#![deny(missing_docs)]
#![deny(clippy::all)]
#![deny(clippy::pedantic)]
#![deny(clippy::nursery)]
use clap::{ArgAction, Args, Parser, Subcommand};
use reqwest::Client;
use rotom::{
Error, Result,
codex::{client::CodexClient, cursor},
config::{AppConfig, AppConfigStore, AuthStore, Credentials, Provider, now_unix},
daemon::{self, DaemonInstallOptions},
logging::{self, LogLevel},
models::{
highlight_model_ids_for_provider, resolve_model_ids_for_provider,
resolve_model_list_for_providers,
},
oauth::{
CodexOAuthClient, CursorOAuthClient, GrokOAuthClient, KiroAuthorizationCallback,
KiroOAuthClient, create_authorization_flow, default_cli_database_path,
default_desktop_token_path, parse_kiro_authorization_callback,
},
server::{AppState, UpstreamState, serve},
timefmt::format_duration,
token::TokenManager,
};
use std::{
io::{self, IsTerminal, Write},
net::SocketAddr,
path::PathBuf,
process::Command as ProcessCommand,
time::Duration,
};
use tokio::time::{MissedTickBehavior, interval};
mod prompt;
use prompt::{
config_string, prompt_authorization_code, prompt_optional_path, prompt_optional_string,
prompt_port, prompt_string,
};
const INTERACTIVE_TOKEN_STATUS_INTERVAL: Duration = Duration::from_secs(1);
const LOG_TOKEN_STATUS_INTERVAL: Duration = Duration::from_secs(60);
const DEFAULT_MODEL_FALLBACK: &str = "gpt-5.5";
const CLI_LONG_ABOUT: &str = "\
rotom is a local OpenAI- and Anthropic-compatible API gateway backed by Codex,
Grok, Kiro, or Cursor OAuth.
It helps clients that speak either the OpenAI Chat Completions API or the
Anthropic Messages API call the selected upstream after you complete the OAuth
login flow. Credentials are stored locally and can be refreshed automatically
during requests or manually with the refresh command/API.";
const CLI_AFTER_LONG_HELP: &str = "\
Examples:
rotom login
rotom login --provider grok
rotom login --kiro
rotom login --cursor
rotom config
rotom config show
rotom serve
rotom serve --bind 127.0.0.1:14550 --api-key local-secret
rotom daemon install
rotom daemon reinstall
rotom daemon start
rotom daemon status
rotom models
rotom models --provider grok
rotom models --provider cursor
rotom kiro import --from cli
rotom refresh
rotom status
rotom status --provider cursor
rotom update
curl -X POST http://127.0.0.1:14550/v1/auth/refresh \\
-H 'authorization: Bearer local-secret'
Environment:
ROTOM_API_KEY Optional local API key for server endpoints
ROTOM_PROVIDER Upstream provider: codex, grok, kiro, or cursor
ROTOM_MODEL_FALLBACK Fallback for unsupported Anthropic model ids
ROTOM_AUTH_FILE Override the credential file path
ROTOM_HOME Override the default config home
Files:
Credentials default to ~/.rotom/auth.json.
Runtime config defaults to ~/.rotom/config.json.
Disclaimer:
rotom is an unofficial tool and is not affiliated with, endorsed by, or
supported by OpenAI, Anthropic, xAI, AWS, Kiro, or Cursor. Use it at your own
risk, make sure your usage complies with the terms that apply to your account
and the upstream services, and do not assume the LGPLv3 license overrides
upstream account restrictions on sharing or reselling personal OAuth-backed
access.
Copyright:
Copyright (c) 2026 rotom contributors. Licensed under the GNU Lesser
General Public License v3.0 only.";
#[derive(Debug, Parser)]
#[command(
name = "rotom",
version,
about = "OpenAI- and Anthropic-compatible API gateway backed by OAuth providers",
long_about = CLI_LONG_ABOUT,
after_long_help = CLI_AFTER_LONG_HELP
)]
struct Cli {
#[arg(
short = 'v',
long = "verbose",
global = true,
action = ArgAction::Count,
help = "Increase logging verbosity: -v for request summaries, -vv/-vvv for full tracing"
)]
verbose: u8,
#[command(subcommand)]
command: Command,
}
#[derive(Debug, Subcommand)]
enum Command {
#[command(
about = "Log in with an OAuth provider and save local credentials",
long_about = "Start the selected OAuth login flow, exchange the authorization code for tokens, and save credentials to the configured auth file."
