@agentqueue/worker 0.0.0 → 0.3.1-ci.g02c90ca5cd192c5a75a7d1d19329683cefb22d6e

package/README.md

@@ -0,0 +1,159 @@
+# Agent Queue self-hosted worker
+
+Agent Queue operates the shared control plane. This package runs the customer-hosted
+execution component and connects outward to that service over HTTPS. Customers do not
+run core, Postgres, the portal, or the deployment CLI.
+
+## Prerequisites
+
+- Node.js 24.22.1+ and a package manager with global installation support.
+- Linux with a systemd user manager that supports filesystem sandboxing, or macOS
+  with `sandbox-exec`. Registration refuses machines without supported process isolation.
+- At least one installed and authenticated runtime: Pi, OpenCode, Codex, or Claude Code 2.1.303 or newer.
+- The Agent Queue service URL and your immutable Clerk Organization ID (`org_...`).
+
+Set `WORKER_VERSION` to the qualified version recorded in its successful release run, then install it from npm:
+
+```sh
+pnpm add --global "@agentqueue/worker@${WORKER_VERSION:?}"
+```
+
+Authenticate a runtime using the instructions below, then use `aq auth` to inspect
+local runtime authentication. Once the
+machine is ready, register it with the service URL and tenant supplied by your team:
+
+```sh
+aq register --server https://agentqueue.example.com --tenant org_YOUR_CLERK_ORGANIZATION_ID
+```
+
+The URL and Organization ID above are placeholders. Use the service origin with
+`--tenant`, which appends `/t/<organization-id>` and saves that tenant-bound address.
+Do not use an organization slug or omit the tenant for the shared service; omission
+is supported only for legacy single-tenant development. Registration opens an enrollment
+page where you sign in to that organization and confirm the printed fingerprint.
+Review requested permissions there; edit them after registration if needed.
+
+A worker registration belongs to one tenant. Run data and results are sent to the
+hosted service, and model requests go to the chosen model provider. Worker-local model
+authentication is not a promise that task data stays only on your machine.
+
+## Capacity and authentication
+
+For projects and workflows, “All accessible” includes every project in the organization
+when the worker owner is an organization admin. Other owners must be project members,
+either directly or through a linked Slack channel. New projects become eligible
+automatically. “Selected” still restricts the worker to the chosen projects or workflows,
+and “None” disables that category. Removing the owner's admin role restores membership
+checks, including for active Runs. People starting chats still need project access.
+
+Workers accept one assignment at a time by default. Set a higher isolated-run limit during registration with `--concurrency 4`, or change an existing worker with `aq capacity 4`. Valid capacity is 1–16; Agent Queue stores the limit and applies changes to the running service automatically.
+
+Registration uses Agent Queue browser sign-in and fingerprint confirmation. Model credentials stay on the machine. `aq auth` reports local runtime authentication. After registration, `aq doctor` reports
+the saved service and worker identity, available runtimes, and process isolation.
+
+Codex uses the official, unmodified `@openai/codex@0.166.0` App Server. Install that qualified version before authenticating:
+
+```sh
+pnpm add --global @openai/codex@0.166.0
+```
+
+Subscription authentication uses the file-backed owner credential store. A trusted process outside the conversation refreshes it through the official account API and supplies short-lived external access tokens. Refresh tokens stay in the owner home:
+
+```sh
+aq auth codex
+```
+
+On a remote or headless machine, use Codex device authentication:
+
+```sh
+aq auth codex --device-auth
+```
+
+Claude subscription authentication must use an inference-only automation token because isolated Runs cannot access the macOS Keychain:
+
+```sh
+aq auth claude --setup-token
+```
+
+Codex and Claude advertise only their native model families. Authenticate Pi and OpenCode with their native login/configuration flows, then configure exact model eligibility during registration or with `AQ_WORKER_PI_MODELS` and `AQ_WORKER_OPENCODE_MODELS` as comma-separated lists. The selected model process receives only its worker-local model authentication and workflow-scoped Agent Queue broker access. Linear OAuth tokens, GitHub App or installation tokens, Agent Queue user tokens, and credentials for other model providers are never sent to it; temporary launch environment files are mode `0600` and removed during cleanup.
