rovecode 0.3.3 → 0.4.0-beta.2

package/src/providers/oauth/device-code.ts

@@ -1,107 +0,0 @@
-/** OAuth 2.0 device-authorization polling (RFC 8628 §3.4–3.5) — VENDORED from pi.
- *
- *  Source: earendil-works/pi, packages/ai/src/auth/oauth/device-code.ts (snapshot under
- *  research/source_snapshots/earendil-works-pi, @earendil-works/ai 0.84.4). License: MIT —
- *
- *    Copyright (c) 2025 Mario Zechner
- *
- *    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
- *    associated documentation files (the "Software"), to deal in the Software without restriction,
- *    including without limitation the rights to use, copy, modify, merge, publish, distribute,
- *    sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is
- *    furnished to do so, subject to the following conditions: The above copyright notice and this
- *    permission notice shall be included in all copies or substantial portions of the Software.
- *    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT
- *    NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
- *    NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
- *    DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- *    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
- *
- *  Local changes (port #66): `sleep` and `now` are injectable (the tests drive pending → slow_down →
- *  complete with a recording sleep and a fixed clock, and pin the interval arithmetic); the default
- *  sleep is pi's abortableSleep; the messages lose the WSL clock-drift paragraph's second sentence.
- *  Semantics unchanged: a missing `interval` means 5 s (§3.2), `slow_down` adds 5 s (§3.5) unless the
- *  server states a new interval (GitHub does), never faster than 1 s, deadline = `expires_in`. */
-
-const CANCEL_MESSAGE = "login cancelled";
-const TIMEOUT_MESSAGE = "device flow timed out";
-const SLOW_DOWN_TIMEOUT_MESSAGE = "device flow timed out after one or more slow_down responses (often clock drift in a WSL/VM — sync the clock and retry)";
-const MINIMUM_INTERVAL_MS = 1000;
-/** RFC 8628 §3.2: when the server omits `interval` the client polls every 5 s */
-const DEFAULT_POLL_INTERVAL_SECONDS = 5;
-/** RFC 8628 §3.5: `slow_down` means the interval grows by 5 s */
-const SLOW_DOWN_INTERVAL_INCREMENT_MS = 5000;
-
-type DeviceCodeIncompletePollResult =
-  | { status: "pending" }
-  | { status: "slow_down"; intervalSeconds?: number }
-  | { status: "failed"; message: string };
-
-export type DeviceCodePollResult<T> = DeviceCodeIncompletePollResult | { status: "complete"; value: T };
-
-export interface DeviceCodePollOptions<T> {
-  intervalSeconds?: number;
-  expiresInSeconds?: number;
-  /** wait one interval before the first poll (GitHub's flow; the user has not even seen the code yet) */
-  waitBeforeFirstPoll?: boolean;
-  poll: () => Promise<DeviceCodePollResult<T>>;
-  signal: AbortSignal;
-  /** injectable timer (default abortableSleep) */
-  sleep?: (ms: number, signal: AbortSignal) => Promise<void>;
-  /** injectable clock (default Date.now) */
-  now?: () => number;
-}
-
-export function abortableSleep(ms: number, signal: AbortSignal, cancelMessage: string = CANCEL_MESSAGE): Promise<void> {
-  return new Promise((resolve, reject) => {
-    if (signal.aborted) {
-      reject(new Error(cancelMessage));
-      return;
-    }
-    const onAbort = () => {
-      clearTimeout(timeout);
-      reject(new Error(cancelMessage));
-    };
-    const timeout = setTimeout(() => {
-      signal.removeEventListener("abort", onAbort);
-      resolve();
-    }, ms);
-    signal.addEventListener("abort", onAbort, { once: true });
-  });
-}
-
-export async function pollDeviceCodeFlow<T>(options: DeviceCodePollOptions<T>): Promise<T> {
-  const now = options.now ?? Date.now;
-  const sleep = options.sleep ?? abortableSleep;
-  const deadline = typeof options.expiresInSeconds === "number" ? now() + options.expiresInSeconds * 1000 : Number.POSITIVE_INFINITY;
-  let intervalMs = Math.max(MINIMUM_INTERVAL_MS, Math.floor((options.intervalSeconds ?? DEFAULT_POLL_INTERVAL_SECONDS) * 1000));
-
-  let slowDownResponses = 0;
-  if (options.waitBeforeFirstPoll) {
-    const remainingMs = deadline - now();
-    if (remainingMs > 0) await sleep(Math.min(intervalMs, remainingMs), options.signal);
-  }
-
-  while (now() < deadline) {
-    if (options.signal.aborted) throw new Error(CANCEL_MESSAGE);
-
-    const result = await options.poll();
-    if (result.status === "complete") return result.value;
-    if (result.status === "failed") throw new Error(result.message);
-    if (result.status === "slow_down") {
-      slowDownResponses += 1;
-      // Use the server-provided interval when given (GitHub reports the new required minimum in
-      // `interval`); trusting only a client-tracked value risks polling early forever under WSL/VM
-      // clock drift. Otherwise apply RFC 8628 §3.5: increase by 5 seconds.