)]
Login {
#[arg(long, value_name = "PATH", help = "Credential file to read/write")]
auth_file: Option<PathBuf>,
#[arg(
long,
env = "ROTOM_PROVIDER",
value_name = "PROVIDER",
help = "OAuth provider to authenticate: codex, grok, kiro, or cursor"
)]
provider: Option<String>,
#[arg(
long,
action = ArgAction::SetTrue,
conflicts_with = "provider",
help = "Authenticate with Kiro without scanning local Kiro credential stores"
)]
kiro: bool,
#[arg(
long,
action = ArgAction::SetTrue,
conflicts_with_all = ["provider", "kiro"],
help = "Authenticate with Cursor's browser polling flow"
)]
cursor: bool,
#[arg(
long,
default_value = "pi",
value_name = "NAME",
help = "OAuth originator parameter to send during login"
)]
originator: String,
},
#[command(
about = "Manage persisted runtime configuration",
long_about = "Interactively save or inspect default host, port, and API key stored in the rotom config file."
)]
Config {
#[command(subcommand)]
command: Option<ConfigCommand>,
},
#[command(
about = "Serve the OpenAI- and Anthropic-compatible HTTP API",
long_about = "Serve OpenAI- and Anthropic-compatible endpoints backed by the selected provider, including /v1/models, /v1/chat/completions, /v1/responses, Responses resource compatibility routes, /v1/messages, /v1/messages/count_tokens, /v1/messages/batches, and /v1/auth/refresh."
)]
Serve {
#[arg(long, value_name = "ADDR", help = "Socket address to listen on")]
bind: Option<SocketAddr>,
#[arg(long, value_name = "PATH", help = "Credential file to read/write")]
auth_file: Option<PathBuf>,
#[arg(
long,
env = "ROTOM_API_KEY",
value_name = "KEY",
help = "Optional local API key accepted as Bearer token or x-api-key"
)]
api_key: Option<String>,
#[arg(
long,
env = "ROTOM_PROVIDER",
value_name = "PROVIDER",
help = "Upstream provider to serve: codex, grok, kiro, or cursor"
)]
provider: Option<String>,
#[arg(
long,
env = "ROTOM_MODEL_FALLBACK",
value_name = "MODEL",
help = "Fallback model for unsupported Anthropic model ids such as claude-sonnet-*"
)]
model_fallback: Option<String>,
},
#[command(
about = "Force refresh saved OAuth tokens",
long_about = "Use saved refresh tokens to fetch fresh credentials immediately and write them back to the configured auth file."
)]
Refresh {
#[arg(long, value_name = "PATH", help = "Credential file to read/write")]
auth_file: Option<PathBuf>,
#[arg(
long,
env = "ROTOM_PROVIDER",
value_name = "PROVIDER",
help = "OAuth provider to refresh: codex, grok, kiro, or cursor. When omitted, refreshes all saved providers."
)]
provider: Option<String>,
},
#[command(
about = "Show provider token status, highlight models, and daemon endpoints",
long_about = "Refresh saved credentials if needed, then show token expiry, authentication status, and strongest highlight models for saved providers. When --provider is omitted, reports all saved providers. If the daemon is running, also prints its local API endpoint URLs. Use `rotom models` for full model lists."
)]
Status {
#[arg(long, value_name = "PATH", help = "Credential file to read/write")]
auth_file: Option<PathBuf>,
#[arg(
long,
value_name = "PROVIDER",
help = "Provider to inspect: codex/openai, grok/xai, kiro, or cursor"
)]
provider: Option<String>,
},
#[command(
about = "List all available models grouped by provider",
long_about = "Print all model identifiers rotom exposes through /v1/models, grouped by upstream provider. Use --provider to list only one provider. When Cursor credentials are available, rotom fetches Cursor's live model registry."