+
+## Managing the service
+
+Use `aq status`, `aq start`, `aq stop`, `aq capacity`, `aq auth`, and `aq unregister` to manage the user-level worker service. The Workers page can drain a machine without revoking it: active assignments keep their leases and finish, while new claims stop until an operator resumes the worker. `aq auth codex` runs Codex's file-backed login, while `aq auth claude --setup-token` runs Claude's long-lived subscription-token flow and securely stores only the resulting token. Both commands verify that the isolated worker can use the credential. `aq upgrade --version <qualified-version>` installs the selected private release and detects npm, pnpm, Yarn Classic, and Bun global installations; pass `--package-manager npm|pnpm|yarn|bun` to override detection.
+
+## App Server protocol library
+
+`@agentqueue/worker/app-server` exports the shared official Codex JSON-RPC client. Core imports this same implementation. The assignment runner uses this same client for Codex, including persistent native threads, supported steering, bounded event delivery and lifecycle cleanup. It has no Codex `exec` fallback. Other installed harnesses keep their adapters.
+
+```ts
+import { CodexAppServer, connectCodexAppServer } from "@agentqueue/worker/app-server";
+
+const local = new CodexAppServer({
+  binaryPath: "/opt/codex/bin/codex",
+  expectedVersion: "0.166.0",
+  cwd: "/data/workspace",
+  env: { PATH: "/usr/local/bin:/usr/bin:/bin", HOME: "/data/home", CODEX_HOME: "/data/codex" },
+  onNotification: async (method, params) => receiveEvent(method, params),
+  onRequest: async (method, params) => authorizeAndHandleRequest(method, params),
+});
+await local.initialize();
+
+const hosted = await connectCodexAppServer({
+  url: trustedAppServerUrl,
+  headers: { Authorization: `Bearer ${transportCapability}` },
+  redactValues: [transportCapability],
+  onNotification: async (method, params) => receiveEvent(method, params),
+  onRequest: async (method, params) => authorizeAndHandleRequest(method, params),
+});
+await hosted.initialize();
+```
+
+Both clients expose `request`, `notify`, `initialize`, `error`, `addRedactions` and idempotent `close`. Native image/tool/usage/child-thread payloads pass through without rewriting. Requests for the same native thread serialize; other threads and response settlement remain independent of an approval wait. An omitted server-request handler returns an explicit unsupported-method error. Consumers remain responsible for tool, approval, identity and live Run authority; this module supplies no such authorization.
+
+Defaults are 16 MiB per JSON frame, separate 32 MiB budgets for queued outbound frames and retained inbound notifications/server requests, 1,024 pending requests and a 120-second client-request timeout. Callers may configure bounded limits and request-specific timeouts or abort signals; a zero request timeout explicitly disables that timer. Frames must be valid UTF-8 JSON-RPC. Oversize, malformed, disconnected, timed-out or aborted transports fail explicitly and never retry a native mutation. A failed request can have an unknown remote outcome; lifecycle/effect reconciliation remains outside the protocol client. Register renewed secrets through `addRedactions` before use. Diagnostics redact configured secrets, known provider environment credentials and transport headers; no wire payloads are logged.
+
+The stdio client owns and closes its POSIX process group, including descendants that stay in that group. Escaped sessions, external jobs and hosted actor cancellation require the separately qualified lifecycle owner. Closing a hosted connection closes only that connection. It does not establish that guest commands stopped. WSS is required remotely; plain WS is allowed only for loopback connections, URL credentials are rejected and redirects are disabled. The official [App Server protocol](https://learn.chatgpt.com/docs/app-server) documents WebSocket transport as experimental and unsupported for production; this preparatory package does not waive the runtime support/activation gates. Local `expectedVersion` checks the official CLI version before spawning; a hosted supervisor must independently verify its qualified image/binary identity.
+
+## Releases and service compatibility
+
+The following release steps are for package and service maintainers.
+
