clauderipple 0.2.0

package/dist/router/src/providers/chatgpt/auth.js

@@ -0,0 +1,226 @@
+// ChatGPT subscription credentials for the Codex backend.
+//
+// Two sources:
+//   own          <home>/chatgpt-auth.json written by `clauderipple login` (OAuth PKCE). We refresh it.
+//   borrow-codex ~/.codex/auth.json written by the Codex CLI. Read-only: refresh tokens rotate, and
+//                refreshing someone else's grant would break their login. If it expires, the user runs
+//                Codex once or logs in with us.
+//
+// OAuth constants are the public ones used by the Codex CLI (auth.openai.com, PKCE S256).
+import crypto from "node:crypto";
+import fs from "node:fs";
+import http from "node:http";
+import os from "node:os";
+import path from "node:path";
+export const OAUTH = {
+    authorizeUrl: "https://auth.openai.com/oauth/authorize",
+    tokenUrl: "https://auth.openai.com/oauth/token",
+    clientId: "app_EMoamEEZ73f0CkXaXp7hrann",
+    redirectUri: "http://localhost:1455/auth/callback",
+    port: 1455,
+    scope: "openid profile email offline_access",
+};
+export function ownAuthPath(home) {
+    return path.join(home, "chatgpt-auth.json");
+}
+export function codexAuthPath() {
+    return process.env.CODEX_HOME ? path.join(process.env.CODEX_HOME, "auth.json") : path.join(os.homedir(), ".codex", "auth.json");
+}
+function b64url(buf) {
+    return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+export function decodeJwt(token) {
+    const parts = token.split(".");
+    if (parts.length < 2)
+        return null;
+    try {
+        return JSON.parse(Buffer.from(parts[1].replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+export function accountIdFromToken(token) {
+    const claims = decodeJwt(token);
+    const auth = claims?.["https://api.openai.com/auth"];
+    return auth?.chatgpt_account_id ?? null;
+}
+function expiryFromToken(token) {
+    const exp = decodeJwt(token)?.exp;
+    return typeof exp === "number" ? exp * 1000 : 0;
+}
+export function readOwn(home) {
+    try {
+        const j = JSON.parse(fs.readFileSync(ownAuthPath(home), "utf8"));
+        if (!j.accessToken || !j.accountId)
+            return null;
+        return { ...j, source: "own" };
+    }
+    catch {
+        return null;
+    }
+}
+export function readBorrowed() {
+    try {
+        const j = JSON.parse(fs.readFileSync(codexAuthPath(), "utf8"));
+        const t = j.tokens;
+        if (!t?.access_token)
+            return null;
+        const accountId = t.account_id ?? accountIdFromToken(t.access_token);
+        if (!accountId)
+            return null;
+        return {
+            accessToken: t.access_token,
+            ...(t.refresh_token ? { refreshToken: t.refresh_token } : {}),
+            ...(t.id_token ? { idToken: t.id_token } : {}),
+            accountId,
+            expiresAt: expiryFromToken(t.access_token),
+            source: "borrow-codex",
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function writeOwn(home, t) {
+    fs.mkdirSync(home, { recursive: true, mode: 0o700 });
+    fs.writeFileSync(ownAuthPath(home), JSON.stringify(t, null, 2), { mode: 0o600 });
+}
+export async function refreshOwn(home, t) {
+    if (!t.refreshToken)
+        throw new Error("no refresh token; run `clauderipple login`");
+    const res = await fetch(OAUTH.tokenUrl, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: t.refreshToken, client_id: OAUTH.clientId }),
+    });
+    if (!res.ok)
+        throw new Error(`token refresh failed: HTTP ${res.status}`);
+    const j = (await res.json());
+    const next = {
+        accessToken: j.access_token,
+        refreshToken: j.refresh_token ?? t.refreshToken,
+        ...(j.id_token ? { idToken: j.id_token } : {}),
+        accountId: accountIdFromToken(j.access_token) ?? t.accountId,
+        expiresAt: j.expires_in ? Date.now() + j.expires_in * 1000 : expiryFromToken(j.access_token),
+        source: "own",
+    };
+    writeOwn(home, next);
+    return next;
+}
+export class CredentialStore {
+    cached = null;
+    home;
+    mode;
+    constructor(home, mode = "auto") {
+        this.home = home;
+        this.mode = mode;
+    }
+    /** Valid tokens or an Error describing what the user must do. Never throws. */
+    async get() {
+        const skew = 5 * 60 * 1000;
+        let t = this.cached;
+        if (!t || Date.now() > t.expiresAt - skew) {
+            t = this.mode === "borrow-codex" ? readBorrowed() : (readOwn(this.home) ?? (this.mode === "own" ? null : readBorrowed()));