)]
Models {
#[arg(long, value_name = "PATH", help = "Credential file to read")]
auth_file: Option<PathBuf>,
#[arg(
long,
value_name = "PROVIDER",
help = "Provider to list: codex/openai, grok/xai, kiro, or cursor"
)]
provider: Option<String>,
},
#[command(
about = "Import local Kiro credentials",
long_about = "Import credentials from the official Kiro CLI SQLite store or Kiro IDE desktop JSON token file. This is separate from `rotom login --kiro` and never prints raw tokens."
)]
Kiro {
#[command(subcommand)]
command: KiroCommand,
},
#[command(
about = "Install the latest rotom release with cargo",
long_about = "Run `cargo install --locked --force rotom` so the currently installed rotom binary is updated to the latest published release. Requires `cargo` to be available on PATH."
)]
Update {
#[arg(
long,
value_name = "VERSION",
help = "Install a specific published version instead of the latest release"
)]
version: Option<String>,
},
#[command(
about = "Install and control the background rotom service",
long_about = "Install and control rotom as a per-user background service. macOS uses launchd LaunchAgents; Linux uses systemd user services."
)]
Daemon {
#[command(subcommand)]
command: DaemonCommand,
},
}
#[derive(Debug, Subcommand)]
enum DaemonCommand {
#[command(
about = "Install rotom as a per-user autostart service",
long_about = "Write the service definition for the current user and enable autostart. Use `rotom daemon start` to start it immediately."
)]
Install(#[command(flatten)] DaemonInstallCliOptions),
#[command(
about = "Reinstall rotom with updated service configuration",
long_about = "Remove the existing per-user daemon definition if present, then install a fresh one using the provided options and saved runtime config defaults."
)]
Reinstall(#[command(flatten)] DaemonInstallCliOptions),
#[command(about = "Start the installed rotom daemon")]
Start,
#[command(about = "Restart the installed rotom daemon")]
Restart,
#[command(about = "Show the installed rotom daemon status")]
Status,
#[command(about = "Stop the installed rotom daemon")]
Stop,
#[command(about = "Disable and remove the installed rotom daemon")]
Uninstall,
}
#[derive(Debug, Subcommand)]
enum ConfigCommand {
#[command(about = "Print the saved runtime configuration as JSON")]
Show,
#[command(about = "Delete the saved runtime configuration file")]
Reset,
}
#[derive(Debug, Subcommand)]
enum KiroCommand {
#[command(
about = "Import credentials from an existing Kiro CLI or IDE login",
long_about = "Read a local Kiro credential store, save a rotom Kiro provider entry, and keep token values out of stdout. Use --from cli for ~/.local/share/kiro-cli/data.sqlite3 or --from desktop for ~/.aws/sso/cache/kiro-auth-token.json."