+Each published package carries `dist/release.json` with its source commit and worker protocol, assignment, and checkpoint format versions. Release automation retains the exact tested tarball, a content-addressed file manifest, and a CycloneDX SBOM. Core operators can set `SELF_HOSTED_WORKER_MIN_VERSION`, `SELF_HOSTED_WORKER_RECOMMENDED_VERSION`, and comma-separated `SELF_HOSTED_WORKER_DENIED_VERSIONS`; incompatible workers are refused before they claim a Run, while workers below the recommended release receive an upgrade notice.
+
+Worker protocol 3 adds qualified native Codex capabilities to the server-owned capacity envelope; assignment and checkpoint format 2 describe the acknowledged state contract.
+
+After each push to main passes the applicable CI checks, release automation retains the exact tarball in private S3, qualifies it on Linux and publishes those bytes to npm from a GitHub-hosted runner through npm trusted publishing. npm generates no provenance attestation because the source repository is private. Each source commit receives a distinct next-patch prerelease version, such as `0.2.1-ci.g<SHA>` for source `0.2.0`. Install that exact qualified version. Linux native execution, cold restore and complete process cessation gate publication. An existing package version must have identical SHA-512 integrity for a retry to succeed.
+
+macOS remains experimental and unqualified and does not gate release. The main-only worker workflow also supports manual recovery but does not move the backend deployment channel or remotely upgrade machines. S3 evidence expires after 90 days; npm versions are permanent. See the [CI storage runbook](../deploy/ci/README.md) and [backend release procedure](../deploy/q11-backend-release.md).
+
+## Native continuity and compatibility
+
+Worker 0.2.0 advertises protocol 3, assignment format 2 and checkpoint format 2. Core must deploy the matching compatibility policy as part of the coordinated cutover; legacy workers are rejected for every harness, including Pi, OpenCode and Claude Code. Drain active assignments and deliver queued completions against the original compatible core before upgrading. Deploy the matching core and worker as one coordinated cutover. Upgrade the worker and qualified Codex package together. This source change does not deploy or publish either package.
+
+Each conversation gets a tenant-bound workspace and native Codex home. Successful completion commits a quiesced native thread graph and its filesystem overlay together. A fresh process restores the acknowledged checkpoint and resumes the same native thread; it does not replay prior requests as new user messages. Current Run instructions and skills replace prior configuration, while broker authorization and approvals use current Run authority. Failed or cancelled native attempts never silently retry or publish their dirty state. Unacknowledged work and external effects require reconciliation; native continuity does not preserve live Python or shell memory.
+
+Unmodified Codex currently retains absolute paths in native state. Eligible replacement workers must use the same platform and absolute `AQ_WORKSPACES` root, and the same or a newer Codex release than the one that wrote the state; a worker never resumes state a newer Codex wrote. Workers advertise their Codex version and workspace root; core routes a retained thread only to a worker advertising that root and a version at least the checkpoint's, before issuing assignment credentials. A newer worker records its own version in the native binding before Codex opens the state, so an upgraded conversation is never handed back to an older worker. Core sends an older checkpoint only to workers that also advertise `codexResumesOlderV1`, so workers from before this rule keep exact matching. A turn no matching worker takes within a day fails and keeps the checkpoint. Only plain `x.y.z` releases compare; any other version string must match exactly. Changing the platform or workspace root, or moving to an older Codex, requires a separately qualified migration; the worker does not rewrite upstream state.
+
+Checkpoints use bounded gzip transport: at most 16 MiB encoded and 128 MiB of expanded JSON, including base64 file data. Files keep their original bytes. Historical JSON overlays remain readable. Native credentials, logs and temporary download caches are excluded. Source overlays omit repository metadata and build caches such as `node_modules`; workflow setup rebuilds excluded dependencies after restore. Use artifact publication for large user-facing output. Exceeding a bound fails visibly and preserves the prior acknowledged head. Completion delivery never drops native state to turn a failed upload into success.
+
