opensecurity 0.1.0

package/dist/login.js

@@ -0,0 +1,583 @@
+import readline from "node:readline";
+import http from "node:http";
+import crypto from "node:crypto";
+import { exec, spawn } from "node:child_process";
+import { loadGlobalConfig, saveGlobalConfig } from "./config.js";
+import { saveOAuthProfile } from "./oauthStore.js";
+export function askQuestion(question) {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    return new Promise((resolve) => {
+        rl.question(question, (answer) => {
+            rl.close();
+            resolve(answer.trim());
+        });
+    });
+}
+// For unit tests
+export async function saveMockToken(token, env = process.env) {
+    const current = await loadGlobalConfig(env);
+    const updated = { ...current, apiKey: token };
+    await saveGlobalConfig(updated, env);
+    return updated;
+}
+export async function login(env = process.env, mode, model, provider) {
+    console.log("\n\x1b[32m\u25C7\x1b[0m  \x1b[1mOpenSecurity Authentication\x1b[0m");
+    if (mode === "api_key") {
+        return loginWithApiKey(env, model, provider);
+    }
+    if (mode === "oauth") {
+        if (provider && provider !== "openai") {
+            throw new Error("OAuth is only supported for OpenAI.");
+        }
+        return loginWithOAuth(env, model);
+    }
+    const modeChoice = await promptLoginMode();
+    if (modeChoice === "api_key") {
+        return loginWithApiKey(env, model, provider);
+    }
+    // Option 1: Codex OAuth (Default)
+    return loginWithOAuth(env, model);
+}
+async function loginWithApiKey(env = process.env, model, provider) {
+    const current = await loadGlobalConfig(env);
+    const selectedProvider = provider ?? (await chooseProvider(current.provider ?? "openai"));
+    const key = await askQuestion(`Enter your ${providerLabel(selectedProvider)} API Key: `);
+    if (selectedProvider === "openai" && !key.startsWith("sk-")) {
+        console.error("\x1b[31mError: Invalid OpenAI API key format.\x1b[0m");
+        process.exit(1);
+    }
+    const selectedModel = await chooseModel({
+        current: model ?? current.model,
+        provider: selectedProvider,
+        source: selectedProvider === "openai" ? "openai" : undefined,
+        apiKey: selectedProvider === "openai" ? key : undefined
+    });
+    const updated = {
+        ...current,
+        provider: selectedProvider,
+        authMode: "api_key",
+        model: selectedModel ?? current.model,
+        apiKey: selectedProvider === "openai" ? key : current.apiKey,
+        providerApiKey: selectedProvider === "openai" ? current.providerApiKey : key
+    };
+    await saveGlobalConfig(updated, env);
+    console.log(`\n✅ Successfully saved ${providerLabel(selectedProvider)} API Key.`);
+    return updated;
+}
+async function loginWithOAuth(env = process.env, model) {
+    const provider = (env.OPENSECURITY_OAUTH_PROVIDER ?? "codex-cli");
+    if (provider === "codex-cli") {
+        return codexCliOAuthLogin(env, model);
+    }
+    return codexOAuthLogin(env, model);
+}
+async function codexCliOAuthLogin(env = process.env, model) {
+    await runCodexLogin();
+    const current = await loadGlobalConfig(env);
+    const selectedModel = await chooseModel({
+        current: model ?? current.model,
+        source: "codex",
+        provider: "openai"
+    });
+    const updated = {
+        ...current,
+        authMode: "oauth",
+        oauthProvider: "codex-cli",
+        authProfileId: "codex-cli",
+        model: selectedModel ?? current.model
+    };
+    await saveGlobalConfig(updated, env);
+    console.log("\n✅ Successfully authenticated with OpenAI/Codex via codex CLI.");
+    return updated;
+}
+async function codexOAuthLogin(env = process.env, model, port = 1455) {
+    const current = await loadGlobalConfig(env);
+    console.log("\n\x1b[32m\u25C7\x1b[0m  \x1b[1mOpenAI Codex OAuth\x1b[0m");
+    console.log("   Browser will open for OpenAI authentication.");
+    console.log("   OpenAI OAuth uses localhost:1455 for the callback.\n");
+    const state = crypto.randomBytes(16).toString("hex");
+    const codeVerifier = crypto.randomBytes(32).toString("base64url");
+    const codeChallenge = crypto.createHash("sha256").update(codeVerifier).digest("base64url");
+    const clientId = "app_EMoamEEZ73f0CkXaXp7hrann";
+    const redirectUri = encodeURIComponent(`http://localhost:${port}/auth/callback`);
+    const proxyBaseUrl = env.OPENSECURITY_PROXY_URL ?? "http://localhost:8787/v1/responses";
+    const authUrl = `https://auth.openai.com/oauth/authorize?response_type=code` +
+        `&client_id=${clientId}` +
+        `&redirect_uri=${redirectUri}` +
+        `&scope=openid+profile+email+offline_access` +
+        `&code_challenge=${codeChallenge}` +
+        `&code_challenge_method=S256` +
+        `&state=${state}` +
+        `&id_token_add_organizations=true` +
