replicas-cli 0.2.12 → 0.2.13

package/dist/commands/codex-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-auth.d.ts","sourceRoot":"","sources":["../../src/commands/codex-auth.ts"],"names":[],"mappings":"AAiBA,wBAAsB,gBAAgB,kBAkDrC"}
+{"version":3,"file":"codex-auth.d.ts","sourceRoot":"","sources":["../../src/commands/codex-auth.ts"],"names":[],"mappings":"AAIA,wBAAsB,gBAAgB,kBA2CrC"}

package/dist/commands/codex-auth.js

@@ -5,49 +5,40 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.codexAuthCommand = codexAuthCommand;
 const chalk_1 = __importDefault(require("chalk"));
-const fs_1 = __importDefault(require("fs"));
-const path_1 = __importDefault(require("path"));
-const os_1 = __importDefault(require("os"));
 const api_1 = require("../lib/api");
+const codex_oauth_1 = require("../lib/codex-oauth");
 async function codexAuthCommand() {
-    console.log(chalk_1.default.gray('Uploading Codex authentication...\n'));
-    const authJsonPath = path_1.default.join(os_1.default.homedir(), '.codex', 'auth.json');
-    let authData = null;
-    if (fs_1.default.existsSync(authJsonPath)) {
-        try {
-            const fileContent = fs_1.default.readFileSync(authJsonPath, 'utf-8');
-            authData = JSON.parse(fileContent);
-        }
-        catch (error) {
-            console.log(chalk_1.default.yellow(`  Warning: Found auth.json but failed to parse it`));
-        }
-    }
-    if (!authData) {
-        throw new Error('Could not find Codex auth.json. Expected at:\n' +
-            `  - ${authJsonPath}\n\n` +
-            'Make sure you have authenticated with Codex CLI first.');
-    }
-    console.log(chalk_1.default.gray(`  Found auth.json at: ${authJsonPath}`));
-    if (!authData.tokens || !authData.tokens.access_token || !authData.tokens.refresh_token || !authData.tokens.id_token) {
-        throw new Error('Invalid auth.json format: missing required tokens');
-    }
+    console.log(chalk_1.default.cyan('Authenticating with Codex...\n'));
     try {
+        // Run OAuth flow (opens browser, starts local server, gets tokens)
+        const tokens = await (0, codex_oauth_1.runCodexOAuthFlow)();
+        console.log(chalk_1.default.gray('\nUploading credentials to Replicas...'));
+        // Upload credentials to Replicas API
         const response = await (0, api_1.authenticatedFetch)('/v1/codex/credentials', {
             method: 'POST',
             body: {
-                access_token: authData.tokens.access_token,
-                refresh_token: authData.tokens.refresh_token,
-                id_token: authData.tokens.id_token,
+                access_token: tokens.accessToken,
+                refresh_token: tokens.refreshToken,
+                id_token: tokens.idToken,
             },
         });
-        console.log(chalk_1.default.green('\n✓ Codex credentials uploaded successfully!'));
-        console.log(chalk_1.default.gray('  Your Codex authentication will now be available in all workspaces.\n'));
+        if (response.success) {
+            console.log(chalk_1.default.green('\n✓ Codex authentication complete!'));
+            if (response.email) {
+                console.log(chalk_1.default.gray(`  Account: ${response.email}`));
+            }
+            if (response.planType) {
+                console.log(chalk_1.default.gray(`  Plan: ${response.planType}`));
+            }
+            console.log(chalk_1.default.gray('\nYou can now use Codex in your workspaces.\n'));
+        }
+        else {
+            throw new Error(response.error || 'Failed to upload Codex credentials to Replicas');
+        }
     }
     catch (error) {
-        if (error instanceof Error) {
-            throw new Error(`Failed to upload credentials: ${error.message}`);
-        }
-        throw error;
+        console.log(chalk_1.default.red('\n✗ Error:'), error instanceof Error ? error.message : error);
+        process.exit(1);
     }
 }
 //# sourceMappingURL=codex-auth.js.map