+Linux execution uses dedicated systemd units with control-group termination, a trusted parent-loss watchdog, a guarded start and durable process journals. Restart reconciles owned units and private launch files before accepting work. Keep runtime installations separate from worker registration data and workspaces. The worker exposes the resolved Node installation in the isolated PATH; non-login shell calls retain that PATH.
+
+macOS uses its existing `sandbox-exec` boundary and POSIX process groups. Linux native continuity and complete process cessation must pass before publication. macOS native continuity is unqualified and does not block this release; the existing installed qualification script can be run manually on an owner-operated Mac. Complete containment of deliberately escaped descendants is not established by that boundary; macOS owner-operated workers are not a substitute for the hosted isolation boundary or eligible for pooled hostile workloads. Production activation remains a separately reviewed step.
+
+Pending completion files are bound to the original tenant URL and worker registration. Re-registering elsewhere cannot send the old tenant's result or checkpoint to the new service. Operator-owned offline copies and backups require operator cleanup; a control-plane deletion does not prove remote erasure of an offline personal computer.
+
+Before upgrading a worker with queued completions, drain its outbox against the original compatible control plane. A valid version 1 completion blocks startup and remains byte-for-byte at its original path. It must not be quarantined, deleted, or assigned the current registration's server by inference. Recovery requires verifying the original server, worker, Run, attempt and lease before an explicit version 2 migration. Reverting only the worker binary cannot drain it against a protocol-3-only core; retain the original file for verified recovery if the old control plane is unavailable.
+
+Native continuity is bound to the core-issued actor, audience, roster and participant-tenure authorization context. A changed or missing context starts from the currently authorized transcript in a fresh workspace and native home; it does not replay old filesystem data or native history. The prior checkpoint generation still fences completion. Previously committed checkpoints and separately saved product artifacts retain their normal control-plane retention policy.
+
+## Planning development package
+
+Ontra pins `@agentqueue/worker/planning-dev` and calls `startPlanningDevelopment` from its dev launcher. The package includes the qualified official Codex binary. Run `pnpm planning:login` once if a Codex subscription login is missing, then `pnpm planning:dev` in Ontra's TypeScript workspace. Set `PLANNING_QM_DEV_TENANT` to an Ontra-owned organization enabled in the hosted service's `QM_DEVELOPMENT_WORKER_TENANTS` allowlist.
+
+The first launch asks for browser approval of a development-only worker. Later launches reuse a private registration per checkout. The foreground worker stops with the app; it does not install a background service. Routine Ontra development needs no QM checkout, local QM server, or QM database. Linux and a working systemd user manager are currently required.
+
+Hosted QM assigns an integration namespace to each approved development worker. Its permanent purpose forbids customer/project/chat claims, while the subscription profile forbids paid-worker fallback. The ordinary hosted run owner retains tools, approvals, effects and checkpoint commits. Only isolated native execution and authenticated callbacks to the paired loopback app run locally. Subscription refresh credentials and local signing/HMAC secrets stay outside the agent filesystem.
+
+The outbound signed HTTPS mailbox is durable across API and execution replicas. Session epochs, live run fences, bounded requests and local authority expiry reject stale execution. Worker-package changes can use Ontra's explicit `QM_WORKER_PATH` override; normal installs use the reviewed package artifact and integrity pin.
+
+Maintain the older `scripts/planning-dev.ts` launcher for QM development itself. Qualify the hosted-control-plane adapter with `DATABASE_URL=<disposable loopback Postgres> node scripts/smoke-hosted-planning-development.ts`; this uses real subscription inference and synthetic headless enrollment, restarts the separate executor between turns, and verifies native checkpoint continuity. `PLANNING_DEV_WORKER_ENTRY` may select Ontra's installed package entry for qualification. No paid runtime is configured by this smoke.

