chatgpt-plan-auth 1.0.0__py3-none-any.whl

chatgpt_plan_auth/__init__.py

@@ -0,0 +1,77 @@
+"""Sign in with ChatGPT (ChatGPT plan usage) for locally hosted apps.
+
+Implements the OAuth flow documented at
+https://developers.openai.com/siwc/token-sharing-open-source/: register a
+dynamic client, authorize with PKCE, exchange the code for tokens, refresh and
+rotate them, read the plan's model catalog, and shape Responses API requests
+for the plan usage route.
+
+The protocol code needs only :mod:`httpx`. The OpenAI SDK wrapper
+(:mod:`chatgpt_plan_auth.client`) needs the ``openai`` extra.
+"""
+
+from .auth import (
+    AuthorizationRequest,
+    ChatGPTCredentials,
+    ChatGPTAuth,
+    async_exchange_code,
+    async_token_request,
+    create_authorization_request,
+    create_ext_agent_host_id,
+    credentials_from_token,
+    parse_callback_url,
+    validate_id_token,
+)
+from .catalog import (
+    async_get_subscription_models,
+    async_get_subscription_models_for_credentials,
+    subscription_model_options,
+)
+from .const import (
+    AUTH_METHOD_CHATGPT,
+    AUTHORIZE_URL,
+    CLIENT_ID_PREFIX,
+    DYNAMIC_AGENT_CLIENT,
+    MODELS_URL,
+    PLAN_SCOPE,
+    REDIRECT_URI,
+    RESOURCE,
+    SCOPE,
+    SUBSCRIPTION_MODEL_SUGGESTIONS,
+    TOKEN_URL,
+)
+from .errors import ChatGPTPlanAuthError, ChatGPTPlanAuthFatalError
+from .requests import shape_request_for_subscription, subscription_error_message
+
+__version__ = "1.0.0"
+
+__all__ = [
+    "AUTH_METHOD_CHATGPT",
+    "AUTHORIZE_URL",
+    "CLIENT_ID_PREFIX",
+    "DYNAMIC_AGENT_CLIENT",
+    "MODELS_URL",
+    "PLAN_SCOPE",
+    "REDIRECT_URI",
+    "RESOURCE",
+    "SCOPE",
+    "SUBSCRIPTION_MODEL_SUGGESTIONS",
+    "TOKEN_URL",
+    "AuthorizationRequest",
+    "ChatGPTCredentials",
+    "ChatGPTAuth",
+    "ChatGPTPlanAuthError",
+    "ChatGPTPlanAuthFatalError",
+    "async_exchange_code",
+    "async_get_subscription_models",
+    "async_get_subscription_models_for_credentials",
+    "async_token_request",
+    "create_authorization_request",
+    "create_ext_agent_host_id",
+    "credentials_from_token",
+    "parse_callback_url",
+    "shape_request_for_subscription",
+    "subscription_error_message",
+    "subscription_model_options",
+    "validate_id_token",
+]

