egaki 0.9.0 → 0.11.0

package/CHANGELOG.md

@@ -2,6 +2,78 @@
 
 All notable changes to this project will be documented in this file.
 
+## 0.11.0
+
+1. **Background OAuth login for agents and non-TTY shells.** `egaki login --provider chatgpt` and `egaki login --provider xai-oauth` start the browser login and return. An interactive terminal still stays attached until login finishes.
+
+   ```bash
+   egaki login --provider chatgpt
+   # Login is running in the background and the browser will open.
+   # After approval, verify with: egaki login status chatgpt
+   ```
+
+2. **New `egaki login status` command** — check one provider. The command exits with status 1 until that login is complete:
+
+   ```bash
+   egaki login status chatgpt
+   egaki login status xai-oauth
+   ```
+
+3. **Shell completions** — install, print, or remove the completion script:
+
+   ```bash
+   egaki completions install
+   egaki completions script
+   egaki completions uninstall
+   ```
+
+4. **`--aspect-ratio` works on OpenAI image models.** `gpt-image-*` and `dall-e-*` have no native aspect-ratio parameter. The flag now picks the closest supported size and states the ratio in the prompt. A 16:9 request on `gpt-image-1-mini` produces 1536x1024 instead of a silent 1024x1024 square:
+
+   ```bash
+   egaki image "a red cube on a white table" \
+     -m gpt-image-1-mini --aspect-ratio 16:9
+   ```
+
+5. **ChatGPT image generation uses the account model list.** A fixed slug such as `gpt-5.4` is no longer sent. Generation uses the highest-priority model that is visible, API-supported, and included in the saved plan. If that model is rejected, it retries once with the next listed model.
+
+6. **ChatGPT login is saved only after the token exchange succeeds.** The redirect uses `localhost`, which the allow-list accepts. The listener stays on `127.0.0.1`. A failed exchange does not replace the previous login. `egaki login --show` no longer calls a revoked token valid. It says the token is not expired locally, or that the next request will try to refresh.
+
+7. **`egaki subscribe --plan` accepts only `plus` and `pro`.** Plus is $29/mo. Pro is $99/mo. An invalid plan name fails in the CLI instead of opening a buy URL that returns 400:
+
+   ```bash
+   egaki subscribe --plan plus
+   egaki subscribe --plan pro
+   ```
+
+8. **Fixed HMR for a root `.mdx` file that is also imported.** Editing `tagline.mdx` when another file imports it updates the player without a manual reload.
+
+9. **`egaki dev` prints SDK method names and a docs link** after the server URL, including `seekTo`, `screenshot`, `filmstrip`, `export`, and `getInfo`.
+
+## 0.10.0
+
+1. **New `egaki dev` command — zero-config MDX video dev server.** Serve an `.mdx` file with no project setup at all: no `package.json`, no `vite.config.ts`, no `npm install`. All dependencies (react, remotion, vite) come from the egaki CLI's own installation:
+
+   ```bash
+   # Serve a single MDX file, no project setup
+   egaki dev video.mdx
+
+   # Serve the current directory (auto-discovers video.mdx > index.mdx > first .mdx)
+   egaki dev
+
+   # Fixed port + open browser
+   egaki dev intro.mdx --port 5199 --open
+   ```
+
+   Uses a random free port by default; `--port`, `--host`, and `--open` are available. Under the hood a shim `node_modules` with symlinks to egaki's own dependencies is created in the folder, so Vite's dep optimizer, Tailwind scans, and even editor TypeScript resolution work in scratch folders. If the folder has a foreign `node_modules` without egaki, you get a clear error with guidance.
+
+2. **SDK usage instructions printed on dev server startup** — after Vite's ready banner, the dev server prints copy-pasteable `window.egakiSDK` examples (getInfo, screenshot, filmstrip, export, seekTo via Playwriter) so agents reading terminal output immediately know how to control the running player.
+
+3. **`<AngledScreen>` hexagonal iris bokeh + new `chromaticAberration` prop** — the depth-of-field kernel is now a sparse 6-blade hexagonal iris, so bright points form hard-edged aperture disks instead of smoothing into a gaussian. The new `chromaticAberration` prop (default `0.45`) adds a radial R/B channel split that scales with local blur, so purple/cyan fringing reads strongest in the bokeh like a real lens.
