theclawbay 0.3.7 → 0.3.9

package/dist/commands/logout.js

@@ -7,6 +7,7 @@ const promises_1 = __importDefault(require("node:fs/promises"));
 const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
 const base_command_1 = require("../lib/base-command");
+const codex_auth_seeding_1 = require("../lib/codex-auth-seeding");
 const codex_history_migration_1 = require("../lib/codex-history-migration");
 const codex_model_cache_migration_1 = require("../lib/codex-model-cache-migration");
 const paths_1 = require("../lib/config/paths");
@@ -246,6 +247,9 @@ class LogoutCommand extends base_command_1.BaseCommand {
                 targetProvider: OPENAI_PROVIDER_ID,
                 sourceProviders: HISTORY_PROVIDER_DB_MIGRATE_SOURCES,
             });
+            const authSeedCleanup = await (0, codex_auth_seeding_1.cleanupSeededCodexApiKeyAuth)({
+                codexHome: paths_1.codexDir,
+            });
             const modelCacheCleanup = await (0, codex_model_cache_migration_1.cleanupSeededCodexModelCache)({
                 codexHome: paths_1.codexDir,
             });
@@ -275,6 +279,20 @@ class LogoutCommand extends base_command_1.BaseCommand {
                 const detail = stateDbMigration.warning ? ` ${stateDbMigration.warning}` : "";
                 this.log(`- Conversation cache: could not update local Codex history DB.${detail}`);
             }
+            if (authSeedCleanup.action === "removed") {
+                this.log("- Codex login state: removed the Claw Bay auth seed.");
+            }
+            else if (authSeedCleanup.action === "preserved") {
+                this.log("- Codex login state: preserved existing Codex auth.");
+                if (authSeedCleanup.warning)
+                    this.log(`- Codex login state: ${authSeedCleanup.warning}`);
+            }
+            else if (authSeedCleanup.warning) {
+                this.log(`- Codex login state: ${authSeedCleanup.warning}`);
+            }
+            else {
+                this.log("- Codex login state: no cleanup needed.");
+            }
             if (modelCacheCleanup.action === "removed") {
                 this.log("- Codex model cache: removed the Claw Bay GPT-5.4 seed.");
             }

package/dist/commands/setup.js

@@ -9,6 +9,7 @@ const node_path_1 = __importDefault(require("node:path"));
 const node_child_process_1 = require("node:child_process");
 const core_1 = require("@oclif/core");
 const base_command_1 = require("../lib/base-command");
+const codex_auth_seeding_1 = require("../lib/codex-auth-seeding");
 const codex_history_migration_1 = require("../lib/codex-history-migration");
 const codex_model_cache_migration_1 = require("../lib/codex-model-cache-migration");
 const paths_1 = require("../lib/config/paths");
@@ -208,7 +209,7 @@ async function writeCodexConfig(params) {
         'name = "OpenAI"',
         `base_url = "${proxyRoot}/backend-api/codex"`,
         'wire_api = "responses"',
-        "requires_openai_auth = false",
+        "requires_openai_auth = true",
         `experimental_bearer_token = "${params.apiKey}"`,
         MANAGED_END,
     ]);
@@ -462,6 +463,10 @@ class SetupCommand extends base_command_1.BaseCommand {
                 migrationStateFile: MIGRATION_STATE_FILE,
                 neutralizeSources: HISTORY_PROVIDER_NEUTRALIZE_SOURCES,
             });
+            const authSeed = await (0, codex_auth_seeding_1.ensureCodexApiKeyAuth)({
+                codexHome: paths_1.codexDir,
+                apiKey,
+            });
             const stateDbMigration = await (0, codex_history_migration_1.migrateStateDbProviders)({
                 codexHome: paths_1.codexDir,
                 targetProvider: DEFAULT_PROVIDER_ID,
@@ -525,6 +530,9 @@ class SetupCommand extends base_command_1.BaseCommand {
             else if (modelCacheMigration.action === "created") {
                 this.log("- Codex model cache: created a local picker cache with GPT-5.4.");
             }
+            else if (modelCacheMigration.action === "refreshed") {
+                this.log("- Codex model cache: refreshed the local picker cache for GPT-5.4.");
+            }
             else if (modelCacheMigration.action === "already_seeded") {
                 this.log("- Codex model cache: GPT-5.4 was already seeded locally.");
             }
@@ -554,7 +562,24 @@ class SetupCommand extends base_command_1.BaseCommand {
             else {
                 this.log("- OpenCode: not detected (skipped)");
             }
-            this.log("- Codex login state: unchanged");
+            if (authSeed.action === "seeded") {
+                this.log("- Codex login state: seeded local API-key auth for Codex UI.");
+            }
+            else if (authSeed.action === "updated") {
+                this.log("- Codex login state: refreshed the Claw Bay API-key auth seed.");
+            }
+            else if (authSeed.action === "already_seeded") {
+                this.log("- Codex login state: the Claw Bay API-key auth was already seeded.");
+            }
+            else if (authSeed.action === "already_present") {
+                this.log("- Codex login state: preserved existing local Codex auth.");
+            }
+            else if (authSeed.warning) {
+                this.log(`- Codex login state: ${authSeed.warning}`);
+            }
+            else {
+                this.log("- Codex login state: no change.");
+            }
             this.log("Next: restart terminal/VS Code window only if you rely on CODEX_LB_API_KEY in your own scripts.");
         });
     }