+            if (!t)
+                return new Error("no ChatGPT credentials: run `clauderipple login`, or sign in to the Codex CLI once");
+            if (Date.now() > t.expiresAt - skew) {
+                if (t.source === "own") {
+                    try {
+                        t = await refreshOwn(this.home, t);
+                    }
+                    catch (e) {
+                        return new Error(`ChatGPT login expired and refresh failed (${e.message}); run \`clauderipple login\``);
+                    }
+                }
+                else {
+                    return new Error("borrowed Codex CLI login has expired; run `codex` once to refresh it, or `clauderipple login` for a login of our own");
+                }
+            }
+            this.cached = t;
+        }
+        return t;
+    }
+    invalidate() {
+        this.cached = null;
+    }
+    describe() {
+        const own = readOwn(this.home);
+        const bor = readBorrowed();
+        const fmt = (t) => (t ? `${t.source} (expires ${new Date(t.expiresAt).toISOString().slice(0, 16)}Z)` : "none");
+        return `own=${fmt(own)} borrow-codex=${fmt(bor)} mode=${this.mode}`;
+    }
+}
+/** Interactive OAuth PKCE login. Opens the browser; the user signs in themselves. Resolves when tokens are stored. */
+export async function login(home, openBrowser) {
+    const verifier = b64url(crypto.randomBytes(32));
+    const challenge = b64url(crypto.createHash("sha256").update(verifier).digest());
+    const state = crypto.randomBytes(16).toString("hex");
+    const url = new URL(OAUTH.authorizeUrl);
+    url.search = new URLSearchParams({
+        response_type: "code",
+        client_id: OAUTH.clientId,
+        redirect_uri: OAUTH.redirectUri,
+        scope: OAUTH.scope,
+        code_challenge: challenge,
+        code_challenge_method: "S256",
+        state,
+        codex_cli_simplified_flow: "true",
+        originator: "codex_cli_rs",
+    }).toString();
+    const code = await new Promise((resolve, reject) => {
+        const server = http.createServer((req, res) => {
+            const u = new URL(req.url ?? "/", "http://localhost");
+            if (u.pathname !== "/auth/callback") {
+                res.writeHead(404).end();
+                return;
+            }
+            const err = u.searchParams.get("error");
+            if (err || u.searchParams.get("state") !== state) {
+                res.writeHead(400, { "content-type": "text/plain" }).end(`Login failed: ${err ?? "state mismatch"}. You can close this tab.`);
+                server.close();
+                reject(new Error(err ?? "state mismatch"));
+                return;
+            }
+            res.writeHead(200, { "content-type": "text/html" }).end("<p>ClaudeRipple is signed in. You can close this tab.</p>");
+            server.close();
+            resolve(u.searchParams.get("code") ?? "");
+        });
+        server.on("error", reject);
+        server.listen(OAUTH.port, "127.0.0.1", () => openBrowser(url.toString()));
+        setTimeout(() => {
+            server.close();
+            reject(new Error("login timed out after 5 minutes"));
+        }, 5 * 60 * 1000).unref();
+    });
+    const res = await fetch(OAUTH.tokenUrl, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({ grant_type: "authorization_code", code, redirect_uri: OAUTH.redirectUri, client_id: OAUTH.clientId, code_verifier: verifier }),
+    });
+    if (!res.ok)
+        throw new Error(`token exchange failed: HTTP ${res.status} ${await res.text()}`);
+    const j = (await res.json());
+    const accountId = accountIdFromToken(j.access_token) ?? (j.id_token ? accountIdFromToken(j.id_token) : null);
+    if (!accountId)
+        throw new Error("token has no chatgpt_account_id claim");
+    const t = {
+        accessToken: j.access_token,
+        ...(j.refresh_token ? { refreshToken: j.refresh_token } : {}),
+        ...(j.id_token ? { idToken: j.id_token } : {}),
+        accountId,
+        expiresAt: j.expires_in ? Date.now() + j.expires_in * 1000 : expiryFromToken(j.access_token),
+        source: "own",
+    };
+    writeOwn(home, t);
+    return t;
+}
+export function logout(home) {
+    try {
+        fs.unlinkSync(ownAuthPath(home));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/router/src/providers/chatgpt/index.js

@@ -0,0 +1,274 @@
+// ChatGPT subscription adapter: serves an Anthropic Messages request by calling the
+// Codex backend (OpenAI Responses over SSE) and streaming the translated answer back.