+
+4. **Fixed "No video config found" with duplicate remotion copies** — under pnpm, when remotion was only a transitive dep of egaki (or the app installed remotion directly while `file:`-linking egaki), two physical copies split the Player context from `useVideoConfig`. All `remotion`, `@remotion/*`, and `motion` imports now converge on a single copy.
+
+5. **Fixed browser crash `"does not provide an export named 'default'"`** on portable npm installs of egaki — nested pure-CJS packages under safe-mdx (format, fault, micromark chain) were split into named-only ESM chunks by the dep optimizer. They now stay internalized with correct CJS interop.
+
 ## 0.9.0
 
 1. **`<AngledScreen>` with true WebGL depth-of-field** — the 3D tilted screen component is now shader-based. Children DOM is captured per frame with Chromium's HTML-in-canvas API and rendered as a perspective-tilted plane in a WebGL2 fragment shader, giving true per-pixel depth. Depth drives bokeh blur (the exact Three.js BokehShader 41-tap ring kernel), fog toward `backgroundColor`, and subtle film grain. Available in MDX without imports:

package/dist/cli/chatgpt-auth.d.ts

@@ -8,15 +8,40 @@ export type ChatGptAuth = {
 };
 /** Extract the ChatGPT plan type (e.g. "plus", "pro") from the access token. */
 export declare function extractPlanType(auth: ChatGptAuth): string | undefined;
+export declare function isRevokedChatGptAccessToken(status: number, body: string): boolean;
+export declare function oauthCallbackAction({ pendingState, callbackState, error, code, }: {
+    pendingState: string | undefined;
+    callbackState: string | null;
+    error: string | null;
+    code: string | null;
+}): 'ignore' | 'provider-error' | 'missing-code' | 'exchange';
+export declare function chatGptReLoginMessage({ status, body, }: {
+    status: number;
+    body: string;
+}): string;
+export type ChatGptResponsesModel = {
+    slug: string;
+    visibility?: string;
+    priority?: number;
+    supportedInApi?: boolean;
+    plans?: string[];
+};
+export declare function pickChatGptResponsesModel({ models, plan, exclude, }: {
+    models: ChatGptResponsesModel[];
+    plan: string | undefined;
+    exclude?: string[];
+}): string | null;
+export declare function resolveChatGptResponsesModel({ auth, exclude, }: {
+    auth: ChatGptAuth;
+    exclude?: string[];
+}): Promise<string | Error>;
 /**
  * Run the full ChatGPT OAuth browser flow with clack UI.
  * Returns the ChatGptAuth object to be stored in credentials.json.
  */
-export declare function chatGptOAuthLogin(): Promise<ChatGptAuth>;
-/**
- * Refresh an expired ChatGPT access token using the refresh token.
- * Returns the updated auth object, or an Error if refresh fails.
- */
+export declare function chatGptOAuthLogin({ openInBackground, }?: {
+    openInBackground?: boolean | undefined;
+}): Promise<ChatGptAuth>;
 export declare function refreshChatGptToken(auth: ChatGptAuth): Promise<ChatGptAuth | Error>;
 /**
  * Refresh the auth object if needed and return the full updated state.