chatgpt_plan_auth/auth.py

@@ -0,0 +1,560 @@
+"""Sign in with ChatGPT (ChatGPT plan usage) authorization.
+
+This implements the OAuth flow documented at
+https://developers.openai.com/siwc/token-sharing-open-source/ which lets an
+open-source, locally hosted app use an eligible ChatGPT plan for eligible
+Responses API requests. The access token obtained here is used as the bearer
+token against ``https://api.openai.com/v1`` instead of an API key.
+
+HISTORY AND SCOPE
+-----------------
+This module was extracted from Home Assistant core, where the same code made
+the reviewer's point for them: it is deep domain knowledge about an external
+system and belongs in a library, not in core. Six modules are ported verbatim
+apart from ``hass`` becoming a plain :class:`httpx.AsyncClient`:
+
+``const`` / ``auth`` / ``catalog`` / ``requests`` (this package, ``httpx`` only)
+and ``client`` (the OpenAI SDK wrapper, behind the ``openai`` extra).
+
+DELIBERATE SIMPLIFICATION: NO ID TOKEN SIGNATURE VERIFICATION
+-------------------------------------------------------------
+``/.well-known/jwks.json`` is never fetched, RSA keys are not parsed and no
+crypto dependency is carried. The ID token is received directly from the
+provider's TLS-authenticated token endpoint in the same response as the code
+exchange, which is the trust model Home Assistant's own OAuth2 flow uses, so
+the signature adds nothing an attacker who already controls the token response
+could not forge. Issuer, audience, expiry and the per-attempt nonce are still
+verified in :func:`validate_id_token`, and the callback ``state`` is checked in
+:func:`async_exchange_code`.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import base64
+import binascii
+from collections.abc import Callable, Mapping
+from dataclasses import dataclass
+from datetime import datetime, timedelta, timezone
+import hashlib
+import json
+import logging
+import secrets
+from typing import Any
+import uuid
+from urllib.parse import parse_qsl, urlencode, urlparse
+
+import httpx
+
+from .const import (
+    AGENT_NAME_HINT,
+    AUTH_METHOD_CHATGPT,
+    AUTHORIZE_URL,
+    CONF_ACCESS_TOKEN,
+    CONF_AUTH_METHOD,
+    CONF_CLIENT_ID,
+    CONF_EARLIEST_REFRESH_AT,
+    CONF_EMAIL,
+    CONF_EXPIRES_AT,
+    CONF_EXT_AGENT_HOST_ID,
+    CONF_ID_TOKEN,
+    CONF_REFRESH_TOKEN,
+    CONF_SCOPES,
+    CONF_SUB,
+    DYNAMIC_AGENT_CLIENT,
+    EXT_AGENT_HOST_ID_SCHEME,
+    FATAL_REFRESH_ERRORS,
+    HTTP_TIMEOUT,
+    ISSUER,
+    REDIRECT_URI,
+    RESOURCE,
+    SCOPE,
+    TOKEN_EXPIRY_MARGIN,
+    TOKEN_URL,
+)
+from .errors import ChatGPTPlanAuthError, ChatGPTPlanAuthFatalError
+
+_LOGGER = logging.getLogger(__name__)
+
+
+def _utcnow() -> datetime:
+    """Return the current UTC time."""
+    return datetime.now(timezone.utc)
+
+
+def _parse_optional_datetime(value: Any) -> datetime | None:
+    """Parse an optional ISO 8601 timestamp."""
+    if not value or not isinstance(value, str):
+        return None
+    try:
+        parsed = datetime.fromisoformat(value.replace("Z", "+00:00"))
+    except ValueError:
+        return None
+    return parsed if parsed.tzinfo is not None else parsed.replace(tzinfo=timezone.utc)
+
+
+@dataclass
+class ChatGPTCredentials:
+    """Credentials of one Sign in with ChatGPT registration."""
+
+    client_id: str
+    ext_agent_host_id: str
+    sub: str
+    email: str | None
+    access_token: str
+    refresh_token: str
+    id_token: str
+    expires_at: datetime
+    scopes: list[str]
+    earliest_refresh_at: datetime | None = None
+
+    @property
+    def unique_id(self) -> str:
+        """Return the account identity scoped to this registration.
+
+        The subject identifies the ChatGPT account, the issued client id the
+        registration (one account can have several workspaces registered).
+        """
+        return f"{self.sub}:{self.client_id}"
+
+    def as_entry_data(self) -> dict[str, Any]:
+        """Return the credentials as a plain mapping, ready to be persisted."""
+        data: dict[str, Any] = {
+            CONF_AUTH_METHOD: AUTH_METHOD_CHATGPT,
+            CONF_CLIENT_ID: self.client_id,
+            CONF_EXT_AGENT_HOST_ID: self.ext_agent_host_id,
+            CONF_SUB: self.sub,
+            CONF_ACCESS_TOKEN: self.access_token,
+            CONF_REFRESH_TOKEN: self.refresh_token,
+            CONF_ID_TOKEN: self.id_token,
+            CONF_EXPIRES_AT: self.expires_at.isoformat(),
+            CONF_SCOPES: self.scopes,
+        }
+        if self.email is not None:
+            data[CONF_EMAIL] = self.email
+        if self.earliest_refresh_at is not None:
+            data[CONF_EARLIEST_REFRESH_AT] = self.earliest_refresh_at.isoformat()
+        return data
+
+    @classmethod
+    def from_entry_data(cls, data: Mapping[str, Any]) -> ChatGPTCredentials:
+        """Build credentials from persisted data."""
+        return cls(
+            client_id=data[CONF_CLIENT_ID],
+            ext_agent_host_id=data.get(CONF_EXT_AGENT_HOST_ID, ""),
+            sub=data.get(CONF_SUB, ""),
+            email=data.get(CONF_EMAIL),
+            access_token=data[CONF_ACCESS_TOKEN],
+            refresh_token=data[CONF_REFRESH_TOKEN],
+            id_token=data.get(CONF_ID_TOKEN, ""),
+            expires_at=_parse_optional_datetime(data[CONF_EXPIRES_AT]) or _utcnow(),
+            scopes=list(data.get(CONF_SCOPES, [])),
+            earliest_refresh_at=_parse_optional_datetime(
+                data.get(CONF_EARLIEST_REFRESH_AT, "")
+            ),
+        )
+
+
+def create_ext_agent_host_id() -> str:
+    """Return a new stable ``ext_agent_host_id`` for this installation.
+
+    The host id identifies the host the app runs on, not the signed in account,
+    and every registration of one instance shares it. A UUID based host id is
+    documented as a supported alternative to a JWK thumbprint URI and needs no
+    key management; callers generate it once and store it themselves.
+    """
+    return f"{EXT_AGENT_HOST_ID_SCHEME}{uuid.uuid4()}"
+
+
+@dataclass
+class AuthorizationRequest:
+    """A pending SIWC authorization attempt."""
+
+    url: str
+    state: str
+    nonce: str
+    code_verifier: str
+    redirect_uri: str
+    ext_agent_host_id: str
+    # The client id to exchange the code with: `dynamic_agent_client` until the
+    # callback returns the issued client id.
+    client_id: str
+    registration: bool
+
+
+def _create_pkce_pair() -> tuple[str, str]:
+    """Create a PKCE verifier and its S256 challenge."""
+    verifier = secrets.token_urlsafe(64)
+    digest = hashlib.sha256(verifier.encode()).digest()
+    challenge = base64.urlsafe_b64encode(digest).decode().rstrip("=")
