opencode-openai-account-switcher 0.1.0

package/dist/upstream/codex-plugin.snapshot.js

@@ -0,0 +1,638 @@
+// @ts-nocheck
+import { AsyncLocalStorage } from "node:async_hooks";
+import { createServer } from "node:http";
+import os from "node:os";
+const officialCodexExportBridgeStorage = new AsyncLocalStorage();
+const officialCodexExportBridge = {
+    version: "snapshot",
+    fetchImpl(request, init) {
+        return globalThis.fetch(request, init);
+    },
+    async run(options = {}, fn) {
+        return officialCodexExportBridgeStorage.run({
+            fetchImpl: options.fetchImpl ?? this.fetchImpl,
+            version: options.version ?? this.version,
+        }, fn);
+    },
+};
+const Installation = {
+    get VERSION() {
+        return officialCodexExportBridgeStorage.getStore()?.version ?? officialCodexExportBridge.version;
+    },
+    set VERSION(value) {
+        officialCodexExportBridge.version = value;
+    },
+};
+const OAUTH_DUMMY_KEY = "official-codex-oauth";
+function fetch(request, init) {
+    return (officialCodexExportBridgeStorage.getStore()?.fetchImpl ?? officialCodexExportBridge.fetchImpl)(request, init);
+}
+function sleep(ms) {
+    return Bun.sleep(ms);
+}
+const Bun = {
+    serve(options) {
+        let closed = false;
+        let listening = false;
+        let closePromise;
+        let resolveReady;
+        let rejectReady;
+        const ready = new Promise((resolve, reject) => {
+            resolveReady = resolve;
+            rejectReady = reject;
+        });
+        const server = createServer((req, res) => {
+            const chunks = [];
+            req.on("data", (chunk) => {
+                chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+            });
+            req.on("error", (error) => {
+                res.statusCode = 500;
+                res.end(String(error));
+            });
+            req.on("end", () => {
+                const body = chunks.length > 0 ? Buffer.concat(chunks) : undefined;
+                const request = new Request("http://127.0.0.1:" + options.port + (req.url ?? "/"), {
+                    method: req.method,
+                    headers: req.headers,
+                    body,
+                    duplex: "half",
+                });
+                Promise.resolve(options.fetch(request))
+                    .then(async (response) => {
+                    res.statusCode = response.status;
+                    response.headers.forEach((value, key) => {
+                        res.setHeader(key, value);
+                    });
+                    const payload = Buffer.from(await response.arrayBuffer());
+                    res.end(payload);
+                })
+                    .catch((error) => {
+                    res.statusCode = 500;
+                    res.end(String(error));
+                });
+            });
+        });
+        server.once("listening", () => {
+            listening = true;
+            resolveReady?.();
+            resolveReady = undefined;
+            rejectReady = undefined;
+        });
+        server.once("error", (error) => {
+            if (!listening) {
+                rejectReady?.(error);
+                resolveReady = undefined;
+                rejectReady = undefined;
+            }
+        });
+        server.listen(options.port);
+        return {
+            ready,
+            stop() {
+                if (closePromise)
+                    return closePromise;
+                closePromise = new Promise((resolve, reject) => {
+                    if (closed) {
+                        resolve();
+                        return;
+                    }
+                    server.close((error) => {
+                        if (error) {
+                            reject(error);
+                            return;
+                        }
+                        closed = true;
+                        resolve();
+                    });
+                });
+                return closePromise;
+            },
+        };
+    },
+    sleep(ms) {
+        return new Promise((resolve) => setTimeout(resolve, ms));
+    },
+};
+const Log = {
+    create() {
+        return {
+            info() { },
+            warn() { },
+            error() { },
+        };
+    },
+};
+/* LOCAL_SHIMS_END */
+const log = Log.create({ service: "plugin.codex" });
+const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+const ISSUER = "https://auth.openai.com";
+const CODEX_API_ENDPOINT = "https://chatgpt.com/backend-api/codex/responses";
+const OAUTH_PORT = 1455;
+const OAUTH_POLLING_SAFETY_MARGIN_MS = 3000;
+async function generatePKCE() {
+    const verifier = generateRandomString(43);
+    const encoder = new TextEncoder();
+    const data = encoder.encode(verifier);
+    const hash = await crypto.subtle.digest("SHA-256", data);
+    const challenge = base64UrlEncode(hash);
+    return { verifier, challenge };
+}
+function generateRandomString(length) {
+    const chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
+    const bytes = crypto.getRandomValues(new Uint8Array(length));
+    return Array.from(bytes)
+        .map((b) => chars[b % chars.length])
+        .join("");
+}
+function base64UrlEncode(buffer) {
+    const bytes = new Uint8Array(buffer);
+    const binary = String.fromCharCode(...bytes);
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function generateState() {
