impel-cli 0.7.0

package/src/codexSecurity.js

@@ -0,0 +1,184 @@
+import fs from "node:fs";
+import path from "node:path";
+
+const PRIVATE_ROOT_FILES = ["auth.json", "config.toml", "models.json"];
+const MANAGED_COMMENT = "# Impel security policy: keep gateway credentials out of shell state.";
+
+function lstatOrNull(target) {
+  try {
+    return fs.lstatSync(target);
+  } catch (error) {
+    if (error?.code === "ENOENT") return null;
+    throw error;
+  }
+}
+
+function escapeRegex(value) {
+  return String(value).replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+}
+
+function tableHeaderPattern(table) {
+  return new RegExp(`^\\s*\\[${escapeRegex(table)}\\]\\s*(?:#.*)?$`, "u");
+}
+
+function assignmentPattern(key) {
+  return new RegExp(`^(\\s*)${escapeRegex(key)}\\s*=.*$`, "u");
+}
+
+function upsertManagedBoolean(toml, table, key, value, configPath) {
+  const lines = String(toml || "").replace(/\r\n/gu, "\n").split("\n");
+  const headerPattern = tableHeaderPattern(table);
+  const headerIndices = lines.flatMap((line, index) => (headerPattern.test(line) ? [index] : []));
+  if (headerIndices.length > 1) {
+    throw new Error(`${configPath} contains duplicate [${table}] tables; resolve them before re-running.`);
+  }
+
+  const firstTable = lines.findIndex((line) => /^\s*\[/u.test(line));
+  const preambleEnd = firstTable === -1 ? lines.length : firstTable;
+  const dottedPattern = new RegExp(`^(\\s*)${escapeRegex(table)}\\.${escapeRegex(key)}\\s*=.*$`, "u");
+  const dottedIndices = lines
+    .slice(0, preambleEnd)
+    .flatMap((line, index) => (dottedPattern.test(line) ? [index] : []));
+  if (dottedIndices.length > 1 || (dottedIndices.length === 1 && headerIndices.length === 1)) {
+    throw new Error(`${configPath} defines ${table}.${key} more than once; resolve it before re-running.`);
+  }
+
+  if (dottedIndices.length === 1) {
+    const index = dottedIndices[0];
+    const indent = lines[index].match(dottedPattern)?.[1] || "";
+    lines[index] = `${indent}${table}.${key} = ${value}`;
+    return `${lines.join("\n").replace(/\s*$/u, "")}\n`;
+  }
+
+  if (headerIndices.length === 1) {
+    const header = headerIndices[0];
+    const nextTableOffset = lines.slice(header + 1).findIndex((line) => /^\s*\[/u.test(line));
+    const end = nextTableOffset === -1 ? lines.length : header + 1 + nextTableOffset;
+    const keyPattern = assignmentPattern(key);
+    const keyIndices = lines
+      .slice(header + 1, end)
+      .flatMap((line, index) => (keyPattern.test(line) ? [header + 1 + index] : []));
+    if (keyIndices.length > 1) {
+      throw new Error(`${configPath} defines ${key} more than once in [${table}].`);
+    }
+    if (keyIndices.length === 1) {
+      const index = keyIndices[0];
+      const indent = lines[index].match(keyPattern)?.[1] || "";
+      lines[index] = `${indent}${key} = ${value}`;
+    } else {
+      lines.splice(header + 1, 0, `${key} = ${value}`);
+    }
+    return `${lines.join("\n").replace(/\s*$/u, "")}\n`;
+  }
+
+  const inlineTablePattern = new RegExp(`^\\s*${escapeRegex(table)}\\s*=`, "u");
+  if (lines.slice(0, preambleEnd).some((line) => inlineTablePattern.test(line))) {
+    throw new Error(`${configPath} defines ${table} as an inline table; convert it to [${table}] before re-running.`);
+  }
+
+  const base = lines.join("\n").replace(/\s*$/u, "");
+  return `${base}${base ? "\n\n" : ""}${MANAGED_COMMENT}\n[${table}]\n${key} = ${value}\n`;
+}
+
+/**
+ * Disable Codex shell snapshots and keep its default KEY/SECRET/TOKEN filter
+ * enabled. Existing unrelated keys in either table are retained.