package/dist/commands/codex-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-auth.js","sourceRoot":"","sources":["../../src/commands/codex-auth.ts"],"names":[],"mappings":";;;;;AAiBA,4CAkDC;AAnED,kDAA0B;AAC1B,4CAAoB;AACpB,gDAAwB;AACxB,4CAAoB;AACpB,oCAAgD;AAazC,KAAK,UAAU,gBAAgB;IACpC,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,CAAC;IAE/D,MAAM,YAAY,GAAG,cAAI,CAAC,IAAI,CAAC,YAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IACpE,IAAI,QAAQ,GAAyB,IAAI,CAAC;IAE1C,IAAI,YAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,YAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YAC3D,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAkB,CAAC;QACtD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,MAAM,CAAC,mDAAmD,CAAC,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,gDAAgD;YAChD,OAAO,YAAY,MAAM;YACzB,wDAAwD,CACzD,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,yBAAyB,YAAY,EAAE,CAAC,CAAC,CAAC;IAEjE,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrH,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAA,wBAAkB,EACvC,uBAAuB,EACvB;YACE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE;gBACJ,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY;gBAC1C,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa;gBAC5C,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ;aACnC;SACF,CACF,CAAC;QAEF,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAC,CAAC;IACpG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"codex-auth.js","sourceRoot":"","sources":["../../src/commands/codex-auth.ts"],"names":[],"mappings":";;;;;AAIA,4CA2CC;AA/CD,kDAA0B;AAC1B,oCAAgD;AAChD,oDAAuD;AAEhD,KAAK,UAAU,gBAAgB;IACpC,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC,CAAC;IAE1D,IAAI,CAAC;QACH,mEAAmE;QACnE,MAAM,MAAM,GAAG,MAAM,IAAA,+BAAiB,GAAE,CAAC;QAEzC,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC,CAAC;QAElE,qCAAqC;QACrC,MAAM,QAAQ,GAAG,MAAM,IAAA,wBAAkB,EAMvC,uBAAuB,EACvB;YACE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE;gBACJ,YAAY,EAAE,MAAM,CAAC,WAAW;gBAChC,aAAa,EAAE,MAAM,CAAC,YAAY;gBAClC,QAAQ,EAAE,MAAM,CAAC,OAAO;aACzB;SACF,CACF,CAAC;QAEF,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC;YAC/D,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACnB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,cAAc,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAC1D,CAAC;YACD,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACtB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,WAAW,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YAC1D,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC,CAAC;QAC3E,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,gDAAgD,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACrF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/index.js

@@ -20,7 +20,7 @@ const program = new commander_1.Command();
 program
     .name('replicas')
     .description('CLI for managing Replicas workspaces')
-    .version('0.2.12');
+    .version('0.2.13');
 program
     .command('login')
     .description('Authenticate with your Replicas account')

package/dist/lib/codex-oauth.d.ts

@@ -0,0 +1,11 @@
+export interface CodexTokens {
+    idToken: string;
+    accessToken: string;
+    refreshToken: string;
+}
+/**
+ * Run the complete OAuth flow
+ * Opens browser, starts local server, waits for callback, exchanges code for tokens
+ */
+export declare function runCodexOAuthFlow(): Promise<CodexTokens>;
+//# sourceMappingURL=codex-oauth.d.ts.map

package/dist/lib/codex-oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-oauth.d.ts","sourceRoot":"","sources":["../../src/lib/codex-oauth.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAyKD;;;GAGG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,WAAW,CAAC,CAiC9D"}

