claude-codex-proxy 1.0.0

package/src/middleware/credentials.js

@@ -0,0 +1,116 @@
+/**
+ * Credentials Middleware
+ * Resolves and validates the active account credentials,
+ * auto-refreshing tokens when they are expired or expiring soon.
+ */
+
+import {
+  getActiveAccount,
+  refreshAccountToken,
+  isTokenExpiredOrExpiringSoon,
+  loadAccounts
+} from '../account-manager.js';
+import { logger } from '../utils/logger.js';
+
+/**
+ * Resolves the active account credentials, refreshing the token if needed.
+ * Returns null if no valid account is available.
+ *
+ * @returns {Promise<{accessToken: string, accountId: string, email: string}|null>}
+ */
+export async function getCredentialsOrError() {
+  const account = getActiveAccount();
+
+  if (!account) {
+    logger.info('No active account found');
+    return null;
+  }
+
+  if (!account.accessToken || !account.accountId) {
+    logger.info(`Account ${account.email} missing token or accountId`);
+    return null;
+  }
+
+  if (isTokenExpiredOrExpiringSoon(account)) {
+    logger.info(`Token expired/expiring soon for ${account.email}, refreshing...`);
+    const result = await refreshAccountToken(account.email);
+
+    if (!result.success) {
+      logger.error(`Failed to refresh token: ${result.message}`);
+      return null;
+    }
+
+    const refreshedAccount = getActiveAccount();
+    if (!refreshedAccount) {
+      logger.error('Failed to get refreshed account');
+      return null;
+    }
+
+    logger.info(`Using refreshed token for ${refreshedAccount.email}`);
+    return {
+      accessToken: refreshedAccount.accessToken,
+      accountId: refreshedAccount.accountId,
+      email: refreshedAccount.email
+    };
+  }
+
+  return {
+    accessToken: account.accessToken,
+    accountId: account.accountId,
+    email: account.email
+  };
+}
+
+/**
+ * Get credentials for a specific account by email.
+ * @param {string} email
+ * @returns {Promise<{accessToken: string, accountId: string, email: string}|null>}
+ */
+export async function getCredentialsForAccount(email) {
+  const data = loadAccounts();
+  const account = data.accounts.find(a => a.email === email);
+
+  if (!account) {
+    return null;
+  }
+
+  if (!account.accessToken || !account.accountId) {
+    return null;
+  }
+
+  if (isTokenExpiredOrExpiringSoon(account)) {
+    const result = await refreshAccountToken(account.email);
+    if (!result.success) {
+      return null;
+    }
+    const refreshedData = loadAccounts();
+    const refreshedAccount = refreshedData.accounts.find(a => a.email === email);
+    if (!refreshedAccount) return null;
+
+    return {
+      accessToken: refreshedAccount.accessToken,
+      accountId: refreshedAccount.accountId,
+      email: refreshedAccount.email
+    };
+  }
+
+  return {
+    accessToken: account.accessToken,
+    accountId: account.accountId,
+    email: account.email
+  };
+}
+
+/**
+ * Sends a 401 authentication error response.
+ * @param {import('express').Response} res
+ * @param {string} [message]
+ */
+export function sendAuthError(res, message = 'No active account with valid credentials. Add an account via /accounts/add') {
+  return res.status(401).json({
+    type: 'error',
+    error: { type: 'authentication_error', message }
+  });
+}
+
+export default { getCredentialsOrError, getCredentialsForAccount, sendAuthError };

