jbai-cli 1.6.0 → 1.8.0

package/bin/jbai-proxy.js

@@ -0,0 +1,857 @@
+#!/usr/bin/env node
+
+/**
+ * jbai-proxy - Local reverse proxy for JetBrains AI Platform (Grazie)
+ *
+ * Runs a local HTTP server that transparently proxies OpenAI / Anthropic / Google
+ * API calls to Grazie, injecting the JWT authentication header automatically.
+ *
+ * This allows ANY tool that supports custom base URLs (Codex Desktop, Cursor,
+ * Continue, etc.) to work through JetBrains AI Platform without per-tool wrappers.
+ *
+ * Routes:
+ *   /openai/v1/*       → Grazie OpenAI endpoint   (explicit)
+ *   /anthropic/v1/*    → Grazie Anthropic endpoint (explicit)
+ *   /google/v1/*       → Grazie Google endpoint    (explicit)
+ *
+ *   /v1/chat/completions → OpenAI   (auto-detect)
+ *   /v1/completions      → OpenAI   (auto-detect)
+ *   /v1/responses        → OpenAI   (auto-detect)
+ *   /v1/embeddings       → OpenAI   (auto-detect)
+ *   /v1/models           → synthetic model list
+ *   /v1/messages         → Anthropic (auto-detect)
+ *
+ * Usage:
+ *   jbai proxy                     # start on default port 18080
+ *   jbai proxy --port 9090         # custom port
+ *   jbai proxy --daemon            # run in background
+ *   jbai proxy stop                # stop background daemon
+ *   jbai proxy status              # check if running
+ */
+
+const http = require('http');
+const https = require('https');
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const config = require('../lib/config');
+
+const DEFAULT_PORT = 18080;
+const PID_FILE = path.join(config.CONFIG_DIR, 'proxy.pid');
+const LOG_FILE = path.join(config.CONFIG_DIR, 'proxy.log');
+
+// ---------------------------------------------------------------------------
+// Token management - re-reads from disk on each request for hot-refresh
+// ---------------------------------------------------------------------------
+let cachedToken = null;
+let tokenMtime = 0;
+
+function getToken() {
+  try {
+    const stat = fs.statSync(config.TOKEN_FILE);
+    if (stat.mtimeMs !== tokenMtime) {
+      cachedToken = fs.readFileSync(config.TOKEN_FILE, 'utf-8').trim();
+      tokenMtime = stat.mtimeMs;
+    }
+  } catch {
+    cachedToken = null;
+  }
+  return cachedToken;
+}
+
+// ---------------------------------------------------------------------------
+// Route resolution
+// ---------------------------------------------------------------------------
+
+function resolveRoute(method, urlPath) {
+  const endpoints = config.getEndpoints();
+
+  // Explicit provider prefix routes
+  if (urlPath.startsWith('/openai/')) {
+    const rest = urlPath.slice('/openai'.length); // keeps /v1/...
+    return { target: endpoints.openai.replace(/\/v1$/, '') + rest, provider: 'openai' };
+  }
+  if (urlPath.startsWith('/anthropic/')) {
+    const rest = urlPath.slice('/anthropic'.length);
+    return { target: endpoints.anthropic.replace(/\/v1$/, '') + rest, provider: 'anthropic' };
+  }
+  if (urlPath.startsWith('/google/')) {
+    const rest = urlPath.slice('/google'.length);
+    return { target: endpoints.google + rest, provider: 'google' };
+  }
+
+  // Auto-detect routes based on standard SDK paths
+  // Anthropic SDK always calls /v1/messages
+  if (urlPath.startsWith('/v1/messages')) {
+    const rest = urlPath.slice('/v1'.length);
+    return { target: endpoints.anthropic + rest, provider: 'anthropic' };
+  }
+
+  // Everything else under /v1/* goes to OpenAI
+  if (urlPath.startsWith('/v1/')) {
+    // Special: /v1/models returns synthetic list
+    if (urlPath === '/v1/models') {
+      return { target: null, provider: 'models' };
+    }
+    const rest = urlPath.slice('/v1'.length);
+    return { target: endpoints.openai + rest, provider: 'openai' };
+  }
+
+  return null;
+}
+
+// ---------------------------------------------------------------------------
+// Synthetic /v1/models response
+// ---------------------------------------------------------------------------
