projectinator 0.3.1 → 0.4.0

package/src/web/oauth-anthropic.ts

@@ -1,206 +0,0 @@
-// Anthropic OAuth (PKCE) — "connect with your Claude Pro/Max subscription".
-//
-// This reuses Claude Code's own OAuth client_id, so every call must be disguised
-// as Claude Code to be accepted. As of Jan 2026 Anthropic enforces this
-// server-side (consumer tokens are rejected outside Claude Code / claude.ai), and
-// third-party use violates their Consumer ToS (account-ban risk). We build it
-// because you asked for the connect-link UX and to test whether the token still
-// works — treat any 401/403 on the test as "enforcement won, fall back".
-//
-// Flow: buildAuthorizeUrl() → user approves in browser → copies the code shown on
-// the callback page → exchangeCode() → tokens stored → refresh() as needed.
-
-import { createHash, randomBytes } from "node:crypto";
-import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-
-const CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
-const AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
-const TOKEN_URL = "https://console.anthropic.com/v1/oauth/token";
-// The only redirect registered for this client's manual flow. The callback page
-// on console.anthropic.com displays the code for you to copy.
-const REDIRECT_URI = "https://console.anthropic.com/oauth/code/callback";
-const SCOPES = "org:create_api_key user:profile user:inference";
-
-// Claude Code's request signature — required or the token is rejected.
-const CC_BETA = "oauth-2025-04-20,claude-code-20250219";
-const CC_UA = "claude-cli/1.0.0 (external, cli)";
-const CC_SYSTEM = "You are Claude Code, Anthropic's official CLI for Claude.";
-
-interface StoredTokens {
-  access_token: string;
-  refresh_token: string;
-  expires_at: number; // epoch ms
-}
-
-function tokenPath(): string {
-  const dir = join(homedir(), ".projectinator", "web", "claude");
-  mkdirSync(dir, { recursive: true });
-  return join(dir, "oauth.json");
-}
-
-export function hasOAuth(): boolean {
-  return existsSync(tokenPath());
-}
-
-export function clearOAuth(): void {
-  try { rmSync(tokenPath(), { force: true }); } catch { /* non-fatal */ }
-}
-
-function saveTokens(t: StoredTokens): void {
-  const p = tokenPath();
-  writeFileSync(p, JSON.stringify(t, null, 2));
-  try { chmodSync(p, 0o600); } catch { /* best effort */ }
-}
-
-function loadTokens(): StoredTokens | null {
-  try {
-    return JSON.parse(readFileSync(tokenPath(), "utf8")) as StoredTokens;
-  } catch {
-    return null;
-  }
-}
-
-// ---- PKCE ----
-function b64url(buf: Buffer): string {
-  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-
-export interface PendingAuth {
-  url: string;
-  verifier: string;
-  state: string;
-}
-
-/** Build the authorize URL + PKCE material. Param order matches Claude Code and
- *  scope spaces are %20-encoded (claude.ai rejects the '+' that URLSearchParams
- *  emits → "Invalid request format"). */
-export function buildAuthorizeUrl(): PendingAuth {
-  const verifier = b64url(randomBytes(32));
-  const challenge = b64url(createHash("sha256").update(verifier).digest());
-  const state = b64url(randomBytes(16));
-  const params = new URLSearchParams({
-    client_id: CLIENT_ID,
-    response_type: "code",
-    redirect_uri: REDIRECT_URI,
-    scope: SCOPES,
-    code_challenge_method: "S256",
-    state,
-    code_challenge: challenge,
-  });
-  return { url: `${AUTHORIZE_URL}?${params.toString().replace(/\+/g, "%20")}`, verifier, state };
-}
-
-/** Exchange the code copied from the callback page. It may arrive as "CODE#STATE". */
-export async function exchangeCode(rawCode: string, pending: PendingAuth): Promise<void> {
-  const [code, stateFromCode] = rawCode.trim().split("#");
-  const res = await fetch(TOKEN_URL, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({
-      grant_type: "authorization_code",
-      code,
-      state: stateFromCode ?? pending.state,