+    return verifier, challenge
+
+
+def create_authorization_request(
+    *,
+    client_id: str | None,
+    ext_agent_host_id: str,
+    id_token_hint: str | None = None,
+    agent_name_hint: str = AGENT_NAME_HINT,
+) -> AuthorizationRequest:
+    """Build the authorization URL for a new or a returning ChatGPT account.
+
+    This is the first half of the flow; :func:`async_exchange_code` finishes it.
+    A fresh state, nonce and PKCE verifier are generated for every attempt.
+    """
+    state = secrets.token_urlsafe(32)
+    nonce = secrets.token_urlsafe(32)
+    verifier, challenge = _create_pkce_pair()
+
+    registration = client_id is None
+    params = {
+        "response_type": "code",
+        "client_id": DYNAMIC_AGENT_CLIENT if registration else client_id,
+        "redirect_uri": REDIRECT_URI,
+        "scope": SCOPE,
+        "resource": RESOURCE,
+        "state": state,
+        "nonce": nonce,
+        "code_challenge": challenge,
+        "code_challenge_method": "S256",
+        "ext_agent_host_id": ext_agent_host_id,
+    }
+    if registration:
+        # agent_name_hint is display metadata and is only sent for the first
+        # (dynamic client registration) authorization request.
+        params["agent_name_hint"] = agent_name_hint
+    if id_token_hint:
+        params["id_token_hint"] = id_token_hint
+
+    return AuthorizationRequest(
+        url=f"{AUTHORIZE_URL}?{urlencode(params)}",
+        state=state,
+        nonce=nonce,
+        code_verifier=verifier,
+        redirect_uri=REDIRECT_URI,
+        ext_agent_host_id=ext_agent_host_id,
+        client_id=client_id or DYNAMIC_AGENT_CLIENT,
+        registration=registration,
+    )
+
+
+def parse_callback_url(url: str) -> dict[str, str]:
+    """Parse the query of the URL the user's browser ended up on.
+
+    The loopback callback is normally on a different machine than the app, so
+    the page itself cannot be loaded. The address bar still holds the OAuth
+    parameters, which is all that is needed.
+    """
+    return dict(parse_qsl(urlparse(url.strip()).query))
+
+
+def _error_code(body: Any) -> str | None:
+    """Return the OAuth error code of a token endpoint response body."""
+    match body:
+        case {"error": {"code": str() as code}}:
+            return code
+        case {"error": str() as code}:
+            return code
+        case {"code": str() as code}:
+            return code
+    return None
+
+
+def _error_message(body: Any) -> str:
+    """Return the message of a token endpoint error response body."""
+    match body:
+        case {"error": {"message": str() as message}}:
+            return message
+        case {"error_description": str() as description}:
+            return description
+        case {"error": {"error_description": str() as description}}:
+            return description
+    return "unknown error"
+
+
+async def async_token_request(
+    client: httpx.AsyncClient,
+    data: dict[str, str],
+    *,
+    fatal_errors: bool = False,
+) -> dict[str, Any]:
+    """POST a form encoded grant to the SIWC token endpoint.
+
+    ``fatal_errors`` maps the errors which invalidate the stored refresh token
+    to :class:`ChatGPTPlanAuthFatalError` so the caller can start reauth.
+    """
+    try:
+        response = await client.post(TOKEN_URL, data=data, timeout=HTTP_TIMEOUT)
+    except httpx.HTTPError as err:
+        raise ChatGPTPlanAuthError(f"Error talking to OpenAI: {err}") from err
+
+    if response.status_code == 200:
+        try:
+            return dict(response.json())
+        except ValueError as err:
+            raise ChatGPTPlanAuthError("Invalid token response from OpenAI") from err
+
+    try:
+        body = response.json()
+    except ValueError:
+        body = None
+    code = _error_code(body)
+    message = _error_message(body)
+
+    if fatal_errors and code in FATAL_REFRESH_ERRORS:
+        raise ChatGPTPlanAuthFatalError(
+            f"Sign in with ChatGPT authentication failed ({code}): {message}"
+        )
+
+    raise ChatGPTPlanAuthError(f"Sign in with ChatGPT failed ({code}): {message}")
+
+
+def _decode_jwt_claims(id_token: str) -> Mapping[str, Any]:
+    """Return the claims of an ID token without verifying its signature.
+
+    See the module docstring: the token arrives from the TLS-authenticated
+    token endpoint, so the signature is not checked and no key material or
+    crypto dependency is carried.
+    """
+    parts = id_token.split(".")
+    if len(parts) != 3:
+        raise ChatGPTPlanAuthError("Invalid ID token: not a JWT")
+    padding = "=" * (-len(parts[1]) % 4)
+    try:
+        claims = json.loads(base64.urlsafe_b64decode(parts[1] + padding))
+    except (binascii.Error, ValueError, UnicodeDecodeError) as err:
+        raise ChatGPTPlanAuthError(f"Invalid ID token: {err}") from err
+    if not isinstance(claims, Mapping):
+        raise ChatGPTPlanAuthError("Invalid ID token: claims are not an object")
+    return claims
+
+
+def validate_id_token(
+    id_token: str, *, client_id: str, nonce: str
+) -> Mapping[str, Any]:
+    """Validate an ID token and return its claims.
+
+    The issuer, the audience (the issued client id), the expiry and the nonce
+    of this authorization attempt are all verified. The signature is not; see
+    the module docstring.
+    """
+    claims = _decode_jwt_claims(id_token)
+
+    if claims.get("iss") != ISSUER:
+        raise ChatGPTPlanAuthError(
+            f"Invalid ID token: unexpected issuer {claims.get('iss')!r}"
+        )
+
+    audience = claims.get("aud")
+    audiences = [audience] if isinstance(audience, str) else list(audience or [])
+    if client_id not in audiences:
+        raise ChatGPTPlanAuthError("Invalid ID token: audience mismatch")
+
+    expires_at = claims.get("exp")
+    if not isinstance(expires_at, (int, float)) or expires_at <= _utcnow().timestamp():
+        raise ChatGPTPlanAuthError("Invalid ID token: expired")
+
+    if claims.get("nonce") != nonce:
+        raise ChatGPTPlanAuthError("Invalid ID token: nonce mismatch")
+
+    return claims
+
+
+def _parse_optional_string(value: Any) -> str | None:
+    """Return a string claim value, or None."""
+    return value if isinstance(value, str) else None
+
+
+async def async_exchange_code(
+    client: httpx.AsyncClient,
+    code: str,
+    *,
+    request: AuthorizationRequest,
+    callback_client_id: str | None = None,
+    callback_state: str | None = None,
+) -> ChatGPTCredentials:
+    """Exchange the authorization code of a callback for credentials.
+
+    ``callback_state`` is compared against the state of ``request`` (the CSRF
+    check) and the nonce of the ID token is verified by