)]
Import {
#[arg(long, value_name = "PATH", help = "rotom credential file to write")]
auth_file: Option<PathBuf>,
#[arg(
long = "from",
value_name = "SOURCE",
required = true,
help = "Credential source: cli, desktop, or explicit auto"
)]
source: String,
#[arg(
long,
value_name = "PATH",
help = "Explicit Kiro SQLite database or desktop token JSON path"
)]
path: Option<PathBuf>,
},
}
#[derive(Debug, Clone, Args)]
struct DaemonInstallCliOptions {
#[arg(
long,
value_name = "PATH",
help = "rotom executable to run; defaults to the current executable"
)]
executable: Option<PathBuf>,
#[arg(
long,
value_name = "ADDR",
help = "Socket address the daemon should listen on"
)]
bind: Option<SocketAddr>,
#[arg(long, value_name = "PATH", help = "Credential file to read/write")]
auth_file: Option<PathBuf>,
#[arg(
long,
env = "ROTOM_API_KEY",
value_name = "KEY",
help = "Optional local API key saved to runtime config for daemon auth"
)]
api_key: Option<String>,
#[arg(
long,
env = "ROTOM_PROVIDER",
value_name = "PROVIDER",
help = "Upstream provider to serve: codex, grok, kiro, or cursor"
)]
provider: Option<String>,
#[arg(
long,
env = "ROTOM_MODEL_FALLBACK",
value_name = "MODEL",
help = "Fallback model for unsupported Anthropic model ids such as claude-sonnet-*"
)]
model_fallback: Option<String>,
}
#[tokio::main]
async fn main() {
if let Err(error) = run(Cli::parse()).await {
eprintln!("error: {error}");
std::process::exit(1);
}
}
async fn run(cli: Cli) -> Result<()> {
let log_level = LogLevel::from_verbosity(cli.verbose);
match cli.command {
Command::Login {
auth_file,
provider,
kiro,
cursor,
originator,
} => {
let store = auth_store(auth_file)?;
let provider = resolve_login_provider(&store, provider, kiro, cursor)?;
login(store, provider, &originator).await
}
Command::Config { command } => config_command(command.as_ref()),
Command::Serve {
bind,
auth_file,
api_key,
provider,
model_fallback,
} => {
logging::init(log_level)?;
let config = load_app_config()?;
let effective_bind = bind
.or_else(|| bind_from_config(config.as_ref()))
.unwrap_or_else(default_bind);
let effective_auth_file = auth_file.or_else(|| config_auth_file(config.as_ref()));
let effective_api_key =
api_key.or_else(|| config_string(config.as_ref(), |item| item.api_key.clone()));
let effective_model_fallback = resolve_model_fallback(model_fallback, config.as_ref());
let http = Client::new();
let store = auth_store(effective_auth_file)?;
let providers = resolve_served_providers(&store, provider, config.as_ref())?;
let mut upstreams = Vec::new();
for provider in &providers {
let token_manager =
TokenManager::new_for_provider(store.clone(), *provider, http.clone());
token_manager.credentials().await?;
upstreams.push(UpstreamState {
provider: *provider,
token_manager,
client: CodexClient::new_for_provider(http.clone(), *provider),
});
}
let model_list = resolve_model_list_for_providers(&providers)?;
println!("listening on http://{effective_bind}");
for upstream in &upstreams {
spawn_token_expiry_display(upstream.token_manager.clone());
}
serve(
effective_bind,
AppState::new_multi_with_model_fallback(
upstreams,
effective_api_key,
model_list,
effective_model_fallback,
),
)
.await
}
Command::Refresh {
auth_file,
provider,
} => refresh(auth_store(auth_file)?, provider).await,
Command::Status {
auth_file,
provider,
} => status(auth_store(auth_file)?, provider).await,
Command::Models {
auth_file,
provider,
} => models(auth_store(auth_file)?, provider).await,
Command::Kiro { command } => kiro_command(command),
Command::Update { version } => update(version.as_deref()),
Command::Daemon { command } => daemon_command(command, cli.verbose),
}
}
async fn models(store: AuthStore, provider: Option<String>) -> Result<()> {
let providers = match provider {
Some(provider) => vec![provider.parse()?],
None => vec![
Provider::Codex,
Provider::Grok,
Provider::Kiro,
Provider::Cursor,
],
};
let groups = model_groups_for_providers(&store, &providers).await?;
print!("{}", format_model_groups(&groups));
Ok(())
}
#[cfg(test)]
fn format_models(providers: &[Provider]) -> String {
