nanocodex-vite 0.6.0

package/codex-auth-file.mjs

@@ -0,0 +1,158 @@
+import { createHash } from "node:crypto";
+import { open } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+
+const MAX_AUTH_FILE_BYTES = 64 * 1024;
+const DEFAULT_MINIMUM_TTL_MS = 5 * 60_000;
+
+export function defaultCodexAuthFile(environment = process.env) {
+  const explicit = nonEmpty(environment.NANOCODEX_AUTH_FILE)
+    ?? nonEmpty(environment.NANOCODEX_CODEX_AUTH_FILE);
+  if (explicit !== undefined) return resolve(explicit);
+  const codexHome = nonEmpty(environment.CODEX_HOME);
+  return resolve(codexHome === undefined ? join(homedir(), ".codex", "auth.json") : join(codexHome, "auth.json"));
+}
+
+export async function readCodexSubscription(path, options = {}) {
+  const authPath = resolve(path);
+  const minimumTtlMs = options.minimumTtlMs ?? DEFAULT_MINIMUM_TTL_MS;
+  if (!Number.isSafeInteger(minimumTtlMs) || minimumTtlMs < 0) {
+    throw new TypeError("minimumTtlMs must be a non-negative integer");
+  }
+
+  let file;
+  try {
+    file = await open(authPath, "r");
+  } catch (error) {
+    throw authError("missing", `cannot open Codex auth file: ${errorMessage(error)}`);
+  }
+
+  let encoded;
+  try {
+    const metadata = await file.stat();
+    if (!metadata.isFile()) throw new Error(`Codex auth path is not a file: ${authPath}`);
+    if (metadata.size > MAX_AUTH_FILE_BYTES) {
+      throw new Error(`Codex auth file exceeds ${MAX_AUTH_FILE_BYTES} bytes`);
+    }
+    if (process.platform !== "win32" && (metadata.mode & 0o077) !== 0) {
+      throw authError("insecure", "Codex auth file must not be accessible by group or other users");
+    }
+    encoded = await file.readFile();
+  } catch (error) {
+    if (error?.code === "NANOCODEX_AUTH_INSECURE") throw error;
+    throw authError("invalid", `cannot read Codex auth file: ${errorMessage(error)}`);
+  } finally {
+    await file.close();
+  }
+  if (encoded.byteLength > MAX_AUTH_FILE_BYTES) {
+    throw authError("invalid", `Codex auth file exceeds ${MAX_AUTH_FILE_BYTES} bytes`);
+  }
+
+  let parsed;
+  try {
+    parsed = JSON.parse(encoded.toString("utf8"));
+  } catch (error) {
+    throw authError("invalid", `cannot parse Codex auth file: ${errorMessage(error)}`);
+  }
+  if (!isRecord(parsed) || parsed.auth_mode !== "chatgpt" || !isRecord(parsed.tokens)) {
+    throw authError("missing", "Codex auth file does not contain a ChatGPT subscription login");
+  }
+
+  const accessToken = requiredString(parsed.tokens.access_token, "access token");
+  const idClaims = jwtPayload(optionalString(parsed.tokens.id_token));
+  const accessClaims = jwtPayload(accessToken);
+  const idAuth = nestedRecord(idClaims, "https://api.openai.com/auth");
+  const accessAuth = nestedRecord(accessClaims, "https://api.openai.com/auth");
+  const accountIds = [
+    optionalString(parsed.tokens.account_id),
+    optionalString(idAuth?.chatgpt_account_id),
+    optionalString(accessAuth?.chatgpt_account_id),
+  ].filter((value) => value !== undefined);
+  const accountId = accountIds[0];
+  if (accountId === undefined) {
+    throw authError("invalid", "Codex auth file is missing the ChatGPT account ID");
+  }
+  if (accountIds.some((candidate) => candidate !== accountId)) {
+    throw authError("invalid", "Codex auth file contains conflicting ChatGPT account IDs");
+  }
+
+  const expiresAt = typeof accessClaims?.exp === "number" && Number.isFinite(accessClaims.exp)
+    ? accessClaims.exp * 1_000
+    : undefined;
+  if (expiresAt === undefined || expiresAt <= Date.now() + minimumTtlMs) {
+    throw authError("expired", "Codex access token expires too soon; run `codex login` and retry");
+  }
+
+  const fedrampClaims = [
+    optionalBoolean(idAuth?.chatgpt_account_is_fedramp),
+    optionalBoolean(accessAuth?.chatgpt_account_is_fedramp),
+  ].filter((value) => value !== undefined);
+  if (fedrampClaims.some((candidate) => candidate !== fedrampClaims[0])) {
+    throw authError("invalid", "Codex auth file contains conflicting FedRAMP claims");
+  }
+
+  return Object.freeze({
+    accessToken,
+    accountId,
+    fedramp: fedrampClaims[0] ?? false,
+    expiresAt,
+    revision: createHash("sha256")
+      .update(accessToken)
+      .update("\0")
+      .update(accountId)
+      .digest("base64url"),
+  });
+}
+
+function jwtPayload(token) {
+  if (token === undefined) return undefined;
+  const encoded = token.split(".")[1];
+  if (!encoded) return undefined;
+  try {
+    const value = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
+    return isRecord(value) ? value : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function nestedRecord(value, key) {
+  const nested = value?.[key];
+  return isRecord(nested) ? nested : undefined;
+}
+
+function requiredString(value, name) {
+  const normalized = optionalString(value);
+  if (normalized === undefined) {
+    throw authError("invalid", `Codex auth file is missing the ${name}`);
+  }
+  return normalized;
+}
+
+function optionalString(value) {
+  return typeof value === "string" && value.trim() ? value : undefined;
+}
+
+function optionalBoolean(value) {
+  return typeof value === "boolean" ? value : undefined;
+}
+
+function nonEmpty(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function authError(kind, message) {
+  return Object.assign(new Error(message), {
+    code: `NANOCODEX_AUTH_${kind.toUpperCase()}`,
+    kind,
+  });
+}
+
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}