package/dist/lib/codex-oauth.js

@@ -0,0 +1,183 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runCodexOAuthFlow = runCodexOAuthFlow;
+const http_1 = __importDefault(require("http"));
+const url_1 = require("url");
+const open_1 = __importDefault(require("open"));
+const pkce_1 = require("./pkce");
+const CODEX_OAUTH_CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann';
+const AUTHORIZATION_ENDPOINT = 'https://auth.openai.com/oauth/authorize';
+const TOKEN_ENDPOINT = 'https://auth.openai.com/oauth/token';
+const CALLBACK_PORT = 1455;
+const CALLBACK_PATH = '/auth/callback';
+const WEB_APP_URL = process.env.REPLICAS_WEB_URL || 'https://replicas.dev';
+/**
+ * Build OAuth authorization URL with PKCE
+ */
+function buildAuthorizationUrl(codeChallenge, state) {
+    const redirectUri = `http://localhost:${CALLBACK_PORT}${CALLBACK_PATH}`;
+    const params = new URLSearchParams({
+        response_type: 'code',
+        client_id: CODEX_OAUTH_CLIENT_ID,
+        redirect_uri: redirectUri,
+        scope: 'openid profile email offline_access',
+        code_challenge: codeChallenge,
+        code_challenge_method: 'S256',
+        id_token_add_organizations: 'true',
+        codex_cli_simplified_flow: 'true',
+        state: state,
+        originator: 'codex_cli_rs',
+    });
+    return `${AUTHORIZATION_ENDPOINT}?${params.toString()}`;
+}
+/**
+ * Exchange authorization code for tokens
+ */
+async function exchangeCodeForTokens(code, codeVerifier) {
+    const redirectUri = `http://localhost:${CALLBACK_PORT}${CALLBACK_PATH}`;
+    const params = new URLSearchParams({
+        grant_type: 'authorization_code',
+        code: code,
+        redirect_uri: redirectUri,
+        client_id: CODEX_OAUTH_CLIENT_ID,
+        code_verifier: codeVerifier,
+    });
+    const response = await fetch(TOKEN_ENDPOINT, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+        },
+        body: params.toString(),
+    });
+    if (!response.ok) {
+        const errorText = await response.text();
+        throw new Error(`Failed to exchange code for tokens: ${response.status} ${errorText}`);
+    }
+    const data = await response.json();
+    return {
+        idToken: data.id_token,
+        accessToken: data.access_token,
+        refreshToken: data.refresh_token,
+    };
+}
+/**
+ * Start local HTTP server to receive OAuth callback
+ */
+function startCallbackServer(expectedState, codeVerifier) {
+    return new Promise((resolve, reject) => {
+        const server = http_1.default.createServer(async (req, res) => {
+            try {
+                if (!req.url) {
+                    res.writeHead(400);
+                    res.end('Bad Request');
+                    return;
+                }
+                const url = new url_1.URL(req.url, `http://127.0.0.1:${CALLBACK_PORT}`);
+                // Handle callback
+                if (url.pathname === CALLBACK_PATH) {
+                    const code = url.searchParams.get('code');
+                    const state = url.searchParams.get('state');
+                    const error = url.searchParams.get('error');
+                    const errorDescription = url.searchParams.get('error_description');
+                    // Check for errors from OAuth provider
+                    if (error) {
+                        const errorMessage = encodeURIComponent(`${error}: ${errorDescription || 'Unknown error'}`);
+                        res.writeHead(302, { 'Location': `${WEB_APP_URL}/codex/oauth/error?message=${errorMessage}` });
+                        res.end();
+                        server.close();
+                        reject(new Error(`OAuth error: ${error} - ${errorDescription}`));
+                        return;
+                    }
+                    // Validate state (CSRF protection)
+                    if (state !== expectedState) {