package/dist/cli/chatgpt-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chatgpt-auth.d.ts","sourceRoot":"","sources":["../../src/cli/chatgpt-auth.ts"],"names":[],"mappings":"AAmBA,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;CAChB,CAAA;AAgGD,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,GAAG,SAAS,CAOrE;AA8JD;;;GAGG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,WAAW,CAAC,CA8C9D;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,GAAG,KAAK,CAAC,CAyBzF;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,WAAW,EACjB,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,IAAI,GACzC,OAAO,CAAC,WAAW,GAAG,KAAK,CAAC,CAS9B"}
+{"version":3,"file":"chatgpt-auth.d.ts","sourceRoot":"","sources":["../../src/cli/chatgpt-auth.ts"],"names":[],"mappings":"AAoBA,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;CAChB,CAAA;AAoGD,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,GAAG,SAAS,CAKrE;AAyDD,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAKjF;AAED,wBAAgB,mBAAmB,CAAC,EAClC,YAAY,EACZ,aAAa,EACb,KAAK,EACL,IAAI,GACL,EAAE;IACD,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;IAChC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CACpB,GAAG,QAAQ,GAAG,gBAAgB,GAAG,cAAc,GAAG,UAAU,CAK5D;AAED,wBAAgB,qBAAqB,CAAC,EACpC,MAAM,EACN,IAAI,GACL,EAAE;IACD,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;CACb,GAAG,MAAM,CAGT;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CACjB,CAAA;AAID,wBAAgB,yBAAyB,CAAC,EACxC,MAAM,EACN,IAAI,EACJ,OAAY,GACb,EAAE;IACD,MAAM,EAAE,qBAAqB,EAAE,CAAA;IAC/B,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;IACxB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB,GAAG,MAAM,GAAG,IAAI,CAWhB;AAED,wBAAsB,4BAA4B,CAAC,EACjD,IAAI,EACJ,OAAY,GACb,EAAE;IACD,IAAI,EAAE,WAAW,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB,GAAG,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,CAiD1B;AAsMD;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,gBAAwB,GACzB;;CAAK,GAAG,OAAO,CAAC,WAAW,CAAC,CAwE5B;AA8DD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,GAAG,KAAK,CAAC,CAUnF;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,WAAW,EACjB,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,IAAI,GACzC,OAAO,CAAC,WAAW,GAAG,KAAK,CAAC,CAS9B"}

package/dist/cli/chatgpt-auth.js

@@ -6,13 +6,14 @@
 // Tokens are stored so egaki can reuse the ChatGPT login for Codex-style
 // backend requests and refresh them when needed.
 import { createServer } from 'node:http';
-import { spawn } from 'node:child_process';
 import { spinner, log, note } from '@clack/prompts';
-import pc from 'picocolors';
+import { colors as pc } from 'goke';
+import { z } from 'zod';
+import { openUrlInBrowser } from './open-browser.js';
 const CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann';
 const ISSUER = 'https://auth.openai.com';
-const OAUTH_PORT = 1455;
-const REDIRECT_URI = `http://localhost:${OAUTH_PORT}/auth/callback`;
+// 1457 is the Codex fallback. The shared client allow-list accepts both.
+const OAUTH_PORTS = [1455, 1457];
 // ─── PKCE helpers ────────────────────────────────────────────────────────────
 function randomString(length) {
     const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';
@@ -31,10 +32,15 @@ async function generatePKCE() {
     const hash = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));
     return { verifier, challenge: base64UrlEncode(hash) };
 }
-function generateState() {
-    return base64UrlEncode(crypto.getRandomValues(new Uint8Array(32)).buffer);
-}
 // ─── JWT parsing ─────────────────────────────────────────────────────────────
+const jwtClaimsSchema = z.object({
+    email: z.string().optional(),
+    chatgpt_account_id: z.string().optional(),
+    'https://api.openai.com/auth': z.object({
+        chatgpt_account_id: z.string().optional(),
+        chatgpt_plan_type: z.string().optional(),
+    }).optional(),
+});
 function parseJwtClaims(token) {
     const parts = token.split('.');
     if (parts.length !== 3)
@@ -43,7 +49,7 @@ function parseJwtClaims(token) {
     if (!payload)
         return undefined;
     try {
-        return JSON.parse(Buffer.from(payload, 'base64url').toString());
+        return jwtClaimsSchema.parse(JSON.parse(Buffer.from(payload, 'base64url').toString()));
     }
     catch {
         return undefined;
@@ -85,13 +91,13 @@ export function extractPlanType(auth) {
     return authClaim?.chatgpt_plan_type;
 }
 // ─── OAuth URL + token exchange ──────────────────────────────────────────────
-function buildAuthorizeUrl(pkce, state) {
+function buildAuthorizeUrl({ challenge, state, redirectUri, }) {
     const params = new URLSearchParams({
         response_type: 'code',
         client_id: CLIENT_ID,
-        redirect_uri: REDIRECT_URI,
+        redirect_uri: redirectUri,
         scope: 'openid profile email offline_access api.connectors.read api.connectors.invoke',
-        code_challenge: pkce.challenge,
+        code_challenge: challenge,
         code_challenge_method: 'S256',
         id_token_add_organizations: 'true',
         codex_cli_simplified_flow: 'true',
@@ -100,23 +106,94 @@ function buildAuthorizeUrl(pkce, state) {
     });
     return `${ISSUER}/oauth/authorize?${params.toString()}`;