+    return base64UrlEncode(crypto.getRandomValues(new Uint8Array(32)).buffer);
+}
+export function parseJwtClaims(token) {
+    const parts = token.split(".");
+    if (parts.length !== 3)
+        return undefined;
+    try {
+        return JSON.parse(Buffer.from(parts[1], "base64url").toString());
+    }
+    catch {
+        return undefined;
+    }
+}
+export function extractAccountIdFromClaims(claims) {
+    return (claims.chatgpt_account_id ||
+        claims["https://api.openai.com/auth"]?.chatgpt_account_id ||
+        claims.organizations?.[0]?.id);
+}
+export function extractAccountId(tokens) {
+    if (tokens.id_token) {
+        const claims = parseJwtClaims(tokens.id_token);
+        const accountId = claims && extractAccountIdFromClaims(claims);
+        if (accountId)
+            return accountId;
+    }
+    if (tokens.access_token) {
+        const claims = parseJwtClaims(tokens.access_token);
+        return claims ? extractAccountIdFromClaims(claims) : undefined;
+    }
+    return undefined;
+}
+function buildAuthorizeUrl(redirectUri, pkce, state) {
+    const params = new URLSearchParams({
+        response_type: "code",
+        client_id: CLIENT_ID,
+        redirect_uri: redirectUri,
+        scope: "openid profile email offline_access",
+        code_challenge: pkce.challenge,
+        code_challenge_method: "S256",
+        id_token_add_organizations: "true",
+        codex_cli_simplified_flow: "true",
+        state,
+        originator: "opencode",
+    });
+    return `${ISSUER}/oauth/authorize?${params.toString()}`;
+}
+async function exchangeCodeForTokens(code, redirectUri, pkce) {
+    const response = await fetch(`${ISSUER}/oauth/token`, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+            grant_type: "authorization_code",
+            code,
+            redirect_uri: redirectUri,
+            client_id: CLIENT_ID,
+            code_verifier: pkce.verifier,
+        }).toString(),
+    });
+    if (!response.ok) {
+        throw new Error(`Token exchange failed: ${response.status}`);
+    }
+    return response.json();
+}
+async function refreshAccessToken(refreshToken) {
+    const response = await fetch(`${ISSUER}/oauth/token`, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+            grant_type: "refresh_token",
+            refresh_token: refreshToken,
+            client_id: CLIENT_ID,
+        }).toString(),
+    });
+    if (!response.ok) {
+        throw new Error(`Token refresh failed: ${response.status}`);
+    }
+    return response.json();
+}
+const HTML_SUCCESS = `<!doctype html>
+<html>
+  <head>
+    <title>OpenCode - Codex Authorization Successful</title>
+    <style>
+      body {
+        font-family:
+          system-ui,
+          -apple-system,
+          sans-serif;
+        display: flex;
+        justify-content: center;
+        align-items: center;
+        height: 100vh;
+        margin: 0;
+        background: #131010;
+        color: #f1ecec;
+      }
+      .container {
+        text-align: center;
+        padding: 2rem;
+      }
+      h1 {
+        color: #f1ecec;
+        margin-bottom: 1rem;
+      }
+      p {
+        color: #b7b1b1;
+      }
+    </style>
+  </head>
+  <body>
+    <div class="container">
+      <h1>Authorization Successful</h1>
+      <p>You can close this window and return to OpenCode.</p>
+    </div>
+    <script>
+      setTimeout(() => window.close(), 2000)
+    </script>
+  </body>
+</html>`;
+const HTML_ERROR = (error) => `<!doctype html>
+<html>
+  <head>
+    <title>OpenCode - Codex Authorization Failed</title>
+    <style>
+      body {
+        font-family:
+          system-ui,
+          -apple-system,
+          sans-serif;
+        display: flex;
+        justify-content: center;
+        align-items: center;
+        height: 100vh;
+        margin: 0;
+        background: #131010;
+        color: #f1ecec;
+      }
+      .container {
+        text-align: center;
+        padding: 2rem;
+      }
+      h1 {
+        color: #fc533a;
+        margin-bottom: 1rem;
+      }
+      p {
+        color: #b7b1b1;
+      }
+      .error {
+        color: #ff917b;
+        font-family: monospace;
+        margin-top: 1rem;
+        padding: 1rem;
+        background: #3c140d;
+        border-radius: 0.5rem;
+      }
+    </style>
+  </head>
+  <body>
+    <div class="container">
+      <h1>Authorization Failed</h1>
+      <p>An error occurred during authorization.</p>
+      <div class="error">${error}</div>
+    </div>
+  </body>
+</html>`;
+let oauthServer;
+let pendingOAuth;
+async function startOAuthServer() {
+    if (oauthServer) {
+        return { port: OAUTH_PORT, redirectUri: `http://localhost:${OAUTH_PORT}/auth/callback` };
+    }
+    oauthServer = Bun.serve({
+        port: OAUTH_PORT,
+        fetch(req) {
+            const url = new URL(req.url);
+            if (url.pathname === "/auth/callback") {
+                const code = url.searchParams.get("code");
+                const state = url.searchParams.get("state");
+                const error = url.searchParams.get("error");
+                const errorDescription = url.searchParams.get("error_description");
+                if (error) {
+                    const errorMsg = errorDescription || error;
+                    pendingOAuth?.reject(new Error(errorMsg));
+                    pendingOAuth = undefined;
+                    return new Response(HTML_ERROR(errorMsg), {
+                        headers: { "Content-Type": "text/html" },
