@agentionai/agents 1.12.0 → 1.13.0

package/dist/agents/openai/codex-auth.js

@@ -0,0 +1,264 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CODEX_CLIENT_VERSION = exports.CODEX_ORIGINATOR = exports.CODEX_TOKEN_URL = exports.CODEX_CLIENT_ID = exports.CODEX_BASE_URL = void 0;
+exports.decodeJwtClaims = decodeJwtClaims;
+exports.jwtExpiry = jwtExpiry;
+exports.codexAuthFilePath = codexAuthFilePath;
+exports.loadCodexCredentials = loadCodexCredentials;
+exports.refreshCodexCredentials = refreshCodexCredentials;
+exports.createCodexTokenProvider = createCodexTokenProvider;
+const fs_1 = require("fs");
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+/**
+ * OAuth against a ChatGPT subscription, as used by OpenAI's Codex CLI.
+ *
+ * This is a different product surface from the platform API: the credentials are
+ * a ChatGPT login rather than a `sk-...` platform key, and requests are billed
+ * against the subscription instead of an API account. The endpoint differs too —
+ * see {@link CODEX_BASE_URL}.
+ *
+ * None of it is a documented public API. The values here were cross-checked
+ * against the Codex CLI's own behaviour and several independent
+ * reimplementations, but OpenAI can change them without notice.
+ */
+/**
+ * Base URL for the ChatGPT-backed Codex Responses API.
+ *
+ * The SDK appends `/responses`, giving
+ * `https://chatgpt.com/backend-api/codex/responses`.
+ */
+exports.CODEX_BASE_URL = "https://chatgpt.com/backend-api/codex";
+/** Public OAuth client id the Codex CLI uses. Not a secret. */
+exports.CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+/** Token endpoint used to exchange a refresh token for a fresh access token. */
+exports.CODEX_TOKEN_URL = "https://auth.openai.com/oauth/token";
+/**
+ * Default `originator` header value.
+ *
+ * OpenAI gates parts of the model catalog on this, so an unrecognised value can
+ * quietly change which models an account may reach.
+ */
+exports.CODEX_ORIGINATOR = "codex_cli_rs";
+/**
+ * `client_version` for the Codex models endpoint, which 400s without one.
+ *
+ * Each model also carries a `minimal_client_version`; the backend hides models
+ * newer than the version claimed here, so an old value quietly shortens the
+ * list rather than erroring.
+ */
+exports.CODEX_CLIENT_VERSION = "0.153.4";
+/**
+ * Decode a JWT's payload without verifying its signature.
+ *
+ * Verification is the token endpoint's job — we are only reading claims out of a
+ * token we were just handed over TLS, never making a trust decision on it.
+ * Returns `undefined` for anything that does not parse, so a malformed or
+ * opaque token degrades to "no claims" rather than throwing.
+ */
+function decodeJwtClaims(token) {
+    const payload = token.split(".")[1];
+    if (!payload)
+        return undefined;
+    try {
+        const json = Buffer.from(payload, "base64url").toString("utf8");
+        const claims = JSON.parse(json);
+        return typeof claims === "object" && claims !== null
+            ? claims
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Seconds-since-epoch expiry of a JWT, or `undefined` if it has no `exp`.
+ */
+function jwtExpiry(token) {
+    const exp = decodeJwtClaims(token)?.exp;
+    return typeof exp === "number" ? exp : undefined;
+}
+/** Default location of Codex's credential file. */
+function codexAuthFilePath(codexHome) {
+    const home = codexHome ?? process.env.CODEX_HOME ?? path.join(os.homedir(), ".codex");
+    return path.join(home, "auth.json");
+}
+/**
+ * Read the credentials the Codex CLI stored at `$CODEX_HOME/auth.json`
+ * (`~/.codex/auth.json` by default).
+ *
+ * Sign in with `codex login` first — this only reads what that wrote, it does
+ * not run the OAuth flow itself.
+ *
+ * @throws if the file is missing, unreadable, not JSON, or holds no access token.
+ */
+async function loadCodexCredentials(codexHome) {
+    const file = codexAuthFilePath(codexHome);
+    let raw;
+    try {
+        raw = await fs_1.promises.readFile(file, "utf8");
+    }
+    catch (error) {
+        const reason = error?.code === "ENOENT"
+            ? "no such file — run `codex login` to sign in with your ChatGPT account"
+            : error instanceof Error
+                ? error.message
+                : "unknown error";
+        throw new Error(`Could not read Codex credentials from ${file}: ${reason}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new Error(`Codex credentials at ${file} are not valid JSON`);
+    }
+    const tokens = parsed.tokens;
+    if (!tokens?.access_token) {
+        throw new Error(`Codex credentials at ${file} contain no OAuth access token` +