+                        const errorMessage = encodeURIComponent('State parameter mismatch. Possible CSRF attack.');
+                        res.writeHead(302, { 'Location': `${WEB_APP_URL}/codex/oauth/error?message=${errorMessage}` });
+                        res.end();
+                        server.close();
+                        reject(new Error('State mismatch - possible CSRF attack'));
+                        return;
+                    }
+                    // Validate code
+                    if (!code) {
+                        const errorMessage = encodeURIComponent('No authorization code received.');
+                        res.writeHead(302, { 'Location': `${WEB_APP_URL}/codex/oauth/error?message=${errorMessage}` });
+                        res.end();
+                        server.close();
+                        reject(new Error('No authorization code received'));
+                        return;
+                    }
+                    // Exchange code for tokens
+                    try {
+                        const tokens = await exchangeCodeForTokens(code, codeVerifier);
+                        res.writeHead(302, { 'Location': `${WEB_APP_URL}/codex/oauth/success` });
+                        res.end();
+                        server.close();
+                        resolve(tokens);
+                    }
+                    catch (tokenError) {
+                        const errorMessage = encodeURIComponent(tokenError instanceof Error ? tokenError.message : 'Unknown error');
+                        res.writeHead(302, { 'Location': `${WEB_APP_URL}/codex/oauth/error?message=${errorMessage}` });
+                        res.end();
+                        server.close();
+                        reject(tokenError);
+                    }
+                }
+                else {
+                    res.writeHead(404);
+                    res.end('Not Found');
+                }
+            }
+            catch (serverError) {
+                res.writeHead(500);
+                res.end('Internal Server Error');
+                server.close();
+                reject(serverError);
+            }
+        });
+        // Handle server errors
+        server.on('error', (err) => {
+            if (err.code === 'EADDRINUSE') {
+                reject(new Error(`Port ${CALLBACK_PORT} is already in use. Please close any other OAuth flows and try again.`));
+            }
+            else {
+                reject(err);
+            }
+        });
+        // Start server
+        server.listen(CALLBACK_PORT, '127.0.0.1');
+    });
+}
+/**
+ * Run the complete OAuth flow
+ * Opens browser, starts local server, waits for callback, exchanges code for tokens
+ */
+async function runCodexOAuthFlow() {
+    // Generate PKCE codes and state
+    const pkce = (0, pkce_1.generatePkceCodes)();
+    const state = (0, pkce_1.generateState)();
+    // Build authorization URL
+    const authUrl = buildAuthorizationUrl(pkce.codeChallenge, state);
+    // Start callback server (non-blocking)
+    const tokensPromise = startCallbackServer(state, pkce.codeVerifier);
+    // Wait a moment for server to start
+    await new Promise(resolve => setTimeout(resolve, 500));
+    console.log('If the browser does not open automatically, visit:');
+    console.log(authUrl);
+    console.log();
+    // Open browser
+    try {
+        await (0, open_1.default)(authUrl);
+    }
+    catch (openError) {
+        console.warn('Failed to open browser automatically. Please open the URL manually.');
+    }
+    console.log('Waiting for authentication...');
+    // Wait for callback and token exchange
+    const tokens = await tokensPromise;
+    console.log('✓ Successfully obtained Codex credentials');
+    return tokens;
+}
+//# sourceMappingURL=codex-oauth.js.map