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,27 @@
+# Third-party notices
+
+Agent Queue includes material derived from [YC’s qm project](https://github.com/yc-software/qm).
+The following notice applies to that upstream material; it does not grant a
+project-wide license for Agent Queue or its original changes.
+
+MIT License
+
+Copyright (c) 2026 QM contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/bin/aq-askpass.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/bin/aq-askpass.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+process.stderr.write("Git credentials are available only through the worker supervisor proxy.\n");
+process.exit(1);
+export {};
+//# sourceMappingURL=aq-askpass.js.map

package/dist/bin/aq-askpass.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aq-askpass.js","sourceRoot":"","sources":["../../bin/aq-askpass.ts"],"names":[],"mappings":";AACA,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2EAA2E,CAAC,CAAC;AAClG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC"}

package/dist/bin/aq.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/bin/aq.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+import { main } from "../src/cli.js";
+main(process.argv.slice(2)).then((code) => {
+    process.exitCode = code;
+}, (error) => {
+    process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+    process.exitCode = 1;
+});
+//# sourceMappingURL=aq.js.map

package/dist/bin/aq.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aq.js","sourceRoot":"","sources":["../../bin/aq.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAC9B,CAAC,IAAI,EAAE,EAAE;IACP,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;AAC1B,CAAC,EACD,CAAC,KAAK,EAAE,EAAE;IACR,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACpF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CACF,CAAC"}

package/dist/release.json

@@ -0,0 +1,16 @@
+{
+  "schemaVersion": 1,
+  "package": {
+    "name": "@agentqueue/worker",
+    "version": "0.3.1-ci.g02c90ca5cd192c5a75a7d1d19329683cefb22d6e"
+  },
+  "source": {
+    "repository": "git+https://github.com/mobility-solutions-inc/qm.git",
+    "commit": "02c90ca5cd192c5a75a7d1d19329683cefb22d6e"
+  },
+  "compatibility": {
+    "workerProtocol": 3,
+    "assignment": 2,
+    "checkpoint": 2
+  }
+}

package/dist/src/app-server/checkpoint-codec.d.ts

@@ -0,0 +1,4 @@
+export declare const MAX_CHECKPOINT_BYTES: number;
+export declare const MAX_CHECKPOINT_CONTENT_BYTES: number;
+export declare function encodeCheckpoint(entries: unknown[]): Promise<string>;
+export declare function decodeCheckpoint(archive: string): unknown[];

package/dist/src/app-server/checkpoint-codec.js

@@ -0,0 +1,31 @@
+import { promisify } from "node:util";
+import { gzip, gunzipSync } from "node:zlib";
+export const MAX_CHECKPOINT_BYTES = 16 * 1024 * 1024;
+export const MAX_CHECKPOINT_CONTENT_BYTES = 128 * 1024 * 1024;
+const PREFIX = "aq-checkpoint-gzip-v1:";
+export async function encodeCheckpoint(entries) {
+    const json = JSON.stringify(entries);
+    if (Buffer.byteLength(json) > MAX_CHECKPOINT_CONTENT_BYTES)
+        throw new Error("workspace checkpoint is too large");
+    const archive = `${PREFIX}${(await promisify(gzip)(json)).toString("base64")}`;
+    if (Buffer.byteLength(archive) > MAX_CHECKPOINT_BYTES)
+        throw new Error("workspace checkpoint is too large");
+    return archive;
+}
+export function decodeCheckpoint(archive) {
+    if (Buffer.byteLength(archive) > MAX_CHECKPOINT_BYTES)
+        throw new Error("workspace checkpoint is too large");
+    let json = archive;
+    if (archive.startsWith(PREFIX)) {
+        const data = archive.slice(PREFIX.length);
+        const bytes = Buffer.from(data, "base64");
+        if (bytes.toString("base64") !== data)
+            throw new Error("workspace checkpoint encoding is invalid");
+        json = gunzipSync(bytes, { maxOutputLength: MAX_CHECKPOINT_CONTENT_BYTES }).toString("utf8");
+    }
+    const entries = JSON.parse(json);
+    if (!Array.isArray(entries))
+        throw new Error("workspace checkpoint is invalid");
+    return entries;
+}
+//# sourceMappingURL=checkpoint-codec.js.map