+            (parsed.OPENAI_API_KEY
+                ? " — that file holds a platform API key instead, which belongs in `apiKey` with the default `authType: \"apiKey\"`"
+                : " — run `codex login` to sign in with your ChatGPT account"));
+    }
+    return credentialsFromTokens(tokens);
+}
+/** Build {@link CodexCredentials} from an `auth.json` `tokens` object. */
+function credentialsFromTokens(tokens) {
+    const claims = tokens.id_token
+        ? decodeJwtClaims(tokens.id_token)
+        : undefined;
+    const auth = claims?.["https://api.openai.com/auth"];
+    return {
+        accessToken: tokens.access_token,
+        refreshToken: tokens.refresh_token,
+        // `auth.json` usually carries `account_id`, but not always; the same value
+        // is a claim on the id_token, so fall back to that before giving up.
+        accountId: tokens.account_id ?? auth?.chatgpt_account_id,
+        email: claims?.email ?? claims?.["https://api.openai.com/profile"]?.email,
+        planType: auth?.chatgpt_plan_type,
+    };
+}
+/**
+ * Exchange a refresh token for a fresh access token.
+ *
+ * The returned credentials carry the new `refresh_token` when the server
+ * rotated it, and the previous one otherwise.
+ */
+async function refreshCodexCredentials(refreshToken, options = {}) {
+    const res = await fetch(options.tokenUrl ?? exports.CODEX_TOKEN_URL, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+            grant_type: "refresh_token",
+            refresh_token: refreshToken,
+            client_id: options.clientId ?? exports.CODEX_CLIENT_ID,
+        }),
+        signal: options.signal,
+    });
+    if (!res.ok) {
+        const body = await res.text().catch(() => "");
+        throw new Error(`Codex token refresh failed (${res.status} ${res.statusText})${body ? `: ${body.slice(0, 500)}` : ""}`);
+    }
+    const data = (await res.json());
+    if (!data.access_token) {
+        throw new Error("Codex token refresh returned no access_token");
+    }
+    return credentialsFromTokens({
+        access_token: data.access_token,
+        // The endpoint only returns a refresh token when it rotates one; reuse the
+        // current one otherwise, or the next refresh has nothing to present.
+        refresh_token: data.refresh_token ?? refreshToken,
+        id_token: data.id_token,
+    });
+}
+/**
+ * Wrap credentials in a self-refreshing token provider.
+ *
+ * Refreshes lazily — only when a token is actually asked for and the current
+ * one is within `refreshSkewSeconds` of expiry. Concurrent callers share a
+ * single in-flight refresh rather than each starting their own.
+ */
+function createCodexTokenProvider(credentials, options = {}) {
+    const skew = options.refreshSkewSeconds ?? 300;
+    let current = credentials;
+    let expiresAt = jwtExpiry(credentials.accessToken);
+    let inFlight;
+    const isFresh = () => {
+        // An opaque token with no readable `exp` is assumed good: refreshing on
+        // every call would be worse than letting a 401 surface.
+        if (expiresAt === undefined)
+            return true;
+        return Date.now() / 1000 < expiresAt - skew;
+    };
+    const refresh = async () => {
+        if (!current.refreshToken) {
+            throw new Error("Codex access token has expired and no refresh token is available — run `codex login` again");
+        }
+        const next = await refreshCodexCredentials(current.refreshToken, {
+            clientId: options.clientId,
+            tokenUrl: options.tokenUrl,
+        });
+        current = {
+            ...next,
+            // A refresh response carries no id_token in some cases, which would drop
+            // the account id the `chatgpt-account-id` header needs.
+            accountId: next.accountId ?? current.accountId,
+            email: next.email ?? current.email,
+            planType: next.planType ?? current.planType,
+        };
+        expiresAt = jwtExpiry(current.accessToken);
+        try {
+            await options.onRefresh?.(current);
+        }
+        catch {
+            // Persisting is best-effort; the token in hand is still valid.
+        }
+        return current.accessToken;
+    };
+    return {
+        getToken: async () => {
+            if (isFresh())
+                return current.accessToken;
+            // Collapse concurrent refreshes: the second caller awaits the first.
+            inFlight ?? (inFlight = refresh().finally(() => {
+                inFlight = undefined;
+            }));
+            return inFlight;
+        },
+        current: () => current,
+    };
+}
+//# sourceMappingURL=codex-auth.js.map

