openai-oauth 2.0.0-beta.3 → 2.0.0-beta.4

package/README.md

@@ -50,10 +50,12 @@ Common flags:
 | Host binding | `--host` | `127.0.0.1` |
 | Port | `--port` | `10531` |
 | Model allowlist | `--models` | Account-specific Codex models discovered from ChatGPT |
-| Auth file path | `--oauth-file` | `$CHATGPT_LOCAL_HOME/auth.json`, `$CODEX_HOME/auth.json`, `~/.chatgpt-local/auth.json`, or `~/.codex/auth.json` |
+| Auth file path | `--oauth-file` | `$CODEX_HOME/auth.json` or `~/.codex/auth.json` |
 | Open browser | `--open` / `--no-open` | `--open` |
 | Login timeout | `--login-timeout-ms` | `300000` |
 
+Binding `--host` beyond loopback exposes the proxy to your network. Anyone who can reach that port can make requests with your ChatGPT account.
+
 Login listens on loopback and uses `http://localhost:1455/auth/callback`, the local callback URL accepted by OpenAI OAuth.
 
 The CLI resolves the latest published Codex client version automatically. Advanced flags also exist for overriding it, the upstream Codex base URL, OAuth client id, and OAuth token URL.

package/dist/{chunk-KROVQ42X.js → chunk-INHW7GRB.js}

@@ -3,7 +3,9 @@ import { createServer } from "http";
 import {
   createOpenAIOAuth
 } from "@openai-oauth/ai-sdk";
-import { createCodexOAuthClient } from "@openai-oauth/core";
+import {
+  createOpenAIOAuthTransport
+} from "@openai-oauth/core";
 import { openaiCredentials } from "@openai-oauth/local";
 
 // src/chat-completions.ts
@@ -25,11 +27,6 @@ var sseHeaders = {
   connection: "keep-alive",
   "x-accel-buffering": "no"
 };
-var corsHeaders = {
-  "access-control-allow-origin": "*",
-  "access-control-allow-methods": "GET,POST,OPTIONS",
-  "access-control-allow-headers": "authorization,content-type"
-};
 var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var isJsonValue = (value) => {
   if (value == null || typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
@@ -46,8 +43,7 @@ var isJsonValue = (value) => {
 var toJsonResponse = (body, status = 200) => new Response(JSON.stringify(body), {
   status,
   headers: {
-    ...jsonHeaders,
-    ...corsHeaders
+    ...jsonHeaders
   }
 });
 var toErrorResponse = (message, status = 400, type = "invalid_request_error") => toJsonResponse(
@@ -97,9 +93,6 @@ var copyUpstreamResponse = (response) => {
   const headers = new Headers(response.headers);
   headers.delete("content-encoding");
   headers.delete("content-length");
-  for (const [key, value] of Object.entries(corsHeaders)) {
-    headers.set(key, value);
-  }
   if (!headers.has("content-type")) {
     headers.set("content-type", "application/json; charset=utf-8");
   }
@@ -584,10 +577,7 @@ var streamChatCompletions = async (request, provider, logContext) => {
   });
   return new Response(stream, {
     status: 200,
-    headers: {
-      ...sseHeaders,
-      ...corsHeaders
-    }
+    headers: sseHeaders
   });
 };
 
@@ -719,11 +709,8 @@ var handleImageEditRequest = async (request, client) => {
 };
 
