clauderipple 0.2.0 → 0.3.1

package/dist/router/src/providers/anthropic-accounts.js

@@ -0,0 +1,281 @@
+// ClaudeRipple-owned pool of Claude subscription OAuth accounts.
+//
+// Secrets live only in <home>/claude-accounts.json (0600). The upstream account UUID is never
+// persisted or returned: a one-way hash is enough to replace the same human account on re-login.
+// The old single-account claude-auth.json is imported atomically on the first pool write so existing
+// installs keep working without keeping two mutable copies of one refresh token.
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { lockSync } from "proper-lockfile";
+import { readClaudeAuthFile, removeClaudeAuthFile } from "./anthropic-token-file.js";
+const LOCK_STALE_MS = 30_000;
+const LOCK_WAIT_MS = 100;
+const LOCK_TIMEOUT_MS = 2_000;
+function withAccountLock(home, mutate) {
+    fs.mkdirSync(home, { recursive: true, mode: 0o700 });
+    const deadline = Date.now() + LOCK_TIMEOUT_MS;
+    let release;
+    for (;;) {
+        try {
+            release = lockSync(claudeAccountsPath(home), {
+                realpath: false,
+                stale: LOCK_STALE_MS,
+                update: 10_000,
+            });
+            break;
+        }
+        catch (error) {
+            if (error.code !== "ELOCKED" || Date.now() >= deadline) {
+                throw error;
+            }
+            Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, LOCK_WAIT_MS);
+        }
+    }
+    try {
+        return mutate();
+    }
+    finally {
+        release();
+    }
+}
+export function claudeAccountsPath(home) {
+    return path.join(home, "claude-accounts.json");
+}
+function validAccount(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const a = value;
+    return typeof a.id === "string" && a.id.length > 0
+        && typeof a.token === "string" && a.token.length > 0
+        && typeof a.refreshToken === "string" && a.refreshToken.length > 0
+        && typeof a.expiresAt === "number" && Number.isFinite(a.expiresAt)
+        && typeof a.createdAt === "string" && typeof a.updatedAt === "string"
+        && typeof a.label === "string" && a.label.length > 0
+        && (a.subjectHash === undefined || (typeof a.subjectHash === "string" && /^[0-9a-f]{64}$/.test(a.subjectHash)))
+        && (a.email === undefined || typeof a.email === "string")
+        && (a.needsReauth === undefined || typeof a.needsReauth === "boolean");
+}
+function parseClaudeAccountsFile(home) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(claudeAccountsPath(home), "utf8"));
+        if (parsed.version !== 1 || !Array.isArray(parsed.accounts) || !parsed.accounts.every(validAccount))
+            return null;
+        const seen = new Set();
+        return parsed.accounts.filter((account) => !seen.has(account.id) && seen.add(account.id)).map((account) => ({ ...account }));
+    }
+    catch (error) {
+        return error.code === "ENOENT" ? [] : null;
+    }
+}
+/** Read only the multi-account file. Malformed secret storage fails closed as an empty pool. */
+export function readClaudeAccountsFile(home) {
+    return parseClaudeAccountsFile(home) ?? [];
+}
+/**
+ * Read the pool plus a virtual import of the old single OAuth file. The legacy file is left alone on
+ * reads; the next mutation writes it into the pool first and only then removes the old copy.
+ */
+function withLegacyOAuthAccount(home, accounts) {
+    const legacy = readClaudeAuthFile(home);
+    if (legacy?.source !== "oauth")
+        return accounts;
+    // If a previous migration wrote the legacy account but crashed before unlinking, do not duplicate
+    // it. The refresh token may already have rotated in the new pool, so the durable local id wins.
+    if (accounts.some((account) => account.id === "legacy" || account.refreshToken === legacy.refreshToken))
+        return accounts;
+    return [
+        ...accounts,
+        {
+            id: "legacy",
+            token: legacy.token,
+            refreshToken: legacy.refreshToken,
+            expiresAt: legacy.expiresAt,
+            createdAt: legacy.createdAt,
+            updatedAt: legacy.createdAt,
+            label: "Claude account",
+        },
+    ];
+}
+export function readClaudeOAuthAccounts(home) {
+    const accounts = parseClaudeAccountsFile(home);
+    if (accounts === null)
+        return [];
+    // Once a valid pool file exists it is the single source of truth. A retained legacy file (for
+    // example where directory fsync is unavailable) must not resurrect an account removed from it.