package/dist/lib/codex-oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-oauth.js","sourceRoot":"","sources":["../../src/lib/codex-oauth.ts"],"names":[],"mappings":";;;;;AA6LA,8CAiCC;AA9ND,gDAAwB;AACxB,6BAA0B;AAC1B,gDAAwB;AACxB,iCAA0D;AAE1D,MAAM,qBAAqB,GAAG,8BAA8B,CAAC;AAC7D,MAAM,sBAAsB,GAAG,yCAAyC,CAAC;AACzE,MAAM,cAAc,GAAG,qCAAqC,CAAC;AAC7D,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,aAAa,GAAG,gBAAgB,CAAC;AACvC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,sBAAsB,CAAC;AAc3E;;GAEG;AACH,SAAS,qBAAqB,CAC5B,aAAqB,EACrB,KAAa;IAEb,MAAM,WAAW,GAAG,oBAAoB,aAAa,GAAG,aAAa,EAAE,CAAC;IAExE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,aAAa,EAAE,MAAM;QACrB,SAAS,EAAE,qBAAqB;QAChC,YAAY,EAAE,WAAW;QACzB,KAAK,EAAE,qCAAqC;QAC5C,cAAc,EAAE,aAAa;QAC7B,qBAAqB,EAAE,MAAM;QAC7B,0BAA0B,EAAE,MAAM;QAClC,yBAAyB,EAAE,MAAM;QACjC,KAAK,EAAE,KAAK;QACZ,UAAU,EAAE,cAAc;KAC3B,CAAC,CAAC;IAEH,OAAO,GAAG,sBAAsB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC1D,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,qBAAqB,CAClC,IAAY,EACZ,YAAoB;IAEpB,MAAM,WAAW,GAAG,oBAAoB,aAAa,GAAG,aAAa,EAAE,CAAC;IAExE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,UAAU,EAAE,oBAAoB;QAChC,IAAI,EAAE,IAAI;QACV,YAAY,EAAE,WAAW;QACzB,SAAS,EAAE,qBAAqB;QAChC,aAAa,EAAE,YAAY;KAC5B,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,cAAc,EAAE;QAC3C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;SACpD;QACD,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;KACxB,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,uCAAuC,QAAQ,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,IAAI,GAAkB,MAAM,QAAQ,CAAC,IAAI,EAAmB,CAAC;IAEnE,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,QAAQ;QACtB,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;KACjC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAC1B,aAAqB,EACrB,YAAoB;IAEpB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,cAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YAClD,IAAI,CAAC;gBACH,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;oBACb,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBACnB,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;oBACvB,OAAO;gBACT,CAAC;gBAED,MAAM,GAAG,GAAG,IAAI,SAAG,CAAC,GAAG,CAAC,GAAG,EAAE,oBAAoB,aAAa,EAAE,CAAC,CAAC;gBAElE,kBAAkB;gBAClB,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;oBACnC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBAC5C,MAAM,gBAAgB,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;oBAEnE,uCAAuC;oBACvC,IAAI,KAAK,EAAE,CAAC;wBACV,MAAM,YAAY,GAAG,kBAAkB,CAAC,GAAG,KAAK,KAAK,gBAAgB,IAAI,eAAe,EAAE,CAAC,CAAC;wBAC5F,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,GAAG,WAAW,8BAA8B,YAAY,EAAE,EAAE,CAAC,CAAC;wBAC/F,GAAG,CAAC,GAAG,EAAE,CAAC;wBACV,MAAM,CAAC,KAAK,EAAE,CAAC;wBACf,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,KAAK,MAAM,gBAAgB,EAAE,CAAC,CAAC,CAAC;wBACjE,OAAO;oBACT,CAAC;oBAED,mCAAmC;oBACnC,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;wBAC5B,MAAM,YAAY,GAAG,kBAAkB,CAAC,iDAAiD,CAAC,CAAC;wBAC3F,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,GAAG,WAAW,8BAA8B,YAAY,EAAE,EAAE,CAAC,CAAC;wBAC/F,GAAG,CAAC,GAAG,EAAE,CAAC;wBACV,MAAM,CAAC,KAAK,EAAE,CAAC;wBACf,MAAM,CAAC,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAC;wBAC3D,OAAO;oBACT,CAAC;oBAED,gBAAgB;oBAChB,IAAI,CAAC,IAAI,EAAE,CAAC;wBACV,MAAM,YAAY,GAAG,kBAAkB,CAAC,iCAAiC,CAAC,CAAC;wBAC3E,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,GAAG,WAAW,8BAA8B,YAAY,EAAE,EAAE,CAAC,CAAC;wBAC/F,GAAG,CAAC,GAAG,EAAE,CAAC;wBACV,MAAM,CAAC,KAAK,EAAE,CAAC;wBACf,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;wBACpD,OAAO;oBACT,CAAC;oBAED,2BAA2B;oBAC3B,IAAI,CAAC;wBACH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;wBAE/D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,GAAG,WAAW,sBAAsB,EAAE,CAAC,CAAC;wBACzE,GAAG,CAAC,GAAG,EAAE,CAAC;wBAEV,MAAM,CAAC,KAAK,EAAE,CAAC;wBACf,OAAO,CAAC,MAAM,CAAC,CAAC;oBAClB,CAAC;oBAAC,OAAO,UAAU,EAAE,CAAC;wBACpB,MAAM,YAAY,GAAG,kBAAkB,CAAC,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;wBAC5G,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,GAAG,WAAW,8BAA8B,YAAY,EAAE,EAAE,CAAC,CAAC;wBAC/F,GAAG,CAAC,GAAG,EAAE,CAAC;wBACV,MAAM,CAAC,KAAK,EAAE,CAAC;wBACf,MAAM,CAAC,UAAU,CAAC,CAAC;oBACrB,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACvB,CAAC;YACH,CAAC;YAAC,OAAO,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;gBACjC,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,WAAW,CAAC,CAAC;YACtB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,uBAAuB;QACvB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,IAAK,GAA6B,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACzD,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,aAAa,uEAAuE,CAAC,CAAC,CAAC;YAClH,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,eAAe;QACf,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,iBAAiB;IACrC,gCAAgC;IAChC,MAAM,IAAI,GAAG,IAAA,wBAAiB,GAAE,CAAC;IACjC,MAAM,KAAK,GAAG,IAAA,oBAAa,GAAE,CAAC;IAE9B,0BAA0B;IAC1B,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IAEjE,uCAAuC;IACvC,MAAM,aAAa,GAAG,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAEpE,oCAAoC;IACpC,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IAEvD,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrB,OAAO,CAAC,GAAG,EAAE,CAAC;IAEd,eAAe;IACf,IAAI,CAAC;QACH,MAAM,IAAA,cAAI,EAAC,OAAO,CAAC,CAAC;IACtB,CAAC;IAAC,OAAO,SAAS,EAAE,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;IACtF,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;IAE7C,uCAAuC;IACvC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;IAEnC,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;IAEzD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/lib/pkce.d.ts