 }
-async function exchangeCodeForTokens(code, verifier) {
+async function exchangeCodeForTokens({ code, verifier, redirectUri, }) {
     const response = await fetch(`${ISSUER}/oauth/token`, {
         method: 'POST',
         headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
         body: new URLSearchParams({
             grant_type: 'authorization_code',
             code,
-            redirect_uri: REDIRECT_URI,
+            redirect_uri: redirectUri,
             client_id: CLIENT_ID,
             code_verifier: verifier,
         }).toString(),
     });
     if (!response.ok) {
-        throw new Error(`Token exchange failed: ${response.status}`);
+        const body = await response.text().catch(() => '');
+        throw new Error(`Token exchange failed: ${response.status}${body ? ` ${body}` : ''}. The previous ChatGPT login was not replaced.`);
     }
     return (await response.json());
 }
+export function isRevokedChatGptAccessToken(status, body) {
+    return (status === 401 &&
+        (body.includes('token_revoked') || body.includes('invalidated oauth token')));
+}
+export function oauthCallbackAction({ pendingState, callbackState, error, code, }) {
+    if (!pendingState || callbackState !== pendingState)
+        return 'ignore';
+    if (error)
+        return 'provider-error';
+    if (!code)
+        return 'missing-code';
+    return 'exchange';
+}
+export function chatGptReLoginMessage({ status, body, }) {
+    const detail = body.trim();
+    return `ChatGPT rejected the saved login (${status}${detail ? `: ${detail}` : ''}). Run: egaki login --provider chatgpt`;
+}
+// ChatGPT accounts reject a fixed slug such as gpt-5.4. Use the account's
+// current models list and pick the highest-priority listed model.
+export function pickChatGptResponsesModel({ models, plan, exclude = [], }) {
+    const ranked = models
+        .filter((model) => {
+        if (!model.slug || exclude.includes(model.slug))
+            return false;
+        if (model.visibility && model.visibility !== 'list')
+            return false;
+        if (model.supportedInApi === false)
+            return false;
+        if (plan && model.plans && !model.plans.includes(plan))
+            return false;
+        return true;
+    })
+        .sort((a, b) => (a.priority ?? 1_000) - (b.priority ?? 1_000));
+    return ranked[0]?.slug ?? null;
+}
+export async function resolveChatGptResponsesModel({ auth, exclude = [], }) {
+    const headers = new Headers({
+        Authorization: `Bearer ${auth.access}`,
+    });
+    if (auth.accountId)
+        headers.set('ChatGPT-Account-ID', auth.accountId);
+    const response = await fetch('https://chatgpt.com/backend-api/codex/models?client_version=0.0.0', { headers }).catch((err) => err instanceof Error ? err : new Error(String(err)));
+    if (response instanceof Error)
+        return response;
+    if (!response.ok) {
+        const body = await response.text().catch(() => '');
+        if (response.status === 401) {
+            return new Error(chatGptReLoginMessage({ status: response.status, body }));
+        }
+        return new Error(`ChatGPT model list failed: ${response.status}${body ? ` ${body}` : ''}`);
+    }
+    const json = (await response.json());
+    const slug = pickChatGptResponsesModel({
+        models: (json.models ?? []).flatMap((model) => model.slug
+            ? [{
+                    slug: model.slug,
+                    visibility: model.visibility,
+                    priority: model.priority,
+                    supportedInApi: model.supported_in_api,
+                    plans: model.available_in_plans,
+                }]
+            : []),
+        plan: auth.plan,
+        exclude,
+    });
+    if (!slug) {
+        return new Error('No ChatGPT model is available for image generation. Run: egaki login --provider chatgpt');
+    }
+    return slug;
+}
 // ─── local callback server ───────────────────────────────────────────────────
 const HTML_SUCCESS = `<!doctype html>
 <html><body style="font-family:system-ui;text-align:center;padding:4em">
@@ -125,10 +202,27 @@ const HTML_SUCCESS = `<!doctype html>
 </body></html>`;
 const htmlError = (error) => `<!doctype html><html><body style="font-family:system-ui;text-align:center;padding:4em">
 <h1>Authorization Failed</h1><pre>${error}</pre></body></html>`;
+function escapeHtml(value) {
+    return value.replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;');
+}
+function sendHtml({ res, status, html, }) {
+    res.statusCode = status;
+    res.setHeader('Content-Type', 'text/html; charset=utf-8');
+    res.setHeader('Connection', 'close');
+    res.end(html);
+}
+function failCallback(res, message) {
+    pendingOAuth?.reject(new Error(message));
+    pendingOAuth = undefined;
+    sendHtml({ res, status: 400, html: htmlError(escapeHtml(message)) });
+}
+const OAUTH_HOST = '127.0.0.1';
 let oauthServer;
 let pendingOAuth;
-function handleOAuthRequest(req, res) {
-    const url = new URL(req.url ?? '/', `http://localhost:${OAUTH_PORT}`);
+// Browser success used to be sent before token exchange. The page then said
+// login was done while credentials.json stayed unchanged.