package/index.d.mts

@@ -0,0 +1,36 @@
+export type NanocodexChatGptViteOptions = Readonly<{
+  /** Defaults to NANOCODEX_AUTH_FILE, NANOCODEX_CODEX_AUTH_FILE, CODEX_HOME/auth.json, then ~/.codex/auth.json. */
+  authFile?: string | URL | undefined;
+  /** Same-origin host-managed WebSocket path. Defaults to /api/responses. */
+  responsesPath?: `/${string}` | undefined;
+}>;
+
+export type NanocodexDevApplication = Readonly<{
+  /** Development response headers applied to every request handled by this mount. */
+  headers?: Readonly<Record<string, string>> | undefined;
+  /** Non-root URL path where the application is served during development. */
+  path: `/${string}`;
+  /** Application root. Its Vite config and index.html remain owned by the application. */
+  root: string | URL;
+}>;
+
+export type NanocodexViteOptions = Readonly<{
+  /** Local ChatGPT subscription support is on by default; pass false to disable it. */
+  chatGpt?: NanocodexChatGptViteOptions | false | undefined;
+  /** Sibling Vite applications mounted into this development server. */
+  devApplications?: readonly NanocodexDevApplication[] | undefined;
+  /** Start the fixed local OAuth callback relay while serving. */
+  oauthRelay?: boolean | undefined;
+}>;
+
+export type NanocodexVitePlugin = Readonly<{
+  name: "nanocodex";
+  enforce: "pre";
+  resolveId(source: string, importer?: string): string | null;
+  config(config: unknown, environment: Readonly<{ command: "build" | "serve" }>): unknown | Promise<unknown>;
+  configureServer(server: unknown): void | Promise<void>;
+  closeBundle(): void | Promise<void>;
+}>;
+
+/** Complete local integration for an ordinary Vite browser application. */
+export function nanocodex(options?: NanocodexViteOptions): NanocodexVitePlugin;

package/index.mjs

@@ -0,0 +1,6 @@
+import { createNanocodexVitePlugin } from "./plugin.mjs";
+
+/** Browser compatibility plus a same-origin local ChatGPT endpoint for ordinary Vite apps. */
+export function nanocodex(options = {}) {
+  return createNanocodexVitePlugin(options, { target: "vite" });
+}