package/src/middleware/sse.js

@@ -0,0 +1,130 @@
+/**
+ * SSE Helpers
+ * Shared utilities for Server-Sent Events streaming and error responses.
+ */
+
+import { resolveModelRouting } from '../model-mapper.js';
+import { formatSSEEvent } from '../response-streamer.js';
+import { logger } from '../utils/logger.js';
+
+/**
+ * Sets the standard SSE response headers and flushes them.
+ * @param {import('express').Response} res
+ */
+export function initSSEResponse(res) {
+  res.setHeader('Content-Type', 'text/event-stream');
+  res.setHeader('Cache-Control', 'no-cache');
+  res.setHeader('Connection', 'keep-alive');
+  res.setHeader('X-Accel-Buffering', 'no');
+  res.flushHeaders();
+}
+
+/**
+ * Streams an async generator of Anthropic-format SSE events to the response.
+ * Writes [DONE] and ends the response when the generator is exhausted.
+ *
+ * @param {import('express').Response} res
+ * @param {AsyncIterable<object>} eventStream
+ */
+export async function pipeSSEStream(res, eventStream) {
+  let usage = null;
+
+  for await (const event of eventStream) {
+    if (event?.data?.type === 'message_delta' && event.data.usage) {
+      usage = event.data.usage;
+    }
+    res.write(formatSSEEvent(event));
+  }
+  res.write('data: [DONE]\n\n');
+  res.end();
+  return usage;
+}
+
+/**
+ * Sends a structured Anthropic-style error JSON response.
+ * If headers have already been sent (mid-stream), writes an SSE error event instead.
+ *
+ * @param {import('express').Response} res
+ * @param {Error} error
+ * @param {string} model
+ * @param {number} startTime
+ */
+export function handleStreamError(res, error, model, startTime) {
+  const duration = Date.now() - startTime;
+  const status = getErrorStatus(error);
+  const errorType = getAnthropicErrorType(error, status);
+  const loggedModel = typeof model === 'string' && model.toLowerCase().startsWith('claude-')
+    ? resolveModelRouting(model).upstreamModel
+    : model;
+  logger.response(status, { model: loggedModel, error: error.message, duration });
+
+  if (res.headersSent) {
+    res.write(
+      `event: error\ndata: ${JSON.stringify({
+        type: 'error',
+        error: { type: errorType, message: getClientErrorMessage(error) }
+      })}\n\n`
+    );
+    res.end();
+    return;
+  }
+
+  if (error.message.includes('AUTH_EXPIRED')) {
+    return res.status(401).json({
+      type: 'error',
+      error: { type: 'authentication_error', message: 'Token expired. Please refresh or re-authenticate.' }
+    });
+  }
+
+  if (error.message.startsWith('RATE_LIMITED:')) {
+    const parts = error.message.split(':');
+    const resetMs = parseInt(parts[1], 10);
+    const errorText = parts.slice(2).join(':') || error.message;
+
+    return res.status(429).json({
+      type: 'error',
+      error: {
+        type: 'rate_limit_error',
+        message: errorText,
+        resetMs: resetMs,
+        resetSeconds: Math.round(resetMs / 1000)
+      }
+    });
+  }
+
+  if (error.message.includes('RESOURCE_EXHAUSTED')) {
+    return res.status(429).json({
+      type: 'error',
+      error: { type: 'rate_limit_error', message: error.message }
+    });
+  }
+
+  res.status(status).json({
+    type: 'error',
+    error: { type: errorType, message: getClientErrorMessage(error) }
+  });
+}
+
+function getErrorStatus(error) {
+  if (Number.isInteger(error?.status) && error.status >= 400 && error.status <= 599) {
+    return error.status;
+  }
+  if (error?.message?.includes('AUTH_EXPIRED')) return 401;
+  if (error?.message?.startsWith('RATE_LIMITED:') || error?.message?.includes('RESOURCE_EXHAUSTED')) return 429;
+  return 500;
+}
+
+function getAnthropicErrorType(error, status) {
+  if (error?.anthropicErrorType) return error.anthropicErrorType;
+  if (status === 401) return 'authentication_error';
+  if (status === 429) return 'rate_limit_error';
+  if (status === 400) return 'invalid_request_error';
+  if (status === 403) return 'permission_error';
+  return 'api_error';
+}
+
+function getClientErrorMessage(error) {
+  return error?.message || 'Internal server error';
+}
+
+export default { initSSEResponse, pipeSSEStream, handleStreamError };