+
+function buildModelsResponse() {
+  const models = [];
+  const now = Math.floor(Date.now() / 1000);
+  const seen = new Set();
+
+  for (const m of config.MODELS.openai.available) {
+    models.push({ id: m, object: 'model', created: now, owned_by: 'openai' });
+    seen.add(m);
+  }
+  // Include codex-only models (responses API only) that aren't already in the openai list
+  for (const m of config.MODELS.codex.available) {
+    if (!seen.has(m)) {
+      models.push({ id: m, object: 'model', created: now, owned_by: 'openai' });
+    }
+  }
+  for (const m of config.MODELS.claude.available) {
+    models.push({ id: m, object: 'model', created: now, owned_by: 'anthropic' });
+  }
+  for (const m of config.MODELS.gemini.available) {
+    models.push({ id: m, object: 'model', created: now, owned_by: 'google' });
+  }
+
+  return { object: 'list', data: models };
+}
+
+// Codex CLI model picker response (matches chatgpt.com/backend-api/codex/models format)
+function buildCodexModelsResponse() {
+  const descriptions = {
+    'gpt-5.3-codex-api-preview': 'Latest GPT-5.3 Codex model. Designed for long-running, detailed software engineering tasks.',
+    'gpt-5.2-codex': 'Latest frontier agentic coding model.',
+    'gpt-5.2-pro-2025-12-11': 'GPT-5.2 Pro for deep reasoning and complex tasks.',
+    'gpt-5.2-2025-12-11': 'Latest frontier model with improvements across knowledge, reasoning and coding.',
+    'gpt-5.2': 'Latest frontier model (alias).',
+    'gpt-5.1-codex-max': 'Codex-optimized flagship for deep and fast reasoning.',
+    'gpt-5.1-codex': 'Codex-optimized for software engineering tasks.',
+    'gpt-5.1-codex-mini': 'Optimized for codex. Cheaper, faster, but less capable.',
+    'gpt-5.1-2025-11-13': 'GPT-5.1 general-purpose model.',
+    'gpt-5-codex': 'GPT-5 Codex for agentic coding.',
+    'gpt-5-2025-08-07': 'GPT-5 general-purpose model.',
+    'o4-mini-2025-04-16': 'O4-mini reasoning model.',
+    'o3-2025-04-16': 'O3 reasoning model.',
+  };
+
+  const models = config.MODELS.codex.available.map((id, i) => ({
+    slug: id,
+    name: id,
+    description: descriptions[id] || id,
+    default_active: i === 0,
+  }));
+
+  return { models };
+}
+
+// ---------------------------------------------------------------------------
+// Proxy handler
+// ---------------------------------------------------------------------------
+
+function proxy(req, res) {
+  const startTime = Date.now();
+
+  // CORS preflight
+  if (req.method === 'OPTIONS') {
+    res.writeHead(204, {
+      'Access-Control-Allow-Origin': '*',
+      'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE, OPTIONS',
+      'Access-Control-Allow-Headers': '*',
+    });
+    res.end();
+    return;
+  }
+
+  // Parse URL (strip query string for routing, preserve for forwarding)
+  const [urlPath, query] = (req.url || '/').split('?');
+  const route = resolveRoute(req.method, urlPath);
+
+  if (!route) {
+    // Codex CLI model picker endpoint (overrides chatgpt.com/backend-api/codex/models)
+    if (urlPath === '/backend-api/codex/models') {
+      res.writeHead(200, {
+        'Content-Type': 'application/json',
+        'Access-Control-Allow-Origin': '*',
+      });
+      res.end(JSON.stringify(buildCodexModelsResponse()));
+      log(`[codex] GET /backend-api/codex/models → 200 (${Date.now() - startTime}ms)`);
+      return;
+    }
+
+    // Health / info endpoint
+    if (urlPath === '/' || urlPath === '/health') {
+      const token = getToken();
+      const info = {
+        service: 'jbai-proxy',
+        status: 'ok',
+        environment: config.getEnvironment(),
+        tokenPresent: !!token,
+        tokenExpired: token ? config.isTokenExpired(token) : null,
+        routes: {
+          openai: 'http://localhost:' + (res.socket?.localPort || DEFAULT_PORT) + '/openai/v1  OR  /v1/chat/completions',
+          anthropic: 'http://localhost:' + (res.socket?.localPort || DEFAULT_PORT) + '/anthropic/v1  OR  /v1/messages',