+    return fs.existsSync(claudeAccountsPath(home)) ? accounts : withLegacyOAuthAccount(home, accounts);
+}
+function readClaudeOAuthAccountsForMutation(home) {
+    const accounts = parseClaudeAccountsFile(home);
+    if (accounts === null)
+        throw new Error("Claude account store is unreadable; refusing to overwrite it");
+    return fs.existsSync(claudeAccountsPath(home)) ? accounts : withLegacyOAuthAccount(home, accounts);
+}
+/** Windows has no directory fsync, so a flushed file plus successful atomic rename completes migration there. */
+export function legacyMigrationDurable(directoryDurable, platform = process.platform) {
+    return directoryDurable || platform === "win32";
+}
+function writeClaudeAccountsFile(home, accounts) {
+    fs.mkdirSync(home, { recursive: true, mode: 0o700 });
+    const file = claudeAccountsPath(home);
+    const tmp = `${file}.tmp-${process.pid}-${crypto.randomBytes(6).toString("hex")}`;
+    try {
+        const fd = fs.openSync(tmp, "wx", 0o600);
+        try {
+            fs.writeFileSync(fd, JSON.stringify({ version: 1, accounts }, null, 2) + "\n", "utf8");
+            fs.fsyncSync(fd);
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+        fs.renameSync(tmp, file);
+        // Persist the directory entry where the filesystem supports it. POSIX keeps the legacy refresh
+        // token unless that succeeds; Windows has no directory fsync, so the flushed file + rename is its
+        // durability boundary and must complete migration rather than resurrect a removed legacy account.
+        let directoryDurable = false;
+        try {
+            const dir = fs.openSync(home, "r");
+            try {
+                fs.fsyncSync(dir);
+            }
+            finally {
+                fs.closeSync(dir);
+            }
+            directoryDurable = true;
+        }
+        catch (error) {
+            const code = error.code;
+            if (process.platform !== "win32" && code !== "EINVAL" && code !== "ENOTSUP" && code !== "EBADF")
+                throw error;
+        }
+        const legacy = readClaudeAuthFile(home);
+        if (legacyMigrationDurable(directoryDurable) && legacy?.source === "oauth")
+            removeClaudeAuthFile(home);
+    }
+    finally {
+        try {
+            fs.unlinkSync(tmp);
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+    }
+}
+function subjectHash(accountId) {
+    return accountId ? crypto.createHash("sha256").update(accountId).digest("hex") : undefined;
+}
+function defaultLabel(accounts, email) {
+    if (email)
+        return email;
+    return `Claude account ${accounts.length + 1}`;
+}
+/** Add a distinct account, or atomically replace the same upstream account after re-login. */
+export function saveClaudeOAuthAccount(home, grant, now = new Date().toISOString()) {
+    return withAccountLock(home, () => {
+        const accounts = readClaudeOAuthAccountsForMutation(home);
+        const hash = subjectHash(grant.accountId);
+        const index = hash ? accounts.findIndex((account) => account.subjectHash === hash) : -1;
+        const previous = index >= 0 ? accounts[index] : undefined;
+        const account = {
+            id: previous?.id ?? crypto.randomUUID(),
+            token: grant.accessToken,
+            refreshToken: grant.refreshToken,
+            expiresAt: grant.expiresAt,
+            createdAt: previous?.createdAt ?? now,
+            updatedAt: now,
+            label: previous?.label ?? defaultLabel(accounts, grant.email),
+            ...(hash ? { subjectHash: hash } : previous?.subjectHash ? { subjectHash: previous.subjectHash } : {}),
+            ...(grant.email ? { email: grant.email } : previous?.email ? { email: previous.email } : {}),
+        };
+        if (index >= 0)
+            accounts[index] = account;
+        else
+            accounts.push(account);
+        writeClaudeAccountsFile(home, accounts);
+        return summarize(account);
+    });
+}
+/** Compare-and-swap a refreshed grant so an older concurrent refresh cannot overwrite a newer one. */
+export function replaceClaudeOAuthAccount(home, id, expectedRefreshToken, grant, now = new Date().toISOString()) {
+    return withAccountLock(home, () => {
+        const accounts = readClaudeOAuthAccountsForMutation(home);
