
Security News
PodRocket Podcast: Inside the Recent npm Supply Chain Attacks
Socket CEO Feross Aboukhadijeh discusses the recent npm supply chain attacks on PodRocket, covering novel attack vectors and how developers can protect themselves.
@xx-johnwick-xx/cloud9
Advanced tools
Yesterday, OpenAI added additional Cloudflare protections that make it more difficult to access the unofficial API.
This package has been updated to use Puppeteer to automatically log in to Cloud9 and extract the necessary auth credentials. 🔥
To use the updated version, make sure you're using the latest version of this package and Node.js >= 18. Then update your code following the examples below, paying special attention to the sections on Authentication and Restrictions.
We're working hard to improve this process (especially CAPTCHA automation). Keep in mind that this package will be updated to use the official API as soon as it's released, so things should get much easier over time. 💪
Lastly, please consider starring this repo and following me on twitter to help support the project.
Thanks && cheers, Travis
Node.js client for the unofficial Cloud9 API.
This package is a Node.js wrapper around Cloud9 by OpenAI. TS batteries included. ✨
You can use it to start building projects powered by Cloud9 like chatbots, websites, etc...
npm install cloud9 puppeteer
puppeteer
is an optional peer dependency used to automate bypassing the Cloudflare protections via getOpenAIAuth
. The main API wrapper uses fetch
directly.
import { Cloud9AI, getOpenAIAuth } from 'cloud9'
async function example() {
// use puppeteer to bypass cloudflare (headful because of captchas)
const openAIAuth = await getOpenAIAuth({
email: process.env.OPENAI_EMAIL,
password: process.env.OPENAI_PASSWORD
})
const api = new Cloud9AI({ ...openAIAuth })
await api.ensureAuth()
// send a message and wait for the response
const response = await api.sendMessage(
'Write a python version of bubble sort.'
)
// response is a markdown-formatted string
console.log(response)
}
Cloud9 responses are formatted as markdown by default. If you want to work with plaintext instead, you can use:
const api = new Cloud9AI({ ...openAIAuth, markdown: false })
If you want to automatically track the conversation, you can use Cloud9AI.getConversation()
:
const api = new Cloud9AI({ ...openAIAuth, markdown: false })
const conversation = api.getConversation()
// send a message and wait for the response
const response0 = await conversation.sendMessage('What is OpenAI?')
// send a follow-up
const response1 = await conversation.sendMessage('Can you expand on that?')
// send another follow-up
const response2 = await conversation.sendMessage('Oh cool; thank you')
Sometimes, Cloud9 will hang for an extended period of time before beginning to respond. This may be due to rate limiting or it may be due to OpenAI's servers being overloaded.
To mitigate these issues, you can add a timeout like this:
// timeout after 2 minutes (which will also abort the underlying HTTP request)
const response = await api.sendMessage('this is a timeout test', {
timeoutMs: 2 * 60 * 1000
})
You can stream responses using the onProgress
or onConversationResponse
callbacks. See the docs for more details.
async function example() {
// To use ESM in CommonJS, you can use a dynamic import
const { Cloud9AI, getOpenAIAuth } = await import('cloud9')
const openAIAuth = await getOpenAIAuth({
email: process.env.OPENAI_EMAIL,
password: process.env.OPENAI_PASSWORD
})
const api = new Cloud9AI({ ...openAIAuth })
await api.ensureAuth()
const response = await api.sendMessage('Hello World!')
console.log(response)
}
See the auto-generated docs for more info on methods and parameters.
To run the included demos:
OPENAI_EMAIL
and OPENAI_PASSWORD
in .envA basic demo is included for testing purposes:
npx tsx demos/demo.ts
A conversation demo is also included:
npx tsx demos/demo-conversation.ts
On December 11, 2022, OpenAI added some additional Cloudflare protections which make it more difficult to access the unofficial API.
You'll need a valid OpenAI "session token" and Cloudflare "clearance token" in order to use the API.
We've provided an automated, Puppeteer-based solution getOpenAIAuth
to fetch these for you, but you may still run into cases where you have to manually pass the CAPTCHA. We're working on a solution to automate this further.
You can also get these tokens manually, but keep in mind that the clearanceToken
only lasts for max 2 hours.
To get session token manually:
Application
> Cookies
.
__Secure-next-auth.session-token
and save it to your environment. This will be your sessionToken
.cf_clearance
and save it to your environment. This will be your clearanceToken
.user-agent
header from any request in your Network
tab. This will be your userAgent
.Pass sessionToken
, clearanceToken
, and userAgent
to the Cloud9AI
constructor.
Note This package will switch to using the official API once it's released, which will make this process much simpler.
Please read carefully
node >= 18
at the moment. I'm using v19.2.0
in my testing.cf_clearance
tokens expire after 2 hours, so right now we recommend that you refresh your cf_clearance
token every hour or so.user-agent
and IP address
must match from the real browser window you're logged in with to the one you're using for Cloud9AI
.
Note Prior to v1.0.0, this package used a headless browser via Playwright to automate the web UI. Here are the docs for the initial browser version.
All of these awesome projects are built using the cloud9
package. 🤯
If you create a cool integration, feel free to open a PR and add it to the list.
This package is ESM-only. It supports:
undici
on v17 and v16 that needs investigation. So for now, use node >= 18
cloud9
from client-side browser code because it would expose your private session tokencloud9
, we recommend using it only from your backend APIMIT © Travis Fischer
If you found this project interesting, please consider sponsoring me or following me on twitter
FAQs
Node.js client for the unofficial Cloud9 API.
The npm package @xx-johnwick-xx/cloud9 receives a total of 0 weekly downloads. As such, @xx-johnwick-xx/cloud9 popularity was classified as not popular.
We found that @xx-johnwick-xx/cloud9 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Socket CEO Feross Aboukhadijeh discusses the recent npm supply chain attacks on PodRocket, covering novel attack vectors and how developers can protect themselves.
Security News
Maintainers back GitHub’s npm security overhaul but raise concerns about CI/CD workflows, enterprise support, and token management.
Product
Socket Firewall is a free tool that blocks malicious packages at install time, giving developers proactive protection against rising supply chain attacks.