+async function handleOAuthRequest(req, res) {
+    const url = new URL(req.url ?? '/', 'http://127.0.0.1');
     if (url.pathname !== '/auth/callback') {
         res.statusCode = 404;
         res.end('Not found');
@@ -138,68 +232,110 @@ function handleOAuthRequest(req, res) {
     const state = url.searchParams.get('state');
     const error = url.searchParams.get('error');
     const errorDescription = url.searchParams.get('error_description');
-    if (error) {
-        const message = errorDescription || error;
-        pendingOAuth?.reject(new Error(message));
-        pendingOAuth = undefined;
-        res.statusCode = 400;
-        res.setHeader('Content-Type', 'text/html');
-        res.end(htmlError(message));
+    const action = oauthCallbackAction({
+        pendingState: pendingOAuth?.state,
+        callbackState: state,
+        error,
+        code,
+    });
+    if (action === 'ignore') {
+        sendHtml({
+            res,
+            status: 400,
+            html: htmlError(escapeHtml('Invalid state. This callback does not match the active egaki login.')),
+        });
         return;
     }
-    if (!code) {
-        const message = 'Missing authorization code';
-        pendingOAuth?.reject(new Error(message));
-        pendingOAuth = undefined;
-        res.statusCode = 400;
-        res.setHeader('Content-Type', 'text/html');
-        res.end(htmlError(message));
+    if (action === 'provider-error') {
+        failCallback(res, errorDescription || error || 'Authorization failed');
         return;
     }
-    if (!pendingOAuth || state !== pendingOAuth.state) {
-        const message = 'Invalid state — potential CSRF attack';
-        pendingOAuth?.reject(new Error(message));
-        pendingOAuth = undefined;
-        res.statusCode = 400;
-        res.setHeader('Content-Type', 'text/html');
-        res.end(htmlError(message));
+    if (action === 'missing-code' || !code) {
+        failCallback(res, 'Missing authorization code. The previous ChatGPT login was not replaced.');
         return;
     }
     const current = pendingOAuth;
+    if (!current) {
+        sendHtml({
+            res,
+            status: 400,
+            html: htmlError(escapeHtml('Invalid state. This callback does not match the active egaki login.')),
+        });
+        return;
+    }
     pendingOAuth = undefined;
-    exchangeCodeForTokens(code, current.verifier)
-        .then((tokens) => current.resolve(tokens))
-        .catch((err) => current.reject(err instanceof Error ? err : new Error(String(err))));
-    res.statusCode = 200;
-    res.setHeader('Content-Type', 'text/html');
-    res.end(HTML_SUCCESS);
+    try {
+        const tokens = await exchangeCodeForTokens({
+            code,
+            verifier: current.verifier,
+            redirectUri: current.redirectUri,
+        });
+        sendHtml({ res, status: 200, html: HTML_SUCCESS });
+        current.resolve(tokens);
+    }
+    catch (err) {
+        const failure = err instanceof Error ? err : new Error(String(err));
+        current.reject(failure);
+        sendHtml({ res, status: 400, html: htmlError(escapeHtml(failure.message)) });
+    }
 }
-async function startOAuthServer() {
-    if (oauthServer)
-        return;
-    oauthServer = createServer(handleOAuthRequest);
-    await new Promise((resolve, reject) => {
-        oauthServer?.once('error', reject);
-        oauthServer?.listen(OAUTH_PORT, '127.0.0.1', () => resolve());
+function listen(server, port) {
+    return new Promise((resolve, reject) => {
+        const onError = (err) => {
+            server.close();
+            reject(err);
+        };
+        server.once('error', onError);
+        server.listen(port, OAUTH_HOST, () => {
+            server.removeListener('error', onError);
+            resolve();
+        });
     });
 }
+// Listen on 127.0.0.1 only. The redirect host must stay localhost for the allow-list.