-      client_id: CLIENT_ID,
-      redirect_uri: REDIRECT_URI,
-      code_verifier: pending.verifier,
-    }),
-  });
-  if (!res.ok) {
-    throw new Error(`Token exchange failed (${res.status}): ${(await res.text()).slice(0, 200)}`);
-  }
-  const j = (await res.json()) as { access_token: string; refresh_token: string; expires_in: number };
-  saveTokens({
-    access_token: j.access_token,
-    refresh_token: j.refresh_token,
-    expires_at: nowMs() + (j.expires_in ?? 3600) * 1000,
-  });
-}
-
-async function refresh(t: StoredTokens): Promise<StoredTokens> {
-  const res = await fetch(TOKEN_URL, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({
-      grant_type: "refresh_token",
-      refresh_token: t.refresh_token,
-      client_id: CLIENT_ID,
-    }),
-  });
-  if (!res.ok) {
-    throw new Error(`Token refresh failed (${res.status}): ${(await res.text()).slice(0, 200)}`);
-  }
-  const j = (await res.json()) as { access_token: string; refresh_token?: string; expires_in: number };
-  const next: StoredTokens = {
-    access_token: j.access_token,
-    refresh_token: j.refresh_token ?? t.refresh_token,
-    expires_at: nowMs() + (j.expires_in ?? 3600) * 1000,
-  };
-  saveTokens(next);
-  return next;
-}
-
-async function validAccessToken(): Promise<string> {
-  const t = loadTokens();
-  if (!t) throw new Error("Not connected. Run the Claude OAuth connect flow first.");
-  if (nowMs() > t.expires_at - 60_000) {
-    return (await refresh(t)).access_token;
-  }
-  return t.access_token;
-}
-
-// nowMs isolated so the "no Date.now in workflow scripts" rule never bites here
-// (this module runs in the app/CLI, not a workflow script).
-function nowMs(): number {
-  return Date.now();
-}
-
-export interface OAuthMessage {
-  role: "user" | "assistant";
-  content: string;
-}
-
-/** Call the Messages API with the OAuth token, disguised as Claude Code.
- *  Returns the assistant text. Tool-calling can be layered on later. */
-export async function oauthComplete(
-  messages: OAuthMessage[],
-  opts: { model?: string; system?: string; maxTokens?: number } = {},
-): Promise<string> {
-  const token = await validAccessToken();
-  // Claude Code always leads the system prompt with its identity line; the token
-  // is rejected without it. Any extra system text is appended after.
-  const system = [
-    { type: "text", text: CC_SYSTEM },
-    ...(opts.system ? [{ type: "text", text: opts.system }] : []),
-  ];
-  const res = await fetch("https://api.anthropic.com/v1/messages", {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      "Authorization": `Bearer ${token}`,
-      "anthropic-version": "2023-06-01",
-      "anthropic-beta": CC_BETA,
-      "anthropic-dangerous-direct-browser-access": "true",
-      "x-app": "cli",
-      "user-agent": CC_UA,
-    },
-    body: JSON.stringify({
-      model: opts.model ?? "claude-sonnet-5",
-      max_tokens: opts.maxTokens ?? 1024,
-      system,
-      messages: messages.map((m) => ({ role: m.role, content: m.content })),
-    }),
-  });
-  if (!res.ok) {
-    const body = (await res.text()).slice(0, 300);
-    throw new Error(`Messages API ${res.status}: ${body}\n(401/403 here = Jan-2026 enforcement rejecting a non-Claude-Code client)`);
-  }
-  const j = (await res.json()) as { content?: { type: string; text?: string }[] };
-  return (j.content ?? []).filter((b) => b.type === "text").map((b) => b.text ?? "").join("").trim();
-}
-
-/** Quick connectivity/enforcement probe. Returns the reply or throws with the status. */
-export async function oauthTest(): Promise<string> {
-  return oauthComplete([{ role: "user", content: "Reply with exactly one word: hello" }], { maxTokens: 16 });
-}

package/src/web/session.ts

@@ -1,299 +0,0 @@
-// EXPERIMENTAL web-login backend. Drives a provider's WEB UI (logged into your paid
-// subscription) in a persistent Chromium profile to get ~free completions.