+          google: 'http://localhost:' + (res.socket?.localPort || DEFAULT_PORT) + '/google/v1',
+        }
+      };
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify(info, null, 2));
+      return;
+    }
+
+    res.writeHead(404, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: { message: `Unknown route: ${urlPath}`, type: 'invalid_request_error' } }));
+    return;
+  }
+
+  // Synthetic models endpoint
+  if (route.provider === 'models') {
+    res.writeHead(200, {
+      'Content-Type': 'application/json',
+      'Access-Control-Allow-Origin': '*',
+    });
+    res.end(JSON.stringify(buildModelsResponse()));
+    log(`[models] GET /v1/models → 200 (${Date.now() - startTime}ms)`);
+    return;
+  }
+
+  // Get token
+  const token = getToken();
+  if (!token) {
+    res.writeHead(401, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: { message: 'No Grazie token found. Run: jbai token set', type: 'authentication_error' } }));
+    return;
+  }
+
+  if (config.isTokenExpired(token)) {
+    res.writeHead(401, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: { message: 'Grazie token expired. Run: jbai token set', type: 'authentication_error' } }));
+    return;
+  }
+
+  // Read request body
+  const chunks = [];
+  req.on('data', (chunk) => chunks.push(chunk));
+  req.on('end', () => {
+    const body = Buffer.concat(chunks);
+    const targetUrl = new URL(route.target + (query ? '?' + query : ''));
+
+    // Build forwarded headers - pass through everything except host/authorization
+    const fwdHeaders = {};
+    for (const [key, value] of Object.entries(req.headers)) {
+      const lower = key.toLowerCase();
+      // Skip hop-by-hop and host headers
+      if (['host', 'connection', 'keep-alive', 'transfer-encoding', 'te', 'trailer', 'upgrade'].includes(lower)) continue;
+      // Skip authorization (we inject our own)
+      if (lower === 'authorization') continue;
+      fwdHeaders[key] = value;
+    }
+
+    // Inject Grazie auth
+    fwdHeaders['Grazie-Authenticate-JWT'] = token;
+
+    // Ensure content-length is correct for the body we have
+    if (body.length > 0) {
+      fwdHeaders['content-length'] = body.length;
+    }
+
+    const proxyReq = https.request({
+      hostname: targetUrl.hostname,
+      port: 443,
+      path: targetUrl.pathname + targetUrl.search,
+      method: req.method,
+      headers: fwdHeaders,
+    }, (proxyRes) => {
+      // Forward status and headers
+      const resHeaders = { ...proxyRes.headers, 'Access-Control-Allow-Origin': '*' };
+      res.writeHead(proxyRes.statusCode, resHeaders);
+
+      // Stream response (supports SSE streaming)
+      proxyRes.pipe(res);
+
+      proxyRes.on('end', () => {
+        const elapsed = Date.now() - startTime;
+        log(`[${route.provider}] ${req.method} ${urlPath} → ${proxyRes.statusCode} (${elapsed}ms)`);
+      });
+    });
+
+    proxyReq.on('error', (err) => {
+      log(`[${route.provider}] ${req.method} ${urlPath} → ERROR: ${err.message}`);
+      if (!res.headersSent) {
+        res.writeHead(502, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: { message: `Proxy error: ${err.message}`, type: 'proxy_error' } }));
+      }
+    });
+
+    if (body.length > 0) {
+      proxyReq.write(body);
+    }
+    proxyReq.end();
+  });
+}
+
+// ---------------------------------------------------------------------------
+// Logging
+// ---------------------------------------------------------------------------
+
+let logToFile = false;
+
+function log(msg) {
+  const line = `${new Date().toISOString()} ${msg}`;
+  if (logToFile) {
+    fs.appendFileSync(LOG_FILE, line + '\n');
+  } else {
+    console.log(line);
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Daemon management
+// ---------------------------------------------------------------------------
+
+function writePid(port) {
+  config.ensureConfigDir();