 // src/models.ts
-var MODELS_CACHE_TTL_MS = 5 * 60 * 1e3;
-var IMAGE_MODEL_ID = "gpt-image-2";
 var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var uniqueStrings = (values) => [...new Set(values)];
-var withImageModel = (models) => uniqueStrings([...models, IMAGE_MODEL_ID]);
 var modelListError = (bodyText) => {
   try {
     const parsed = JSON.parse(bodyText);
@@ -755,41 +742,16 @@ var readModelList = async (client) => {
   if (models.length === 0) {
     throw new Error("Codex returned an empty models list.");
   }
-  return withImageModel(models);
+  return models;
 };
 var resolveOpenAIOAuthModels = async (client, configuredModels) => Array.isArray(configuredModels) && configuredModels.length > 0 ? uniqueStrings(configuredModels) : readModelList(client);
-var createModelResolver = (client, configuredModels) => {
-  let cachedModels;
-  let cacheExpiresAt = 0;
-  let inflight;
-  return async () => {
-    const now = Date.now();
-    if (cachedModels && now < cacheExpiresAt) {
-      return [...cachedModels];
-    }
-    if (inflight) {
-      return [...await inflight];
-    }
-    inflight = resolveOpenAIOAuthModels(client, configuredModels).then((models) => {
-      cachedModels = models;
-      cacheExpiresAt = Date.now() + MODELS_CACHE_TTL_MS;
-      inflight = void 0;
-      return models;
-    }).catch((error) => {
-      inflight = void 0;
-      throw error;
-    });
-    return [...await inflight];
-  };
-};
+var createModelResolver = (client, configuredModels) => () => resolveOpenAIOAuthModels(client, configuredModels);
 
 // src/responses.ts
-import {
-  collectCompletedResponseFromSse,
-  normalizeCodexResponsesBody,
-  usesServerReplayState
-} from "@openai-oauth/core";
-var handleResponsesRequest = async (request, settings, client) => {
+var usesServerReplayState = (body) => typeof body.previous_response_id === "string" || Array.isArray(body.input) && body.input.some(
+  (item) => isRecord(item) && item.type === "item_reference" && typeof item.id === "string"
+);
+var handleResponsesRequest = async (request, client) => {
   const body = await request.json();
   if (!isRecord(body)) {
     return toErrorResponse("Request body must be a JSON object.");
@@ -799,45 +761,19 @@ var handleResponsesRequest = async (request, settings, client) => {
       "Stateless Codex responses endpoint does not support `previous_response_id` or `item_reference`. Replay the full conversation history in `input` on each request."
     );
   }
-  const wantsStream = body.stream === true;
   const upstream = await client.request("/responses", {
     method: "POST",
     headers: {
       "Content-Type": "application/json"
     },
-    body: JSON.stringify(
-      normalizeCodexResponsesBody(body, {
-        forceStream: true,
-        instructions: settings.instructions
-      })
-    )
+    body: JSON.stringify(body),
+    signal: request.signal
   });
-  if (!upstream.ok) {
-    return copyUpstreamResponse(upstream);
-  }
-  if (wantsStream) {
-    return new Response(upstream.body, {
-      status: upstream.status,
-      headers: {
-        ...sseHeaders,
-        ...corsHeaders
-      }
-    });
-  }
-  const completed = await collectCompletedResponseFromSse(
-    upstream.body ?? new ReadableStream()
-  );
-  return toJsonResponse(completed);
+  return copyUpstreamResponse(upstream);
 };
 