+    :func:`validate_id_token`. A dynamic client registration returns the issued
+    client id in the callback as ``client_id``; pass it as
+    ``callback_client_id`` so the code is exchanged with the registered client.
+    """
+    if callback_state is not None and callback_state != request.state:
+        raise ChatGPTPlanAuthError("Sign in with ChatGPT failed: state mismatch")
+
+    client_id = callback_client_id or request.client_id
+
+    token = await async_token_request(
+        client,
+        {
+            "grant_type": "authorization_code",
+            "client_id": client_id,
+            "code": code,
+            "code_verifier": request.code_verifier,
+            "redirect_uri": request.redirect_uri,
+            "resource": RESOURCE,
+        },
+        fatal_errors=True,
+    )
+
+    sub: str | None = None
+    email: str | None = None
+    if id_token := token.get("id_token"):
+        claims = validate_id_token(id_token, client_id=client_id, nonce=request.nonce)
+        sub = _parse_optional_string(claims.get("sub"))
+        email = _parse_optional_string(claims.get("email"))
+
+    return credentials_from_token(
+        token,
+        client_id=client_id,
+        ext_agent_host_id=request.ext_agent_host_id,
+        sub=sub,
+        email=email,
+    )
+
+
+def credentials_from_token(
+    token: Mapping[str, Any],
+    *,
+    client_id: str,
+    ext_agent_host_id: str,
+    previous: ChatGPTCredentials | None = None,
+    sub: str | None = None,
+    email: str | None = None,
+) -> ChatGPTCredentials:
+    """Build credentials from a token endpoint response.
+
+    Refresh tokens rotate on every refresh, so the response always replaces the
+    stored credentials. Fields the response does not repeat are kept from
+    ``previous``.
+    """
+    scopes = str(token.get("scope", "")).split()
+    expires_in = token.get("expires_in")
+    return ChatGPTCredentials(
+        client_id=client_id,
+        ext_agent_host_id=ext_agent_host_id,
+        sub=sub if sub is not None else (previous.sub if previous else ""),
+        email=email if email is not None else (previous.email if previous else None),
+        access_token=token["access_token"],
+        refresh_token=token.get("refresh_token")
+        or (previous.refresh_token if previous else ""),
+        id_token=token.get("id_token") or (previous.id_token if previous else ""),
+        expires_at=_utcnow() + timedelta(seconds=int(expires_in) if expires_in else 3600),
+        scopes=scopes or (previous.scopes if previous else []),
+        earliest_refresh_at=_parse_optional_datetime(token.get("earliest_refresh_at")),
+    )
+
+
+class ChatGPTAuth:
+    """Manage the SIWC token lifecycle of one set of credentials.
+
+    The manager is storage agnostic: it refreshes through the given
+    :class:`httpx.AsyncClient` and reports every rotation through ``on_update``
+    so the caller can persist it. A dead refresh token raises
+    :class:`ChatGPTPlanAuthFatalError`; starting the reauth flow is the
+    caller's job.
+    """
+
+    def __init__(
+        self,
+        credentials: ChatGPTCredentials,
+        *,
+        client: httpx.AsyncClient,
+        on_update: Callable[[ChatGPTCredentials], None] | None = None,
+    ) -> None:
+        """Initialize the token manager."""
+        self.credentials = credentials
+        self.client = client
+        self.on_update = on_update
+        self._lock = asyncio.Lock()
+
+    @classmethod
+    def from_entry_data(
+        cls,
+        data: Mapping[str, Any],
+        *,
+        client: httpx.AsyncClient,
+        on_update: Callable[[ChatGPTCredentials], None] | None = None,
+    ) -> ChatGPTAuth:
+        """Build the token manager from persisted credentials."""
+        return cls(
+            ChatGPTCredentials.from_entry_data(data), client=client, on_update=on_update
+        )
+
+    async def async_get_access_token(self) -> str:
+        """Return a valid access token, refreshing it when it is about to expire.
+
+        This is used as the async `api_key` provider of the OpenAI client, so
+        the token is checked (and refreshed) before every request.
+        """
+        async with self._lock:
+            if self._needs_refresh():
+                await self._async_refresh()
+        return self.credentials.access_token
+
+    def _needs_refresh(self) -> bool:
+        """Return if the access token should be refreshed."""
+        now = _utcnow()
+        if (
+            self.credentials.earliest_refresh_at is not None
+            and now < self.credentials.earliest_refresh_at
+        ):
+            # The token endpoint rejects refresh attempts before this time.
+            return False
+        return now >= self.credentials.expires_at - TOKEN_EXPIRY_MARGIN
+
+    async def async_handle_authentication_error(self) -> None:
+        """Refresh the token after the API rejected the access token."""
+        async with self._lock:
+            if (
+                self.credentials.earliest_refresh_at is not None
+                and _utcnow() < self.credentials.earliest_refresh_at
+            ):
+                # The token endpoint refuses refreshes before this time, so the
+                # rejected request was not a token expiry problem.
+                return
+            await self._async_refresh()
+
+    async def _async_refresh(self) -> None:
+        """Exchange the refresh token for a new set of tokens."""
+        token = await async_token_request(
+            self.client,
+            {
+                "grant_type": "refresh_token",
+                "client_id": self.credentials.client_id,
+                "refresh_token": self.credentials.refresh_token,
+                "resource": RESOURCE,
+            },
+            fatal_errors=True,
+        )
+
+        self._store(
+            credentials_from_token(
+                token,
+                client_id=self.credentials.client_id,
+                ext_agent_host_id=self.credentials.ext_agent_host_id,
+                previous=self.credentials,
+            )
+        )
+
+    def _store(self, credentials: ChatGPTCredentials) -> None:
+        """Replace the (rotated) credentials and hand them to the caller."""
+        self.credentials = credentials
+        if self.on_update is not None:
+            self.on_update(credentials)
+
+
+__all__ = [
+    "AuthorizationRequest",
+    "ChatGPTCredentials",
+    "ChatGPTAuth",
+    "async_exchange_code",
+    "async_token_request",
+    "create_authorization_request",
+    "create_ext_agent_host_id",
+    "credentials_from_token",
+    "parse_callback_url",
+    "validate_id_token",
+]