-      intervalMs = typeof result.intervalSeconds === "number" && Number.isFinite(result.intervalSeconds) && result.intervalSeconds > 0
-        ? Math.max(MINIMUM_INTERVAL_MS, Math.floor(result.intervalSeconds * 1000))
-        : Math.max(MINIMUM_INTERVAL_MS, intervalMs + SLOW_DOWN_INTERVAL_INCREMENT_MS);
-    }
-
-    const remainingMs = deadline - now();
-    if (remainingMs <= 0) break;
-    await sleep(Math.min(intervalMs, remainingMs), options.signal);
-  }
-
-  throw new Error(slowDownResponses > 0 ? SLOW_DOWN_TIMEOUT_MESSAGE : TIMEOUT_MESSAGE);
-}

package/src/providers/oauth/github-copilot.ts

@@ -1,146 +0,0 @@
-/** GitHub Copilot OAuth (port #66): the GitHub device-code flow, then the Copilot token exchange.
- *
- *  Ported from pi packages/ai/src/auth/oauth/github-copilot.ts (earendil-works/pi, MIT — Copyright (c)
- *  2025 Mario Zechner; snapshot under research/source_snapshots/earendil-works-pi). Kept as pi has it:
- *  - POST /login/device/code with the Copilot Chat client id + scope read:user → user_code +
- *    verification_uri + interval + expires_in; the verification URI must parse as http(s) (never handed
- *    to an opener otherwise);
- *  - poll POST /login/oauth/access_token (grant urn:ietf:params:oauth:grant-type:device_code) through
- *    pollDeviceCodeFlow, waiting one interval before the first poll; `authorization_pending` → pending,
- *    `slow_down` → the server's new `interval`; a 200 body with `error` is how GitHub reports both;
- *  - the GitHub OAuth token is the long-lived REFRESH credential; GET api.github.com/copilot_internal/
- *    v2/token (Bearer <github token> + the Copilot editor headers) mints the short-lived Copilot
- *    token (`token`, `expires_at` seconds) — stored as `access` with a 5-minute early expiry;
- *  - the chat base URL comes from the Copilot token's `proxy-ep=` field (proxy.X → https://api.X),
- *    default https://api.individual.githubcopilot.com; requests carry the editor headers.
- *  Deviations: enterprise domains are not prompted for (github.com only — follow-up); pi's
- *  /models catalog fetch + per-model policy enabling is not ported (rovecode fetches /models itself
- *  through providers/stream.ts fetchModels); endpoints are injectable for the fake-server tests.
- *  Honesty: the client id is the one the GitHub Copilot Chat VS Code extension uses (pi, opencode and
- *  others sign in with it); the token endpoint is GitHub's internal Copilot API. Not live-verified
- *  on this box (no Copilot account) — see README. */
-
-import { fetchOrCancel, httpFailure, jsonObject, type OAuthCredential, type OAuthDeps, type OAuthLoginIO, type OAuthProvider } from "./common.ts";
-import { pollDeviceCodeFlow } from "./device-code.ts";
-
-export interface GitHubCopilotEndpoints {
-  deviceCodeUrl: string;
-  accessTokenUrl: string;
-  copilotTokenUrl: string;
-  /** fixed chat base URL (tests; enterprise proxies). Default: derived from the token's proxy-ep. */
-  chatBaseUrl?: string;
-}
-
-export const GITHUB_COPILOT_ENDPOINTS: GitHubCopilotEndpoints = {
-  deviceCodeUrl: "https://github.com/login/device/code",
-  accessTokenUrl: "https://github.com/login/oauth/access_token",
-  copilotTokenUrl: "https://api.github.com/copilot_internal/v2/token",
-};
-
-/** pi: the GitHub Copilot Chat (VS Code extension) OAuth app id, base64 as upstream keeps it */
-const CLIENT_ID = atob("SXYxLmI1MDdhMDhjODdlY2ZlOTg=");
-const USER_AGENT = "GitHubCopilotChat/0.35.0";
-/** the editor headers the Copilot API expects on every request (pi COPILOT_HEADERS) */
-export const COPILOT_HEADERS: Readonly<Record<string, string>> = {
-  "User-Agent": USER_AGENT,
-  "Editor-Version": "vscode/1.107.0",
-  "Editor-Plugin-Version": "copilot-chat/0.35.0",
-  "Copilot-Integration-Id": "vscode-chat",
-};
-const DEFAULT_BASE_URL = "https://api.individual.githubcopilot.com";
-/** the stored expiry leads the server's by this much, so a request never races the real expiry */
-const EXPIRY_SKEW_MS = 5 * 60_000;
-export const GITHUB_COPILOT_DEFAULT_MODEL = "gpt-4o";
-