+ */
+export function hardenManagedCodexToml(toml, configPath = "managed Codex config") {
+  const withoutSnapshots = upsertManagedBoolean(toml, "features", "shell_snapshot", "false", configPath);
+  return upsertManagedBoolean(
+    withoutSnapshots,
+    "shell_environment_policy",
+    "ignore_default_excludes",
+    "false",
+    configPath,
+  );
+}
+
+function assertSafeManagedPath(target, expectedType) {
+  const stat = lstatOrNull(target);
+  if (!stat) return null;
+  if (stat.isSymbolicLink()) throw new Error(`${target} must not be a symbolic link.`);
+  if (expectedType === "directory" && !stat.isDirectory()) {
+    throw new Error(`${target} must be a directory.`);
+  }
+  if (expectedType === "file" && !stat.isFile()) {
+    throw new Error(`${target} must be a regular file.`);
+  }
+  return stat;
+}
+
+/**
+ * Remove all derived shell snapshots from an Impel-owned Codex home. Snapshot
+ * generation is disabled in config, so retaining any snapshot has no benefit
+ * and deleting the whole derived directory avoids reading a credential merely
+ * to decide whether the file contains one. Known credential/config files are
+ * owner-only. This function must never be called for the native ~/.codex home.
+ */
+export function secureManagedCodexHome(codexHome) {
+  const existing = assertSafeManagedPath(codexHome, "directory");
+  if (!existing) fs.mkdirSync(codexHome, { recursive: true, mode: 0o700 });
+  fs.chmodSync(codexHome, 0o700);
+
+  const snapshots = path.join(codexHome, "shell_snapshots");
+  const snapshotStat = assertSafeManagedPath(snapshots, "directory");
+  if (snapshotStat) fs.rmSync(snapshots, { recursive: true, force: true });
+  for (const fileName of PRIVATE_ROOT_FILES) {
+    const filePath = path.join(codexHome, fileName);
+    const stat = assertSafeManagedPath(filePath, "file");
+    if (!stat) continue;
+    fs.chmodSync(filePath, 0o600);
+  }
+}
+
+function secureExistingManagedHome(root, relativeParts, secured) {
+  let current = root;
+  for (const part of relativeParts) {
+    current = path.join(current, part);
+    const stat = lstatOrNull(current);
+    if (!stat) return;
+    if (stat.isSymbolicLink()) throw new Error(`${current} must not be a symbolic link.`);
+    if (!stat.isDirectory()) throw new Error(`${current} must be a directory.`);
+  }
+  secureManagedCodexHome(current);
+  secured.push(current);
+}
+
+function secureTenantHomes(root, suffix, secured) {
+  const tenants = path.join(root, "tenants");
+  const tenantRootStat = lstatOrNull(tenants);
+  if (!tenantRootStat) return;
+  if (tenantRootStat.isSymbolicLink()) throw new Error(`${tenants} must not be a symbolic link.`);
+  if (!tenantRootStat.isDirectory()) throw new Error(`${tenants} must be a directory.`);
+
+  for (const entry of fs.readdirSync(tenants, { withFileTypes: true })) {
+    const tenantRoot = path.join(tenants, entry.name);
+    if (entry.isSymbolicLink()) throw new Error(`${tenantRoot} must not be a symbolic link.`);
+    if (!entry.isDirectory()) continue;
+    secureExistingManagedHome(tenantRoot, suffix, secured);
+  }
+}
+
+/**
+ * Secure every Impel-owned Codex profile, including inactive tenants and the
+ * pre-tenancy legacy locations. This deliberately accepts only the two Impel
+ * profile roots; it never scans or modifies the native ~/.codex directory.
+ */
+export function secureAllManagedCodexHomes({ appsRoot = null, cliRoot = null } = {}) {
+  const secured = [];
+  if (appsRoot) {
+    const appsStat = assertSafeManagedPath(appsRoot, "directory");
+    if (appsStat) {
+      secureExistingManagedHome(appsRoot, ["chatgpt", "codex-home"], secured);
+      secureTenantHomes(appsRoot, ["chatgpt", "codex-home"], secured);
+    }
+  }
+  if (cliRoot) {
+    const cliStat = assertSafeManagedPath(cliRoot, "directory");
+    if (cliStat) {
+      secureExistingManagedHome(cliRoot, ["codex"], secured);
+      secureTenantHomes(cliRoot, ["codex"], secured);
+    }
+  }
+  return secured;
+}

package/src/codexSetup.js

@@ -0,0 +1,224 @@
+// Applies / reverts / detects the Impel-gateway config in ~/.codex/config.toml.
+//
+// Codex CLI supports a "command-backed" bearer token for custom
+// model_providers (a `[model_providers.<id>.auth]` table with `command` +
+// `args`), which Codex re-invokes on a timer and on auth retries. That's the
+// same contract as Claude Code's `apiKeyHelper`. Managed Codex configs invoke
+// this installation's Node + impel.js directly, which also works when the
+// public `impel` command is an npm .cmd shim on Windows. The PAT itself is
+// never written into config.toml or into ~/.codex/auth.json.