chatgpt_plan_auth/catalog.py

@@ -0,0 +1,94 @@
+"""Fetch the ChatGPT plan model catalog.
+
+The plan usage route serves a non-standard catalog body (a ``models`` list of
+objects carrying a ``slug``) which the OpenAI SDK cannot parse, so the request
+is made directly with :mod:`httpx`.
+"""
+
+from __future__ import annotations
+
+import httpx
+
+from .auth import ChatGPTCredentials, ChatGPTAuth
+from .const import (
+    HTTP_TIMEOUT,
+    MODELS_URL,
+    SUBSCRIPTION_MODEL_SUGGESTIONS,
+)
+from .errors import ChatGPTPlanAuthError, ChatGPTPlanAuthFatalError
+
+
+def subscription_model_options(models: list[str]) -> list[str]:
+    """Return the models to offer, falling back to the known suggestions."""
+    return models or SUBSCRIPTION_MODEL_SUGGESTIONS
+
+
+async def async_get_subscription_models(
+    client: httpx.AsyncClient, auth: ChatGPTAuth
+) -> list[str]:
+    """Return the model slugs offered to a ChatGPT plan account."""
+    return await _async_fetch_subscription_models(
+        client, await auth.async_get_access_token()
+    )
+
+
+async def async_get_subscription_models_for_credentials(
+    client: httpx.AsyncClient, credentials: ChatGPTCredentials
+) -> list[str]:
+    """Return the model slugs of an account which is not stored yet.
+
+    Used while creating or converting an entry, when there is no
+    :class:`ChatGPTAuth` (and therefore no stored token) to supply the access
+    token.
+    """
+    return await _async_fetch_subscription_models(client, credentials.access_token)
+
+
+async def _async_fetch_subscription_models(
+    client: httpx.AsyncClient, access_token: str
+) -> list[str]:
+    """Return the model slugs offered to a ChatGPT plan account."""
+    try:
+        response = await client.get(
+            MODELS_URL,
+            headers={"Authorization": f"Bearer {access_token}"},
+            timeout=HTTP_TIMEOUT,
+        )
+    except httpx.HTTPError as err:
+        raise ChatGPTPlanAuthError(f"Error talking to OpenAI: {err}") from err
+
+    if response.status_code in (401, 403):
+        raise ChatGPTPlanAuthFatalError(
+            "Sign in with ChatGPT authentication failed while listing models"
+        )
+
+    try:
+        response.raise_for_status()
+    except httpx.HTTPError as err:
+        raise ChatGPTPlanAuthError(f"Error listing OpenAI models: {err}") from err
+
+    try:
+        payload = response.json()
+    except ValueError as err:
+        raise ChatGPTPlanAuthError(
+            "Invalid model catalog response from OpenAI"
+        ) from err
+
+    models = payload.get("models") if isinstance(payload, dict) else None
+    if not isinstance(models, list):
+        raise ChatGPTPlanAuthError(
+            "The model catalog response from OpenAI did not contain a models list"
+        )
+
+    return [
+        item["slug"]
+        for item in models
+        if isinstance(item, dict) and isinstance(item.get("slug"), str)
+    ]
+
+
+__all__ = [
+    "async_get_subscription_models",
+    "async_get_subscription_models_for_credentials",
+    "subscription_model_options",
+]

chatgpt_plan_auth/client.py

@@ -0,0 +1,84 @@
+"""OpenAI SDK client which authenticates with a ChatGPT plan.
+
+Requires the ``openai`` extra: ``pip install chatgpt-plan-auth[openai]``. Nothing
+else in this package imports the OpenAI SDK.
+
+The ported overrides carry no ``typing.override`` decorator: that is Python
+3.12+ and this package supports 3.10.
+"""
+
+from __future__ import annotations
+
+from collections.abc import AsyncGenerator
+from typing import Any
+
+import httpx
+from openai import AsyncOpenAI
+
+from .auth import ChatGPTAuth
+from .const import PLACEHOLDER_API_KEY
+
+
+class ChatGPTSubscriptionAuth(httpx.Auth):
+    """Attach the SIWC access token and refresh it once on a 401."""
+
+    def __init__(self, auth: ChatGPTAuth) -> None:
+        """Initialize the auth flow."""
+        self._auth = auth
+
+    async def async_auth_flow(
+        self, request: httpx.Request
+    ) -> AsyncGenerator[httpx.Request, httpx.Response]:
+        """Attach the access token, refreshing it when it was rejected."""
+        request.headers["Authorization"] = (
+            f"Bearer {await self._auth.async_get_access_token()}"
+        )
+        response = yield request
+        if response.status_code == 401:
+            await self._auth.async_handle_authentication_error()
+            request.headers["Authorization"] = (
+                f"Bearer {self._auth.credentials.access_token}"
+            )
+            yield request
+
+
+class ChatGPTSubscriptionClient(AsyncOpenAI):
+    """OpenAI client authenticating with a ChatGPT plan subscription."""
+
+    def __init__(
+        self,
+        auth: ChatGPTAuth,
+        http_client: httpx.AsyncClient,
+        **options: Any,
+    ) -> None:
+        """Initialize the client."""
+        self.auth = auth
+        # A ChatGPT plan has no API key: the bearer token is attached per request
+        # by `custom_auth`, which also refreshes it. The SDK still requires a
+        # non-empty `api_key` to build a client, and it does not support a
+        # callable one (that raises inside the request).
+        options.pop("api_key", None)
+        # The plan usage route answers a degraded provider edge with a 5xx and a
+        # `retry_after` (60 seconds when this was written), which the SDK honors
+        # while backing off. The default of two retries therefore leaves an
+        # interactive request waiting minutes before the caller sees the error,
+        # so bound it to a single retry and let the caller report the status.
+        options.setdefault("max_retries", 1)
+        super().__init__(api_key=PLACEHOLDER_API_KEY, http_client=http_client, **options)
+
+    def with_options(self, **options: Any) -> ChatGPTSubscriptionClient:
+        """Return a copy of this client which keeps the ChatGPT plan sign in.
+
+        The base implementation copies a client with `type(self)(**options)`,
+        which would not carry the sign in of this instance.
+        """
+        options.setdefault("http_client", self._client)
+        return ChatGPTSubscriptionClient(self.auth, **options)
+
+    @property
+    def custom_auth(self) -> httpx.Auth | None:
+        """Return the token refreshing auth flow."""
+        return ChatGPTSubscriptionAuth(self.auth)
+
+
+__all__ = ["ChatGPTSubscriptionAuth", "ChatGPTSubscriptionClient"]