-interface DeviceCode { deviceCode: string; userCode: string; verificationUri: string; interval?: number; expiresIn: number }
-
-/** `tid=…;exp=…;proxy-ep=proxy.individual.githubcopilot.com;…` → https://api.individual.githubcopilot.com */
-export function baseUrlFromCopilotToken(token: string): string | null {
-  const match = /proxy-ep=([^;]+)/.exec(token);
-  if (!match || !match[1]) return null;
-  return `https://${match[1].replace(/^proxy\./, "api.")}`;
-}
-
-async function postForm(deps: OAuthDeps, url: string, fields: Record<string, string>, signal: AbortSignal | undefined, what: string): Promise<Record<string, unknown>> {
-  const res = await fetchOrCancel(deps, url, {
-    method: "POST",
-    headers: { Accept: "application/json", "Content-Type": "application/x-www-form-urlencoded", "User-Agent": USER_AGENT },
-    body: new URLSearchParams(fields).toString(),
-  }, signal);
-  if (!res.ok) throw await httpFailure(what, res);
-  return jsonObject(res, what);
-}
-
-async function startDeviceFlow(ep: GitHubCopilotEndpoints, deps: OAuthDeps, signal: AbortSignal): Promise<DeviceCode> {
-  const data = await postForm(deps, ep.deviceCodeUrl, { client_id: CLIENT_ID, scope: "read:user" }, signal, "GitHub device code request");
-  const { device_code: deviceCode, user_code: userCode, verification_uri: verificationUri, interval, expires_in: expiresIn } = data;
-  if (typeof deviceCode !== "string" || typeof userCode !== "string" || typeof verificationUri !== "string"
-    || (interval !== undefined && typeof interval !== "number") || typeof expiresIn !== "number") {
-    throw new Error("GitHub device code response is missing fields");
-  }
-  // the verification URI is shown for the user to open — force it to be an http(s) URL (pi)
-  let parsed: URL;
-  try {
-    parsed = new URL(verificationUri);
-  } catch {
-    throw new Error("GitHub device code response carries an untrusted verification_uri");
-  }
-  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") throw new Error("GitHub device code response carries an untrusted verification_uri");
-  return { deviceCode, userCode, verificationUri: parsed.href, interval: interval as number | undefined, expiresIn };
-}
-
-function pollAccessToken(ep: GitHubCopilotEndpoints, device: DeviceCode, deps: OAuthDeps, signal: AbortSignal): Promise<string> {
-  return pollDeviceCodeFlow<string>({
-    intervalSeconds: device.interval,
-    expiresInSeconds: device.expiresIn,
-    waitBeforeFirstPoll: true,
-    signal,
-    sleep: deps.sleep,
-    now: deps.now,
-    poll: async () => {
-      const raw = await postForm(deps, ep.accessTokenUrl, {
-        client_id: CLIENT_ID, device_code: device.deviceCode, grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-      }, signal, "GitHub device token poll");
-      if (typeof raw.access_token === "string" && raw.access_token.length > 0) return { status: "complete", value: raw.access_token };
-      if (typeof raw.error === "string") {
-        if (raw.error === "authorization_pending") return { status: "pending" };
-        if (raw.error === "slow_down") return { status: "slow_down", intervalSeconds: typeof raw.interval === "number" ? raw.interval : undefined };
-        return { status: "failed", message: `GitHub device flow failed: ${raw.error}${typeof raw.error_description === "string" ? ` — ${raw.error_description.slice(0, 160)}` : ""}` };
-      }
-      return { status: "failed", message: "GitHub device token response is missing fields" };
-    },
-  });
-}
-
-/** Bearer <github token> → the Copilot token (`access`) + expiry; the GitHub token stays `refresh`. */
-async function exchangeCopilotToken(ep: GitHubCopilotEndpoints, githubToken: string, deps: OAuthDeps, signal: AbortSignal | undefined): Promise<OAuthCredential> {
-  const res = await fetchOrCancel(deps, ep.copilotTokenUrl, {
-    headers: { Accept: "application/json", Authorization: `Bearer ${githubToken}`, ...COPILOT_HEADERS },
-  }, signal);
-  if (!res.ok) throw await httpFailure("Copilot token exchange", res);