package/src/model-api.js

@@ -0,0 +1,189 @@
+/**
+ * Model API for ChatGPT Codex
+ * Handles model listing and quota retrieval from ChatGPT backend API.
+ */
+
+const CHATGPT_API_BASE = 'https://chatgpt.com/backend-api';
+const CLIENT_VERSION = '0.100.0';
+
+const MODEL_CACHE = {
+    models: null,
+    lastFetched: 0,
+    ttlMs: 5 * 60 * 1000
+};
+
+export async function fetchModels(accessToken, accountId) {
+    const now = Date.now();
+    
+    if (MODEL_CACHE.models && (now - MODEL_CACHE.lastFetched) < MODEL_CACHE.ttlMs) {
+        return MODEL_CACHE.models;
+    }
+    
+    const url = `${CHATGPT_API_BASE}/codex/models?client_version=${CLIENT_VERSION}`;
+    
+    const response = await fetch(url, {
+        method: 'GET',
+        headers: {
+            'Authorization': `Bearer ${accessToken}`,
+            'ChatGPT-Account-ID': accountId,
+            'Accept': 'application/json'
+        }
+    });
+    
+    if (!response.ok) {
+        const errorText = await response.text();
+        throw new Error(`Failed to fetch models: ${response.status} - ${errorText}`);
+    }
+    
+    const data = await response.json();
+    
+    const models = (data.models || []).map(m => ({
+        id: m.slug,
+        name: m.display_name || m.slug,
+        description: m.description || '',
+        defaultReasoningLevel: m.default_reasoning_level || 'medium',
+        supportedReasoningLevels: m.supported_reasoning_levels || [],
+        supportedInApi: m.supported_in_api || false,
+        visibility: m.visibility || 'list'
+    }));
+    
+    MODEL_CACHE.models = models;
+    MODEL_CACHE.lastFetched = now;
+    
+    return models;
+}
+
+export async function fetchUsage(accessToken, accountId) {
+    const url = `${CHATGPT_API_BASE}/wham/usage`;
+    
+    const response = await fetch(url, {
+        method: 'GET',
+        headers: {
+            'Authorization': `Bearer ${accessToken}`,
+            'ChatGPT-Account-ID': accountId,
+            'Accept': 'application/json'
+        }
+    });
+    
+    if (!response.ok) {
+        const errorText = await response.text();
+        throw new Error(`Failed to fetch usage: ${response.status} - ${errorText}`);
+    }
+    
+    const data = await response.json();
+    
+    const primaryWindow = data.rate_limit?.primary_window || {};
+    const usedPercentRaw = Number(primaryWindow?.used_percent);
+    const usedPercent = Number.isFinite(usedPercentRaw) ? usedPercentRaw : 0;
+
+    const limitWindowSecondsRaw = Number(primaryWindow?.limit_window_seconds);
+    const limitWindowSeconds = Number.isFinite(limitWindowSecondsRaw) ? limitWindowSecondsRaw : null;
+
+    const resetAfterSecondsRaw = Number(primaryWindow?.reset_after_seconds);
+    const resetAfterSeconds = Number.isFinite(resetAfterSecondsRaw) ? resetAfterSecondsRaw : null;
+
+    const resetAtEpoch = Number(primaryWindow?.reset_at);
+    const resetAt = Number.isFinite(resetAtEpoch) ? new Date(resetAtEpoch * 1000).toISOString() : null;
+    
+    return {
+        totalTokenUsage: usedPercent,
+        limit: 100,
+        remaining: 100 - usedPercent,
+        percentage: usedPercent,
+        resetAt: resetAt,
+        resetAfterSeconds: resetAfterSeconds,
+        limitWindowSeconds: limitWindowSeconds,
+        planType: data.plan_type || null,
+        limitReached: data.rate_limit?.limit_reached || false,
+        allowed: data.rate_limit?.allowed ?? true,
+        raw: data
+    };
+}
+
+export async function fetchAccountCheck(accessToken, accountId) {
+    const url = `${CHATGPT_API_BASE}/wham/accounts/check`;
+    
+    const response = await fetch(url, {
+        method: 'GET',
+        headers: {
+            'Authorization': `Bearer ${accessToken}`,
+            'ChatGPT-Account-ID': accountId,
+            'Accept': 'application/json'
+        }
+    });
+    
+    if (!response.ok) {
+        const errorText = await response.text();
+        throw new Error(`Failed to fetch account check: ${response.status} - ${errorText}`);
+    }
+    
+    return await response.json();
+}
+
+export async function getAccountQuota(accessToken, accountId) {
+    try {
+        const [usage, accountCheck] = await Promise.allSettled([
+            fetchUsage(accessToken, accountId),
+            fetchAccountCheck(accessToken, accountId)
+        ]);
+        
+        const quotaInfo = {
+            usage: usage.status === 'fulfilled' ? usage.value : null,
+            account: accountCheck.status === 'fulfilled' ? accountCheck.value : null,
+            fetchedAt: new Date().toISOString()
+        };
+        
+        if (usage.status === 'rejected') {
+            quotaInfo.usageError = usage.reason?.message || 'Unknown error';
+        }
+        
+        if (accountCheck.status === 'rejected') {
+            quotaInfo.accountError = accountCheck.reason?.message || 'Unknown error';
+        }
+        
+        return quotaInfo;
+    } catch (error) {
+        return {
+            usage: null,
+            account: null,
+            error: error.message,
+            fetchedAt: new Date().toISOString()
+        };
+    }
+}
+
+export async function getModelsAndQuota(accessToken, accountId) {
+    try {
+        const [models, quota] = await Promise.all([
+            fetchModels(accessToken, accountId),
+            getAccountQuota(accessToken, accountId)
+        ]);
+        
+        return {
+            models,
+            quota,
+            success: true
+        };
+    } catch (error) {
+        return {
+            models: null,
+            quota: null,
+            error: error.message,
+            success: false
+        };
+    }
+}
+
+export function clearModelCache() {
+    MODEL_CACHE.models = null;
+    MODEL_CACHE.lastFetched = 0;
+}
+
+export default {
+    fetchModels,
+    fetchUsage,
+    fetchAccountCheck,
+    getAccountQuota,
+    getModelsAndQuota,
+    clearModelCache
+};