+  fs.writeFileSync(PID_FILE, JSON.stringify({ pid: process.pid, port }), { mode: 0o600 });
+}
+
+function readPid() {
+  try {
+    return JSON.parse(fs.readFileSync(PID_FILE, 'utf-8'));
+  } catch {
+    return null;
+  }
+}
+
+function removePid() {
+  try { fs.unlinkSync(PID_FILE); } catch {}
+}
+
+function isRunning(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function stopDaemon() {
+  const info = readPid();
+  if (!info) {
+    console.log('No proxy daemon found');
+    return;
+  }
+  if (!isRunning(info.pid)) {
+    console.log('Proxy daemon not running (stale pid file)');
+    removePid();
+    return;
+  }
+  try {
+    process.kill(info.pid, 'SIGTERM');
+    console.log(`Stopped proxy daemon (pid ${info.pid})`);
+    removePid();
+  } catch (e) {
+    console.log(`Failed to stop daemon: ${e.message}`);
+  }
+}
+
+function showStatus() {
+  const info = readPid();
+  if (!info) {
+    console.log('Proxy: not running');
+    return;
+  }
+  if (!isRunning(info.pid)) {
+    console.log('Proxy: not running (stale pid file)');
+    removePid();
+    return;
+  }
+  console.log(`Proxy: running on port ${info.port} (pid ${info.pid})`);
+  console.log(`  OpenAI:    http://localhost:${info.port}/openai/v1`);
+  console.log(`  Anthropic: http://localhost:${info.port}/anthropic/v1`);
+  console.log(`  Auto:      http://localhost:${info.port}/v1/...`);
+  console.log(`  Logs:      ${LOG_FILE}`);
+}
+
+function startDaemon(port) {
+  const { spawn } = require('child_process');
+  const child = spawn(process.execPath, [__filename, '--port', String(port), '--_daemon'], {
+    detached: true,
+    stdio: 'ignore',
+    env: { ...process.env }
+  });
+  child.unref();
+  // Give it a moment to start
+  setTimeout(() => {
+    const info = readPid();
+    if (info && isRunning(info.pid)) {
+      console.log(`Proxy daemon started on port ${port} (pid ${info.pid})`);
+      console.log('');
+      printUsage(port);
+    } else {
+      console.log('Failed to start daemon. Check logs: ' + LOG_FILE);
+    }
+  }, 500);
+}
+
+// ---------------------------------------------------------------------------
+// macOS launchd service
+// ---------------------------------------------------------------------------
+
+const LAUNCHD_LABEL = 'com.jetbrains.jbai-proxy';
+
+function getLaunchdPlistPath() {
+  return path.join(os.homedir(), 'Library', 'LaunchAgents', `${LAUNCHD_LABEL}.plist`);
+}
+
+function installService(port) {
+  if (process.platform !== 'darwin') {
+    console.log('Auto-start service is only supported on macOS.');
+    console.log('On Linux, create a systemd user service manually.');
+    return;
+  }
+
+  const nodePath = process.execPath;
+  const proxyPath = path.resolve(__filename);
+  const home = os.homedir();
+  const plistPath = getLaunchdPlistPath();
+
+  const plist = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>${LAUNCHD_LABEL}</string>
+    <key>ProgramArguments</key>
+    <array>
+        <string>${nodePath}</string>
+        <string>${proxyPath}</string>
+        <string>--port</string>
+        <string>${port}</string>
+        <string>--_daemon</string>
+    </array>
+    <key>RunAtLoad</key>
+    <true/>
+    <key>KeepAlive</key>
+    <true/>
+    <key>StandardOutPath</key>
+    <string>${home}/.jbai/proxy.log</string>
+    <key>StandardErrorPath</key>
+    <string>${home}/.jbai/proxy.log</string>
+</dict>
+</plist>`;
+
+  const launchAgentsDir = path.join(home, 'Library', 'LaunchAgents');
+  if (!fs.existsSync(launchAgentsDir)) {
+    fs.mkdirSync(launchAgentsDir, { recursive: true });
+  }
+
+  fs.writeFileSync(plistPath, plist);
+  console.log(`Written: ${plistPath}`);
+
+  // Load the service
+  const { execSync } = require('child_process');
+  try {
+    // Unload first in case it's already loaded
+    try { execSync(`launchctl unload "${plistPath}" 2>/dev/null`); } catch {}
+    execSync(`launchctl load "${plistPath}"`);
+    console.log(`Service loaded and started on port ${port}`);