chatgpt_plan_auth/const.py

@@ -0,0 +1,167 @@
+"""Constants of the Sign in with ChatGPT (ChatGPT plan usage) protocol.
+
+Ports the protocol constants out of Home Assistant core's
+``openai_conversation/chatgpt_auth.py``. Endpoint URLs, the dynamic client
+registration id, scopes, the ``ext_agent_host_id`` scheme, the parameters and
+tools the plan usage route rejects, and the model suggestions live here.
+"""
+
+from datetime import timedelta
+from typing import Any
+
+AUTHORIZE_URL = "https://auth.openai.com/api/accounts/authorize"
+TOKEN_URL = "https://auth.openai.com/api/accounts/oauth/token"
+ISSUER = "https://auth.openai.com"
+RESOURCE = "https://api.openai.com/v1"
+MODELS_URL = "https://api.openai.com/v1/models"
+
+# The callback URI must be an HTTP loopback address on 127.0.0.1; only the port
+# may vary. A fixed port keeps the URI stable between authorization attempts.
+REDIRECT_URI = "http://127.0.0.1:1455/auth/callback"
+
+# `dynamic_agent_client` is the first-time registration entrypoint only. It must
+# never be stored: the callback returns the issued client id (oaiapp_...) which
+# is used for the code exchange and all later authorizations.
+DYNAMIC_AGENT_CLIENT = "dynamic_agent_client"
+CLIENT_ID_PREFIX = "oaiapp_"
+
+# Display metadata of the first (dynamic client registration) authorization
+# request. Callers pass their own product name.
+AGENT_NAME_HINT = "chatgpt-plan-auth"
+
+# The `ext_agent_host_id` scheme: a UUID based host id is documented as a
+# supported alternative to a JWK thumbprint URI and needs no key management.
+EXT_AGENT_HOST_ID_SCHEME = "urn:uuid:"
+
+SCOPE = "openid profile email offline_access resource.invoke chatgpt.tokens.use.direct"
+# Granted scope required before the ChatGPT plan may be used.
+PLAN_SCOPE = "chatgpt.tokens.use.direct"
+
+# Refresh the access token this long before it expires. Access tokens live one
+# hour and refresh tokens 30 days.
+TOKEN_EXPIRY_MARGIN = timedelta(minutes=5)
+HTTP_TIMEOUT = 30
+
+# Keys of the credential mapping (`ChatGPTCredentials.as_entry_data`). They are
+# plain strings so a caller can persist them wherever it wants; Home Assistant
+# stores them as config entry data.
+CONF_AUTH_METHOD = "auth_method"
+CONF_ACCESS_TOKEN = "access_token"
+CONF_CLIENT_ID = "client_id"
+CONF_EMAIL = "email"
+CONF_EARLIEST_REFRESH_AT = "earliest_refresh_at"
+CONF_EXPIRES_AT = "expires_at"
+CONF_EXT_AGENT_HOST_ID = "ext_agent_host_id"
+CONF_ID_TOKEN = "id_token"
+CONF_REFRESH_TOKEN = "refresh_token"
+CONF_SCOPES = "scopes"
+CONF_SUB = "sub"
+
+AUTH_METHOD_API_KEY = "api_key"
+AUTH_METHOD_CHATGPT = "chatgpt"
+
+# Token endpoint errors which mean the refresh token can never be used again.
+FATAL_REFRESH_ERRORS = frozenset(
+    {
+        "invalid_grant",
+        "invalid_client",
+        "invalid_refresh_token",
+        "refresh_token_expired",
+        "refresh_token_invalidated",
+        "refresh_token_reused",
+        "token_expired",
+    }
+)
+
+# Errors returned by the subscription route itself (inference requests).
+SUBSCRIPTION_INFERENCE_ERROR_HINTS = {
+    "subscription_sharing_user_not_eligible": (
+        "This ChatGPT account is not eligible to use the ChatGPT plan with "
+        "this app. Check your plan in ChatGPT settings."
+    ),
+    "subscription_sharing_usage_limit_exceeded": (
+        "The ChatGPT plan usage limit was reached. Check ChatGPT settings -> "
+        "Usage to see the remaining plan usage."
+    ),
+    "subscription_sharing_usage_unavailable": (
+        "ChatGPT plan usage is currently unavailable, please retry later."
+    ),
+    "subscription_sharing_route_not_supported": (
+        "This request is not supported by ChatGPT plan usage."
+    ),
+    "subscription_sharing_unsupported_capability": (
+        "This request uses a capability which ChatGPT plan usage does not support."
+    ),
+    "subscription_sharing_invalid_user": (
+        "The ChatGPT sign-in is no longer valid. Please sign in with ChatGPT again."
+    ),
+}
+
+# Parameters the ChatGPT plan usage route rejects. Everything else in the
+# request builder is either required (model/input) or accepted.
+SUBSCRIPTION_UNSUPPORTED_PARAMS = (
+    "background",
+    "conversation",
+    "max_output_tokens",
+    "max_tool_calls",
+    "metadata",
+    "moderation",
+    "multi_agent",
+    "prompt",
+    "prompt_cache_key",
+    "prompt_cache_options",
+    "prompt_cache_retention",
+    "safety_identifier",
+    "service_tier",
+    "temperature",
+    "top_logprobs",
+    "top_p",
+    "truncation",
+    "user",
+)
+
+# Hosted tools which the subscription route does not provide. Web search is
+# still offered by the route, subject to the account's plan and policy.
+SUBSCRIPTION_UNSUPPORTED_TOOL_TYPES = (
+    "code_interpreter",
+    "file_search",
+    "image_generation",
+    "mcp",
+    "tool_search",
+)
+
+# The subscription route requires unsaved, streamed responses.
+SUBSCRIPTION_STORE = False
+SUBSCRIPTION_STREAM = True
+
+# Placeholder value the OpenAI SDK insists on; the real credential is the OAuth
+# access token attached by `ChatGPTSubscriptionClient.custom_auth`.
+PLACEHOLDER_API_KEY = "chatgpt-plan"
+
+# Models which were observed in the catalog of a ChatGPT plan account. The
+# catalog is authoritative and is used whenever it can be read, but it can be
+# unavailable (OpenAI answered a transient HTTP 520 while this was written) and
+# the plan usage route rejects the regular API default model, so these are
+# offered as suggestions in that case. The model field stays editable, so a
+# model outside this list can still be used.
+SUBSCRIPTION_MODEL_SUGGESTIONS: list[str] = [
+    "gpt-6.1-sol",
+    "gpt-6-astra",
+    "gpt-6-sol",
+    "gpt-6-luna",
+    "gpt-reserve",
+    "gpt-5.6-sol",
+    "gpt-5.6-terra",
+    "gpt-5.6-luna",
+    "gpt-daybreak-blue-latest",
+    "gpt-5.5",
+    "codex-auto-review",
+]
+
+
+def is_chatgpt_data(data: dict[str, Any]) -> bool:
+    """Return if stored data authenticates with a ChatGPT plan.
+
+    API key data keeps the historical layout and has no auth method key.
+    """
+    return data.get(CONF_AUTH_METHOD) == AUTH_METHOD_CHATGPT