-  const raw = await jsonObject(res, "Copilot token exchange");
-  const { token, expires_at: expiresAt } = raw;
-  if (typeof token !== "string" || token.length === 0 || typeof expiresAt !== "number") throw new Error("Copilot token response is missing fields");
-  return { type: "oauth", access: token, refresh: githubToken, expires: expiresAt * 1000 - EXPIRY_SKEW_MS };
-}
-
-export function githubCopilotOAuth(endpoints: GitHubCopilotEndpoints = GITHUB_COPILOT_ENDPOINTS): OAuthProvider {
-  return {
-    id: "github-copilot",
-    label: "GitHub Copilot (device code)",
-    defaultModel: GITHUB_COPILOT_DEFAULT_MODEL,
-    async login(io: OAuthLoginIO, deps: OAuthDeps): Promise<OAuthCredential> {
-      const device = await startDeviceFlow(endpoints, deps, io.signal);
-      io.notify({ type: "device_code", userCode: device.userCode, verificationUri: device.verificationUri, intervalSeconds: device.interval ?? 5, expiresInSeconds: device.expiresIn });
-      const githubToken = await pollAccessToken(endpoints, device, deps, io.signal);
-      io.notify({ type: "progress", message: "authorized — exchanging for a Copilot token" });
-      return exchangeCopilotToken(endpoints, githubToken, deps, io.signal);
-    },
-    refresh(cred, signal, deps) {
-      return exchangeCopilotToken(endpoints, cred.refresh, deps, signal);
-    },
-    toAuth(cred) {
-      return { apiKey: cred.access, baseUrl: endpoints.chatBaseUrl ?? baseUrlFromCopilotToken(cred.access) ?? DEFAULT_BASE_URL, headers: { ...COPILOT_HEADERS } };
-    },
-  };
-}

package/src/providers/oauth/loopback.ts

@@ -1,158 +0,0 @@
-/** One-shot loopback OAuth callback server (port #66, extracted for port #76): binds 127.0.0.1 on an ephemeral
- *  port, waits for ONE browser GET on `/callback/<nonce>` and hands its `?code=` to the caller's `onCode`.
- *
- *  Extracted — behaviour unchanged — from the OpenRouter flow of port #66 (openrouter.ts, itself ported from pi
- *  packages/ai/src/auth/oauth/openrouter.ts: earendil-works/pi, MIT, Copyright (c) 2025 Mario Zechner; snapshot under
- *  research/source_snapshots/earendil-works-pi) so the MCP login (mcp/oauth.ts) shares every rule:
- *  - Bun.serve on CALLBACK_HOST (127.0.0.1) port 0 — never 0.0.0.0, never a fixed port (opencode's 19876 is the
- *    anti-pattern); the callback URL is built from the BOUND server (hostname + port), so a bind regression shows up
- *    in the URL the tests pin;
- *  - anything but GET is a 404 (pi: `request.method !== "GET"` → 404), so is a request whose Host is not the loopback
- *    host (a DNS-rebinding page reaching the port) and a request off the `/callback/` prefix (a favicon probe) —
- *    all three keep waiting;
- *  - the callback PATH carries a fresh 32-byte nonce (pi randomizes the path with a UUID): a GET on
- *    `/callback/<anything else>` is a STATE MISMATCH — 400 and the whole login rejects, not merely ignored, because a
- *    forged redirect is the one thing the nonce exists to catch;
- *  - `requireStateParam` (port #76; the MCP SDK appends `state` to the authorize URL): `?state=` must equal the nonce
- *    too, else the same 400 + reject. OpenRouter passes none — whether it preserves a query string on the redirect is
- *    not live-verified, and a wrong guess would abort every real login;
- *  - `?error=` (RFC 6749 §4.1.2.1) rejects with the provider's reason; a GET without `code` is a 400 that keeps waiting;
- *  - single use: once a callback is being exchanged (`claimed`) or the outcome is decided (`closing`, flipped
- *    synchronously; `settled` follows SETTLE_DELAY_MS later so the browser gets its page first) every later request —
- *    genuine or forged — is a 409 that never reaches `onCode`. The ONE accepted code runs `onCode` BEFORE the 200 is
- *    sent (exchange-before-200); a throwing `onCode` answers 502 and rejects the login;
- *  - the server closes when the login settles — success, mismatch, denial, `onCode` failure, abort (`signal`),
- *    `stop()` or the timeout (5 minutes by default) — and refuses connections afterwards.
