object')
+        return null;
+    const e = entry;
+    return e.type === 'oauth' ? e : null;
+}
+/**
+ * The GitHub OAuth token opencode holds for Copilot, or null.
+ *
+ * This is the value LiteLLM writes into its `access-token` file; it is not
+ * usable directly against any model endpoint.
+ */
+export function readCopilotToken(home) {
+    const entry = copilotEntry(home);
+    if (entry === null)
+        return null;
+    return str(entry.access) ?? null;
+}
+/** The scope GitHub requires before it will mint a Copilot key. */
+export const COPILOT_SCOPE = 'copilot';
+/**
+ * Whether the stored GitHub token may be exchanged for a Copilot key.
+ *
+ * It usually may not. opencode requests only `read:user`, so GitHub answers the
+ * exchange with 403 and LiteLLM silently drops the deployment — the request
+ * then fails as "no healthy deployments", naming neither the token nor the
+ * scope. Checking first is what keeps a credential that cannot work from being
+ * offered as if it could.
+ *
+ * Scopes are not in the token (it is opaque), so this asks GitHub, which
+ * returns them in `x-oauth-scopes`. **Fails closed**: any error, timeout or
+ * offline machine yields false, because "unknown" must not be treated as usable.
+ */
+export async function copilotTokenCanExchange(token, opts = {}) {
+    const doFetch = opts.fetch ?? fetch;
+    try {
+        const response = await doFetch('https://api.github.com/user', {
+            headers: { Authorization: `Bearer ${token}` },
+            signal: AbortSignal.timeout(opts.timeoutMs ?? 5000),
+        });
+        if (!response.ok)
+            return false;
+        const scopes = (response.headers.get('x-oauth-scopes') ?? '')
+            .split(',')
+            .map((scope) => scope.trim());
+        return scopes.includes(COPILOT_SCOPE);
+    }
+    catch {
+        return false;
+    }
+}
+/** Health information, carrying no secret material. */
+export function copilotAuthReport(home, now = Date.now()) {
+    const entry = copilotEntry(home);
+    if (entry === null || str(entry.access) === undefined) {
+        return {
+            present: false,
+            problem: 'no Copilot login in opencode — run `opencode auth login` and choose github-copilot',
+        };
+    }
+    // opencode records `expires` in milliseconds, and writes 0 for the Copilot
+    // entry to mean "does not expire" — reading that literally reported a live
+    // token as expired since 1970.
+    const expiresAt = typeof entry.expires === 'number' && entry.expires > 0
+        ? Math.floor(entry.expires / 1000)
+        : undefined;
+    const expired = expiresAt !== undefined && now / 1000 >= expiresAt;
+    // LiteLLM re-exchanges the GitHub token for a Copilot key on demand, and the
+    // GitHub token itself is long-lived; an expired *Copilot* key is not a problem
+    // the user has to act on. Only a missing token is.
+    return { present: true, expiresAt, expired };
+}
+//# sourceMappingURL=copilot-auth.js.map

package/dist/native/copilot-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"copilot-auth.js","sourceRoot":"","sources":["../../src/native/copilot-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AASnD,SAAS,GAAG,CAAC,KAAc;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,KAAK,GAAI,GAA+B,CAAC,gBAAgB,CAAC,CAAC;IACjE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,OAAO,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;AACnC,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC;AAEvC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAa,EACb,OAAqD,EAAE;IAEvD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,6BAA6B,EAAE;YAC5D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;YAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;SACpD,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QAC/B,MAAM,MAAM,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;aAC1D,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAChC,OAAO,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IACtE,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,KAAK,KAAK,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;QACtD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,oFAAoF;SAC9F,CAAC;IACJ,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,+BAA+B;IAC/B,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC;QACtE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;QAClC,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,OAAO,GAAG,SAAS,KAAK,SAAS,IAAI,GAAG,GAAG,IAAI,IAAI,SAAS,CAAC;IAEnE,6EAA6E;IAC7E,+EAA+E;IAC/E,mDAAmD;IACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAC/C,CAAC"}