chatgpt_plan_auth/errors.py

@@ -0,0 +1,15 @@
+"""Errors of the Sign in with ChatGPT flow.
+
+Callers map these onto their own error types: :class:`ChatGPTPlanAuthFatalError`
+means the stored refresh token can never be used again and the user has to sign
+in again (Home Assistant starts its reauth flow), every other
+:class:`ChatGPTPlanAuthError` is a transient failure.
+"""
+
+
+class ChatGPTPlanAuthError(Exception):
+    """Error of the Sign in with ChatGPT flow."""
+
+
+class ChatGPTPlanAuthFatalError(ChatGPTPlanAuthError):
+    """The stored credentials are dead and the user has to sign in again."""

chatgpt_plan_auth/requests.py

@@ -0,0 +1,101 @@
+"""Adapt Responses API requests for the ChatGPT plan usage route.
+
+The plan usage route accepts a subset of the Responses API: ``store: false``
+with ``stream: true``, no system input items, no hosted tools beyond web
+search, and none of the parameters listed in ``SUBSCRIPTION_UNSUPPORTED_PARAMS``.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from .const import (
+    SUBSCRIPTION_INFERENCE_ERROR_HINTS,
+    SUBSCRIPTION_STORE,
+    SUBSCRIPTION_STREAM,
+    SUBSCRIPTION_UNSUPPORTED_PARAMS,
+    SUBSCRIPTION_UNSUPPORTED_TOOL_TYPES,
+)
+
+
+def shape_request_for_subscription(
+    model_args: dict[str, Any],
+    messages: list[Any],
+) -> None:
+    """Adapt a Responses API request for the ChatGPT plan usage route.
+
+    The subscription route only accepts `store: false` together with
+    `stream: true` and rejects a documented list of parameters. It also does
+    not accept system input items: the system prompt is sent as `instructions`
+    instead. Function tools are accepted flat.
+    """
+    for param in SUBSCRIPTION_UNSUPPORTED_PARAMS:
+        model_args.pop(param, None)
+
+    model_args["store"] = SUBSCRIPTION_STORE
+    model_args["stream"] = SUBSCRIPTION_STREAM
+
+    # System/developer messages are not accepted as input items.
+    instructions = model_args.get("instructions")
+    while messages and (
+        isinstance(messages[0], dict)
+        and messages[0].get("type") == "message"
+        and messages[0].get("role") in ("system", "developer")
+    ):
+        content = messages.pop(0).get("content")
+        if isinstance(content, str):
+            instructions = f"{instructions}\n\n{content}" if instructions else content
+    if instructions:
+        model_args["instructions"] = instructions
+
+    # The route rejects explicit `system` input items.
+    for item in messages:
+        if (
+            isinstance(item, dict)
+            and item.get("type") == "message"
+            and item.get("role") == "system"
+        ):
+            item["role"] = "developer"
+
+    # Hosted tools which the subscription route does not provide are removed;
+    # function tools are sent flat and `web_search` is kept.
+    if tools := model_args.get("tools"):
+        kept = [
+            tool
+            for tool in tools
+            if tool.get("type") == "function"
+            or tool.get("type") not in SUBSCRIPTION_UNSUPPORTED_TOOL_TYPES
+        ]
+        if kept:
+            model_args["tools"] = kept
+        else:
+            model_args.pop("tools")
+
+    # Naming a single function as `tool_choice` is not supported.
+    if isinstance(model_args.get("tool_choice"), dict):
+        model_args.pop("tool_choice")
+
+
+def subscription_error_message(err: Exception) -> str | None:
+    """Return a helpful message for a subscription route error.
+
+    Duck types on ``code`` and only imports the OpenAI SDK when the error is not
+    recognised by code, so this module works without the ``openai`` extra.
+    """
+    code: Any = getattr(err, "code", None)
+    if isinstance(code, str) and (
+        hint := SUBSCRIPTION_INFERENCE_ERROR_HINTS.get(code)
+    ):
+        return hint
+
+    try:
+        import openai
+    except ImportError:
+        return None
+
+    if isinstance(err, openai.AuthenticationError):
+        return SUBSCRIPTION_INFERENCE_ERROR_HINTS["subscription_sharing_invalid_user"]
+    return None
+
+
+__all__ = ["shape_request_for_subscription", "subscription_error_message"]