- *  Every message is built from `what` ("OpenRouter", `MCP server "x"`) so OpenRouter's texts stay verbatim. */
-
-import { loginCancelled } from "./common.ts";
-
-/** the callback server binds loopback only — the browser must run on this machine */
-export const CALLBACK_HOST = "127.0.0.1";
-export const DEFAULT_LOGIN_TIMEOUT_MS = 5 * 60_000;
-/** the browser's response is flushed before the server goes away */
-const SETTLE_DELAY_MS = 20;
-
-export interface LoopbackOptions<T> {
-  /** the per-login nonce (pkce.ts randomState): the callback path is `/callback/<nonce>` */
-  nonce: string;
-  /** Ctrl-C — aborting rejects `result` with loginCancelled() */
-  signal: AbortSignal;
-  /** who is being signed in to; prefixes every message and page ("OpenRouter", `MCP server "x"`) */
-  what: string;
-  /** the sentence the 400 mismatch page ends with ("Run rovecode auth login openrouter again.") */
-  retryHint: string;
-  /** what `onCode` does, for the 502 page (default "key exchange") */
-  exchange?: string;
-  /** also require `?state=` to equal the nonce (the MCP SDK sends it; OpenRouter does not) */
-  requireStateParam?: boolean;
-  timeoutMs?: number;
-  /** runs with the accepted code BEFORE the browser gets its 200 page; a throw answers 502 and rejects `result` */
-  onCode: (code: string) => Promise<T>;
-}
-
-export interface LoopbackCallback<T> {
-  /** `http://127.0.0.1:<port>/callback/<nonce>` from the BOUND server */
-  callbackUrl: string;
-  /** onCode's value; rejects on mismatch, denial, onCode failure, abort, stop() or timeout — never with a token */
-  result: Promise<T>;
-  /** stop the server now (idempotent; runs on its own once `result` settles) */
-  stop(): void;
-}
-
-/** the thrown text for a callback on a wrong path (or, with requireStateParam, a wrong `?state=`) */
-export function stateMismatchMessage(what: string): string {
-  return `${what} OAuth: state mismatch on the callback — login aborted`;
-}
-
-function html(status: number, text: string): Response {
-  return new Response(`<!doctype html><meta charset="utf-8"><title>rovecode</title><p>${text}</p>`, {
-    status, headers: { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" },
-  });
-}
-
-function minutes(ms: number): string {
-  return ms >= 60_000 ? `${Math.round(ms / 60_000)} minutes` : `${ms} ms`;
-}
-
-export function startLoopbackCallback<T>(opts: LoopbackOptions<T>): LoopbackCallback<T> {
-  type Outcome = { value: T } | { error: Error };
-  const callbackPath = `/callback/${opts.nonce}`;
-  const exchange = opts.exchange ?? "key exchange";
-  let settle: (o: Outcome) => void = () => {};
-  const outcome = new Promise<Outcome>((resolve) => { settle = resolve; });
-  let settled = false;
-  let claimed = false;
-  /** the outcome is decided but `settled` waits SETTLE_DELAY_MS — flipped synchronously so no callback that lands in
-   *  that window is exchanged (a forged mismatch first, the genuine redirect 5 ms later) */
-  let closing = false;
-  const finish = (o: Outcome): void => {
-    if (settled) return;
-    settled = true;
-    settle(o);
-  };
-  // the browser gets its page before the login settles and the server stops
-  const finishAfterResponse = (o: Outcome): void => { closing = true; setTimeout(() => finish(o), SETTLE_DELAY_MS); };
-  const mismatch = (): Response => {
-    finishAfterResponse({ error: new Error(stateMismatchMessage(opts.what)) });
-    return html(400, `State mismatch — this login was aborted. ${opts.retryHint}`);
-  };
-
-  const server = Bun.serve({
-    port: 0,
-    hostname: CALLBACK_HOST,
-    async fetch(req) {
-      // pi: the redirect is a browser GET — anything else is not a callback (404, keep waiting)
-      if (req.method !== "GET") return html(404, "Not an OAuth callback.");
-      const url = new URL(req.url);
-      // a foreign Host header (a page at evil.example resolving to 127.0.0.1) is never the redirect we issued
-      if (url.hostname !== CALLBACK_HOST) return html(404, "Not an OAuth callback.");
-      if (!url.pathname.startsWith("/callback/")) return html(404, "Not an OAuth callback.");