package/dist/lib/codex-auth-seeding.d.ts

@@ -0,0 +1,15 @@
+export type EnsureCodexApiKeyAuthResult = {
+    action: "seeded" | "updated" | "already_seeded" | "already_present" | "skipped";
+    warning?: string;
+};
+export type CleanupCodexApiKeyAuthResult = {
+    action: "removed" | "preserved" | "none";
+    warning?: string;
+};
+export declare function ensureCodexApiKeyAuth(params: {
+    codexHome: string;
+    apiKey: string;
+}): Promise<EnsureCodexApiKeyAuthResult>;
+export declare function cleanupSeededCodexApiKeyAuth(params: {
+    codexHome: string;
+}): Promise<CleanupCodexApiKeyAuthResult>;

package/dist/lib/codex-auth-seeding.js

@@ -0,0 +1,190 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureCodexApiKeyAuth = ensureCodexApiKeyAuth;
+exports.cleanupSeededCodexApiKeyAuth = cleanupSeededCodexApiKeyAuth;
+const node_crypto_1 = require("node:crypto");
+const promises_1 = __importDefault(require("node:fs/promises"));
+const node_path_1 = __importDefault(require("node:path"));
+const AUTH_FILE = "auth.json";
+const AUTH_STATE_FILE = "theclawbay.auth-state.json";
+const OPENAI_API_KEY_FIELD = "OPENAI_API_KEY";
+function objectRecordOr(value) {
+    if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+        return value;
+    }
+    return null;
+}
+function stableStringify(value) {
+    if (Array.isArray(value)) {
+        return `[${value.map((entry) => stableStringify(entry)).join(",")}]`;
+    }
+    if (value && typeof value === "object") {
+        const obj = value;
+        const keys = Object.keys(obj).sort();
+        return `{${keys.map((key) => `${JSON.stringify(key)}:${stableStringify(obj[key])}`).join(",")}}`;
+    }
+    return JSON.stringify(value);
+}
+function fingerprintAuthDocument(document) {
+    return (0, node_crypto_1.createHash)("sha256").update(stableStringify(document)).digest("hex");
+}
+function extractApiKey(document) {
+    const value = document[OPENAI_API_KEY_FIELD];
+    if (typeof value !== "string")
+        return null;
+    const trimmed = value.trim();
+    return trimmed ? trimmed : null;
+}
+function hasTokenData(document) {
+    const value = document.tokens;
+    return value !== undefined && value !== null;
+}
+function hasUsableAuth(document) {
+    return Boolean(extractApiKey(document)) || hasTokenData(document);
+}
+function buildSeededAuthDocument(apiKey) {
+    return {
+        [OPENAI_API_KEY_FIELD]: apiKey,
+        tokens: null,
+        last_refresh: null,
+    };
+}
+async function readJsonTextIfExists(filePath) {
+    try {
+        const raw = await promises_1.default.readFile(filePath, "utf8");
+        return { parsed: JSON.parse(raw), raw };
+    }
+    catch (error) {
+        const err = error;
+        if (err.code === "ENOENT")
+            return null;
+        throw error;
+    }
+}
+async function removeFileIfExists(filePath) {
+    try {
+        await promises_1.default.unlink(filePath);
+    }
+    catch (error) {
+        const err = error;
+        if (err.code !== "ENOENT")
+            throw error;
+    }
+}
+async function readSeedState(filePath) {
+    const doc = await readJsonTextIfExists(filePath);
+    if (!doc)
+        return null;
+    const obj = objectRecordOr(doc.parsed);
+    if (!obj)
+        return null;
+    if (obj.version !== 1)
+        return null;
+    if (typeof obj.fingerprint !== "string" || !obj.fingerprint)
+        return null;
+    return {
+        version: 1,
+        fingerprint: obj.fingerprint,
+    };
+}
+async function writeSeedState(filePath, fingerprint) {
+    await promises_1.default.mkdir(node_path_1.default.dirname(filePath), { recursive: true });
+    const contents = JSON.stringify({
+        version: 1,
+        fingerprint,