+//
+// Docs (fetched July 2026):
+//   https://developers.openai.com/codex/config-reference
+//   https://developers.openai.com/codex/config-advanced
+//   https://developers.openai.com/codex/auth
+//   https://developers.openai.com/codex/ide
+//
+// This file is NOT a general TOML parser/writer. Codex's config.toml can
+// contain arbitrary user tables (sandbox policy, MCP servers, other
+// providers, etc.) that we must never touch. Instead we do a narrow,
+// targeted merge:
+//   1. Find/replace a single root-level `model_provider = "..."` line
+//      (root-level = before the first `[table]` header). On revert we reset it
+//      to its backed-up prior value, or remove it so Codex uses its default.
+//   2. Insert our own `[model_providers.impel]` + `[model_providers.impel.auth]`
+//      tables inside clearly-marked comment fences, so applying is idempotent
+//      and reverting is an exact, targeted removal (find our own fenced block).
+//   3. Refuse to APPLY if a *foreign* (not ours) `[model_providers.impel*]`
+//      table already exists, rather than risk emitting duplicate TOML tables.
+
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+import { impelCliInvocation } from "./selfInvocation.js";
+
+export const CODEX_HOME = process.env.CODEX_HOME || path.join(os.homedir(), ".codex");
+export const CODEX_CONFIG_PATH = path.join(CODEX_HOME, "config.toml");
+
+export const PROVIDER_ID = "impel";
+
+// Genuine Codex CLI traffic has its own byte-preserving compatibility route.
+// With wire_api = "responses", Codex POSTs to `${base_url}/responses`, so this
+// base must stop immediately before that suffix. Do not point the CLI at the
+// separate `/v1/responses` SDK front door; the gateway may shape that body.
+export const CODEX_CLI_BASE_PATH = "/chatgpt_passthrough/backend-api/codex";
+export const impelCodexBaseUrl = (gatewayUrl) => `${gatewayUrl}${CODEX_CLI_BASE_PATH}`;
+
+const START_MARK = `# >>> impel-cli managed block (model_providers.${PROVIDER_ID}) >>>`;
+const END_MARK = `# <<< impel-cli managed block <<<`;
+
+const PROVIDER_LINE_RE = /^model_provider[ \t]*=[ \t]*"([^"]*)"[ \t]*$/m;
+
+function providerTablesBlock(gatewayUrl) {
+  const baseUrl = impelCodexBaseUrl(gatewayUrl);
+  const auth = impelCliInvocation(["token"]);
+  const mcp = impelCliInvocation(["mcp"]);
+  return [
+    START_MARK,
+    "# Generated by `impel use gateway codex`. Safe to re-run; do not hand-edit",
+    "# the lines between the markers above/below, they'll be overwritten.",
+    `[model_providers.${PROVIDER_ID}]`,
+    `name = "Impel Gateway"`,
+    `base_url = "${baseUrl}"`,
+    `wire_api = "responses"`,
+    "",
+    `[model_providers.${PROVIDER_ID}.auth]`,
+    `command = ${JSON.stringify(auth.command)}`,
+    `args = [${auth.args.map((argument) => JSON.stringify(argument)).join(", ")}]`,
+    `timeout_ms = 5000`,
+    `refresh_interval_ms = 300000`,
+    "",
+    `[mcp_servers.${PROVIDER_ID}]`,
+    `command = ${JSON.stringify(mcp.command)}`,
+    `args = [${mcp.args.map((argument) => JSON.stringify(argument)).join(", ")}]`,
+    END_MARK,
+  ].join("\n");
+}
+
+function readConfig() {
+  const exists = fs.existsSync(CODEX_CONFIG_PATH);
+  const text = exists ? fs.readFileSync(CODEX_CONFIG_PATH, "utf8") : "";
+  return { text, exists };
+}
+
+function writeConfig(text) {
+  fs.mkdirSync(CODEX_HOME, { recursive: true, mode: 0o700 });
+  fs.writeFileSync(CODEX_CONFIG_PATH, text, { mode: 0o600 });
+}
+
+/** Splits `text` into the root preamble (keys before the first [table] header) and the rest. */
+function splitPreamble(text) {
+  const match = text.match(/^\s*\[/m);
+  if (!match) return { preamble: text, rest: "" };
+  const idx = match.index;
+  return { preamble: text.slice(0, idx), rest: text.slice(idx) };
+}
+
+/** Removes a previously-written impel-cli managed block, wherever it lives in the file. */
+function stripManagedBlock(text) {
+  const startIdx = text.indexOf(START_MARK);
+  if (startIdx === -1) return text;
+  const endIdx = text.indexOf(END_MARK);
+  if (endIdx === -1) return text; // shouldn't happen; don't eat the rest of the file
+  return text.slice(0, startIdx) + text.slice(endIdx + END_MARK.length);
+}
+
+/** True if a `[model_providers.impel` table exists outside of our own managed markers. */
+function hasForeignImpelTable(textWithoutManagedBlock) {
+  return /^(\[model_providers\.impel(\.|\])|\[mcp_servers\.impel\])/m.test(
+    textWithoutManagedBlock
+  );
+}
+
+/** Reads the current root-level `model_provider` value, or null if unset. */
+function currentProviderValue(text) {
+  return text.match(PROVIDER_LINE_RE)?.[1] ?? null;
+}
+
+/** Collapse 3+ consecutive newlines to 2, strip leading blank lines, ensure trailing newline. */
+function tidy(text) {
+  let out = text.replace(/\n{3,}/g, "\n\n").replace(/^\n+/, "");
+  out = out.replace(/\s+$/, "");
+  return out ? out + "\n" : "";
+}
+
+/**
+ * Detects whether Codex is currently routed through Impel.