package/src/model-mapper.js

@@ -0,0 +1,88 @@
+/**
+ * Model Mapper
+ * Maps Anthropic/Claude model names to upstream OpenAI model identifiers.
+ */
+
+import { getServerSettings } from './server-settings.js';
+
+const DEFAULT_CODEX_MODEL = 'gpt-5.5';
+
+const DIRECT_GPT_MODEL_RE = /^gpt-[a-z0-9][a-z0-9._-]*(?::[a-z0-9._-]+)?$/i;
+
+function getDefaultCodexModel(settings = getServerSettings()) {
+  return settings.defaultCodexModel || DEFAULT_CODEX_MODEL;
+}
+
+function lookupModelMap(model, modelMap) {
+  if (!model || !modelMap) return null;
+
+  if (modelMap[model]) {
+    return modelMap[model];
+  }
+
+  const modelLower = model.toLowerCase();
+
+  for (const [key, value] of Object.entries(modelMap)) {
+    if (key.toLowerCase() === modelLower) {
+      return value;
+    }
+  }
+
+  return null;
+}
+
+function resolveFamilyAlias(alias, modelMap, fallback) {
+  return lookupModelMap(alias, modelMap) || fallback;
+}
+
+export function mapClaudeModel(model) {
+  const settings = getServerSettings();
+  const modelMap = settings.modelMap || {};
+  const fallback = getDefaultCodexModel(settings);
+  const requestedModel = model || fallback;
+  const modelLower = requestedModel.toLowerCase();
+
+  // 1. User-defined full keys take precedence.
+  const exactMappedModel = lookupModelMap(requestedModel, modelMap);
+  if (exactMappedModel) {
+    return exactMappedModel;
+  }
+
+  // 2. Pass through `gpt-*` directly to prevent `gpt-5.5` from being mapped to `gpt-5`.
+  if (DIRECT_GPT_MODEL_RE.test(modelLower)) {
+    return requestedModel;
+  }
+
+  // 3. Claude full model names follow the family-based UI configuration.
+  if (modelLower.startsWith('claude-')) {
+    if (modelLower.includes('opus')) {
+      return resolveFamilyAlias('opus', modelMap, fallback);
+    }
+
+    if (modelLower.includes('sonnet')) {
+      return resolveFamilyAlias('sonnet', modelMap, fallback);
+    }
+
+    if (modelLower.includes('haiku')) {
+      return resolveFamilyAlias('haiku', modelMap, fallback);
+    }
+  }
+
+  return fallback;
+}
+
+/**
+ * Resolves all model routing info from a requested model name.
+ * @param {string} requestedModel
+ * @returns {{ mappedModel: string, upstreamModel: string }}
+ */
+export function resolveModelRouting(requestedModel) {
+  const settings = getServerSettings();
+  const mappedModel = mapClaudeModel(requestedModel || getDefaultCodexModel(settings));
+  return { mappedModel, upstreamModel: mappedModel };
+}
+
+export default {
+  mapClaudeModel,
+  resolveModelRouting
+};