+    }, null, 2);
+    await promises_1.default.writeFile(filePath, `${contents}\n`, "utf8");
+}
+async function writeSeededAuth(authPath, statePath, apiKey) {
+    const next = buildSeededAuthDocument(apiKey);
+    const contents = JSON.stringify(next, null, 2);
+    await promises_1.default.mkdir(node_path_1.default.dirname(authPath), { recursive: true });
+    await promises_1.default.writeFile(authPath, `${contents}\n`, "utf8");
+    await promises_1.default.chmod(authPath, 0o600).catch(() => { });
+    await writeSeedState(statePath, fingerprintAuthDocument(next));
+}
+async function ensureCodexApiKeyAuth(params) {
+    const authPath = node_path_1.default.join(params.codexHome, AUTH_FILE);
+    const statePath = node_path_1.default.join(params.codexHome, AUTH_STATE_FILE);
+    const seedState = await readSeedState(statePath);
+    let existing;
+    try {
+        existing = await readJsonTextIfExists(authPath);
+    }
+    catch (error) {
+        return {
+            action: "skipped",
+            warning: `could not read local Codex auth file: ${error.message}`,
+        };
+    }
+    if (!existing) {
+        await writeSeededAuth(authPath, statePath, params.apiKey);
+        return { action: "seeded" };
+    }
+    const existingDocument = objectRecordOr(existing.parsed);
+    if (!existingDocument) {
+        await removeFileIfExists(statePath);
+        return {
+            action: "skipped",
+            warning: "existing Codex auth.json is not a JSON object, so it was left unchanged.",
+        };
+    }
+    const existingFingerprint = fingerprintAuthDocument(existingDocument);
+    const seededByUs = seedState?.fingerprint === existingFingerprint;
+    const existingApiKey = extractApiKey(existingDocument);
+    if (seededByUs) {
+        if (existingApiKey === params.apiKey && !hasTokenData(existingDocument)) {
+            return { action: "already_seeded" };
+        }
+        await writeSeededAuth(authPath, statePath, params.apiKey);
+        return { action: "updated" };
+    }
+    await removeFileIfExists(statePath);
+    if (hasUsableAuth(existingDocument)) {
+        return { action: "already_present" };
+    }
+    await writeSeededAuth(authPath, statePath, params.apiKey);
+    return { action: "seeded" };
+}
+async function cleanupSeededCodexApiKeyAuth(params) {
+    const authPath = node_path_1.default.join(params.codexHome, AUTH_FILE);
+    const statePath = node_path_1.default.join(params.codexHome, AUTH_STATE_FILE);
+    const seedState = await readSeedState(statePath);
+    if (!seedState) {
+        return { action: "none" };
+    }
+    let existing;
+    try {
+        existing = await readJsonTextIfExists(authPath);
+    }
+    catch (error) {
+        await removeFileIfExists(statePath);
+        return {
+            action: "preserved",
+            warning: `could not read local Codex auth file, so it was preserved: ${error.message}`,
+        };
+    }
+    if (!existing) {
+        await removeFileIfExists(statePath);
+        return { action: "none" };
+    }
+    const existingDocument = objectRecordOr(existing.parsed);
+    if (!existingDocument) {
+        await removeFileIfExists(statePath);
+        return {
+            action: "preserved",
+            warning: "existing Codex auth.json is not a JSON object, so it was preserved.",
+        };
+    }
+    const existingFingerprint = fingerprintAuthDocument(existingDocument);
+    if (existingFingerprint !== seedState.fingerprint) {
+        await removeFileIfExists(statePath);
+        return { action: "preserved" };
+    }
+    await removeFileIfExists(authPath);
+    await removeFileIfExists(statePath);
+    return { action: "removed" };
+}