+ * Gateway mode = our managed block is present OR model_provider == "impel".
+ */
+export function detectCodexMode() {
+  const { text, exists } = readConfig();
+  const hasBlock = text.includes(START_MARK);
+  const providerIsImpel = currentProviderValue(text) === PROVIDER_ID;
+  return {
+    mode: hasBlock || providerIsImpel ? "gateway" : "account",
+    exists,
+    hasBlock,
+    providerIsImpel,
+    providerValue: currentProviderValue(text),
+  };
+}
+
+/**
+ * Turns ON gateway mode. Returns `priorProviderValue` (the model_provider value
+ * that was set before, or null) so the caller can back it up.
+ */
+export function applyCodexGateway(gatewayUrl) {
+  const { text: original } = readConfig();
+
+  const withoutOurBlock = stripManagedBlock(original);
+  if (hasForeignImpelTable(withoutOurBlock)) {
+    throw new Error(
+      `${CODEX_CONFIG_PATH} already has an Impel model-provider or MCP table that wasn't written by impel-cli. ` +
+        `Remove or rename it, then re-run.`
+    );
+  }
+
+  const { preamble, rest } = splitPreamble(withoutOurBlock);
+  const priorProviderValue = preamble.match(PROVIDER_LINE_RE)?.[1] ?? null;
+  const newProviderLine = `model_provider = "${PROVIDER_ID}"`;
+
+  let newPreamble;
+  if (priorProviderValue != null) {
+    newPreamble = preamble.replace(PROVIDER_LINE_RE, newProviderLine);
+  } else {
+    const trimmed = preamble.trimEnd();
+    newPreamble = trimmed ? `${trimmed}\n${newProviderLine}\n` : `${newProviderLine}\n`;
+  }
+
+  const block = providerTablesBlock(gatewayUrl);
+  const restTrimmed = rest.trim();
+  const newText = `${newPreamble.trimEnd()}\n\n${block}\n` + (restTrimmed ? `\n${restTrimmed}\n` : "");
+
+  writeConfig(newText);
+
+  return {
+    path: CODEX_CONFIG_PATH,
+    baseUrl: impelCodexBaseUrl(gatewayUrl),
+    priorProviderValue,
+  };
+}
+
+/**
+ * Turns OFF gateway mode: removes our marker-fenced block, and resets the
+ * root-level `model_provider` line — to the backed-up prior value if given,
+ * otherwise removes the line entirely so Codex falls back to its built-in
+ * default (`openai`). Only touches the line if it currently reads "impel";
+ * a value the user set by hand is left alone. All other tables are untouched.
+ */
+export function revertCodexGateway(backup = {}) {
+  const { text: original, exists } = readConfig();
+  if (!exists) {
+    return { path: CODEX_CONFIG_PATH, exists: false, changed: false };
+  }
+
+  const removedBlock = original.includes(START_MARK);
+  let text = stripManagedBlock(original);
+
+  let resetProvider = false;
+  let restoredProvider = null;
+  if (currentProviderValue(text) === PROVIDER_ID) {
+    resetProvider = true;
+    if (backup.model_provider != null) {
+      restoredProvider = backup.model_provider;
+      text = text.replace(PROVIDER_LINE_RE, `model_provider = "${backup.model_provider}"`);
+    } else {
+      // Remove the whole line (including its trailing newline).
+      text = text.replace(/^model_provider[ \t]*=[ \t]*"[^"]*"[ \t]*\n?/m, "");
+    }
+  }
+
+  const tidied = tidy(text);
+  const changed = tidied !== original;
+  if (changed) writeConfig(tidied);
+
+  return {
+    path: CODEX_CONFIG_PATH,
+    exists: true,
+    changed,
+    removedBlock,
+    resetProvider,
+    restoredProvider,
+  };
+}