package/dist/native/credentials.js

@@ -0,0 +1,83 @@
+import { chmodSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+function readJson(path) {
+    try {
+        const value = JSON.parse(readFileSync(path, 'utf8'));
+        return value !== null && typeof value === 'object' && !Array.isArray(value)
+            ? value
+            : {};
+    }
+    catch {
+        return {};
+    }
+}
+function usableKey(value) {
+    return typeof value === 'string' && value.trim() !== '' ? value : undefined;
+}
+function sonataKeys(home) {
+    return Object.fromEntries(Object.entries(readJson(sonataKeyStorePath(home))).flatMap(([gateway, key]) => {
+        const usable = usableKey(key);
+        return usable === undefined ? [] : [[gateway, usable]];
+    }));
+}
+function opencodeKeys(home) {
+    return Object.fromEntries(Object.entries(readJson(join(home, '.local/share/opencode/auth.json'))).flatMap(([gateway, value]) => {
+        if (value === null || typeof value !== 'object' || Array.isArray(value))
+            return [];
+        const credential = value;
+        const key = usableKey(credential.key) ?? usableKey(credential.apiKey);
+        return key === undefined ? [] : [[gateway, key]];
+    }));
+}
+const SOURCES = [
+    { name: 'sonata', read: sonataKeys },
+    { name: 'opencode', read: opencodeKeys },
+];
+export function sonataKeyStorePath(home) {
+    return join(home, '.config/sonata/keys.json');
+}
+export function resolveKeyFromSource(gateway, home, source) {
+    const reader = SOURCES.find((candidate) => candidate.name === source);
+    return reader?.read(home)[gateway];
+}
+export function resolveKeys(gateways, home) {
+    const sources = SOURCES.map((source) => ({ name: source.name, keys: source.read(home) }));
+    const resolved = [];
+    for (const gateway of new Set(gateways)) {
+        for (const source of sources) {
+            const key = source.keys[gateway];
+            if (key !== undefined) {
+                resolved.push({ gateway, source: source.name, key });
+                break;
+            }
+        }
+    }
+    return resolved;
+}
+export function keyReport(gateways, home) {
+    const sources = new Map(resolveKeys(gateways, home).map(({ gateway, source }) => [gateway, source]));
+    return gateways.map((gateway) => ({ gateway, source: sources.get(gateway) ?? null }));
+}
+export function writeSonataKey(home, gateway, key) {
+    const path = sonataKeyStorePath(home);
+    mkdirSync(join(home, '.config/sonata'), { recursive: true });
+    writeFileSync(path, `${JSON.stringify({ ...sonataKeys(home), [gateway]: key }, null, 2)}\n`, { mode: 0o600 });
+    chmodSync(path, 0o600);
+}
+export function removeSonataKey(home, gateway) {
+    const path = sonataKeyStorePath(home);
+    const keys = sonataKeys(home);
+    delete keys[gateway];
+    if (Object.keys(keys).length === 0) {
+        try {
+            unlinkSync(path);
+        }
+        catch {
+            // A missing store has the same result as an empty one.
+        }
+        return;
+    }
+    writeFileSync(path, `${JSON.stringify(keys, null, 2)}\n`, { mode: 0o600 });
+    chmodSync(path, 0o600);
+}
+//# sourceMappingURL=credentials.js.map

package/dist/native/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/native/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAmBjC,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,CAAC;QACH,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9D,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACzE,CAAC,CAAC,KAAgC;YAClC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE;QAC5E,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,iCAAiC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE;QACnG,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACnF,MAAM,UAAU,GAAG,KAAgC,CAAC;QACpD,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACtE,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,GAAqB;IAChC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE;IACpC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE;CACzC,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,IAAI,CAAC,IAAI,EAAE,0BAA0B,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,IAAY,EACZ,MAA6B;IAE7B,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;IACtE,OAAO,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAAkB,EAAE,IAAY;IAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1F,MAAM,QAAQ,GAAgB,EAAE,CAAC;IAEjC,KAAK,MAAM,OAAO,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;gBACrD,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,QAAkB,EAAE,IAAY;IACxD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACrG,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,OAAe,EAAE,GAAW;IACvE,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACtC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9G,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,OAAe;IAC3D,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;IAErB,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,uDAAuD;QACzD,CAAC;QACD,OAAO;IACT,CAAC;IAED,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3E,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACzB,CAAC"}