+        `&codex_cli_simplified_flow=true` +
+        `&originator=pi`;
+    console.log(`Open: ${authUrl}\n`);
+    return new Promise((resolve) => {
+        const server = http.createServer(async (req, res) => {
+            try {
+                const url = new URL(req.url || "", `http://${req.headers.host}`);
+                if (url.pathname === "/auth/callback") {
+                    const code = url.searchParams.get("code");
+                    const returnedState = url.searchParams.get("state");
+                    if (returnedState !== state) {
+                        res.writeHead(400);
+                        res.end("State mismatch. Security error.");
+                        return;
+                    }
+                    if (code) {
+                        res.writeHead(200, { "Content-Type": "text/html" });
+                        res.end(`
+              <html>
+                <head><title>Success</title><style>body { font-family: -apple-system, sans-serif; text-align: center; margin-top: 50px; }</style></head>
+                <body>
+                  <h1>✅ Authentication Successful!</h1>
+                  <p>OpenSecurity has successfully authenticated via OpenAI/Codex.</p>
+                  <p>You can close this window and return to your terminal.</p>
+                  <script>window.close();</script>
+                </body>
+              </html>
+            `);
+                        const tokens = await exchangeCodeForTokens({
+                            code,
+                            codeVerifier,
+                            clientId,
+                            redirectUri: `http://localhost:${port}/auth/callback`
+                        });
+                        if (!tokens.access_token) {
+                            throw new Error("OAuth token exchange did not return an access_token.");
+                        }
+                        const expiresAt = tokens.expires_in
+                            ? Date.now() + tokens.expires_in * 1000
+                            : undefined;
+                        await saveOAuthProfile({
+                            provider: "codex",
+                            accessToken: tokens.access_token,
+                            refreshToken: tokens.refresh_token,
+                            tokenType: tokens.token_type,
+                            scope: tokens.scope,
+                            expiresAt,
+                            obtainedAt: Date.now()
+                        }, env);
+                        const selectedModel = await chooseModel({
+                            current: model ?? current.model,
+                            source: "codex",
+                            provider: "openai"
+                        });
+                        const updated = {
+                            ...current,
+                            baseUrl: proxyBaseUrl,
+                            apiType: "responses",
+                            authMode: "oauth",
+                            authProfileId: "codex",
+                            oauthProvider: "proxy",
+                            model: selectedModel ?? current.model
+                        };
+                        await saveGlobalConfig(updated, env);
+                        console.log(`\n✅ Successfully authenticated with OpenAI/Codex.`);
+                        console.log(`   Proxy base URL set to ${proxyBaseUrl}`);
+                        server.close();
+                        resolve(updated);
+                    }
+                    else {
+                        res.writeHead(400);
+                        res.end("No authorization code received.");
+                    }
+                }
+                else {
+                    res.writeHead(404);
+                    res.end("Not Found");
+                }
+            }
+            catch (err) {
+                res.writeHead(500);
+                res.end("Internal error");
+            }
+        });
+        server.listen(port, () => {
+            exec(`open "${authUrl}"`);
+        });
+    });
+}
+function runCodexLogin() {
+    return new Promise((resolve, reject) => {
+        const proc = spawn("codex", ["login"], { stdio: "inherit" });
+        proc.on("error", reject);
+        proc.on("exit", (code) => {
+            if (code === 0)
+                resolve();
+            else
+                reject(new Error(`codex login failed with exit code ${code ?? "unknown"}`));
+        });
+    });
+}
+async function promptLoginMode() {
+    try {
+        return await interactiveSelectLoginMode();
+    }
+    catch {
+        // fall through to text prompt
+    }
+    const answer = await askQuestion("Select auth mode (oauth/api_key): ");
+    return answer.trim() === "api_key" ? "api_key" : "oauth";
+}