chatgpt_plan_auth-1.0.0.dist-info/METADATA

@@ -0,0 +1,128 @@
+Metadata-Version: 2.5
+Name: chatgpt-plan-auth
+Version: 1.0.0
+Summary: Sign in with ChatGPT (ChatGPT plan usage) for locally hosted apps
+Author-email: Michael Guber <michael@guber.dev>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: chatgpt,oauth,openai,pkce,siwc
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Typing :: Typed
+Requires-Python: >=3.10
+Requires-Dist: httpx>=0.27
+Provides-Extra: dev
+Requires-Dist: openai>=1.40; extra == 'dev'
+Requires-Dist: pytest-asyncio>=0.23; extra == 'dev'
+Requires-Dist: pytest>=8; extra == 'dev'
+Provides-Extra: openai
+Requires-Dist: openai>=1.40; extra == 'openai'
+Description-Content-Type: text/markdown
+
+# chatgpt-plan-auth
+
+Sign in with ChatGPT (ChatGPT plan usage) for locally hosted, open-source apps.
+
+Implements the SIWC OAuth flow documented at
+<https://developers.openai.com/siwc/token-sharing-open-source/>: register a
+dynamic client, authorize with PKCE, exchange the code for tokens, keep them
+refreshed and rotated, read the plan's model catalog, and shape Responses API
+requests for the plan usage route. The access token is used as the bearer token
+against `https://api.openai.com/v1` instead of an API key.
+
+The library is a straight extraction of Home Assistant core's
+`openai_conversation/chatgpt_auth.py` (the reviewer's point: deep knowledge of
+an external system belongs in a library, not in core). It carries no Home
+Assistant imports, no `hass`, no config-entry or storage knowledge, and no
+crypto dependency.
+
+```bash
+pip install chatgpt-plan-auth          # protocol only: httpx
+pip install chatgpt-plan-auth[openai]  # + the OpenAI SDK client wrapper
+```
+
+## What lives where
+
+| Module | Contents |
+| --- | --- |
+| `chatgpt_plan_auth.const` | endpoints, `dynamic_agent_client`, scopes, the `ext_agent_host_id` scheme, rejected params/tools lists, model suggestions |
+| `chatgpt_plan_auth.auth` | authorization URL + PKCE/state/nonce, callback parsing, token requests, code exchange, ID token claim validation, credentials, token lifecycle |
+| `chatgpt_plan_auth.catalog` | plan model catalog fetch/parse and the suggestion fallback |
+| `chatgpt_plan_auth.requests` | `shape_request_for_subscription`, `subscription_error_message` |
+| `chatgpt_plan_auth.client` | httpx auth flow and `openai.AsyncOpenAI` subclass (extra: `openai`) |
+
+Everything is caller-driven: no Home Assistant, no global session, no storage.
+
+```python
+import httpx
+from chatgpt_plan_auth import (
+    ChatGPTCredentials, ChatGPTAuth, async_exchange_code, create_authorization_request,
+    create_ext_agent_host_id, parse_callback_url,
+)
+
+host_id = create_ext_agent_host_id()          # generate once, persist it yourself
+request = create_authorization_request(client_id=None, ext_agent_host_id=host_id)
+# send the user to request.url, then read the loopback address bar (any machine):
+params = parse_callback_url(callback_url)
+async with httpx.AsyncClient() as client:
+    credentials = await async_exchange_code(
+        client, params["code"], request=request,
+        callback_client_id=params.get("client_id"), callback_state=params.get("state"),
+    )
+
+# Later, per request:
+auth = ChatGPTAuth(credentials, client=client, on_update=save)  # `save` persists rotation
+token = await auth.async_get_access_token()
+```
+
+Errors: `ChatGPTPlanAuthFatalError` means the stored refresh token can never be
+used again (start your re-authentication flow); any other
+`ChatGPTPlanAuthError` is transient. With the `openai` extra,
+`ChatGPTSubscriptionClient(auth, http_client=...)` attaches the token per
+request and retries once on a 401.
+
+## Deliberate simplification: no ID token signature verification
+
+`/.well-known/jwks.json` is never fetched, RSA keys are never parsed and no JWT
+or crypto dependency is carried — the JWKS helpers and their cache from core are
+gone.
+
+Rationale: the ID token arrives directly from the provider's
+TLS-authenticated token endpoint in the same response as the code exchange. That
+is the trust model Home Assistant's own OAuth2 flow uses, and it is exactly the
+dependency-heavy part the core reviewer objected to. A signature check adds
+nothing there: anyone able to forge the token response could equally forge the
+signature.
+
+What is still verified on every code exchange:
+
+- `iss` is `https://auth.openai.com`
+- `aud` contains the client id the code was exchanged with
+- `exp` is in the future
+- `nonce` equals the nonce of that authorization attempt
+- the callback `state` equals the state of that authorization attempt
+
+Token endpoint errors (`invalid_grant`, `invalid_client`, `token_expired`, ...)
+still surface as fatal errors and never invalidate good credentials.
+
+If you need signature verification — or you cannot trust your network path to
+the token endpoint — verify the ID token against the JWKS in your application
+before calling `validate_id_token`.
+
+## Out of scope (stays in the consuming application)
+
+- Home Assistant: config-entry inspection/storage, `Store` for the host id, the
+  HA http client, config-flow and reauth steps.
+- Application branding: pass `agent_name_hint` (defaults to
+  `chatgpt-plan-auth`).
+- Persisting credentials: the library returns plain mappings
+  (`ChatGPTCredentials.as_entry_data()`), nothing is written to disk.
+
+## Tests
+
+```bash
+uv run --with pytest-asyncio --with openai python -m pytest tests -q
+```
+
+All network access is a fake `httpx.MockTransport`; no test touches the network
+and no test needs key material.

chatgpt_plan_auth-1.0.0.dist-info/RECORD

@@ -0,0 +1,12 @@
+chatgpt_plan_auth/__init__.py,sha256=Uqhl6MCVksCpiUBGb6TdIx3fiTInDH6Ma4IyaMxOC5Q,2123
+chatgpt_plan_auth/auth.py,sha256=bJKUHK5rVCpNo-PR0VFjYuz4PAZMWEVrwhQUttkJaWQ,19528
+chatgpt_plan_auth/catalog.py,sha256=V6FewEdhguoDgqcq0hEo2iv_D6wapbMGDYokLVyU4M8,2951
+chatgpt_plan_auth/client.py,sha256=LvE7eGZWd5Cy-9olHvq6vrYI-sjpMF-P7r2FxOpcFJE,3210
+chatgpt_plan_auth/const.py,sha256=BP9Ejl6Fef3tuSv8MwBr8Qtni-4dNV_JMOp7L5X4vrI,5957
+chatgpt_plan_auth/errors.py,sha256=5IXUq5XoBl_TCT8moAYWuPfZrmAVjy1SUkt1y1UXptY,551
+chatgpt_plan_auth/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+chatgpt_plan_auth/requests.py,sha256=UXDEY9IW34nyUF7BvWIs8MzmIe4CNlrTl_PlJCbgXYA,3415
+chatgpt_plan_auth-1.0.0.dist-info/METADATA,sha256=-5WIdGTLiacBEuzetMj7neXUkx5zdTJebxC_hAAYNQw,5510
+chatgpt_plan_auth-1.0.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+chatgpt_plan_auth-1.0.0.dist-info/licenses/LICENSE,sha256=gTWpUtJRJGTvKKxNlJJ0rKdlUe11k2FkmT93JGljSFI,1070
+chatgpt_plan_auth-1.0.0.dist-info/RECORD,,

chatgpt_plan_auth-1.0.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.32.4
+Root-Is-Purelib: true
+Tag: py3-none-any

chatgpt_plan_auth-1.0.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Michael Guber
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.