 // src/server.ts
-var handleRoutes = async (request, settings, provider, client, resolveModels, requestLogger) => {
-  if (request.method === "OPTIONS") {
-    return new Response(null, {
-      status: 204,
-      headers: corsHeaders
-    });
-  }
+var handleRoutes = async (request, provider, client, resolveModels, requestLogger) => {
   const url = new URL(request.url);
   if (request.method === "GET" && url.pathname === "/health") {
     return toJsonResponse({
@@ -866,7 +802,7 @@ var handleRoutes = async (request, settings, provider, client, resolveModels, re
     }
   }
   if (request.method === "POST" && url.pathname === "/v1/responses") {
-    return handleResponsesRequest(request, settings, client);
+    return handleResponsesRequest(request, client);
   }
   if (request.method === "POST" && url.pathname === "/v1/chat/completions") {
     return handleChatCompletionsRequest(request, provider, requestLogger);
@@ -879,22 +815,21 @@ var handleRoutes = async (request, settings, provider, client, resolveModels, re
   }
   return toErrorResponse("Route not found.", 404, "not_found_error");
 };
-var createOpenAIOAuthFetchHandler = (settings = {}) => {
+var createOpenAIOAuthRuntime = (settings = {}) => {
   const auth = openaiCredentials(settings);
   const sharedSettings = {
     ...settings,
     auth: () => auth.getSession(),
     responsesState: false
   };
-  const client = createCodexOAuthClient(sharedSettings);
-  const provider = createOpenAIOAuth(auth);
+  const client = createOpenAIOAuthTransport(sharedSettings);
+  const provider = createOpenAIOAuth(client);
   const resolveModels = createModelResolver(client, settings.models);
   const requestLogger = createRequestLogger(settings);
-  return async (request) => {
+  const handler = async (request) => {
     try {
       return await handleRoutes(
         request,
-        settings,
         provider,
         client,
         resolveModels,
@@ -908,11 +843,15 @@ var createOpenAIOAuthFetchHandler = (settings = {}) => {
       );
     }
   };
+  return { handler, resolveModels };
 };
+var createOpenAIOAuthFetchHandler = (settings = {}) => createOpenAIOAuthRuntime(settings).handler;
 var startOpenAIOAuthServer = async (settings = {}) => {
   const host = settings.host ?? DEFAULT_HOST;
   const port = settings.port ?? DEFAULT_PORT;
-  const handler = createOpenAIOAuthFetchHandler(settings);
+  const runtime = createOpenAIOAuthRuntime(settings);
+  const models = await runtime.resolveModels();
+  const handler = runtime.handler;
   const server = createServer(async (req, res) => {
     try {
       const request = await toWebRequest(req, { host, port });
@@ -940,6 +879,7 @@ var startOpenAIOAuthServer = async (settings = {}) => {
     host: address.host,
     port: address.port,
     url: `http://${address.host}:${address.port}/v1`,
+    models,
     close: () => new Promise((resolve, reject) => {
       server.close((error) => {
         if (error) {
@@ -958,9 +898,11 @@ import { createServer as createServer2 } from "http";
 import { createConnection } from "net";
 import {
   createOpenAIOAuthRequest,
-  exchangeOpenAIOAuthCode,
-  saveAuthTokens
+  exchangeOpenAIOAuthCode
 } from "@openai-oauth/core";
+import {
+  saveAuthTokens
+} from "@openai-oauth/local/auth-file";
 
 // src/callback-success.html?raw
 var callback_success_default = `<!doctype html>
@@ -1155,24 +1097,10 @@ var isAddressUnavailableError = (error) => error instanceof Error && "code" in e
   String(error.code)
 );
 var createLoginCancelledError = () => new Error("OpenAI OAuth login cancelled.");
-var toCallbackHtml = (title, message) => `<!doctype html>
-<html lang="en">
-	<head>
-		<meta charset="utf-8" />
-		<title>${title}</title>
-		<style>
-			body {
-				font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
-				margin: 3rem;
-				line-height: 1.5;
-			}
-		</style>
-	</head>
-	<body>
-		<h1>${title}</h1>
-		<p>${message}</p>
-	</body>
-</html>`;
+var toCallbackHtml = (title, message) => callback_success_default.replace("Sign-in complete", title).replace(
+  /Your ChatGPT credentials are saved locally\. You can close this\s+window and return to your terminal\./,
+  message
+);
 var htmlHeaders = {
   "Content-Type": "text/html; charset=utf-8",
   Connection: "close"
@@ -1393,7 +1321,6 @@ var runOpenAIOAuthLogin = async (options = {}) => {
 };
 
 export {
-  resolveOpenAIOAuthModels,
   DEFAULT_PORT,
   createOpenAIOAuthFetchHandler,
   startOpenAIOAuthServer,

package/dist/cli.js

@@ -1,10 +1,9 @@
 #!/usr/bin/env node
 import {
   DEFAULT_PORT,
-  resolveOpenAIOAuthModels,
   runOpenAIOAuthLogin,
   startOpenAIOAuthServer
-} from "./chunk-KROVQ42X.js";
+} from "./chunk-INHW7GRB.js";
 
 // src/cli-app.ts
 import { access } from "fs/promises";
@@ -12,7 +11,7 @@ import { createInterface } from "readline/promises";
 import {
   resolveAuthFileCandidates,
   resolveCodexAuthFilePath
-} from "@openai-oauth/core";
+} from "@openai-oauth/local/auth-file";
 import yargs from "yargs";
 import { hideBin } from "yargs/helpers";
 