+                    });
+                }
+                if (!code) {
+                    const errorMsg = "Missing authorization code";
+                    pendingOAuth?.reject(new Error(errorMsg));
+                    pendingOAuth = undefined;
+                    return new Response(HTML_ERROR(errorMsg), {
+                        status: 400,
+                        headers: { "Content-Type": "text/html" },
+                    });
+                }
+                if (!pendingOAuth || state !== pendingOAuth.state) {
+                    const errorMsg = "Invalid state - potential CSRF attack";
+                    pendingOAuth?.reject(new Error(errorMsg));
+                    pendingOAuth = undefined;
+                    return new Response(HTML_ERROR(errorMsg), {
+                        status: 400,
+                        headers: { "Content-Type": "text/html" },
+                    });
+                }
+                const current = pendingOAuth;
+                pendingOAuth = undefined;
+                exchangeCodeForTokens(code, `http://localhost:${OAUTH_PORT}/auth/callback`, current.pkce)
+                    .then((tokens) => current.resolve(tokens))
+                    .catch((err) => current.reject(err));
+                return new Response(HTML_SUCCESS, {
+                    headers: { "Content-Type": "text/html" },
+                });
+            }
+            if (url.pathname === "/cancel") {
+                pendingOAuth?.reject(new Error("Login cancelled"));
+                pendingOAuth = undefined;
+                return new Response("Login cancelled", { status: 200 });
+            }
+            return new Response("Not found", { status: 404 });
+        },
+    });
+    log.info("codex oauth server started", { port: OAUTH_PORT });
+    return { port: OAUTH_PORT, redirectUri: `http://localhost:${OAUTH_PORT}/auth/callback` };
+}
+function stopOAuthServer() {
+    if (oauthServer) {
+        oauthServer.stop();
+        oauthServer = undefined;
+        log.info("codex oauth server stopped");
+    }
+}
+function waitForOAuthCallback(pkce, state) {
+    return new Promise((resolve, reject) => {
+        const timeout = setTimeout(() => {
+            if (pendingOAuth) {
+                pendingOAuth = undefined;
+                reject(new Error("OAuth callback timeout - authorization took too long"));
+            }
+        }, 5 * 60 * 1000); // 5 minute timeout
+        pendingOAuth = {
+            pkce,
+            state,
+            resolve: (tokens) => {
+                clearTimeout(timeout);
+                resolve(tokens);
+            },
+            reject: (error) => {
+                clearTimeout(timeout);
+                reject(error);
+            },
+        };
+    });
+}
+export async function CodexAuthPlugin(input) {
+    return {
+        auth: {
+            provider: "openai",
+            async loader(getAuth, provider) {
+                const auth = await getAuth();
+                if (auth.type !== "oauth")
+                    return {};
+                // Filter models to only allowed Codex models for OAuth
+                const allowedModels = new Set([
+                    "gpt-5.1-codex",
+                    "gpt-5.1-codex-max",
+                    "gpt-5.1-codex-mini",
+                    "gpt-5.2",
+                    "gpt-5.2-codex",
+                    "gpt-5.3-codex",
+                    "gpt-5.4",
+                    "gpt-5.4-mini",
+                ]);
+                for (const modelId of Object.keys(provider.models)) {
+                    if (modelId.includes("codex"))
+                        continue;
+                    if (allowedModels.has(modelId))
+                        continue;
+                    delete provider.models[modelId];
+                }
+                // Zero out costs for Codex (included with ChatGPT subscription)
+                for (const model of Object.values(provider.models)) {
+                    model.cost = {
+                        input: 0,
+                        output: 0,
+                        cache: { read: 0, write: 0 },
+                    };
+                }
+                return {
+                    apiKey: OAUTH_DUMMY_KEY,
+                    async fetch(requestInput, init) {
+                        // Remove dummy API key authorization header
+                        if (init?.headers) {
+                            if (init.headers instanceof Headers) {
+                                init.headers.delete("authorization");
+                                init.headers.delete("Authorization");
+                            }
+                            else if (Array.isArray(init.headers)) {
+                                init.headers = init.headers.filter(([key]) => key.toLowerCase() !== "authorization");
+                            }
+                            else {
+                                delete init.headers["authorization"];
+                                delete init.headers["Authorization"];
+                            }
+                        }
+                        const currentAuth = await getAuth();
+                        if (currentAuth.type !== "oauth")
+                            return fetch(requestInput, init);
+                        // Cast to include accountId field
+                        const authWithAccount = currentAuth;