+        const index = accounts.findIndex((account) => account.id === id && account.refreshToken === expectedRefreshToken);
+        if (index < 0)
+            return false;
+        const previous = accounts[index];
+        accounts[index] = {
+            ...previous,
+            token: grant.accessToken,
+            refreshToken: grant.refreshToken,
+            expiresAt: grant.expiresAt,
+            updatedAt: now,
+            needsReauth: false,
+            ...(grant.email ? { email: grant.email } : {}),
+        };
+        writeClaudeAccountsFile(home, accounts);
+        return true;
+    });
+}
+/** Mark only the generation that actually failed; a simultaneous successful login wins. */
+export function markClaudeAccountNeedsReauth(home, id, expectedRefreshToken) {
+    return withAccountLock(home, () => {
+        const accounts = readClaudeOAuthAccountsForMutation(home);
+        const index = accounts.findIndex((account) => account.id === id && account.refreshToken === expectedRefreshToken);
+        if (index < 0)
+            return false;
+        accounts[index] = { ...accounts[index], needsReauth: true, updatedAt: new Date().toISOString() };
+        writeClaudeAccountsFile(home, accounts);
+        return true;
+    });
+}
+export function renameClaudeAccount(home, id, label) {
+    const clean = label.replace(/[\x00-\x1f\x7f]/g, "").trim().slice(0, 80);
+    if (!clean)
+        return false;
+    return withAccountLock(home, () => {
+        const accounts = readClaudeOAuthAccountsForMutation(home);
+        const index = accounts.findIndex((account) => account.id === id);
+        if (index < 0)
+            return false;
+        accounts[index] = { ...accounts[index], label: clean, updatedAt: new Date().toISOString() };
+        writeClaudeAccountsFile(home, accounts);
+        return true;
+    });
+}
+export function removeClaudeAccount(home, id) {
+    return withAccountLock(home, () => {
+        const accounts = readClaudeOAuthAccountsForMutation(home);
+        const next = accounts.filter((account) => account.id !== id);
+        if (next.length === accounts.length)
+            return false;
+        writeClaudeAccountsFile(home, next);
+        return true;
+    });
+}
+export function removeAllClaudeAccounts(home) {
+    return withAccountLock(home, () => {
+        let removed = removeClaudeAuthFile(home);
+        try {
+            fs.unlinkSync(claudeAccountsPath(home));
+            removed = true;
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        return removed;
+    });
+}
+export function summarize(account) {
+    return {
+        id: account.id,
+        label: account.label,
+        ...(account.email ? { email: account.email } : {}),
+        expiresAt: account.expiresAt,
+        needsReauth: account.needsReauth === true,
+    };
+}
+export function listClaudeAccounts(home) {
+    return readClaudeOAuthAccounts(home).map(summarize);
+}

package/dist/router/src/providers/chatgpt/catalog.js

@@ -0,0 +1,97 @@
+// The Codex backend's own model catalogue, so a model OpenAI ships appears in ClaudeRipple without
+// a router release.
+//
+// Measured 2026-09-23: GET {base}/codex/models?client_version=<ver> with the subscription's bearer
+// answers `{ models: [{ slug, display_name, visibility: "list"|"hide", supported_in_api,
+// context_window, supported_reasoning_levels: [{ effort, description }] }] }`. The server filters on
+// client_version: 0.146.0 omits the gpt-6-* models that 0.155.0 lists, so the version is read from
+// the installed Codex CLI's cache rather than pinned to whatever was current when this was written.
+// Everything here tolerates a shape change by returning [] — a catalogue we cannot read must leave
+// the caller on its fallback list, not empty the model picker.
+import fs from "node:fs";
+import path from "node:path";
+import { codexHome } from "../../../../cli/src/codex.js";
+/** The client_version floor: below this the backend hides models ClaudeRipple already supports. */
+export const CODEX_CLIENT_VERSION_FLOOR = "0.155.0";
+/**
+ * Copied from the Codex catalog 2026-09-23, used only when the live catalog cannot be read. The
+ * catalog lists `ultra` on astra, sol and 5.6 terra/sol and not on either Luna — the reverse of a
+ * 2026-09-11 measurement (ARCHITECTURE §4); `effortClamp` keeps `ultra` off the wire regardless.
