cpyany 0.2.7 → 0.2.8

package/README.md

@@ -8,8 +8,10 @@ npx cpyany setup
 ```
 
 Auto-detects every supported AI client installed on your machine (Claude Code,
-Claude Desktop, Cursor), opens a browser to authorize, and writes the resulting
-bearer token into each client's MCP config from a single OAuth flow.
+Claude Desktop, Cursor, Codex), opens a browser to authorize, and writes the
+resulting bearer token into each client's MCP config from a single OAuth flow.
+Re-running setup reuses the machine's existing login, so adding a client later
+is just `npx cpyany setup --client <name>`.
 
 After setup, ask your coding agent to copy from a reference:
 
@@ -24,6 +26,7 @@ Use cpyany to copy the hero section from https://example.com into this app.
 | Claude Code | runs `claude mcp add --scope user --transport http …` (writes `~/.claude.json`) | `~/.claude/rules/cpyany.md` + `~/.claude/skills/cpyany/SKILL.md` | `claude` on `PATH` |
 | Claude Desktop | `~/Library/Application Support/Claude/claude_desktop_config.json` (mac) / `%APPDATA%\Claude\claude_desktop_config.json` (win) — bridged via `mcp-remote` | _(none — Claude Desktop has no rules/skills mechanism)_ | the per-platform Claude config dir exists |
 | Cursor | `~/.cursor/mcp.json` | `~/.cursor/rules/cpyany.mdc` (`alwaysApply: true`) + `~/.cursor/skills/cpyany/SKILL.md` | `~/.cursor` exists |
+| Codex | `[mcp_servers.cpyany]` table in `~/.codex/config.toml` (streamable HTTP, bearer via `http_headers`) | _(none yet — MCP config only)_ | `~/.codex` exists or `codex` on `PATH` |
 
 Guidance is two-tier: a short always-loaded rule telling the agent when to use
 cpyany, and a deeper `cpyany` skill with the copy-from-reference workflow.
@@ -35,8 +38,8 @@ cpyany, and a deeper `cpyany` skill with the copy-from-reference workflow.
 npx cpyany setup --client claude-code
 ```
 
-`--client` accepts `claude-code`, `claude-desktop`, or `cursor`. Aliases:
-`--claude` (= `--claude-desktop`), `--code` (= `--claude-code`).
+`--client` accepts `claude-code`, `claude-desktop`, `cursor`, or `codex`.
+Aliases: `--claude` (= `--claude-desktop`), `--code` (= `--claude-code`).
 
 ## Skip the browser
 

package/index.mjs

@@ -11,7 +11,7 @@ import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import open from "open";
 
-const VERSION = "0.2.6";
+const VERSION = "0.2.8";
 const execFileP = promisify(execFile);
 const APP_URL = process.env.PINGHUMANS_APP_URL ?? "https://pinghumans.com";
 // Hoisted with the other top-of-module consts — the entry try-block runs
@@ -20,7 +20,7 @@ const APP_URL = process.env.PINGHUMANS_APP_URL ?? "https://pinghumans.com";
 // reaches NUDGE_INTERVAL_MS transitively from that path, so it lives here.
 const CLI_CLIENT_ID = "pinghumans-cli";
 const DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
-const SUPPORTED_CLIENTS = ["claude-desktop", "claude-code", "cursor"];
+const SUPPORTED_CLIENTS = ["claude-desktop", "claude-code", "cursor", "codex"];
 // Throttle the passive token-health check to once/day so it neither spams
 // the nudge nor adds a whoami round-trip to every incidental invocation.
 const NUDGE_INTERVAL_MS = 24 * 60 * 60 * 1000;
@@ -223,7 +223,7 @@ async function setup(client) {
     const detected = await detectClients();
     if (detected.length === 0) {
       throw new Error(
-        "Couldn't find Claude Code, Claude Desktop, or Cursor on this machine. " +
+        "Couldn't find Claude Code, Claude Desktop, Cursor, or Codex on this machine. " +
           "Install one of them first, or pass --client to specify manually."
       );
     }
@@ -244,13 +244,30 @@ async function setup(client) {
     }
   }
 