+    console.log('');
+    console.log('The proxy will now auto-start on login.');
+    console.log(`  Logs:    ${home}/.jbai/proxy.log`);
+    console.log(`  Remove:  jbai proxy uninstall-service`);
+    console.log('');
+    printUsage(port);
+  } catch (e) {
+    console.log(`Written plist but failed to load: ${e.message}`);
+    console.log(`Try: launchctl load "${plistPath}"`);
+  }
+}
+
+function uninstallService() {
+  if (process.platform !== 'darwin') {
+    console.log('Auto-start service is only supported on macOS.');
+    return;
+  }
+
+  const plistPath = getLaunchdPlistPath();
+  if (!fs.existsSync(plistPath)) {
+    console.log('No launchd service installed.');
+    return;
+  }
+
+  const { execSync } = require('child_process');
+  try {
+    execSync(`launchctl unload "${plistPath}"`);
+  } catch {}
+  fs.unlinkSync(plistPath);
+  console.log('Service uninstalled. Proxy will no longer auto-start.');
+}
+
+// ---------------------------------------------------------------------------
+// One-liner setup: proxy + codex + shell env
+// ---------------------------------------------------------------------------
+
+function setup(port) {
+  console.log('Setting up jbai-proxy...\n');
+
+  // 1. Check token
+  const token = config.getToken();
+  if (!token) {
+    console.log('No token found. Let\'s set one up first.\n');
+    console.log('  1. Go to https://platform.jetbrains.ai/ (or staging: https://platform.stgn.jetbrains.ai/)');
+    console.log('  2. Click Profile → "Copy Developer Token"');
+    console.log('  3. Run: jbai token set\n');
+    console.log('Then re-run: jbai proxy setup');
+    process.exit(1);
+  }
+
+  if (config.isTokenExpired(token)) {
+    console.log('Your token is expired. Run: jbai token set');
+    console.log('Then re-run: jbai proxy setup');
+    process.exit(1);
+  }
+
+  console.log(`Token: valid`);
+  console.log(`Environment: ${config.getEnvironment()}\n`);
+
+  let steps = 0;
+
+  // 2. Configure Codex Desktop (config.toml)
+  steps += configureCodexDesktop(port);
+
+  // 3. Add JBAI_PROXY_KEY to shell rc
+  steps += configureShellEnv();
+
+  // 4. Install launchd service (macOS) or start daemon
+  steps += configureAutoStart(port);
+
+  // 5. Verify proxy is running
+  console.log('');
+  verifyProxy(port);
+
+  console.log(`\n--- Setup complete (${steps} changes) ---\n`);
+  printUsage(port);
+
+  console.log(`Cursor (manual step):
+  Open Cursor → Settings → Models → enable "Override OpenAI Base URL"
+    Base URL:  http://localhost:${port}/openai/v1
+    API Key:   placeholder
+`);
+}
+
+function configureCodexDesktop(port) {
+  const codexDir = path.join(os.homedir(), '.codex');
+  const codexConfig = path.join(codexDir, 'config.toml');
+  let changed = 0;
+
+  if (!fs.existsSync(codexDir)) {
+    fs.mkdirSync(codexDir, { recursive: true });
+  }
+
+  let content = '';
+  if (fs.existsSync(codexConfig)) {
+    content = fs.readFileSync(codexConfig, 'utf-8');
+  }
+
+  // Add jbai-proxy provider if missing
+  if (!content.includes('[model_providers.jbai-proxy]')) {
+    const providerBlock = `
+# JetBrains AI via local proxy (for Codex Desktop)
+[model_providers.jbai-proxy]
+name = "JetBrains AI (Proxy)"
+base_url = "http://localhost:${port}/openai/v1"
+env_key = "JBAI_PROXY_KEY"
+wire_api = "responses"
+`;
+    fs.appendFileSync(codexConfig, providerBlock);
+    console.log('Codex Desktop: added jbai-proxy provider to ~/.codex/config.toml');
+    changed++;
+  } else {
+    console.log('Codex Desktop: jbai-proxy provider already configured');
+  }
+
+  // Set model_provider = "jbai-proxy" if not already set
+  if (content.includes('model_provider')) {
+    if (!content.includes('model_provider = "jbai-proxy"')) {
+      // Replace existing model_provider line
+      const updated = content.replace(/^model_provider\s*=\s*"[^"]*"/m, 'model_provider = "jbai-proxy"');
+      fs.writeFileSync(codexConfig, updated);