-//
-// Caveats you accepted: brittle (site DOM changes break selectors), against provider
-// ToS (account-ban risk), TEXT ONLY (no tool-calling / no file tools), slow.
-//
-// Selectors live in PROVIDERS below — when a site changes, edit them there.
-
-import { chromium, type BrowserContext, type Page } from "playwright";
-import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-import { createInterface } from "node:readline";
-
-export type WebProvider = "chatgpt" | "claude" | "gemini";
-
-interface ProviderConfig {
-  label: string;
-  newChatUrl: string;
-  /** The message input (contenteditable or textarea). */
-  inputSelector: string;
-  /** Selector matching every assistant message; we read the last one. */
-  assistantSelector: string;
-  /** Selector for the "stop generating" control — present while streaming. */
-  stopSelector: string;
-}
-
-const PROVIDERS: Record<WebProvider, ProviderConfig> = {
-  claude: {
-    label: "Claude (claude.ai)",
-    newChatUrl: "https://claude.ai/new",
-    inputSelector: 'div[contenteditable="true"]',
-    assistantSelector: '[class*="claude"]',
-    stopSelector: '[data-is-streaming="true"]',
-  },
-  chatgpt: {
-    label: "ChatGPT (chatgpt.com)",
-    newChatUrl: "https://chatgpt.com/",
-    inputSelector: '#prompt-textarea, div[contenteditable="true"], textarea',
-    assistantSelector: '[data-message-author-role="assistant"]',
-    stopSelector: 'button[data-testid="stop-button"], button[aria-label*="Stop"]',
-  },
-  gemini: {
-    label: "Gemini (gemini.google.com)",
-    newChatUrl: "https://gemini.google.com/app",
-    inputSelector: 'rich-textarea div[contenteditable="true"], div[contenteditable="true"], textarea',
-    assistantSelector: "message-content, .model-response-text",
-    stopSelector: 'button[aria-label*="Stop"], button[aria-label*="stop"]',
-  },
-};
-
-function profileDir(provider: WebProvider): string {
-  const dir = join(homedir(), ".projectinator", "web", provider);
-  mkdirSync(dir, { recursive: true });
-  return dir;
-}
-
-function connectedMarker(provider: WebProvider): string {
-  return join(profileDir(provider), ".connected");
-}
-
-/** Has this provider been logged in at least once (session saved)? */
-export function isConnected(provider: WebProvider): boolean {
-  return existsSync(connectedMarker(provider));
-}
-
-/** Which providers have a saved session. */
-export function connectedProviders(): WebProvider[] {
-  return (Object.keys(PROVIDERS) as WebProvider[]).filter(isConnected);
-}
-
-function markConnected(provider: WebProvider): void {
-  try {
-    writeFileSync(connectedMarker(provider), new Date().toISOString());
-  } catch {
-    /* non-fatal */
-  }
-}
-
-/** Log out: wipe the saved session (cookies + profile) for a provider. */
-export function disconnect(provider: WebProvider): void {
-  try {
-    rmSync(profileDir(provider), { recursive: true, force: true });
-  } catch {
-    /* non-fatal */
-  }
-}
-
-// Push the run window far off-screen so it drives the session without stealing
-// focus or cluttering the desktop. Login windows stay on-screen (you interact).
-const OFFSCREEN_ARGS = ["--window-position=-3200,-3200", "--window-size=1280,900"];
-
-async function openContext(
-  provider: WebProvider,
-  opts: { headless: boolean; offscreen?: boolean },
-): Promise<BrowserContext> {
-  return chromium.launchPersistentContext(profileDir(provider), {
-    headless: opts.headless,
-    viewport: { width: 1280, height: 900 },
-    args: [
-      "--disable-blink-features=AutomationControlled",
-      ...(opts.offscreen ? OFFSCREEN_ARGS : []),
-    ],
-  });
-}
-
-// One long-lived background browser per provider, reused across completions so
-// nothing pops up per task. Launched on first webComplete, closed on app exit.