@@ -362,7 +361,7 @@ var activateCliRuntime = async (lock, options) => {
     }
     if (request.method === "POST" && request.url === "/stop") {
       response.writeHead(202).end();
-      setImmediate(() => void options.onStop());
+      setImmediate(options.onStop);
       return;
     }
     response.writeHead(404).end();
@@ -668,8 +667,6 @@ var sendDetachedError = (message) => new Promise((resolve) => {
 });
 
 // src/cli-worker.ts
-import { createCodexOAuthClient } from "@openai-oauth/core";
-import { openaiCredentials } from "@openai-oauth/local";
 var isWorkerCommand = (value) => {
   if (typeof value !== "object" || value == null) {
     return false;
@@ -681,13 +678,6 @@ var startCliInstance = async (options, mode, version, onRemoteStop) => {
   const lock = await acquireCliRuntimeLock();
   let server;
   try {
-    const auth = openaiCredentials(options);
-    const client = createCodexOAuthClient({
-      ...options,
-      auth: () => auth.getSession(),
-      responsesState: false
-    });
-    const models = await resolveOpenAIOAuthModels(client, options.models);
     server = await startOpenAIOAuthServer(options);
     const runtime = await activateCliRuntime(lock, {
       mode,
@@ -695,7 +685,7 @@ var startCliInstance = async (options, mode, version, onRemoteStop) => {
       version,
       onStop: onRemoteStop
     });
-    return { server, runtime, models };
+    return { server, runtime, models: server.models };
   } catch (error) {
     await server?.close().catch(() => void 0);
     await lock.release();
@@ -724,9 +714,12 @@ var runCliWorker = async (options, initialMode, version) => {
     }
     process.exit(0);
   };
-  instance = await startCliInstance(options, initialMode, version, () => {
-    void shutdown("remote");
-  });
+  instance = await startCliInstance(
+    options,
+    initialMode,
+    version,
+    () => shutdown("remote")
+  );
   const onMessage = (value) => {
     if (!isWorkerCommand(value) || stopping) {
       return;
@@ -752,7 +745,7 @@ var runCliWorker = async (options, initialMode, version) => {
       void shutdown("disconnect");
     }
   };
-  const onSignal = () => void shutdown("signal");
+  const onSignal = () => shutdown("signal");
   process.on("message", onMessage);
   process.once("disconnect", onDisconnect);
   process.once("SIGINT", onSignal);
@@ -762,17 +755,19 @@ var runCliWorker = async (options, initialMode, version) => {
 };
 
 // src/update-check.ts
-var REGISTRY_URL = "https://registry.npmjs.org/openai-oauth/latest";
+var registryUrl = "https://registry.npmjs.org/openai-oauth/latest";
 var normalizeVersion = (value) => {
   if (typeof value !== "string") {
     return void 0;
   }
-  const match = value.trim().match(/^\d+\.\d+\.\d+$/);
+  const match = value.trim().match(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/);
   return match?.[0];
 };
 var compareSemver = (left, right) => {
-  const leftParts = left.split(".").map(Number);
-  const rightParts = right.split(".").map(Number);
+  const [leftCore = "", leftPrerelease] = left.split("-", 2);
+  const [rightCore = "", rightPrerelease] = right.split("-", 2);
+  const leftParts = leftCore.split(".").map(Number);
+  const rightParts = rightCore.split(".").map(Number);
   for (let index = 0; index < 3; index += 1) {
     const leftPart = leftParts[index] ?? 0;
     const rightPart = rightParts[index] ?? 0;
@@ -783,6 +778,26 @@ var compareSemver = (left, right) => {
       return 1;
     }
   }
+  if (leftPrerelease == null) return rightPrerelease == null ? 0 : 1;
+  if (rightPrerelease == null) return -1;
+  const leftIdentifiers = leftPrerelease.split(".");
+  const rightIdentifiers = rightPrerelease.split(".");
+  const length = Math.max(leftIdentifiers.length, rightIdentifiers.length);
+  for (let index = 0; index < length; index += 1) {
+    const leftIdentifier = leftIdentifiers[index];
+    const rightIdentifier = rightIdentifiers[index];
+    if (leftIdentifier == null) return -1;
+    if (rightIdentifier == null) return 1;
+    if (leftIdentifier === rightIdentifier) continue;
+    const leftNumber = /^\d+$/.test(leftIdentifier) ? Number(leftIdentifier) : void 0;
+    const rightNumber = /^\d+$/.test(rightIdentifier) ? Number(rightIdentifier) : void 0;
+    if (leftNumber != null && rightNumber != null) {
+      return leftNumber < rightNumber ? -1 : 1;
+    }
+    if (leftNumber != null) return -1;
+    if (rightNumber != null) return 1;
+    return leftIdentifier < rightIdentifier ? -1 : 1;
+  }
   return 0;
 };
 var fetchLatestVersion = async (fetchImpl, signal) => {
@@ -795,7 +810,7 @@ var fetchLatestVersion = async (fetchImpl, signal) => {
     if (signal) {
       requestInit.signal = signal;
     }
-    const response = await fetchImpl(REGISTRY_URL, requestInit);
+    const response = await fetchImpl(registryUrl, requestInit);
     if (!response.ok) {
       return void 0;
     }
@@ -834,10 +849,82 @@ Run \`npx openai-oauth@latest\` to use the newest version.`
   );
 };
 