+import http from "node:http";
+import { CredentialStore } from "./auth.js";
+import { SseParser } from "./sse.js";
+import { StreamMapper, conversationKey, estimateTokens, formatSse, toResponsesRequest } from "./translate.js";
+import { credentialHeaderValues, redactErrorText } from "../../redact.js";
+import fs from "node:fs";
+import path from "node:path";
+import { homeDir } from "../../config.js";
+export const DEFAULT_BASE = "https://chatgpt.com/backend-api";
+const PING_MS = 15_000;
+function anthropicError(status, type, message) {
+    return { status, body: JSON.stringify({ type: "error", error: { type, message } }) };
+}
+function mapHttpError(status, text) {
+    let msg = text.slice(0, 500);
+    try {
+        const j = JSON.parse(text);
+        msg = j.error?.message ?? j.detail ?? msg;
+    }
+    catch {
+        /* keep raw */
+    }
+    if (status === 401 || status === 403)
+        return anthropicError(401, "authentication_error", `ChatGPT: ${msg}`);
+    if (status === 429)
+        return anthropicError(429, "rate_limit_error", `ChatGPT: ${msg}`);
+    if (status >= 500)
+        return anthropicError(529, "overloaded_error", `ChatGPT: ${msg}`);
+    return anthropicError(400, "invalid_request_error", `ChatGPT: ${msg}`);
+}
+/**
+ * Quota snapshot from the backend's `x-codex-*` response headers (measured 2026-09-13: the
+ * backend reports limits there on every response; the `codex.rate_limits` SSE event is not
+ * always sent). Same shape as the event so the GUI reads either.
+ */
+export function rateLimitsFromHeaders(h) {
+    const num = (k) => {
+        const v = h.get(k);
+        if (v === null || v === "")
+            return undefined;
+        const n = Number(v);
+        return Number.isFinite(n) ? n : undefined;
+    };
+    const window = (p) => {
+        const used = num(`x-codex-${p}-used-percent`);
+        if (used === undefined)
+            return null;
+        const w = { used_percent: used };
+        const wm = num(`x-codex-${p}-window-minutes`);
+        const ra = num(`x-codex-${p}-reset-after-seconds`);
+        const rt = num(`x-codex-${p}-reset-at`);
+        if (wm !== undefined)
+            w.window_minutes = wm;
+        if (ra !== undefined)
+            w.reset_after_seconds = ra;
+        if (rt !== undefined)
+            w.reset_at = rt;
+        return w;
+    };
+    const primary = window("primary");
+    if (!primary)
+        return null;
+    const secondary = window("secondary");
+    return {
+        type: "codex.rate_limits",
+        plan_type: h.get("x-codex-plan-type") ?? undefined,
+        rate_limits: { primary, secondary: secondary && secondary.window_minutes ? secondary : null },
+        at: Date.now(),
+    };
+}
+export class ChatGptAdapter {
+    name;
+    cfg;
+    creds;
+    log;
+    lastRateLimits = null;
+    constructor(name, cfg, home, log) {
+        this.name = name;
+        this.cfg = cfg;
+        this.log = log;
+        this.creds = new CredentialStore(home, cfg.auth ?? "auto");
+    }
+    describeAuth() {
+        return this.creds.describe();
+    }
+    /** Last measured total input (uncached + cached) per conversation, for the next message_start estimate. */
+    lastInputByKey = new Map();
+    rememberInput(key, u) {
+        const total = u.input_tokens + u.cache_read_input_tokens;
+        if (total > 0) {
+            this.lastInputByKey.set(key, total);
+            if (this.lastInputByKey.size > 500)
+                this.lastInputByKey.delete(this.lastInputByKey.keys().next().value);
+        }
+    }
+    /** Troubleshooting aid (provider.debugDump): the failing exchange, secrets excluded (the request carries none). */
+    dump(status, anthropic, upstreamReq, upstreamText) {
+        try {
+            const dir = path.join(homeDir(), "debug");
+            fs.mkdirSync(dir, { recursive: true });
+            const file = path.join(dir, `upstream-${new Date().toISOString().replace(/[:.]/g, "-")}-${status}.json`);
+            fs.writeFileSync(file, JSON.stringify({ status, upstream: upstreamText, request: upstreamReq, anthropic }, null, 1));
+            const files = fs.readdirSync(dir).filter((f) => f.startsWith("upstream-")).sort();
+            for (const f of files.slice(0, Math.max(0, files.length - 60)))