-      // single use: once a callback is being exchanged (claimed) or the outcome is decided (closing / settled),
-      // every later request — genuine or forged — is a 409 that never reaches onCode
-      if (settled || claimed || closing) return html(409, "This OAuth callback has already been used.");
-      if (url.pathname !== callbackPath) return mismatch();
-      if (opts.requireStateParam === true && url.searchParams.get("state") !== opts.nonce) return mismatch();
-      const denied = url.searchParams.get("error");
-      if (denied) {
-        finishAfterResponse({ error: new Error(`${opts.what} authorization denied: ${(url.searchParams.get("error_description") ?? denied).slice(0, 160)}`) });
-        return html(400, `${opts.what} authorization was denied.`);
-      }
-      const code = url.searchParams.get("code");
-      if (!code) return html(400, `${opts.what} returned no authorization code.`);
-      claimed = true;
-      try {
-        const value = await opts.onCode(code);
-        finishAfterResponse({ value });
-        return html(200, `Signed in to ${opts.what} — you can close this tab and return to rovecode.`);
-      } catch (e) {
-        finishAfterResponse({ error: e instanceof Error ? e : new Error(String(e)) });
-        return html(502, `${opts.what} ${exchange} failed — see the rovecode terminal.`);
-      }
-    },
-  });
-
-  // from the BOUND server, not the constant: a bind regression (0.0.0.0) shows up in the printed URL the tests pin
-  const callbackUrl = `http://${server.hostname}:${server.port}${callbackPath}`;
-  const timeoutMs = opts.timeoutMs ?? DEFAULT_LOGIN_TIMEOUT_MS;
-  const onAbort = (): void => finish({ error: loginCancelled() });
-  opts.signal.addEventListener("abort", onAbort, { once: true });
-  const timer = setTimeout(() => finish({ error: new Error(`${opts.what} OAuth login timed out (${minutes(timeoutMs)})`) }), timeoutMs);
-  let stopped = false;
-  const stop = (): void => {
-    if (stopped) return;
-    stopped = true;
-    clearTimeout(timer);
-    opts.signal.removeEventListener("abort", onAbort);
-    server.stop(true);
-    finish({ error: new Error(`${opts.what} OAuth login aborted`) }); // no-op when the outcome is already in
-  };
-  if (opts.signal.aborted) onAbort();
-  const result = outcome.then((o) => {
-    stop();
-    if ("error" in o) throw o.error;
-    return o.value;
-  });
-  result.catch(() => {}); // observed by the caller; a caller that stopped early must not leave it unhandled
-  return { callbackUrl, result, stop };
-}

package/src/providers/oauth/openai.ts

@@ -1,163 +0,0 @@
-/** OpenAI (ChatGPT) OAuth device-code flow (port #66).
- *
- *  Ported from pi packages/ai/src/auth/oauth/openai-codex.ts (earendil-works/pi, MIT — Copyright (c)
- *  2025 Mario Zechner; snapshot under research/source_snapshots/earendil-works-pi), device-code half
- *  only (pi's browser PKCE half on the fixed port 1455 is not ported — follow-up). Kept as pi has it:
- *  - POST auth.openai.com/api/accounts/deviceauth/usercode {client_id} → device_auth_id + user_code +
- *    interval (number or numeric string); the user opens https://auth.openai.com/codex/device;
- *  - poll POST …/deviceauth/token {device_auth_id, user_code}: 200 → authorization_code + the
- *    server-issued code_verifier; 403/404 or error code deviceauth_authorization_pending → pending;
- *    slow_down → slow_down; anything else fails; 15-minute deadline;
- *  - exchange at POST auth.openai.com/oauth/token (grant authorization_code, redirect_uri
- *    …/deviceauth/callback) → access_token + refresh_token + expires_in; refresh = grant
- *    refresh_token at the same URL; the ChatGPT account id is read from the access token's JWT claim
- *    `https://api.openai.com/auth`.chatgpt_account_id and sent as the `chatgpt-account-id` header.
- *  Deviations: a token without the account claim is accepted (pi throws) — accountId is optional;
- *  a 404 on the usercode request is reported as "device code login not enabled" like pi.