+ */
+export const CHATGPT_FALLBACK_MODELS = [
+    { id: "gpt-5.6-terra", name: "GPT-5.6 Terra", effortLevels: ["low", "medium", "high", "xhigh", "max", "ultra"], contextWindow: 272000 },
+    { id: "gpt-5.6-sol", name: "GPT-5.6 Sol", effortLevels: ["low", "medium", "high", "xhigh", "max", "ultra"], contextWindow: 272000 },
+    { id: "gpt-5.6-luna", name: "GPT-5.6 Luna", effortLevels: ["low", "medium", "high", "xhigh", "max"], contextWindow: 272000 },
+    { id: "gpt-6-astra", name: "GPT-6 Astra", effortLevels: ["low", "medium", "high", "xhigh", "max", "ultra"], contextWindow: 272000 },
+    { id: "gpt-6-sol", name: "GPT-6 Sol", effortLevels: ["low", "medium", "high", "xhigh", "max", "ultra"], contextWindow: 272000 },
+    { id: "gpt-6-luna", name: "GPT-6 Luna", effortLevels: ["low", "medium", "high", "xhigh", "max"], contextWindow: 272000 },
+];
+/** A hyphen that joins a capitalised word ("GPT-6-Sol", "GPT-6-Astra") reads as a space. */
+const JOINING_HYPHEN = /-(?=[A-Z])/g;
+function displayName(slug, display) {
+    const raw = typeof display === "string" && display.trim() !== "" ? display.trim() : slug;
+    return raw.replace(JOINING_HYPHEN, " ");
+}
+/**
+ * The catalogue's `list` entries as provider models. `hide` entries (codex-auto-review,
+ * gpt-reserve) are for the CLI's own machinery, not for the user's picker, so they are dropped.
+ * Anything unrecognisable yields [].
+ */
+export function parseCodexCatalog(json) {
+    const entries = json?.models;
+    if (!Array.isArray(entries))
+        return [];
+    const out = [];
+    for (const entry of entries) {
+        if (!entry || typeof entry !== "object")
+            continue;
+        const e = entry;
+        if (typeof e.slug !== "string" || e.slug === "" || e.visibility !== "list")
+            continue;
+        const model = { id: e.slug, name: displayName(e.slug, e.display_name) };
+        if (Array.isArray(e.supported_reasoning_levels)) {
+            const levels = e.supported_reasoning_levels
+                .map((level) => (level && typeof level === "object" ? level.effort : undefined))
+                .filter((effort) => typeof effort === "string" && effort !== "");
+            // An empty ladder is meaningful to the config (it disables the provider fallback), so it is
+            // carried through rather than omitted.
+            model.effortLevels = [...new Set(levels)];
+        }
+        if (typeof e.context_window === "number" && Number.isFinite(e.context_window) && e.context_window > 0)
+            model.contextWindow = e.context_window;
+        out.push(model);
+    }
+    return out;
+}
+/** Numeric major.minor.patch comparison; the prerelease suffix is not part of the version. */
+function compareVersions(a, b) {
+    const segments = (v) => v.split(".").map((part) => Number.parseInt(part, 10) || 0);
+    const x = segments(a);
+    const y = segments(b);
+    for (let i = 0; i < Math.max(x.length, y.length); i++) {
+        const d = (x[i] ?? 0) - (y[i] ?? 0);
+        if (d !== 0)
+            return d < 0 ? -1 : 1;
+    }
+    return 0;
+}
+/**
+ * The version to ask the catalogue with: the installed Codex CLI's, from the cache it writes
+ * (`<codexHome>/models_cache.json`, honouring `CODEX_HOME`), but never below the floor — an older
+ * CLI must not cost us the models the newer backend would list. Missing or unreadable file, or a
+ * version that is not numeric, answers the floor.
+ */
+export function codexClientVersion(home = codexHome()) {
+    let cached;
+    try {
+        cached = JSON.parse(fs.readFileSync(path.join(home, "models_cache.json"), "utf8")).client_version;
+    }
+    catch {
+        return CODEX_CLIENT_VERSION_FLOOR;
+    }
+    if (typeof cached !== "string" || !/^\d+(\.\d+)*/.test(cached))
+        return CODEX_CLIENT_VERSION_FLOOR;
+    // "0.155.1-nightly.3" is 0.155.1 as far as the backend's filter is concerned.
+    const core = cached.split("-")[0];
+    return compareVersions(core, CODEX_CLIENT_VERSION_FLOOR) > 0 ? core : CODEX_CLIENT_VERSION_FLOOR;
+}