+                fs.rmSync(path.join(dir, f), { force: true });
+        }
+        catch (e) {
+            this.log.warn(`chatgpt ${this.name}: debug dump failed: ${e.message}`);
+        }
+    }
+    /** Handle a fully-read Messages request. `model`/`effort` already resolved by routing. */
+    async handle(req, res, path, json, model, effort) {
+        if (path.startsWith("/v1/messages/count_tokens")) {
+            const body = JSON.stringify({ input_tokens: estimateTokens(json) });
+            res.writeHead(200, { "content-type": "application/json", "content-length": String(body.length) }).end(body);
+            return { status: 200, bytes: body.length, note: "estimated" };
+        }
+        const tokens = await this.creds.get();
+        if (tokens instanceof Error) {
+            const e = anthropicError(401, "authentication_error", tokens.message);
+            res.writeHead(e.status, { "content-type": "application/json" }).end(e.body);
+            return { status: e.status, bytes: e.body.length, note: "no credentials" };
+        }
+        const upstreamReq = toResponsesRequest(json, {
+            model,
+            effort: effort ?? this.cfg.defaultEffort ?? "high",
+            identity: this.cfg.identity ?? true,
+            ...(this.cfg.instructionsAppend ? { instructionsAppend: this.cfg.instructionsAppend } : {}),
+        });
+        const body = JSON.stringify(upstreamReq);
+        const cacheKey = upstreamReq.prompt_cache_key;
+        // Input estimate for message_start: a conversation only grows, so the last measured total is a floor.
+        const startInput = Math.max(estimateTokens(json), this.lastInputByKey.get(cacheKey) ?? 0);
+        const ac = new AbortController();
+        const onClose = () => ac.abort();
+        res.on("close", onClose);
+        const upstreamHeaders = {
+            "content-type": "application/json",
+            accept: "text/event-stream",
+            authorization: `Bearer ${tokens.accessToken}`,
+            "chatgpt-account-id": tokens.accountId,
+            "OpenAI-Beta": "responses=experimental",
+            originator: "codex_cli_rs",
+        };
+        const upstreamSecrets = credentialHeaderValues(Object.entries(upstreamHeaders));
+        let upstream;
+        try {
+            upstream = await fetch(`${(this.cfg.url ?? DEFAULT_BASE).replace(/\/$/, "")}/codex/responses`, {
+                method: "POST",
+                headers: upstreamHeaders,
+                body,
+                signal: ac.signal,
+            });
+        }
+        catch (e) {
+            res.off("close", onClose);
+            if (ac.signal.aborted)
+                return { status: 0, bytes: 0, note: "client closed" };
+            const err = anthropicError(502, "api_error", `ChatGPT backend unreachable: ${e.message}`);
+            if (!res.headersSent)
+                res.writeHead(err.status, { "content-type": "application/json" }).end(err.body);
+            throw e; // let the proxy feed health with the connect error
+        }
+        const fromHeaders = rateLimitsFromHeaders(upstream.headers);
+        if (fromHeaders)
+            this.lastRateLimits = fromHeaders;
+        if (!upstream.ok || !upstream.body) {
+            const text = await upstream.text().catch(() => "");
+            const safeText = redactErrorText(text, upstreamSecrets);
+            if (upstream.status === 401)
+                this.creds.invalidate();
+            const err = mapHttpError(upstream.status, safeText);
+            this.log.warn(`chatgpt ${this.name}: upstream ${upstream.status} for ${model}: ${safeText.slice(0, 400)}`);
+            if (this.cfg.debugDump)
+                this.dump(upstream.status, json, upstreamReq, safeText);
+            res.off("close", onClose);
+            res.writeHead(err.status, { "content-type": "application/json" }).end(err.body);
+            return { status: err.status, bytes: err.body.length, note: `upstream ${upstream.status}` };
+        }
+        if (this.cfg.debugDump === "all")
+            this.dump(upstream.status, json, upstreamReq, "");
+        const wantStream = json.stream === true;
+        const mapper = new StreamMapper(model, startInput);
+        const parser = new SseParser();
+        let bytes = 0;
+        let ping = null;