-  // One device-code sign-in regardless of how many configs we'll patch
-  // (RFC 8628 — works over SSH too, no localhost listener needed).
-  const token = await performDeviceLogin();
-  if (!token) process.exit(1);
-  _bearerForTelemetry = token;
+  // One sign-in regardless of how many configs we'll patch. A stored token
+  // that still authenticates is reused — re-running setup to add a second
+  // client must not force a fresh sign-in. Anything else falls through to
+  // the device flow (RFC 8628 — works over SSH too, no localhost listener).
   const pc0 = await import("picocolors").then((m) => m.default);
-  console.log(`${pc0.green("✔")} Authenticated`);
+  let token = await resolveLocalToken();
+  if (token) {
+    try {
+      const who = await fetchWhoami(token);
+      if (who?.success === false) throw new Error("token revoked");
+      const name = who?.email || who?.name;
+      console.log(
+        `${pc0.green("✔")} Already signed in${name ? ` as ${pc0.bold(name)}` : ""} — reusing this machine's login (\`cpyany remove\` signs out)`
+      );
+    } catch {
+      token = null; // dead or unverifiable → fresh sign-in
+    }
+  }
+  if (!token) {
+    token = await performDeviceLogin();
+    if (!token) process.exit(1);
+    console.log(`${pc0.green("✔")} Authenticated`);
+  }
+  _bearerForTelemetry = token;
   await saveLocalToken(token); // lets `cpyany wait`/`whoami` authenticate later
 
   // Install everything, then print a Context7-style per-client summary.
@@ -362,13 +379,14 @@ async function isOnPath(cmd) {
  *   - claude-desktop: the per-platform config directory exists (created on
  *     first launch; absent if the app was never opened)
  *   - cursor: ~/.cursor exists
+ *   - codex: ~/.codex exists, or the `codex` binary is on PATH
  */
 async function detectClients() {
   const home = homedir();
   const isMac = platform() === "darwin";
   const isWin = platform() === "win32";
 
-  const [hasClaudeCode, hasClaudeDesktop, hasCursor] = await Promise.all([
+  const [hasClaudeCode, hasClaudeDesktop, hasCursor, hasCodexDir, hasCodexBin] = await Promise.all([
     isOnPath("claude"),
     pathExists(
       isMac
@@ -378,12 +396,15 @@ async function detectClients() {
           : join(home, ".config", "Claude")
     ),
     pathExists(join(home, ".cursor")),
+    pathExists(join(home, ".codex")),
+    isOnPath("codex"),
   ]);
 
   const out = [];
   if (hasClaudeCode) out.push("claude-code");
   if (hasClaudeDesktop) out.push("claude-desktop");
   if (hasCursor) out.push("cursor");
+  if (hasCodexDir || hasCodexBin) out.push("codex");
   return out;
 }
 
@@ -580,6 +601,8 @@ function configPath(client) {
     }
     case "cursor":
       return join(home, ".cursor", "mcp.json");
+    case "codex":
+      return join(home, ".codex", "config.toml");
     case "claude-code":
       return null; // managed via `claude mcp add`
     default:
@@ -591,6 +614,9 @@ async function patchConfig(client, token) {
   if (client === "claude-code") {
     return patchClaudeCodeViaCli(token);
   }
+  if (client === "codex") {
+    return patchCodexConfig(token);
+  }
   const path = configPath(client);
   await mkdir(dirname(path), { recursive: true });
   let config = {};
@@ -637,6 +663,17 @@ async function unpatchConfig(client) {
     await execFileP("claude", ["mcp", "remove", "pinghumans", "--scope", "user"]).catch(() => {});
     return;
   }
+  if (client === "codex") {
+    try {
+      const path = configPath("codex");
+      const text = await readFile(path, "utf8");
+      const next = stripTomlTable(text, "mcp_servers.cpyany");
+      if (next !== text) await writeFile(path, next);
+    } catch {
+      /* nothing to remove */
+    }
+    return;
+  }
   const path = configPath(client);
   try {
     const text = await readFile(path, "utf8");
@@ -651,6 +688,48 @@ async function unpatchConfig(client) {
   }
 }
 