+      console.log('Codex Desktop: switched model_provider to jbai-proxy');
+      changed++;
+    } else {
+      console.log('Codex Desktop: already using jbai-proxy provider');
+    }
+  } else {
+    // Add model_provider after model = line, or at top
+    if (content.includes('model =')) {
+      const updated = content.replace(/^(model\s*=\s*"[^"]*")/m, '$1\nmodel_provider = "jbai-proxy"');
+      fs.writeFileSync(codexConfig, updated);
+    } else {
+      const updated = 'model_provider = "jbai-proxy"\n' + content;
+      fs.writeFileSync(codexConfig, updated);
+    }
+    console.log('Codex Desktop: set model_provider = "jbai-proxy"');
+    changed++;
+  }
+
+  return changed;
+}
+
+function configureShellEnv() {
+  const home = os.homedir();
+  // Detect shell rc file
+  const shell = process.env.SHELL || '/bin/zsh';
+  let rcFile;
+  if (shell.includes('zsh')) {
+    rcFile = path.join(home, '.zshrc');
+  } else if (shell.includes('bash')) {
+    // macOS uses .bash_profile, Linux uses .bashrc
+    const profile = path.join(home, '.bash_profile');
+    const bashrc = path.join(home, '.bashrc');
+    rcFile = fs.existsSync(profile) ? profile : bashrc;
+  } else {
+    rcFile = path.join(home, '.profile');
+  }
+
+  if (!fs.existsSync(rcFile)) {
+    fs.writeFileSync(rcFile, '');
+  }
+
+  const rcContent = fs.readFileSync(rcFile, 'utf-8');
+  if (rcContent.includes('JBAI_PROXY_KEY')) {
+    console.log(`Shell: JBAI_PROXY_KEY already in ${path.basename(rcFile)}`);
+    return 0;
+  }
+
+  const envLine = '\n# jbai-proxy: placeholder key for Codex Desktop / Cursor\nexport JBAI_PROXY_KEY="placeholder"\n';
+  fs.appendFileSync(rcFile, envLine);
+  console.log(`Shell: added JBAI_PROXY_KEY to ~/${path.basename(rcFile)}`);
+
+  // Also set it in current process for immediate use
+  process.env.JBAI_PROXY_KEY = 'placeholder';
+  return 1;
+}
+
+function configureAutoStart(port) {
+  if (process.platform === 'darwin') {
+    const plistPath = getLaunchdPlistPath();
+    if (fs.existsSync(plistPath)) {
+      // Check if proxy is already running
+      const info = readPid();
+      if (info && isRunning(info.pid)) {
+        console.log(`Proxy: already running on port ${info.port} (pid ${info.pid})`);
+        return 0;
+      }
+    }
+    // Install service (starts proxy + auto-start on login)
+    installService(port);
+    return 1;
+  } else {
+    // Non-macOS: just start daemon
+    startDaemon(port);
+    return 1;
+  }
+}
+
+function verifyProxy(port) {
+  const http = require('http');
+  const req = http.get(`http://127.0.0.1:${port}/health`, { timeout: 2000 }, (res) => {
+    let body = '';
+    res.on('data', chunk => body += chunk);
+    res.on('end', () => {
+      try {
+        const info = JSON.parse(body);
+        if (info.status === 'ok' && info.tokenPresent) {
+          console.log(`Proxy: running on port ${port}`);
+        } else {
+          console.log(`Proxy: running but token issue — ${JSON.stringify(info)}`);
+        }
+      } catch {
+        console.log(`Proxy: running on port ${port} (health check returned non-JSON)`);
+      }
+    });
+  });
+  req.on('error', () => {
+    console.log('Proxy: not responding yet (may need a moment to start)');
+  });
+}
+
+// ---------------------------------------------------------------------------
+// Usage instructions
+// ---------------------------------------------------------------------------
+
+function printUsage(port) {
+  console.log(`Configure your tools to use these base URLs:
+
+  OpenAI tools (Codex Desktop, Cursor, etc.):
+    OPENAI_BASE_URL=http://localhost:${port}/openai/v1
+    OPENAI_API_KEY=placeholder
+
+  Anthropic tools (Claude Desktop, etc.):
+    ANTHROPIC_BASE_URL=http://localhost:${port}/anthropic
+    ANTHROPIC_API_KEY=placeholder
+
+  Auto-detect mode (works for most tools):
+    Base URL: http://localhost:${port}/v1
+    API Key:  placeholder
+
+  The API key can be any non-empty string — auth is handled by your Grazie JWT.