@@ -0,0 +1,14 @@
+export interface PkceCodes {
+    codeVerifier: string;
+    codeChallenge: string;
+}
+/**
+ * Generate PKCE (Proof Key for Code Exchange) codes for OAuth flow
+ * Implements RFC 7636 for enhanced security
+ */
+export declare function generatePkceCodes(): PkceCodes;
+/**
+ * Generate random state for OAuth flow
+ */
+export declare function generateState(): string;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/lib/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../src/lib/pkce.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,SAAS;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,SAAS,CAsB7C;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC"}

package/dist/lib/pkce.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generatePkceCodes = generatePkceCodes;
+exports.generateState = generateState;
+const crypto_1 = require("crypto");
+/**
+ * Generate PKCE (Proof Key for Code Exchange) codes for OAuth flow
+ * Implements RFC 7636 for enhanced security
+ */
+function generatePkceCodes() {
+    // Generate 32 random bytes for code verifier
+    const verifierBytes = (0, crypto_1.randomBytes)(32);
+    const codeVerifier = verifierBytes
+        .toString('base64')
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=+$/, '');
+    // Create SHA256 hash for code challenge
+    const hash = (0, crypto_1.createHash)('sha256');
+    hash.update(codeVerifier);
+    const codeChallenge = hash
+        .digest('base64')
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=+$/, '');
+    return {
+        codeVerifier,
+        codeChallenge,
+    };
+}
+/**
+ * Generate random state for OAuth flow
+ */
+function generateState() {
+    return (0, crypto_1.randomBytes)(16).toString('hex');
+}
+//# sourceMappingURL=pkce.js.map

package/dist/lib/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../src/lib/pkce.ts"],"names":[],"mappings":";;AAWA,8CAsBC;AAKD,sCAEC;AAxCD,mCAAiD;AAOjD;;;GAGG;AACH,SAAgB,iBAAiB;IAC/B,6CAA6C;IAC7C,MAAM,aAAa,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC;IACtC,MAAM,YAAY,GAAG,aAAa;SAC/B,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAEtB,wCAAwC;IACxC,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1B,MAAM,aAAa,GAAG,IAAI;SACvB,MAAM,CAAC,QAAQ,CAAC;SAChB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAEtB,OAAO;QACL,YAAY;QACZ,aAAa;KACd,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,aAAa;IAC3B,OAAO,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replicas-cli",
-  "version": "0.2.12",
+  "version": "0.2.13",
   "description": "CLI for managing Replicas workspaces - SSH into cloud dev environments with automatic port forwarding",
   "main": "dist/index.js",
   "bin": {