package/dist/index.d.ts

@@ -1,6 +1,10 @@
 export * from "./agents/BaseAgent";
 export * from "./agents/anthropic/ClaudeAgent";
 export { OpenAiAgent } from "./agents/openai/OpenAiAgent";
+export { CODEX_BASE_URL, CODEX_CLIENT_ID, CODEX_ORIGINATOR, CODEX_TOKEN_URL, codexAuthFilePath, createCodexTokenProvider, loadCodexCredentials, refreshCodexCredentials, } from "./agents/openai/codex-auth";
+export type { CodexModelCard, CodexCredentials, CodexTokenProvider, CodexTokenProviderOptions, } from "./agents/openai/codex-auth";
+export { CodexAgent } from "./agents/openai/CodexAgent";
+export type { CodexAgentConfig, CodexModel, CodexReasoningEffort, } from "./agents/openai/CodexAgent";
 export { MistralAgent } from "./agents/mistral/MistralAgent";
 export type { MistralModelCard } from "./agents/mistral/MistralAgent";
 export { GeminiAgent, GEMINI_RETIRED_MODELS, } from "./agents/google/GeminiAgent";

package/dist/index.js

@@ -22,12 +22,23 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.openRouterTransformer = exports.chatCompletionsTransformer = exports.ollamaTransformer = exports.geminiTransformer = exports.mistralTransformer = exports.openAiTransformer = exports.anthropicTransformer = exports.OpenRouterAgent = exports.OpenAICompatibleAgent = exports.LlamaCppAgent = exports.OllamaAgent = exports.GEMINI_RETIRED_MODELS = exports.GeminiAgent = exports.MistralAgent = exports.OpenAiAgent = void 0;
+exports.openRouterTransformer = exports.chatCompletionsTransformer = exports.ollamaTransformer = exports.geminiTransformer = exports.mistralTransformer = exports.openAiTransformer = exports.anthropicTransformer = exports.OpenRouterAgent = exports.OpenAICompatibleAgent = exports.LlamaCppAgent = exports.OllamaAgent = exports.GEMINI_RETIRED_MODELS = exports.GeminiAgent = exports.MistralAgent = exports.CodexAgent = exports.refreshCodexCredentials = exports.loadCodexCredentials = exports.createCodexTokenProvider = exports.codexAuthFilePath = exports.CODEX_TOKEN_URL = exports.CODEX_ORIGINATOR = exports.CODEX_CLIENT_ID = exports.CODEX_BASE_URL = exports.OpenAiAgent = void 0;
 // Agents
 __exportStar(require("./agents/BaseAgent"), exports);
 __exportStar(require("./agents/anthropic/ClaudeAgent"), exports);
 var OpenAiAgent_1 = require("./agents/openai/OpenAiAgent");
 Object.defineProperty(exports, "OpenAiAgent", { enumerable: true, get: function () { return OpenAiAgent_1.OpenAiAgent; } });
+var codex_auth_1 = require("./agents/openai/codex-auth");
+Object.defineProperty(exports, "CODEX_BASE_URL", { enumerable: true, get: function () { return codex_auth_1.CODEX_BASE_URL; } });
+Object.defineProperty(exports, "CODEX_CLIENT_ID", { enumerable: true, get: function () { return codex_auth_1.CODEX_CLIENT_ID; } });
+Object.defineProperty(exports, "CODEX_ORIGINATOR", { enumerable: true, get: function () { return codex_auth_1.CODEX_ORIGINATOR; } });
+Object.defineProperty(exports, "CODEX_TOKEN_URL", { enumerable: true, get: function () { return codex_auth_1.CODEX_TOKEN_URL; } });
+Object.defineProperty(exports, "codexAuthFilePath", { enumerable: true, get: function () { return codex_auth_1.codexAuthFilePath; } });
+Object.defineProperty(exports, "createCodexTokenProvider", { enumerable: true, get: function () { return codex_auth_1.createCodexTokenProvider; } });
+Object.defineProperty(exports, "loadCodexCredentials", { enumerable: true, get: function () { return codex_auth_1.loadCodexCredentials; } });
+Object.defineProperty(exports, "refreshCodexCredentials", { enumerable: true, get: function () { return codex_auth_1.refreshCodexCredentials; } });
+var CodexAgent_1 = require("./agents/openai/CodexAgent");
+Object.defineProperty(exports, "CodexAgent", { enumerable: true, get: function () { return CodexAgent_1.CodexAgent; } });
 var MistralAgent_1 = require("./agents/mistral/MistralAgent");
 Object.defineProperty(exports, "MistralAgent", { enumerable: true, get: function () { return MistralAgent_1.MistralAgent; } });
 var GeminiAgent_1 = require("./agents/google/GeminiAgent");