package/oauth-relay-server.mjs

@@ -0,0 +1,125 @@
+import { createServer } from "node:http";
+import { randomBytes } from "node:crypto";
+
+import {
+  LOCAL_OAUTH_RELAY_HMAC_KEY,
+  LOCAL_OAUTH_RELAY_HOST,
+  LOCAL_OAUTH_RELAY_ORIGIN,
+  LOCAL_OAUTH_RELAY_PORT,
+  localOAuthRelayCallbackRedirect,
+  localOAuthRelayChallengeProof,
+} from "./oauth-relay.mjs";
+
+export async function startLocalOAuthRelay() {
+  const server = createServer(async (request, response) => {
+    response.setHeader("cache-control", "no-store");
+    response.setHeader("referrer-policy", "no-referrer");
+    response.setHeader("x-content-type-options", "nosniff");
+    if (typeof request.url !== "string") return json(response, 404, { error: "not_found" });
+
+    let url;
+    try { url = new URL(request.url, LOCAL_OAUTH_RELAY_ORIGIN); } catch {
+      return json(response, 400, { error: "invalid_callback" });
+    }
+    if (request.method === "GET" && url.pathname === "/api/oauth-callback-relay") {
+      try {
+        return json(response, 200, {
+          service: "nanocodex-local-oauth-relay",
+          status: "ok",
+          version: 1,
+          proof: await localOAuthRelayChallengeProof(
+            url.searchParams.get("challenge"),
+            LOCAL_OAUTH_RELAY_HMAC_KEY,
+          ),
+        });
+      } catch {
+        return json(response, 400, { error: "invalid_challenge" });
+      }
+    }
+    if (request.method !== "GET") return json(response, 404, { error: "not_found" });
+
+    const destination = await localOAuthRelayCallbackRedirect(url, LOCAL_OAUTH_RELAY_HMAC_KEY);
+    if (!destination) return json(response, 400, { error: "invalid_callback" });
+    response.statusCode = 303;
+    response.setHeader("location", destination.href);
+    response.end();
+  });
+  server.on("clientError", (_error, socket) => {
+    socket.end("HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n");
+  });
+  try {
+    await listen(server);
+  } catch (error) {
+    if (error?.code === "EADDRINUSE" && await compatibleRelayIsRunning()) {
+      return followExistingRelay();
+    }
+    throw error;
+  }
+  return {
+    close: () => new Promise((resolve, reject) => {
+      server.close((error) => error ? reject(error) : resolve());
+    }),
+  };
+}
+
+function listen(server) {
+  return new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(LOCAL_OAUTH_RELAY_PORT, LOCAL_OAUTH_RELAY_HOST, () => {
+      server.off("error", reject);
+      resolve();
+    });
+  });
+}
+
+function followExistingRelay() {
+  let closed = false;
+  let acquiring = false;
+  let owned;
+  const timer = setInterval(async () => {
+    if (closed || acquiring || owned || await compatibleRelayIsRunning()) return;
+    acquiring = true;
+    try {
+      const relay = await startLocalOAuthRelay();
+      if (closed) await relay.close();
+      else owned = relay;
+    } catch {
+      // The fixed callback port changed hands while reacquiring; retry while Vite lives.
+    } finally {
+      acquiring = false;
+    }
+  }, 1_000);
+  timer.unref();
+  return {
+    async close() {
+      closed = true;
+      clearInterval(timer);
+      await owned?.close();
+    },
+  };
+}
+
+async function compatibleRelayIsRunning() {
+  const challenge = randomBytes(32).toString("base64url");
+  const expected = await localOAuthRelayChallengeProof(challenge, LOCAL_OAUTH_RELAY_HMAC_KEY);
+  try {
+    const response = await fetch(
+      `${LOCAL_OAUTH_RELAY_ORIGIN}/api/oauth-callback-relay?challenge=${challenge}`,
+      { signal: AbortSignal.timeout(1_000) },
+    );
+    const body = await response.json();
+    return response.ok
+      && body?.service === "nanocodex-local-oauth-relay"
+      && body.status === "ok"
+      && body.version === 1
+      && body.proof === expected;
+  } catch {
+    return false;
+  }
+}
+
+function json(response, status, body) {
+  response.statusCode = status;
+  response.setHeader("content-type", "application/json; charset=utf-8");
+  response.end(`${JSON.stringify(body)}\n`);
+}