+                        // Check if token needs refresh
+                        if (!currentAuth.access || currentAuth.expires < Date.now()) {
+                            log.info("refreshing codex access token");
+                            const tokens = await refreshAccessToken(currentAuth.refresh);
+                            const newAccountId = extractAccountId(tokens) || authWithAccount.accountId;
+                            await input.client.auth.set({
+                                path: { id: "openai" },
+                                body: {
+                                    type: "oauth",
+                                    refresh: tokens.refresh_token,
+                                    access: tokens.access_token,
+                                    expires: Date.now() + (tokens.expires_in ?? 3600) * 1000,
+                                    ...(newAccountId && { accountId: newAccountId }),
+                                },
+                            });
+                            currentAuth.access = tokens.access_token;
+                            authWithAccount.accountId = newAccountId;
+                        }
+                        // Build headers
+                        const headers = new Headers();
+                        if (init?.headers) {
+                            if (init.headers instanceof Headers) {
+                                init.headers.forEach((value, key) => {
+                                    headers.set(key, value);
+                                });
+                            }
+                            else if (Array.isArray(init.headers)) {
+                                for (const [key, value] of init.headers) {
+                                    if (value !== undefined)
+                                        headers.set(key, String(value));
+                                }
+                            }
+                            else {
+                                for (const [key, value] of Object.entries(init.headers)) {
+                                    if (value !== undefined)
+                                        headers.set(key, String(value));
+                                }
+                            }
+                        }
+                        // Set authorization header with access token
+                        headers.set("authorization", `Bearer ${currentAuth.access}`);
+                        // Set ChatGPT-Account-Id header for organization subscriptions
+                        if (authWithAccount.accountId) {
+                            headers.set("ChatGPT-Account-Id", authWithAccount.accountId);
+                        }
+                        // Rewrite URL to Codex endpoint
+                        const parsed = requestInput instanceof URL
+                            ? requestInput
+                            : new URL(typeof requestInput === "string" ? requestInput : requestInput.url);
+                        const url = parsed.pathname.includes("/v1/responses") || parsed.pathname.includes("/chat/completions")
+                            ? new URL(CODEX_API_ENDPOINT)
+                            : parsed;
+                        return fetch(url, {
+                            ...init,
+                            headers,
+                        });
+                    },
+                };
+            },
+            methods: [
+                {
+                    label: "ChatGPT Pro/Plus (browser)",
+                    type: "oauth",
+                    authorize: async () => {
+                        const { redirectUri } = await startOAuthServer();
+                        const pkce = await generatePKCE();
+                        const state = generateState();
+                        const authUrl = buildAuthorizeUrl(redirectUri, pkce, state);
+                        const callbackPromise = waitForOAuthCallback(pkce, state);
+                        return {
+                            url: authUrl,
+                            instructions: "Complete authorization in your browser. This window will close automatically.",
+                            method: "auto",
+                            callback: async () => {
+                                const tokens = await callbackPromise;
+                                stopOAuthServer();
+                                const accountId = extractAccountId(tokens);
+                                return {
+                                    type: "success",
+                                    refresh: tokens.refresh_token,
+                                    access: tokens.access_token,
+                                    expires: Date.now() + (tokens.expires_in ?? 3600) * 1000,
+                                    accountId,
+                                };
+                            },
+                        };
+                    },
+                },
+                {
+                    label: "ChatGPT Pro/Plus (headless)",
+                    type: "oauth",
+                    authorize: async () => {
+                        const deviceResponse = await fetch(`${ISSUER}/api/accounts/deviceauth/usercode`, {
+                            method: "POST",
+                            headers: {
+                                "Content-Type": "application/json",
+                                "User-Agent": `opencode/${Installation.VERSION}`,