+// Codex keeps MCP servers in ~/.codex/config.toml ([mcp_servers.<name>]
+// tables). Streamable HTTP works natively via `url`; the bearer rides in
+// `http_headers` — codex's config validation rejects an inline
+// `bearer_token` key, and the only other option (bearer_token_env_var)
+// needs an env var setup can't persist into the user's shell. Only our
+// own table is rewritten; the rest of the file — users hand-edit
+// config.toml — is left byte-for-byte alone.
+async function patchCodexConfig(token) {
+  const path = configPath("codex");
+  await mkdir(dirname(path), { recursive: true });
+  let text = "";
+  try {
+    text = await readFile(path, "utf8");
+  } catch {
+    /* missing — start fresh */
+  }
+  // Collapse the strip's leftover trailing blank lines so re-runs are
+  // byte-stable instead of growing one blank line per invocation.
+  text = stripTomlTable(text, "mcp_servers.cpyany").replace(/\n{2,}$/, "\n");
+  const block =
+    `[mcp_servers.cpyany]\n` +
+    `url = "${APP_URL}/api/mcp"\n` +
+    `http_headers = { "Authorization" = "Bearer ${token}" }\n`;
+  const sep = text.trim().length === 0 ? "" : text.endsWith("\n") ? "\n" : "\n\n";
+  await writeFile(path, (text.trim().length === 0 ? "" : text) + sep + block);
+}
+
+// Drop one [name] table — its header line plus every line up to the next
+// table header (or EOF). Line-based surgery, not a TOML parse: it only
+// ever deletes between OUR header and the next header, so hand-authored
+// tables around it survive untouched.
+function stripTomlTable(text, tableName) {
+  const out = [];
+  let inTable = false;
+  for (const line of text.split("\n")) {
+    const header = /^\s*\[([^\]]+)\]/.exec(line);
+    if (header) inTable = header[1].trim() === tableName;
+    if (!inTable) out.push(line);
+  }
+  return out.join("\n");
+}
+
 // ─── Agent rules ──────────────────────────────────────────────────────────
 //
 // In addition to MCP tool descriptions, we install a short prose "rule"
@@ -893,6 +972,7 @@ function parseClient(args) {
     if (args[i] === "--code" || args[i] === "--claude-code")
       return "claude-code";
     if (args[i] === "--cursor") return "cursor";
+    if (args[i] === "--codex") return "codex";
   }
   return null;
 }
@@ -903,6 +983,7 @@ function prettyClient(client) {
       "claude-desktop": "Claude Desktop",
       "claude-code": "Claude Code",
       cursor: "Cursor",
+      codex: "Codex",
     }[client] || client
   );
 }
@@ -911,8 +992,8 @@ function printHelp() {
   console.log(`cpyany — install the cpyany MCP server in your AI client.
 
 Usage:
-  cpyany setup [--client claude-code|claude-desktop|cursor]
-  cpyany remove [--client claude-code|claude-desktop|cursor]
+  cpyany setup [--client claude-code|claude-desktop|cursor|codex]
+  cpyany remove [--client claude-code|claude-desktop|cursor|codex]
   cpyany wait <ping_id> [--timeout <seconds>]
                        # block until the cpyany test has results (exit 0 = news,
                        # 2 = timed out). Run it in the background after filing
@@ -922,8 +1003,10 @@ Usage:
   cpyany version
 
 Without --client, setup auto-detects every supported AI client installed on
-this machine (Claude Code, Claude Desktop, Cursor) and patches all of their
-configs from a single OAuth flow. Use --client to restrict to one.
+this machine (Claude Code, Claude Desktop, Cursor, Codex) and patches all of
+their configs from a single OAuth flow. Use --client to restrict to one.
+Re-running setup reuses this machine's login, so adding a client later is
+just \`cpyany setup --client <name>\`.
 
 Setup opens your browser to ${APP_URL}/cli-auth, generates a fresh bearer
 token after you sign in, and writes it into each client's MCP config.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cpyany",
-  "version": "0.2.7",
+  "version": "0.2.8",
   "description": "Install cpyany so coding agents can copy websites, pages, and elements from references.",
   "type": "module",
   "main": "index.mjs",