+async function interactiveSelectLoginMode() {
+    return new Promise((resolve, reject) => {
+        const readline = require("node:readline");
+        const { input, output, cleanup: baseCleanup } = getInteractiveStreams();
+        readline.emitKeypressEvents(input);
+        input.setRawMode(true);
+        const options = [
+            { label: "OpenAI Codex OAuth (browser)", value: "oauth" },
+            { label: "OpenAI API Key (manual)", value: "api_key" }
+        ];
+        let index = 0;
+        const render = () => {
+            output.write("\x1b[2J\x1b[H");
+            output.write("Select authentication method\n");
+            for (let i = 0; i < options.length; i += 1) {
+                const prefix = i === index ? "◉" : "○";
+                output.write(`${prefix} ${options[i].label}\n`);
+            }
+            output.write("\nUse ↑/↓ to move, Enter to select.\n");
+        };
+        const cleanup = () => {
+            input.off("keypress", onKeypress);
+            baseCleanup();
+        };
+        const onKeypress = (_, key) => {
+            if (key.ctrl && key.name === "c") {
+                cleanup();
+                reject(new Error("Selection cancelled."));
+                return;
+            }
+            if (key.name === "down") {
+                index = (index + 1) % options.length;
+                render();
+                return;
+            }
+            if (key.name === "up") {
+                index = (index - 1 + options.length) % options.length;
+                render();
+                return;
+            }
+            if (key.name === "return") {
+                const value = options[index].value;
+                cleanup();
+                resolve(value);
+            }
+        };
+        input.on("keypress", onKeypress);
+        render();
+    });
+}
+function shouldForceInteractive() {
+    return process.env.OPENSECURITY_FORCE_TTY === "1";
+}
+function getInteractiveStreams() {
+    if (process.stdin.isTTY && process.stdout.isTTY) {
+        const wasRaw = process.stdin.isRaw;
+        const cleanup = () => {
+            if (!wasRaw)
+                process.stdin.setRawMode(false);
+            process.stdout.write("\x1b[2J\x1b[H");
+        };
+        return { input: process.stdin, output: process.stdout, cleanup };
+    }
+    try {
+        const tty = require("node:tty");
+        const fs = require("node:fs");
+        const fd = fs.openSync("/dev/tty", "r+");
+        const input = new tty.ReadStream(fd);
+        const output = new tty.WriteStream(fd);
+        const cleanup = () => {
+            input.setRawMode(false);
+            input.pause();
+            output.write("\x1b[2J\x1b[H");
+            fs.closeSync(fd);
+        };
+        return { input, output, cleanup };
+    }
+    catch (err) {
+        throw new Error("No TTY available for interactive selection.");
+    }
+}
+async function chooseModel(params) {
+    const { current, source, apiKey, provider } = params;
+    const models = provider === "openai" && source === "openai" && apiKey
+        ? await fetchOpenAiModels(apiKey)
+        : provider === "openai" && source === "codex"
+            ? getCodexModelChoices()
+            : apiKey
+                ? await fetchProviderModels(provider, apiKey)
+                : getProviderModelChoices(provider);
+    return promptForModel({
+        current,
+        models
+    });
+}
+function getCodexModelChoices() {
+    return [
+        "openai-codex/gpt-5.1",
+        "openai-codex/gpt-5.1-codex-max",
+        "openai-codex/gpt-5.1-codex-mini",
+        "openai-codex/gpt-5.2",
+        "openai-codex/gpt-5.2-codex",
+        "openai-codex/gpt-5.3-codex",
+        "openai-codex/gpt-5.3-codex-spark"
+    ];
+}
+async function fetchOpenAiModels(apiKey) {
+    const res = await fetch("https://api.openai.com/v1/models", {
+        headers: {
+            Authorization: `Bearer ${apiKey}`
+        }
+    });
+    if (!res.ok) {
+        return [];
+    }
+    const data = (await res.json());
+    const ids = data.data?.map((m) => m.id) ?? [];
+    return unique(ids).sort();
+}
+function unique(items) {
+    return Array.from(new Set(items));
+}
+async function promptForModel(params) {
+    const { current, models } = params;
+    const choices = [
+        { name: `Keep current${current ? ` (${current})` : ""}`, value: undefined },
+        ...models.map((id) => ({ name: id, value: id })),
+        { name: "Custom model id…", value: "__custom__" }
+    ];
+    const selected = await selectFromList("Default model", choices);
+    if (selected === "__custom__") {
+        const custom = await askQuestion("Enter custom model id: ");
+        return custom.trim() || undefined;
+    }
+    return selected;
+}
+async function selectFromList(message, choices) {
+    return interactiveSelect(message, choices);