+                            },
+                            body: JSON.stringify({ client_id: CLIENT_ID }),
+                        });
+                        if (!deviceResponse.ok)
+                            throw new Error("Failed to initiate device authorization");
+                        const deviceData = (await deviceResponse.json());
+                        const interval = Math.max(parseInt(deviceData.interval) || 5, 1) * 1000;
+                        return {
+                            url: `${ISSUER}/codex/device`,
+                            instructions: `Enter code: ${deviceData.user_code}`,
+                            method: "auto",
+                            async callback() {
+                                while (true) {
+                                    const response = await fetch(`${ISSUER}/api/accounts/deviceauth/token`, {
+                                        method: "POST",
+                                        headers: {
+                                            "Content-Type": "application/json",
+                                            "User-Agent": `opencode/${Installation.VERSION}`,
+                                        },
+                                        body: JSON.stringify({
+                                            device_auth_id: deviceData.device_auth_id,
+                                            user_code: deviceData.user_code,
+                                        }),
+                                    });
+                                    if (response.ok) {
+                                        const data = (await response.json());
+                                        const tokenResponse = await fetch(`${ISSUER}/oauth/token`, {
+                                            method: "POST",
+                                            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+                                            body: new URLSearchParams({
+                                                grant_type: "authorization_code",
+                                                code: data.authorization_code,
+                                                redirect_uri: `${ISSUER}/deviceauth/callback`,
+                                                client_id: CLIENT_ID,
+                                                code_verifier: data.code_verifier,
+                                            }).toString(),
+                                        });
+                                        if (!tokenResponse.ok) {
+                                            throw new Error(`Token exchange failed: ${tokenResponse.status}`);
+                                        }
+                                        const tokens = await tokenResponse.json();
+                                        return {
+                                            type: "success",
+                                            refresh: tokens.refresh_token,
+                                            access: tokens.access_token,
+                                            expires: Date.now() + (tokens.expires_in ?? 3600) * 1000,
+                                            accountId: extractAccountId(tokens),
+                                        };
+                                    }
+                                    if (response.status !== 403 && response.status !== 404) {
+                                        return { type: "failed" };
+                                    }
+                                    await sleep(interval + OAUTH_POLLING_SAFETY_MARGIN_MS);
+                                }
+                            },
+                        };
+                    },
+                },
+                {
+                    label: "Manually enter API Key",
+                    type: "api",
+                },
+            ],
+        },
+        "chat.headers": async (input, output) => {
+            if (input.model.providerID !== "openai")
+                return;
+            output.headers.originator = "opencode";
+            output.headers["User-Agent"] = `opencode/${Installation.VERSION} (${os.platform()} ${os.release()}; ${os.arch()})`;
+            output.headers.session_id = input.sessionID;
+        },
+    };
+}
+/* GENERATED_EXPORT_BRIDGE_START */
+export { officialCodexExportBridge };
+/* GENERATED_EXPORT_BRIDGE_END */

package/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "opencode-openai-account-switcher",
+  "version": "0.1.0",
+  "description": "OpenAI Codex account switcher plugin for OpenCode",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist/",
+    "scripts/sync-codex-upstream.mjs",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "prebuild": "node scripts/clean-dist.mjs",
+    "build": "tsc -p tsconfig.build.json",
+    "sync:codex-snapshot": "node scripts/sync-codex-upstream.mjs --output src/upstream/codex-plugin.snapshot.ts",
+    "check:codex-sync": "node scripts/sync-codex-upstream.mjs --output src/upstream/codex-plugin.snapshot.ts --check",
+    "test": "npm run build && node --test test/*.test.js",
+    "typecheck": "tsc --noEmit",
+    "prepublishOnly": "npm run build"
+  },
+  "engines": {
+    "node": ">=24.0.0"
+  },
+  "dependencies": {
+    "@opencode-ai/plugin": "1.14.41",
+    "xdg-basedir": "^5.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^24.10.1",
+    "typescript": "^5.0.0"
+  }
+}