+`);
+}
+
+// ---------------------------------------------------------------------------
+// CLI
+// ---------------------------------------------------------------------------
+
+function parseProxyArgs(argv) {
+  const opts = { port: DEFAULT_PORT, daemon: false, _daemon: false };
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === '--port' || arg === '-p') {
+      opts.port = parseInt(argv[++i], 10) || DEFAULT_PORT;
+    } else if (arg === '--daemon' || arg === '-d') {
+      opts.daemon = true;
+    } else if (arg === '--_daemon') {
+      opts._daemon = true;
+    } else if (arg === 'stop') {
+      opts.stop = true;
+    } else if (arg === 'status') {
+      opts.status = true;
+    } else if (arg === 'setup') {
+      opts.setup = true;
+    } else if (arg === 'install-service') {
+      opts.installService = true;
+    } else if (arg === 'uninstall-service') {
+      opts.uninstallService = true;
+    } else if (arg === 'help' || arg === '--help' || arg === '-h') {
+      opts.help = true;
+    }
+  }
+  return opts;
+}
+
+const PROXY_HELP = `
+jbai proxy - Local reverse proxy for JetBrains AI Platform
+
+USAGE:
+  jbai proxy setup             One-liner: configure everything + start proxy
+  jbai proxy                   Start proxy (foreground, port ${DEFAULT_PORT})
+  jbai proxy --port 9090       Start on custom port
+  jbai proxy --daemon          Start in background
+  jbai proxy stop              Stop background daemon
+  jbai proxy status            Check proxy status
+  jbai proxy install-service   Auto-start on login (macOS launchd)
+  jbai proxy uninstall-service Remove auto-start
+
+ROUTES:
+  /openai/v1/*                 → Grazie OpenAI endpoint
+  /anthropic/v1/*              → Grazie Anthropic endpoint
+  /google/v1/*                 → Grazie Google endpoint
+  /v1/chat/completions         → OpenAI (auto)
+  /v1/responses                → OpenAI (auto)
+  /v1/messages                 → Anthropic (auto)
+  /v1/models                   → Synthetic model list
+  /health                      → Proxy status
+
+TOOL SETUP:
+  Codex Desktop:   OPENAI_BASE_URL=http://localhost:${DEFAULT_PORT}/openai/v1
+  Cursor:          Set base URL to http://localhost:${DEFAULT_PORT}/openai/v1
+  Claude tools:    ANTHROPIC_BASE_URL=http://localhost:${DEFAULT_PORT}/anthropic
+  API Key:         Use any non-empty string (e.g. "placeholder")
+`;
+
+// ---------------------------------------------------------------------------
+// Main
+// ---------------------------------------------------------------------------
+
+function main() {
+  // When invoked directly (not via jbai.js), parse from argv[2]
+  // When invoked via jbai.js, args are passed from the caller
+  const args = process.argv.slice(2);
+  const opts = parseProxyArgs(args);
+
+  if (opts.help) {
+    console.log(PROXY_HELP);
+    return;
+  }
+
+  if (opts.stop) {
+    stopDaemon();
+    return;
+  }
+
+  if (opts.status) {
+    showStatus();
+    return;
+  }
+
+  if (opts.setup) {
+    setup(opts.port);
+    return;
+  }
+
+  if (opts.installService) {
+    installService(opts.port);
+    return;
+  }
+
+  if (opts.uninstallService) {
+    uninstallService();
+    return;
+  }
+
+  if (opts.daemon && !opts._daemon) {
+    startDaemon(opts.port);
+    return;
+  }
+
+  // Actual server startup
+  if (opts._daemon) {
+    logToFile = true;
+  }
+
+  const server = http.createServer(proxy);
+
+  server.listen(opts.port, '127.0.0.1', () => {
+    writePid(opts.port);
+    log(`jbai-proxy listening on http://127.0.0.1:${opts.port}`);
+    log(`Environment: ${config.getEnvironment()}`);
+    log(`Token file: ${config.TOKEN_FILE}`);
+
+    if (!opts._daemon) {
+      console.log(`\njbai-proxy running on http://localhost:${opts.port}\n`);
+      printUsage(opts.port);
+      console.log('Press Ctrl+C to stop.\n');
+    }
+  });
+
+  // Graceful shutdown
+  const shutdown = () => {
+    log('Shutting down...');
+    removePid();
+    server.close(() => process.exit(0));
+    setTimeout(() => process.exit(0), 2000);
+  };
+  process.on('SIGTERM', shutdown);
+  process.on('SIGINT', shutdown);
+}
+
+// Allow both direct execution and require() from jbai.js
+if (require.main === module) {
+  main();
+} else {
+  module.exports = { main, parseProxyArgs, PROXY_HELP, stopDaemon, showStatus, startDaemon, DEFAULT_PORT };
+}