let groups = providers
.iter()
.copied()
.map(|provider| (provider, provider_model_ids(provider)))
.collect::<Vec<_>>();
format_model_groups(&groups)
}
fn format_model_groups(groups: &[(Provider, Vec<String>)]) -> String {
groups
.iter()
.map(|(provider, models)| {
let models = model_lines(models.clone()).join("\n");
format!(
"{} ({provider})\n{models}\n",
model_provider_label(*provider)
)
})
.collect::<Vec<_>>()
.join("\n")
}
async fn model_groups_for_providers(
store: &AuthStore,
providers: &[Provider],
) -> Result<Vec<(Provider, Vec<String>)>> {
let credentials = store.load_all()?;
let mut groups = Vec::new();
for provider in providers {
let models = if let Some(credentials) = credentials
.iter()
.find(|credentials| credentials.provider == *provider)
{
provider_model_ids_for_credentials(*provider, credentials).await
} else {
provider_model_ids(*provider)
};
groups.push((*provider, models));
}
Ok(groups)
}
const fn model_provider_label(provider: Provider) -> &'static str {
match provider {
Provider::Codex => "OpenAI",
Provider::Grok => "Grok",
Provider::Kiro => "Kiro",
Provider::Cursor => "Cursor",
}
}
fn update(version: Option<&str>) -> Result<()> {
let mut command = build_update_command(version);
println!("running {command:?}");
let status = command.status()?;
if status.success() {
match version {
Some(version) => println!("updated rotom to version {version}"),
None => println!("updated rotom to the latest published release"),
}
Ok(())
} else {
Err(Error::upstream(format!(
"cargo install exited with status {status}"
)))
}
}
#[must_use]
fn build_update_command(version: Option<&str>) -> ProcessCommand {
let mut command = ProcessCommand::new("cargo");
command.args(["install", "--locked", "--force", "rotom"]);
if let Some(version) = version {
command.args(["--version", version]);
}
command
}
include!("main_config.rs");
include!("main_auth.rs");
async fn status(store: AuthStore, provider: Option<String>) -> Result<()> {
let http = Client::new();
let requested_provider = provider
.map(|value| value.parse::<Provider>())
.transpose()?;
let providers = resolve_status_providers(store.load_all()?, requested_provider)?;
println!("{}", rotom_version_line());
for provider in providers {
println!();
render_provider_status(&store, provider, http.clone()).await?;
}
if let Some(base_url) = running_daemon_base_url(&http).await {
println!();
println!("daemon: running at {base_url}");
println!("endpoints:");
for line in daemon_endpoint_lines(&base_url) {
println!("{line}");
}
}
Ok(())
}
fn rotom_version_line() -> String {
format!("rotom: {}", env!("CARGO_PKG_VERSION"))
}
async fn render_provider_status(store: &AuthStore, provider: Provider, http: Client) -> Result<()> {
let token_manager = TokenManager::new_for_provider(store.clone(), provider, http);
let credentials = token_manager.credentials().await?;
let models = provider_model_ids_for_credentials(provider, &credentials).await;
let highlights = highlight_model_ids_for_provider(provider, &models);
println!("provider: {}", credentials.provider);
println!("token: {}", token_expiry_message(&credentials));
println!("status: authenticated");
println!("highlight_models:");
for line in model_lines(highlights) {
println!("{line}");
}
Ok(())
}
async fn provider_model_ids_for_credentials(
provider: Provider,
credentials: &Credentials,
) -> Vec<String> {
match live_provider_model_ids(provider, credentials).await {
Ok(models) => models,
Err(error) => {
eprintln!(
"warning: failed to fetch live {} model list; showing built-in fallback: {error}",
provider.display_name()
);
provider_model_ids(provider)
}
}
}
async fn live_provider_model_ids(
provider: Provider,
credentials: &Credentials,
) -> Result<Vec<String>> {
match provider {
Provider::Cursor => cursor::list_model_ids(credentials).await,
Provider::Codex | Provider::Grok | Provider::Kiro => Ok(provider_model_ids(provider)),
}
}
fn provider_model_ids(provider: Provider) -> Vec<String> {
resolve_model_ids_for_provider(provider)
}
fn model_lines(models: Vec<String>) -> Vec<String> {
models
.into_iter()