+// package.json
+var package_default = {
+  name: "openai-oauth",
+  version: "2.0.0-beta.4",
+  description: "Free OpenAI API access with your ChatGPT account.",
+  keywords: [
+    "openai",
+    "oauth",
+    "chatgpt",
+    "codex",
+    "cli",
+    "openai-compatible"
+  ],
+  type: "module",
+  engines: {
+    node: ">=20"
+  },
+  sideEffects: false,
+  main: "./dist/index.js",
+  types: "./dist/index.d.ts",
+  bin: {
+    "openai-oauth": "dist/cli.js"
+  },
+  exports: {
+    ".": {
+      types: "./dist/index.d.ts",
+      import: "./dist/index.js",
+      default: "./dist/index.js"
+    }
+  },
+  files: [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  scripts: {
+    build: "tsup src/index.ts src/cli.ts --format esm --dts --outDir dist --clean --loader .html=text",
+    dev: "bun ./src/cli.ts",
+    prepublishOnly: "bun run build",
+    typecheck: "tsc --noEmit",
+    test: "vitest run",
+    "test:live": "LIVE_CODEX_E2E=1 vitest run test/live.e2e.test.ts"
+  },
+  dependencies: {
+    "@openai-oauth/ai-sdk": "workspace:*",
+    "@openai-oauth/core": "workspace:*",
+    "@openai-oauth/local": "workspace:*",
+    ai: "6.0.116",
+    yargs: "17.7.3"
+  },
+  devDependencies: {
+    "@ai-sdk/openai": "3.0.41",
+    "@types/node": "20.17.24",
+    "@types/yargs": "^17.0.33",
+    typescript: "5.9.2",
+    vitest: "4.1.10",
+    zod: "^3.25.76"
+  },
+  author: "EvanZhouDev",
+  license: "AGPL-3.0-only",
+  repository: {
+    type: "git",
+    url: "git+https://github.com/EvanZhouDev/openai-oauth.git",
+    directory: "packages/openai-oauth"
+  },
+  bugs: {
+    url: "https://github.com/EvanZhouDev/openai-oauth/issues"
+  },
+  homepage: "https://github.com/EvanZhouDev/openai-oauth#readme"
+};
+
 // src/version.ts
-var packageVersion = "2.0.0-beta.3";
+var packageVersion = package_default.version;
 