package/oauth-relay.d.mts

@@ -0,0 +1,104 @@
+export type LocalOAuthProvider = "github" | "google" | "gmail" | "gdrive" | "slack" | "x";
+export type LocalOAuthFlow = "connect" | "managed";
+export type LocalConnectorFlow = LocalOAuthFlow;
+export type LocalConnectorAuthorization = Readonly<{
+  connector: LocalOAuthProvider;
+  redirectUri: string;
+  targetOrigin: string;
+  flow: LocalConnectorFlow;
+}>;
+export type LocalMcpAuthorization = Readonly<{
+  connectionId: string;
+  redirectUri: string;
+  targetOrigin: string;
+  flow: LocalConnectorFlow;
+}>;
+export type LocalOAuthRelayEnvelope = Readonly<{
+  v: 1;
+  p: LocalOAuthProvider;
+  o: string;
+  f: LocalOAuthFlow;
+  s: string;
+  i: number;
+  e: number;
+  n: string;
+}>;
+export type LocalMcpOAuthRelayEnvelope = Readonly<{
+  v: 1;
+  c: string;
+  o: string;
+  f: LocalOAuthFlow;
+  s: string;
+  i: number;
+  e: number;
+  n: string;
+}>;
+
+export const LOCAL_OAUTH_RELAY_HOST: "127.0.0.1";
+export const LOCAL_OAUTH_RELAY_PORT: 47891;
+export const LOCAL_OAUTH_RELAY_ORIGIN: "http://127.0.0.1:47891";
+export const LOCAL_OAUTH_RELAY_HMAC_KEY: "nanocodex-local-oauth-relay-hmac-v1-only";
+
+export function localOAuthRelayCallbackUrl(provider: string): string | undefined;
+export function localMcpOAuthRelayCallbackUrl(connectionId: string): string | undefined;
+export function isLocalNanocodexOrigin(value: string): boolean;
+export function localConnectorAuthorization(
+  targetOrigin: string,
+  connector: string,
+  flow: LocalConnectorFlow,
+): LocalConnectorAuthorization | undefined;
+export function localMcpAuthorization(
+  targetOrigin: string,
+  connectionId: string,
+  flow: LocalConnectorFlow,
+): LocalMcpAuthorization | undefined;
+export function wrapLocalConnectorAuthorizationState(
+  authorizationUrl: URL,
+  local: LocalConnectorAuthorization,
+  relayKey: string,
+): Promise<URL>;
+export function wrapLocalMcpAuthorizationState(
+  authorizationUrl: URL,
+  local: LocalMcpAuthorization,
+  relayKey: string,
+): Promise<URL>;
+export function signLocalOAuthRelayState(
+  value: Readonly<{
+    provider: string;
+    connectionId?: undefined;
+    targetOrigin: string;
+    flow: string;
+    state: string;
+  }>,
+  secret: string,
+  options?: Readonly<{ now?: number; nonce?: string }>,
+): Promise<string>;
+export function signLocalOAuthRelayState(
+  value: Readonly<{
+    provider?: undefined;
+    connectionId: string;
+    targetOrigin: string;
+    flow: string;
+    state: string;
+  }>,
+  secret: string,
+  options?: Readonly<{ now?: number; nonce?: string }>,
+): Promise<string>;
+export function verifyLocalOAuthRelayState(
+  value: unknown,
+  expectedProvider: string,
+  secret: string,
+  options?: Readonly<{ now?: number }>,
+): Promise<LocalOAuthRelayEnvelope | undefined>;
+export function verifyLocalMcpOAuthRelayState(
+  value: unknown,
+  expectedConnectionId: string,
+  secret: string,
+  options?: Readonly<{ now?: number }>,
+): Promise<LocalMcpOAuthRelayEnvelope | undefined>;
+export function localOAuthRelayCallbackRedirect(
+  url: URL,
+  secret: string,
+  options?: Readonly<{ now?: number }>,
+): Promise<URL | undefined>;
+export function localOAuthRelayChallengeProof(challenge: string, secret: string): Promise<string>;