package/dist/openai.d.ts

@@ -1,4 +1,7 @@
 export * from "./core";
-export { OpenAiAgent } from "./agents/openai/OpenAiAgent";
+export { OpenAiAgent, describeOpenAIError, wrapErrorBodyFetch, } from "./agents/openai/OpenAiAgent";
+export { CodexAgent } from "./agents/openai/CodexAgent";
+export type { CodexAgentConfig, CodexModel, CodexReasoningEffort, } from "./agents/openai/CodexAgent";
 export { openAiTransformer } from "./history/transformers";
+export { CODEX_BASE_URL, CODEX_CLIENT_ID, CODEX_ORIGINATOR, CODEX_TOKEN_URL, codexAuthFilePath, createCodexTokenProvider, decodeJwtClaims, jwtExpiry, loadCodexCredentials, refreshCodexCredentials, type CodexCredentials, type CodexTokenProvider, type CodexTokenProviderOptions, type CodexModelCard, } from "./agents/openai/codex-auth";
 //# sourceMappingURL=openai.d.ts.map

package/dist/openai.js

@@ -14,11 +14,26 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.openAiTransformer = exports.OpenAiAgent = void 0;
+exports.refreshCodexCredentials = exports.loadCodexCredentials = exports.jwtExpiry = exports.decodeJwtClaims = exports.createCodexTokenProvider = exports.codexAuthFilePath = exports.CODEX_TOKEN_URL = exports.CODEX_ORIGINATOR = exports.CODEX_CLIENT_ID = exports.CODEX_BASE_URL = exports.openAiTransformer = exports.CodexAgent = exports.wrapErrorBodyFetch = exports.describeOpenAIError = exports.OpenAiAgent = void 0;
 // OpenAI Agent Entry Point
 __exportStar(require("./core"), exports);
 var OpenAiAgent_1 = require("./agents/openai/OpenAiAgent");
 Object.defineProperty(exports, "OpenAiAgent", { enumerable: true, get: function () { return OpenAiAgent_1.OpenAiAgent; } });
+Object.defineProperty(exports, "describeOpenAIError", { enumerable: true, get: function () { return OpenAiAgent_1.describeOpenAIError; } });
+Object.defineProperty(exports, "wrapErrorBodyFetch", { enumerable: true, get: function () { return OpenAiAgent_1.wrapErrorBodyFetch; } });
+var CodexAgent_1 = require("./agents/openai/CodexAgent");
+Object.defineProperty(exports, "CodexAgent", { enumerable: true, get: function () { return CodexAgent_1.CodexAgent; } });
 var transformers_1 = require("./history/transformers");
 Object.defineProperty(exports, "openAiTransformer", { enumerable: true, get: function () { return transformers_1.openAiTransformer; } });
+var codex_auth_1 = require("./agents/openai/codex-auth");
+Object.defineProperty(exports, "CODEX_BASE_URL", { enumerable: true, get: function () { return codex_auth_1.CODEX_BASE_URL; } });
+Object.defineProperty(exports, "CODEX_CLIENT_ID", { enumerable: true, get: function () { return codex_auth_1.CODEX_CLIENT_ID; } });
+Object.defineProperty(exports, "CODEX_ORIGINATOR", { enumerable: true, get: function () { return codex_auth_1.CODEX_ORIGINATOR; } });
+Object.defineProperty(exports, "CODEX_TOKEN_URL", { enumerable: true, get: function () { return codex_auth_1.CODEX_TOKEN_URL; } });
+Object.defineProperty(exports, "codexAuthFilePath", { enumerable: true, get: function () { return codex_auth_1.codexAuthFilePath; } });
+Object.defineProperty(exports, "createCodexTokenProvider", { enumerable: true, get: function () { return codex_auth_1.createCodexTokenProvider; } });
+Object.defineProperty(exports, "decodeJwtClaims", { enumerable: true, get: function () { return codex_auth_1.decodeJwtClaims; } });
+Object.defineProperty(exports, "jwtExpiry", { enumerable: true, get: function () { return codex_auth_1.jwtExpiry; } });
+Object.defineProperty(exports, "loadCodexCredentials", { enumerable: true, get: function () { return codex_auth_1.loadCodexCredentials; } });
+Object.defineProperty(exports, "refreshCodexCredentials", { enumerable: true, get: function () { return codex_auth_1.refreshCodexCredentials; } });
 //# sourceMappingURL=openai.js.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@agentionai/agents",
   "author": "Laurent Zuijdwijk",
-  "version": "1.12.0",
+  "version": "1.13.0",
   "description": "Agent Library",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",