+async function startOAuthServer() {
+    if (oauthServer) {
+        const address = oauthServer.address();
+        if (address && typeof address === 'object')
+            return address.port;
+    }
+    const errors = [];
+    for (const port of OAUTH_PORTS) {
+        const server = createServer((req, res) => {
+            void handleOAuthRequest(req, res);
+        });
+        try {
+            await listen(server, port);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            errors.push(`${OAUTH_HOST}:${port} ${message}`);
+            continue;
+        }
+        oauthServer = server;
+        return port;
+    }
+    throw new Error(`Could not listen for the ChatGPT login callback. ${errors.join(' ')} Close Codex or another egaki login, then run egaki login --provider chatgpt again.`);
+}
 async function stopOAuthServer() {
-    if (!oauthServer)
-        return;
-    await new Promise((resolve) => oauthServer?.close(() => resolve()));
+    const server = oauthServer;
     oauthServer = undefined;
+    if (!server)
+        return;
+    await new Promise((resolve) => server.close(() => resolve()));
 }
-function waitForOAuthCallback(verifier, state) {
+function waitForOAuthCallback({ verifier, state, redirectUri, }) {
     return new Promise((resolve, reject) => {
         const timeout = setTimeout(() => {
             if (pendingOAuth) {
                 pendingOAuth = undefined;
-                reject(new Error('OAuth callback timeout — authorization took too long'));
+                reject(new Error('OAuth callback timeout. The browser sign-in did not reach this process, so the previous ChatGPT login was not replaced.'));
             }
         }, 5 * 60 * 1000);
         pendingOAuth = {
             verifier,
             state,
+            redirectUri,
             resolve: (tokens) => {
                 clearTimeout(timeout);
                 resolve(tokens);
@@ -211,32 +347,52 @@ function waitForOAuthCallback(verifier, state) {
         };
     });
 }
-function openBrowser(url) {
-    const cmd = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'start' : 'xdg-open';
-    const child = spawn(cmd, [url], { detached: true, stdio: 'ignore' });
-    child.unref();
-}
 // ─── public API ──────────────────────────────────────────────────────────────
 /**
  * Run the full ChatGPT OAuth browser flow with clack UI.
  * Returns the ChatGptAuth object to be stored in credentials.json.
  */
-export async function chatGptOAuthLogin() {
-    await startOAuthServer();
+export async function chatGptOAuthLogin({ openInBackground = false, } = {}) {
+    const port = await startOAuthServer();
+    // The allow-list accepts localhost, not 127.0.0.1. The listener stays on IPv4.