package/dist/lib/codex-model-cache-migration.d.ts

@@ -1,5 +1,5 @@
 export type EnsureCodexModelCacheResult = {
-    action: "seeded" | "created" | "already_present" | "already_seeded" | "skipped";
+    action: "seeded" | "created" | "refreshed" | "already_present" | "already_seeded" | "skipped";
     warning?: string;
 };
 export type CleanupCodexModelCacheResult = {

package/dist/lib/codex-model-cache-migration.js

@@ -196,6 +196,19 @@ function buildSeedModel(models) {
     }
     return normalizeSeedModel(null);
 }
+function setCacheFreshnessMetadata(doc, clientVersion) {
+    let changed = false;
+    const now = new Date().toISOString();
+    if (doc.fetched_at !== now) {
+        doc.fetched_at = now;
+        changed = true;
+    }
+    if (clientVersion && doc.client_version !== clientVersion) {
+        doc.client_version = clientVersion;
+        changed = true;
+    }
+    return changed;
+}
 function parseCodexVersion(stdout) {
     const match = stdout.match(/\b(\d+\.\d+\.\d+)\b/);
     return match ? match[1] : null;
@@ -356,31 +369,46 @@ async function ensureCodexModelCacheHasGpt54(params) {
                 warning: "Codex models cache exists but is not valid JSON in the expected format; skipped GPT-5.4 seed.",
             };
         }
+        const clientVersion = (await inferCodexClientVersion(params.codexHome)) ??
+            (typeof doc.client_version === "string" && doc.client_version ? doc.client_version : null);
         const existingModel = findModel(doc.models, TARGET_MODEL_ID);
         if (existingModel) {
             const currentFingerprint = fingerprintModel(existingModel);
             if (existingState && existingState.fingerprint === currentFingerprint && !hasSeedMarker(existingModel)) {
                 const seededModel = applySeedMarker(existingModel);
                 doc.models = doc.models.map((entry) => (entry.slug === TARGET_MODEL_ID ? seededModel : entry));
+                setCacheFreshnessMetadata(doc, clientVersion);
                 await promises_1.default.writeFile(cachePath, `${JSON.stringify(doc, null, 2)}\n`, "utf8");
                 await writePatchState(statePath, fingerprintModel(seededModel));
                 return { action: "seeded" };
             }
             if (hasSeedMarker(existingModel)) {
+                const docChanged = setCacheFreshnessMetadata(doc, clientVersion);
                 if (!existingState || existingState.fingerprint !== currentFingerprint) {
                     await writePatchState(statePath, currentFingerprint);
+                    await promises_1.default.writeFile(cachePath, `${JSON.stringify(doc, null, 2)}\n`, "utf8");
+                    return { action: "refreshed" };
+                }
+                if (docChanged) {
+                    await promises_1.default.writeFile(cachePath, `${JSON.stringify(doc, null, 2)}\n`, "utf8");
+                    return { action: "refreshed" };
                 }
                 return { action: "already_seeded" };
             }
             if (existingState && existingState.fingerprint !== currentFingerprint) {
                 await removeFileIfExists(statePath);
             }
+            if (setCacheFreshnessMetadata(doc, clientVersion)) {
+                await promises_1.default.writeFile(cachePath, `${JSON.stringify(doc, null, 2)}\n`, "utf8");
+                return { action: "refreshed" };
+            }
             return {
                 action: existingState && existingState.fingerprint === currentFingerprint ? "already_seeded" : "already_present",
             };
         }
         const seed = buildSeedModel(doc.models);
         doc.models = [seed, ...doc.models];
+        setCacheFreshnessMetadata(doc, clientVersion);
         await promises_1.default.writeFile(cachePath, `${JSON.stringify(doc, null, 2)}\n`, "utf8");
         await writePatchState(statePath, fingerprintModel(seed));
         return { action: "seeded" };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "theclawbay",
-  "version": "0.3.7",
+  "version": "0.3.9",
   "description": "The Claw Bay CLI: one-time API-key setup for direct Codex access.",
   "license": "MIT",
   "bin": {