-const runContexts = new Map<WebProvider, BrowserContext>();
-
-async function runContext(provider: WebProvider): Promise<BrowserContext> {
-  const existing = runContexts.get(provider);
-  if (existing) return existing;
-  const ctx = await openContext(provider, { headless: false, offscreen: true });
-  ctx.on("close", () => {
-    if (runContexts.get(provider) === ctx) runContexts.delete(provider);
-  });
-  runContexts.set(provider, ctx);
-  return ctx;
-}
-
-/** Close every background browser. Call on app exit. */
-export async function closeWebSessions(): Promise<void> {
-  const ctxs = [...runContexts.values()];
-  runContexts.clear();
-  await Promise.all(ctxs.map((c) => c.close().catch(() => {})));
-}
-
-/** Open a real browser window so you can log in once; the session is saved to disk. */
-export async function webLogin(provider: WebProvider): Promise<void> {
-  const cfg = PROVIDERS[provider];
-  const ctx = await openContext(provider, { headless: false });
-  const page = ctx.pages()[0] ?? (await ctx.newPage());
-  // Non-fatal: even if the page is slow / behind a challenge, the window is open
-  // and you can log in (or navigate) manually.
-  try {
-    await page.goto(cfg.newChatUrl, { waitUntil: "commit", timeout: 60_000 });
-  } catch {
-    /* keep the window open regardless */
-  }
-  process.stdout.write(`\n  A browser opened for ${cfg.label}.\n  Log in there (wait for it to load), then press Enter here to save the session…`);
-  await new Promise<void>((resolve) => {
-    const rl = createInterface({ input: process.stdin, output: process.stdout });
-    rl.question("", () => {
-      rl.close();
-      resolve();
-    });
-  });
-  await ctx.close();
-  markConnected(provider);
-  process.stdout.write("  Session saved.\n");
-}
-
-/** Non-interactive login for the TUI: open the login window and resolve once the
- *  caller signals done (e.g. user pressed a key in the app). Returns a handle to
- *  finish. The window shows the real site so you can log in. */
-export async function webLoginBegin(provider: WebProvider): Promise<{
-  finish: () => Promise<void>;
-  cancel: () => Promise<void>;
-}> {
-  const cfg = PROVIDERS[provider];
-  const ctx = await openContext(provider, { headless: false });
-  const page = ctx.pages()[0] ?? (await ctx.newPage());
-  try {
-    await page.goto(cfg.newChatUrl, { waitUntil: "commit", timeout: 60_000 });
-  } catch {
-    /* keep the window open regardless */
-  }
-  return {
-    finish: async () => {
-      await ctx.close();
-      markConnected(provider);
-    },
-    cancel: async () => {
-      await ctx.close();
-    },
-  };
-}
-
-async function lastAssistantText(page: Page, cfg: ProviderConfig): Promise<string> {
-  const nodes = page.locator(cfg.assistantSelector);
-  const count = await nodes.count();
-  if (count === 0) return "";
-  return (await nodes.nth(count - 1).innerText()).trim();
-}
-
-/** Send one prompt to the provider's web UI and return the reply text.
- *  Runs HEADED by default — claude.ai/chatgpt block headless browsers. Set
- *  opts.headless=true to try headless (often challenged). */
-export async function webComplete(
-  provider: WebProvider,
-  prompt: string,
-  opts: { headless?: boolean; timeoutMs?: number } = {},
-): Promise<string> {
-  const cfg = PROVIDERS[provider];
-  const timeoutMs = opts.timeoutMs ?? 90_000;
-  // Reuse the one background browser; open a fresh page (= fresh chat) per ask.
-  const ctx = await runContext(provider);
-  const page = await ctx.newPage();
-  try {
-    try {
-      await page.goto(cfg.newChatUrl, { waitUntil: "commit", timeout: 60_000 });
-    } catch {
-      /* proceed — the input wait below is the real readiness check */
-    }
-
-    const input = page.locator(cfg.inputSelector).first();
-    try {
-      await input.waitFor({ state: "visible", timeout: 45_000 });
-    } catch (e) {
-      // Diagnose: dump what actually loaded so we can fix selectors / spot a challenge.