.map(|model| format!(" {model}"))
.collect()
}
fn resolve_status_providers(
credentials: Vec<Credentials>,
requested_provider: Option<Provider>,
) -> Result<Vec<Provider>> {
if credentials.is_empty() {
return Err(Error::config("not logged in; run `rotom login` first"));
}
if let Some(provider) = requested_provider {
return if credentials.iter().any(|item| item.provider == provider) {
Ok(vec![provider])
} else {
Err(Error::config(format!(
"not logged in for provider {provider}; run `rotom login --provider {provider}` first"
)))
};
}
let mut providers = credentials
.into_iter()
.map(|credentials| credentials.provider)
.collect::<Vec<_>>();
providers.sort_unstable();
providers.dedup();
Ok(providers)
}
async fn running_daemon_base_url(http: &Client) -> Option<String> {
let config = load_app_config().ok().flatten();
let bind = bind_from_config(config.as_ref()).unwrap_or_else(default_bind);
let base_url = format!("http://{bind}");
let health_url = format!("{base_url}/health");
let response = http
.get(health_url)
.timeout(Duration::from_millis(500))
.send()
.await
.ok()?;
response.status().is_success().then_some(base_url)
}
fn daemon_endpoint_lines(base_url: &str) -> Vec<String> {
const ENDPOINTS: [(&str, &str); 18] = [
("GET", "/health"),
("GET", "/v1/status"),
("GET", "/v1/models"),
("POST", "/v1/auth/refresh"),
("POST", "/v1/chat/completions"),
("POST", "/v1/responses"),
("GET,DELETE", "/v1/responses/{response_id}"),
("POST", "/v1/responses/{response_id}/cancel"),
("GET", "/v1/responses/{response_id}/input_items"),
("POST", "/v1/responses/compact"),
("POST", "/v1/responses/input_tokens"),
("POST", "/v1/messages"),
("POST", "/v1/messages/count_tokens"),
("GET,POST", "/v1/messages/batches"),
("GET,DELETE", "/v1/messages/batches/{batch_id}"),
("POST", "/v1/messages/batches/{batch_id}/cancel"),
("GET", "/v1/messages/batches/{batch_id}/results"),
("POST", "/v1/images/generations"),
];
ENDPOINTS
.iter()
.map(|(method, path)| format!(" {method:<10} {base_url}{path}"))
.collect()
}
fn auth_store(path: Option<PathBuf>) -> Result<AuthStore> {
path.map(AuthStore::new)
.map_or_else(AuthStore::from_default_path, Ok)
}
fn default_bind() -> SocketAddr {
"127.0.0.1:14550"
.parse()
.expect("hardcoded default bind address should parse")
}
fn bind_from_config(config: Option<&AppConfig>) -> Option<SocketAddr> {
let config = config?;
let host = config.bind_host.as_deref()?;
let port = config.bind_port?;
format!("{host}:{port}").parse().ok()
}
fn config_auth_file(config: Option<&AppConfig>) -> Option<PathBuf> {
config.and_then(|item| item.auth_file.clone())
}
fn spawn_token_expiry_display(token_manager: TokenManager) {
tokio::spawn(async move {
let interactive = io::stdout().is_terminal();
let mut ticker = interval(if interactive {
INTERACTIVE_TOKEN_STATUS_INTERVAL
} else {
LOG_TOKEN_STATUS_INTERVAL
});
ticker.set_missed_tick_behavior(MissedTickBehavior::Skip);
loop {
ticker.tick().await;
let status = token_expiry_status(&token_manager).await;
if interactive {
print!("\r\x1b[2K{status}");
let _ = io::stdout().flush();
} else {
println!("{status}");
}
}
});
}
async fn token_expiry_status(token_manager: &TokenManager) -> String {
match token_manager.credentials_snapshot().await {
Some(credentials) if credentials.expires_at > now_unix() => {
token_expiry_message(&credentials)
}
Some(_) => token_manager.credentials().await.map_or_else(
|error| format!("token refresh failed: {error}"),
|credentials| token_expiry_message(&credentials),
),
None => "token status unavailable: not logged in; run `rotom login` first".to_owned(),
}
}
fn token_expiry_message(credentials: &Credentials) -> String {
let remaining_secs = credentials.expires_at.saturating_sub(now_unix());
let subject = credential_subject(credentials);
if remaining_secs == 0 {
format!("token expired ({subject})")
} else {
format!(
"token expires in {} ({subject})",
format_duration(remaining_secs),
)
}
}
fn credential_subject(credentials: &Credentials) -> String {
format!("{} credentials", credentials.provider.display_name())
}
#[cfg(test)]
mod main_tests;