- *  Honesty: the client id is the Codex CLI's (pi and opencode sign in with it). The resulting token is a
- *  ChatGPT-subscription token accepted by the Codex Responses backend ONLY, so `toAuth` (port #75) hands the
- *  seam `baseUrl` https://chatgpt.com/backend-api/codex (codex model-provider-info/src/lib.rs:40
- *  CHATGPT_CODEX_BASE_URL; pi openai-codex-responses.ts:45 + resolveCodexUrl :633-639), `wire: "responses"`
- *  (providers/wire-select.ts sends every request through providers/responses.ts — never /chat/completions)
- *  and the headers that backend requires: `chatgpt-account-id` (when the JWT carries the claim),
- *  `OpenAI-Beta: responses=experimental` and `originator: rovecode` (pi openai-codex-responses.ts:1607-1609,
- *  :1622; codex core/src/client.rs:688 adds its own originator). Not live-verified on this box (no ChatGPT
- *  account): the path is pinned against loopback fakes (test/unit/oauth-openai-responses.test.ts) — README. */
-
-import { fetchOrCancel, httpFailure, jsonObject, type OAuthCredential, type OAuthDeps, type OAuthLoginIO, type OAuthProvider } from "./common.ts";
-import { pollDeviceCodeFlow } from "./device-code.ts";
-
-export interface OpenAIEndpoints {
-  deviceUserCodeUrl: string;
-  deviceTokenUrl: string;
-  tokenUrl: string;
-  deviceVerificationUri: string;
-  deviceRedirectUri: string;
-  /** the Responses base the token is sent to (…/responses is appended by providers/responses.ts) */
-  responsesBaseUrl: string;
-}
-
-const AUTH_BASE_URL = "https://auth.openai.com";
-export const OPENAI_ENDPOINTS: OpenAIEndpoints = {
-  deviceUserCodeUrl: `${AUTH_BASE_URL}/api/accounts/deviceauth/usercode`,
-  deviceTokenUrl: `${AUTH_BASE_URL}/api/accounts/deviceauth/token`,
-  tokenUrl: `${AUTH_BASE_URL}/oauth/token`,
-  deviceVerificationUri: `${AUTH_BASE_URL}/codex/device`,
-  deviceRedirectUri: `${AUTH_BASE_URL}/deviceauth/callback`,
-  responsesBaseUrl: "https://chatgpt.com/backend-api/codex",
-};
-
-/** the two headers the Codex Responses backend expects beside the bearer + account id (pi :1607-1609, :1622) */
-export const CODEX_RESPONSES_HEADERS: Readonly<Record<string, string>> = { "OpenAI-Beta": "responses=experimental", originator: "rovecode" };
-
-/** pi: the Codex CLI OAuth client id */
-const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
-const DEVICE_CODE_TIMEOUT_SECONDS = 15 * 60;
-const JWT_CLAIM = "https://api.openai.com/auth";
-
-interface DeviceAuth { deviceAuthId: string; userCode: string; intervalSeconds: number }
-interface DeviceGrant { authorizationCode: string; codeVerifier: string }
-
-/** The ChatGPT account id claim of an access-token JWT; undefined when absent or not a JWT. */
-export function accountIdFromJwt(token: string): string | undefined {
-  try {
-    const parts = token.split(".");
-    if (parts.length !== 3 || !parts[1]) return undefined;
-    const b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
-    const payload = JSON.parse(atob(b64 + "=".repeat((4 - (b64.length % 4)) % 4))) as Record<string, unknown>;
-    const claim = payload[JWT_CLAIM];
-    const id = typeof claim === "object" && claim !== null ? (claim as { chatgpt_account_id?: unknown }).chatgpt_account_id : undefined;
-    return typeof id === "string" && id.length > 0 ? id : undefined;
-  } catch {
-    return undefined;
-  }
-}
-
-async function readTokenResponse(res: Response, what: string, now: () => number): Promise<OAuthCredential> {
-  if (!res.ok) throw await httpFailure(what, res);
-  const json = await jsonObject(res, what);
-  const { access_token: access, refresh_token: refresh, expires_in: expiresIn } = json;
-  if (typeof access !== "string" || access.length === 0 || typeof refresh !== "string" || typeof expiresIn !== "number") throw new Error(`${what}: response is missing fields`);
-  const accountId = accountIdFromJwt(access);
-  return { type: "oauth", access, refresh, expires: now() + expiresIn * 1000, ...(accountId !== undefined ? { accountId } : {}) };
-}
-
-async function startDeviceAuth(ep: OpenAIEndpoints, deps: OAuthDeps, signal: AbortSignal): Promise<DeviceAuth> {
-  const res = await fetchOrCancel(deps, ep.deviceUserCodeUrl, {
-    method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ client_id: CLIENT_ID }),
-  }, signal);
-  if (res.status === 404) throw new Error("OpenAI device code login is not enabled for this server (HTTP 404)");