-      const shot = join(profileDir(provider), "debug.png");
-      try { await page.screenshot({ path: shot, fullPage: false }); } catch { /* ignore */ }
-      const url = page.url();
-      const title = await page.title().catch(() => "");
-      const body = (await page.locator("body").innerText().catch(() => "")).slice(0, 200).replace(/\s+/g, " ");
-      throw new Error(
-        `Input never appeared.\n    url: ${url}\n    title: ${title}\n    page text: "${body}…"\n    screenshot: ${shot}\n    (looks like a login/challenge page? → the session may not be carrying over, or the selector changed)`,
-      );
-    }
-    await input.click();
-    await input.fill(prompt);
-    await page.keyboard.press("Enter");
-
-    // Wait for a reply to appear, then for it to stop changing.
-    const deadline = Date.now() + timeoutMs;
-    let last = "";
-    let stable = 0;
-    while (Date.now() < deadline) {
-      try {
-        await page.waitForTimeout(700);
-        const text = await lastAssistantText(page, cfg);
-        const streaming = (await page.locator(cfg.stopSelector).count()) > 0;
-        if (text && text === last && !streaming) {
-          stable++;
-          if (stable >= 3) return text; // ~2s unchanged and not streaming → done
-        } else {
-          stable = 0;
-        }
-        last = text;
-      } catch {
-        break; // page/context closed — return whatever we captured
-      }
-    }
-    if (last) return last;
-    throw new Error("No response captured (selectors may be stale, or you're not logged in).");
-  } finally {
-    await page.close().catch(() => {}); // keep the context alive for the next ask
-  }
-}
-
-/** Diagnostic: send a prompt, wait, then dump candidate selectors so we can find the
- *  right one for the assistant reply. Headed. */
-export async function webDump(provider: WebProvider, prompt: string): Promise<void> {
-  const cfg = PROVIDERS[provider];
-  const ctx = await openContext(provider, { headless: false });
-  try {
-    const page = ctx.pages()[0] ?? (await ctx.newPage());
-    try { await page.goto(cfg.newChatUrl, { waitUntil: "commit", timeout: 60_000 }); } catch { /* ignore */ }
-    const input = page.locator(cfg.inputSelector).first();
-    await input.waitFor({ state: "visible", timeout: 45_000 });
-    await input.click();
-    await input.fill(prompt);
-    await page.keyboard.press("Enter");
-    console.log("  sent — waiting 18s for the reply to render…");
-    await page.waitForTimeout(18_000);
-
-    const report = await page.evaluate(() => {
-      const cands = [
-        // chatgpt
-        '[data-message-author-role="assistant"]', ".markdown",
-        // gemini
-        "message-content", ".model-response-text", "model-response",
-        // claude
-        '[class*="claude"]', ".font-claude-message", "[data-is-streaming]",
-        // generic
-        ".prose", '[class*="message"]', "[data-testid]", "main div[tabindex]",
-      ];
-      const out: { sel: string; count: number; lastText: string }[] = [];
-      for (const sel of cands) {
-        const els = document.querySelectorAll(sel);
-        const last = els[els.length - 1] as HTMLElement | undefined;
-        out.push({ sel, count: els.length, lastText: (last?.innerText ?? "").slice(0, 100).replace(/\s+/g, " ") });
-      }
-      return { url: location.href, title: document.title, cands: out };
-    });
-    console.log("\n  url:", report.url, "\n  title:", report.title, "\n  --- candidate selectors ---");
-    for (const c of report.cands) console.log(`  [${c.count}] ${c.sel}\n        last: "${c.lastText}"`);
-    console.log("");
-  } finally {
-    await ctx.close();
-  }
-}
-
-export function isWebProvider(s: string): s is WebProvider {
-  return s === "chatgpt" || s === "claude" || s === "gemini";
-}
-
-export { PROVIDERS };