 // src/cli-app.ts
+var cliCommand = "npx openai-oauth@latest";
 var defaultUpdateCheckWarning = (message) => {
   console.error(message);
 };
@@ -852,12 +939,12 @@ var helpLines = [
   "Free OpenAI API access with your ChatGPT account.",
   "",
   "Usage",
-  "  npx openai-oauth@latest [options]",
-  "  npx openai-oauth@latest --detach [options]",
-  "  npx openai-oauth@latest status",
-  "  npx openai-oauth@latest logs [--follow]",
-  "  npx openai-oauth@latest stop",
-  "  npx openai-oauth@latest login [options]",
+  `  ${cliCommand} [options]`,
+  `  ${cliCommand} --detach [options]`,
+  `  ${cliCommand} status`,
+  `  ${cliCommand} logs [--follow]`,
+  `  ${cliCommand} stop`,
+  `  ${cliCommand} login [options]`,
   "",
   "Options",
   "  --host <host>              Proxy host. Login callback always listens on loopback.",
@@ -1041,6 +1128,13 @@ var toMissingAuthFileMessage = (authFilePath) => {
 var runUpdateCheck = () => checkForOpenAIOAuthUpdates(packageVersion, {
   onWarning: defaultUpdateCheckWarning
 });
+var warnAboutNetworkBinding = (host) => {
+  if (host && host !== "127.0.0.1" && host !== "localhost" && host !== "::1") {
+    console.warn(
+      `Warning: --host ${host} exposes OpenAI OAuth to your network. Anyone who can reach this port can make requests with your ChatGPT account.`
+    );
+  }
+};
 var createLoginCancellation = () => {
   const abortController = new AbortController();
   let signalName;
@@ -1348,6 +1442,7 @@ var runCli = async (argv = hideBin(process.argv)) => {
   }
   const updateCheck = runUpdateCheck();
   const options = toServerOptions(args);
+  warnAboutNetworkBinding(options.host);
   const existingAuthFile = await findExistingAuthFile(options.authFilePath);
   if (!existingAuthFile) {
     await updateCheck;

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { SavedAuthTokens } from '@openai-oauth/core';
+import { SavedAuthTokens } from '@openai-oauth/local/auth-file';
 import { Server } from 'node:http';
 import { LocalOpenAIOAuthOptions } from '@openai-oauth/local';
 
@@ -108,6 +108,7 @@ type RunningOpenAIOAuthServer = {
     host: string;
     port: number;
     url: string;
+    models: string[];
     close: () => Promise<void>;
 };
 

package/dist/index.js

@@ -2,7 +2,7 @@ import {
   createOpenAIOAuthFetchHandler,
   runOpenAIOAuthLogin,
   startOpenAIOAuthServer
-} from "./chunk-KROVQ42X.js";
+} from "./chunk-INHW7GRB.js";
 export {
   createOpenAIOAuthFetchHandler,
   runOpenAIOAuthLogin,

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "openai-oauth",
-	"version": "2.0.0-beta.3",
+	"version": "2.0.0-beta.4",
 	"description": "Free OpenAI API access with your ChatGPT account.",
 	"keywords": [
 		"openai",
@@ -11,6 +11,9 @@
 		"openai-compatible"
 	],
 	"type": "module",
+	"engines": {
+		"node": ">=20"
+	},
 	"sideEffects": false,
 	"main": "./dist/index.js",
 	"types": "./dist/index.d.ts",
@@ -38,18 +41,18 @@
 		"test:live": "LIVE_CODEX_E2E=1 vitest run test/live.e2e.test.ts"
 	},
 	"dependencies": {
-		"@openai-oauth/ai-sdk": "2.0.0-beta.3",
-		"@openai-oauth/core": "2.0.0-beta.3",
-		"@openai-oauth/local": "2.0.0-beta.3",
+		"@openai-oauth/ai-sdk": "2.0.0-beta.4",
+		"@openai-oauth/core": "2.0.0-beta.4",
+		"@openai-oauth/local": "2.0.0-beta.4",
 		"ai": "6.0.116",
-		"yargs": "^17.7.2"
+		"yargs": "17.7.3"
 	},
 	"devDependencies": {
 		"@ai-sdk/openai": "3.0.41",
 		"@types/node": "20.17.24",
 		"@types/yargs": "^17.0.33",
-		"typescript": "latest",
-		"vitest": "latest",
+		"typescript": "5.9.2",
+		"vitest": "4.1.10",
 		"zod": "^3.25.76"
 	},
 	"author": "EvanZhouDev",