-  if (!res.ok) throw await httpFailure("OpenAI device code request", res);
-  const json = await jsonObject(res, "OpenAI device code request");
-  const { device_auth_id: deviceAuthId, user_code: userCode, interval } = json;
-  const intervalSeconds = typeof interval === "string" ? Number(interval.trim()) : interval;
-  if (typeof deviceAuthId !== "string" || !deviceAuthId || typeof userCode !== "string" || !userCode
-    || typeof intervalSeconds !== "number" || !Number.isFinite(intervalSeconds) || intervalSeconds < 0) {
-    throw new Error("OpenAI device code response is missing fields");
-  }
-  return { deviceAuthId, userCode, intervalSeconds };
-}
-
-function pollDeviceAuth(ep: OpenAIEndpoints, device: DeviceAuth, deps: OAuthDeps, signal: AbortSignal): Promise<DeviceGrant> {
-  return pollDeviceCodeFlow<DeviceGrant>({
-    intervalSeconds: device.intervalSeconds,
-    expiresInSeconds: DEVICE_CODE_TIMEOUT_SECONDS,
-    signal,
-    sleep: deps.sleep,
-    now: deps.now,
-    poll: async () => {
-      const res = await fetchOrCancel(deps, ep.deviceTokenUrl, {
-        method: "POST", headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ device_auth_id: device.deviceAuthId, user_code: device.userCode }),
-      }, signal);
-      if (res.ok) {
-        const json = await jsonObject(res, "OpenAI device token poll");
-        const { authorization_code: authorizationCode, code_verifier: codeVerifier } = json;
-        if (typeof authorizationCode !== "string" || !authorizationCode || typeof codeVerifier !== "string" || !codeVerifier) {
-          return { status: "failed", message: "OpenAI device token response is missing fields" };
-        }
-        return { status: "complete", value: { authorizationCode, codeVerifier } };
-      }
-      if (res.status === 403 || res.status === 404) return { status: "pending" };
-      let errorCode: unknown;
-      try {
-        const json = (await res.json()) as { error?: string | { code?: string } } | null;
-        errorCode = typeof json?.error === "object" ? json.error?.code : json?.error;
-      } catch {
-        // non-JSON error body: reported by status below
-      }
-      if (errorCode === "deviceauth_authorization_pending") return { status: "pending" };
-      if (errorCode === "slow_down") return { status: "slow_down" };
-      return { status: "failed", message: `OpenAI device authorization failed (HTTP ${res.status})${typeof errorCode === "string" ? `: ${errorCode.slice(0, 80)}` : ""}` };
-    },
-  });
-}
-
-async function postToken(ep: OpenAIEndpoints, fields: Record<string, string>, deps: OAuthDeps, signal: AbortSignal | undefined, what: string): Promise<OAuthCredential> {
-  const res = await fetchOrCancel(deps, ep.tokenUrl, {
-    method: "POST", headers: { "Content-Type": "application/x-www-form-urlencoded" }, body: new URLSearchParams(fields).toString(),
-  }, signal);
-  return readTokenResponse(res, what, deps.now);
-}
-
-export function openAIOAuth(endpoints: OpenAIEndpoints = OPENAI_ENDPOINTS): OAuthProvider {
-  return {
-    id: "openai",
-    label: "OpenAI / ChatGPT (device code)",
-    async login(io: OAuthLoginIO, deps: OAuthDeps): Promise<OAuthCredential> {
-      const device = await startDeviceAuth(endpoints, deps, io.signal);
-      io.notify({ type: "device_code", userCode: device.userCode, verificationUri: endpoints.deviceVerificationUri, intervalSeconds: device.intervalSeconds, expiresInSeconds: DEVICE_CODE_TIMEOUT_SECONDS });
-      const grant = await pollDeviceAuth(endpoints, device, deps, io.signal);
-      io.notify({ type: "progress", message: "authorized — exchanging the authorization code" });
-      return postToken(endpoints, {
-        grant_type: "authorization_code", client_id: CLIENT_ID, code: grant.authorizationCode, code_verifier: grant.codeVerifier, redirect_uri: endpoints.deviceRedirectUri,
-      }, deps, io.signal, "OpenAI token exchange");
-    },
-    refresh(cred, signal, deps) {
-      return postToken(endpoints, { grant_type: "refresh_token", refresh_token: cred.refresh, client_id: CLIENT_ID }, deps, signal, "OpenAI token refresh");
-    },
-    toAuth(cred) {
-      return { apiKey: cred.access, baseUrl: endpoints.responsesBaseUrl, wire: "responses", headers: { ...(cred.accountId ? { "chatgpt-account-id": cred.accountId } : {}), ...CODEX_RESPONSES_HEADERS } };
-    },
-  };
-}