+}
+async function interactiveSelect(message, choices) {
+    return new Promise((resolve, reject) => {
+        const readline = require("node:readline");
+        const { input, output, cleanup: baseCleanup } = getInteractiveStreams();
+        readline.emitKeypressEvents(input);
+        input.setRawMode(true);
+        let index = 0;
+        const render = () => {
+            output.write("\x1b[2J\x1b[H");
+            output.write(`${message}\n`);
+            for (let i = 0; i < choices.length; i += 1) {
+                const prefix = i === index ? "●" : "○";
+                output.write(`${prefix} ${choices[i].name}\n`);
+            }
+            output.write("\nUse ↑/↓ to move, Enter to select.\n");
+        };
+        const onKeypress = (_, key) => {
+            if (key.ctrl && key.name === "c") {
+                cleanup();
+                reject(new Error("Selection cancelled."));
+                return;
+            }
+            if (key.name === "down") {
+                index = (index + 1) % choices.length;
+                render();
+                return;
+            }
+            if (key.name === "up") {
+                index = (index - 1 + choices.length) % choices.length;
+                render();
+                return;
+            }
+            if (key.name === "return") {
+                const value = choices[index].value;
+                cleanup();
+                resolve(value);
+            }
+        };
+        const cleanup = () => {
+            input.off("keypress", onKeypress);
+            baseCleanup();
+        };
+        input.on("keypress", onKeypress);
+        render();
+    });
+}
+async function exchangeCodeForTokens(params) {
+    const body = new URLSearchParams({
+        grant_type: "authorization_code",
+        client_id: params.clientId,
+        code_verifier: params.codeVerifier,
+        code: params.code,
+        redirect_uri: params.redirectUri
+    });
+    const res = await fetch("https://auth.openai.com/oauth/token", {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body
+    });
+    if (!res.ok) {
+        const text = await res.text();
+        throw new Error(`OAuth token exchange failed: ${res.status} ${text}`);
+    }
+    return res.json();
+}
+async function chooseProvider(current) {
+    const choices = [
+        { name: "OpenAI", value: "openai" },
+        { name: "Anthropic", value: "anthropic" },
+        { name: "Google Gemini", value: "google" },
+        { name: "Mistral", value: "mistral" },
+        { name: "xAI", value: "xai" },
+        { name: "Cohere", value: "cohere" }
+    ];
+    const selected = await selectFromList(`Provider (current: ${current})`, choices);
+    return selected ?? current;
+}
+function providerLabel(provider) {
+    switch (provider) {
+        case "openai":
+            return "OpenAI";
+        case "anthropic":
+            return "Anthropic";
+        case "google":
+            return "Google Gemini";
+        case "mistral":
+            return "Mistral";
+        case "xai":
+            return "xAI";
+        case "cohere":
+            return "Cohere";
+        default:
+            return "Provider";
+    }
+}
+function getProviderModelChoices(provider) {
+    switch (provider) {
+        case "anthropic":
+            return [
+                "claude-opus",
+                "claude-sonnet"
+            ];
+        case "google":
+            return [
+                "gemini-2.5-pro",
+                "gemini-2.5-flash"
+            ];
+        case "mistral":
+            return [
+                "codestral-latest",
+                "mistral-medium-latest"
+            ];
+        case "xai":
+            return [
+                "grok-4-1-fast-reasoning",
+                "grok-4-1-fast-non-reasoning",
+                "grok-code-fast-1"
+            ];
+        case "cohere":
+            return [
+                "command-a-03-2025",
+                "command-a-reasoning-08-2025"
+            ];
+        case "openai":
+        default:
+            return [
+                "gpt-5.2",
+                "gpt-5.1",
+                "gpt-4.1",
+                "gpt-4o-mini"
+            ];
+    }
+}
+async function fetchProviderModels(provider, apiKey) {
+    switch (provider) {
+        case "anthropic":
+            return fetchAnthropicModels(apiKey);
+        case "google":
+            return fetchGeminiModels(apiKey);
+        case "mistral":
+            return fetchMistralModels(apiKey);
+        case "cohere":
+            return fetchCohereModels(apiKey);
+        case "openai":
+            return fetchOpenAiModels(apiKey);
+        case "xai":
+        default:
+            return getProviderModelChoices(provider);
+    }
+}
+async function fetchAnthropicModels(apiKey) {
+    const res = await fetch("https://api.anthropic.com/v1/models", {