+        if (wantStream) {
+            res.writeHead(200, { "content-type": "text/event-stream", "cache-control": "no-cache", connection: "keep-alive" });
+            for (const ev of mapper.start())
+                bytes += write(res, formatSse(ev));
+            ping = setInterval(() => {
+                if (!res.writableEnded)
+                    bytes += write(res, formatSse({ event: "ping", data: { type: "ping" } }));
+            }, PING_MS);
+        }
+        const reader = upstream.body.getReader();
+        const decoder = new TextDecoder();
+        try {
+            for (;;) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                for (const ev of parser.feed(decoder.decode(value, { stream: true }))) {
+                    const outEvents = mapper.feed(ev);
+                    if (mapper.rateLimits)
+                        this.lastRateLimits = mapper.rateLimits;
+                    this.rememberInput(cacheKey, mapper.usage);
+                    if (wantStream)
+                        for (const o of outEvents)
+                            bytes += write(res, formatSse(o));
+                    if (mapper.isFinished)
+                        break;
+                }
+                if (mapper.isFinished)
+                    break;
+            }
+            if (!mapper.isFinished) {
+                // Upstream ended without response.completed: treat as done with what we have.
+                const tail = mapper.finish();
+                if (wantStream)
+                    for (const o of tail)
+                        bytes += write(res, formatSse(o));
+            }
+        }
+        catch (e) {
+            if (!ac.signal.aborted) {
+                const tail = mapper.fail(`stream interrupted: ${e.message}`);
+                if (wantStream)
+                    for (const o of tail)
+                        bytes += write(res, formatSse(o));
+            }
+        }
+        finally {
+            if (ping)
+                clearInterval(ping);
+            res.off("close", onClose);
+            try {
+                await reader.cancel();
+            }
+            catch {
+                /* already closed */
+            }
+        }
+        if (!wantStream) {
+            const msg = JSON.stringify(mapper.message());
+            res.writeHead(200, { "content-type": "application/json", "content-length": String(Buffer.byteLength(msg)) }).end(msg);
+            bytes = msg.length;
+        }
+        else if (!res.writableEnded) {
+            res.end();
+        }
+        const u = mapper.usage;
+        return {
+            status: 200,
+            bytes,
+            note: `in=${u.input_tokens} cached=${u.cache_read_input_tokens} out=${u.output_tokens} stop=${mapper.stopReason}`,
+            usage: {
+                input: u.input_tokens,
+                cached: u.cache_read_input_tokens,
+                ...(u.cache_creation_input_tokens > 0 ? { cacheWrite: u.cache_creation_input_tokens } : {}),
+                output: u.output_tokens,
+            },
+            stopReason: mapper.stopReason,
+        };
+    }
+}
+function write(res, s) {
+    if (res.writableEnded || res.destroyed)
+        return 0;
+    res.write(s);
+    return s.length;
+}

package/dist/router/src/providers/chatgpt/sse.js

@@ -0,0 +1,28 @@
+// Minimal SSE parser: bytes in, `data:` payloads out. Handles multi-line data and CRLF.
+export class SseParser {
+    buf = "";
+    /** Feed a chunk; returns the parsed JSON objects of complete events (non-JSON data is skipped). */
+    feed(chunk) {
+        this.buf += chunk;
+        const out = [];
+        let idx;
+        while ((idx = this.buf.search(/\r?\n\r?\n/)) >= 0) {
+            const raw = this.buf.slice(0, idx);
+            this.buf = this.buf.slice(idx).replace(/^\r?\n\r?\n/, "");
+            const data = raw
+                .split(/\r?\n/)
+                .filter((l) => l.startsWith("data:"))
+                .map((l) => l.slice(5).replace(/^ /, ""))
+                .join("\n");
+            if (!data || data === "[DONE]")
+                continue;
+            try {
+                out.push(JSON.parse(data));
+            }
+            catch {
+                /* ignore non-JSON frames */
+            }
+        }
+        return out;
+    }
+}