+    const redirectUri = `http://localhost:${port}/auth/callback`;
     const pkce = await generatePKCE();
-    const state = generateState();
-    const authUrl = buildAuthorizeUrl(pkce, state);
-    const callbackPromise = waitForOAuthCallback(pkce.verifier, state);
+    const state = base64UrlEncode(crypto.getRandomValues(new Uint8Array(32)).buffer);
+    const authUrl = buildAuthorizeUrl({
+        challenge: pkce.challenge,
+        state,
+        redirectUri,
+    });
+    const callbackPromise = waitForOAuthCallback({
+        verifier: pkce.verifier,
+        state,
+        redirectUri,
+    });
     note(`Open this URL in your browser to sign in with your ChatGPT account:\n\n` +
         `  ${pc.cyan(pc.underline(authUrl))}\n\n` +
-        `${pc.dim(`Listening for callback on ${REDIRECT_URI}`)}`, 'ChatGPT OAuth');
-    openBrowser(authUrl);
+        `${pc.dim(`Listening for callback on ${redirectUri}`)}\n` +
+        `${pc.dim('The previous login stays saved until this command prints that the new login was saved.')}`, 'ChatGPT OAuth');
+    const opened = openUrlInBrowser(authUrl, {
+        allowNonInteractive: openInBackground,
+    });
+    if (openInBackground && !opened) {
+        const error = new Error('Could not open a browser for ChatGPT authorization');
+        pendingOAuth?.reject(error);
+        pendingOAuth = undefined;
+        await stopOAuthServer();
+        await callbackPromise;
+        throw error;
+    }
     const s = spinner();
     s.start('Waiting for authorization in browser...');
     let tokens;
     try {
         tokens = await callbackPromise;
     }
+    catch (err) {
+        s.stop('ChatGPT sign-in did not save new credentials');
+        throw err instanceof Error ? err : new Error(String(err));
+    }
     finally {
         await stopOAuthServer();
     }
@@ -255,30 +411,40 @@ export async function chatGptOAuthLogin() {
     log.success(`Signed in as ${pc.bold(label)}` + (plan ? ` (${pc.cyan(plan)} plan)` : ''));
     return auth;
 }
-/**
- * Refresh an expired ChatGPT access token using the refresh token.
- * Returns the updated auth object, or an Error if refresh fails.
- */
-export async function refreshChatGptToken(auth) {
+let refreshFlight;
+async function performChatGptTokenRefresh(auth) {
     try {
         const response = await fetch(`${ISSUER}/oauth/token`, {
             method: 'POST',
-            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-            body: new URLSearchParams({
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
                 grant_type: 'refresh_token',
                 refresh_token: auth.refresh,
                 client_id: CLIENT_ID,
-            }).toString(),
+            }),
         });
         if (!response.ok) {
-            return new Error(`Token refresh failed: ${response.status}`);
+            const body = await response.text().catch(() => '');
+            if (response.status === 401) {
+                return new Error(chatGptReLoginMessage({ status: response.status, body }));
+            }
+            return new Error(`Token refresh failed: ${response.status}${body ? ` ${body}` : ''}`);
         }
         const json = (await response.json());
+        if (!json.access_token) {
+            return new Error('ChatGPT token refresh did not return an access token. Run: egaki login --provider chatgpt');
+        }
+        const tokens = {
+            id_token: json.id_token,
+            access_token: json.access_token,
+            refresh_token: json.refresh_token ?? auth.refresh,
+            expires_in: json.expires_in,
+        };
         return {
             ...auth,
-            plan: extractPlanTypeFromTokens(json) ?? auth.plan,
-            access: json.access_token,
-            refresh: json.refresh_token ?? auth.refresh,
+            plan: extractPlanTypeFromTokens(tokens) ?? auth.plan,
+            access: tokens.access_token,
+            refresh: tokens.refresh_token,
             expires: Date.now() + (json.expires_in ?? 3600) * 1000,
         };
     }
@@ -286,6 +452,18 @@ export async function refreshChatGptToken(auth) {
         return err instanceof Error ? err : new Error(String(err));
     }
 }
+export function refreshChatGptToken(auth) {
+    if (refreshFlight?.source === auth.refresh)
+        return refreshFlight.result;
+    const result = performChatGptTokenRefresh(auth);
+    refreshFlight = { source: auth.refresh, result };
+    void result.then((value) => {
+        if (value instanceof Error && refreshFlight?.result === result) {
+            refreshFlight = undefined;
+        }
+    });
+    return result;
+}
 /**
  * Refresh the auth object if needed and return the full updated state.
  */

package/dist/cli/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/cli/cli.ts"],"names":[],"mappings":";AAgGA,QAAA,MAAM,GAAG,yBAAgB,CAAA;AA2yCzB,OAAO,EAAE,GAAG,EAAE,CAAA"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/cli/cli.ts"],"names":[],"mappings":";AAqGA,QAAA,MAAM,GAAG,yBAAgB,CAAA;AA46CzB,OAAO,EAAE,GAAG,EAAE,CAAA"}