+        headers: {
+            "x-api-key": apiKey,
+            "anthropic-version": "2023-06-01"
+        }
+    });
+    if (!res.ok) {
+        console.error(`\x1b[33mWarning:\x1b[0m Anthropic models API failed (${res.status}). Using fallback list.`);
+        return getProviderModelChoices("anthropic");
+    }
+    const data = (await res.json());
+    const ids = data.data?.map((m) => m.id).filter(Boolean);
+    if (!ids?.length) {
+        console.error("\x1b[33mWarning:\x1b[0m Anthropic models API returned no models. Using fallback list.");
+    }
+    return ids?.length ? ids : getProviderModelChoices("anthropic");
+}
+async function fetchGeminiModels(apiKey) {
+    const res = await fetch(`https://generativelanguage.googleapis.com/v1beta/models?key=${apiKey}`);
+    if (!res.ok) {
+        console.error(`\x1b[33mWarning:\x1b[0m Gemini models API failed (${res.status}). Using fallback list.`);
+        return getProviderModelChoices("google");
+    }
+    const data = (await res.json());
+    const models = (data.models ?? [])
+        .filter((m) => m.supportedGenerationMethods?.includes("generateContent"))
+        .map((m) => m.name)
+        .filter(Boolean)
+        .map((name) => name.startsWith("models/") ? name.slice("models/".length) : name);
+    if (!models.length) {
+        console.error("\x1b[33mWarning:\x1b[0m Gemini models API returned no models. Using fallback list.");
+    }
+    return models.length ? models : getProviderModelChoices("google");
+}
+async function fetchMistralModels(apiKey) {
+    const res = await fetch("https://api.mistral.ai/v1/models", {
+        headers: {
+            Authorization: `Bearer ${apiKey}`
+        }
+    });
+    if (!res.ok) {
+        console.error(`\x1b[33mWarning:\x1b[0m Mistral models API failed (${res.status}). Using fallback list.`);
+        return getProviderModelChoices("mistral");
+    }
+    const data = (await res.json());
+    const ids = data.data?.map((m) => m.id).filter(Boolean);
+    if (ids?.length)
+        return ids;
+    const names = data.models?.map((m) => m.id ?? m.name).filter(Boolean);
+    if (!names?.length) {
+        console.error("\x1b[33mWarning:\x1b[0m Mistral models API returned no models. Using fallback list.");
+    }
+    return names?.length ? names : getProviderModelChoices("mistral");
+}
+async function fetchCohereModels(apiKey) {
+    const res = await fetch("https://api.cohere.com/v1/models", {
+        headers: {
+            Authorization: `Bearer ${apiKey}`
+        }
+    });
+    if (!res.ok) {
+        console.error(`\x1b[33mWarning:\x1b[0m Cohere models API failed (${res.status}). Using fallback list.`);
+        return getProviderModelChoices("cohere");
+    }
+    const data = (await res.json());
+    const names = data.models?.map((m) => m.name ?? m.id).filter(Boolean);
+    if (!names?.length) {
+        console.error("\x1b[33mWarning:\x1b[0m Cohere models API returned no models. Using fallback list.");
+    }
+    return names?.length ? names : getProviderModelChoices("cohere");
+}

package/dist/oauthStore.js

@@ -0,0 +1,48 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { getConfigDir } from "./config.js";
+const DEFAULT_PROFILE_ID = "codex";
+export function getAuthProfilesPath(env = process.env) {
+    return path.join(getConfigDir(env), "auth-profiles.json");
+}
+async function readJsonFile(filePath) {
+    try {
+        const raw = await fs.readFile(filePath, "utf8");
+        return JSON.parse(raw);
+    }
+    catch (err) {
+        if (err?.code === "ENOENT")
+            return null;
+        throw err;
+    }
+}
+async function writeJsonFile(filePath, data) {
+    await fs.mkdir(path.dirname(filePath), { recursive: true });
+    await fs.writeFile(filePath, JSON.stringify(data, null, 2), "utf8");
+}
+export async function loadAuthStore(env = process.env) {
+    const filePath = getAuthProfilesPath(env);
+    const existing = await readJsonFile(filePath);
+    return existing ?? { profiles: [] };
+}
+export async function saveAuthStore(store, env = process.env) {
+    await writeJsonFile(getAuthProfilesPath(env), store);
+}
+export async function saveOAuthProfile(profile, env = process.env) {
+    const store = await loadAuthStore(env);
+    const id = profile.id ?? DEFAULT_PROFILE_ID;
+    const normalized = { ...profile, id };
+    const next = store.profiles.filter((p) => p.id !== id);
+    next.push(normalized);
+    await saveAuthStore({ profiles: next }, env);
+    return normalized;
+}
+export async function getOAuthProfile(id, env = process.env) {
+    const store = await loadAuthStore(env);
+    return store.profiles.find((p) => p.id === id) ?? null;
+}
+export function isTokenExpired(profile, skewMs = 60_000) {
+    if (!profile.expiresAt)
+        return false;
+    return Date.now() + skewMs >= profile.expiresAt;
+}