package/dist/src/app-server/checkpoint-codec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkpoint-codec.js","sourceRoot":"","sources":["../../../src/app-server/checkpoint-codec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE7C,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACrD,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAC9D,MAAM,MAAM,GAAG,wBAAwB,CAAC;AAExC,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAkB;IACvD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,4BAA4B;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACjH,MAAM,OAAO,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC/E,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,oBAAoB;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC5G,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,oBAAoB;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC5G,IAAI,IAAI,GAAG,OAAO,CAAC;IACnB,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QACnG,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,eAAe,EAAE,4BAA4B,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,OAAO,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAChF,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/src/app-server/codex-token-snapshot.d.ts

@@ -0,0 +1,11 @@
+export interface CodexTokenSnapshot {
+    accessToken: string;
+    accountId: string;
+    planType: string | null;
+    credentialRevision: number;
+    expiresAt: number | null;
+}
+export declare function codexTokenSnapshot<T extends {
+    authJson: string;
+    secretRevision: number;
+}>(credential: T): CodexTokenSnapshot;

package/dist/src/app-server/codex-token-snapshot.js

@@ -0,0 +1,45 @@
+function objectValue(value) {
+    return value && typeof value === "object" ? value : null;
+}
+function jwtClaims(token) {
+    const payload = token.split(".")[1];
+    if (!payload)
+        return null;
+    try {
+        return objectValue(JSON.parse(Buffer.from(payload, "base64url").toString("utf8")));
+    }
+    catch {
+        return null;
+    }
+}
+export function codexTokenSnapshot(credential) {
+    let auth;
+    try {
+        auth = objectValue(JSON.parse(credential.authJson)) ?? {};
+    }
+    catch {
+        throw new Error("stored Codex authentication is invalid");
+    }
+    const tokens = objectValue(auth.tokens);
+    const accessToken = typeof tokens?.access_token === "string" ? tokens.access_token : "";
+    if (!accessToken)
+        throw new Error("stored Codex authentication has no access token");
+    const claims = jwtClaims(accessToken);
+    const openai = objectValue(claims?.["https://api.openai.com/auth"]);
+    const accountIds = [tokens?.account_id, openai?.chatgpt_account_id, claims?.chatgpt_account_id].filter((value) => typeof value === "string" && Boolean(value));
+    if (!accountIds.length)
+        throw new Error("stored Codex authentication has no account id");
+    if (new Set(accountIds).size !== 1)
+        throw new Error("stored Codex authentication has inconsistent account ids");
+    const accountId = accountIds[0];
+    const planType = [openai?.chatgpt_plan_type, claims?.chatgpt_plan_type].find((value) => typeof value === "string" && Boolean(value));
+    const exp = typeof claims?.exp === "number" && Number.isFinite(claims.exp) ? claims.exp : null;
+    return {
+        accessToken,
+        accountId,
+        planType: planType ?? null,
+        credentialRevision: credential.secretRevision,
+        expiresAt: exp === null ? null : exp * 1_000,
+    };
+}
+//# sourceMappingURL=codex-token-snapshot.js.map

package/dist/src/app-server/codex-token-snapshot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-token-snapshot.js","sourceRoot":"","sources":["../../../src/app-server/codex-token-snapshot.ts"],"names":[],"mappings":"AAQA,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,IAAI,CAAC;AACxF,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,UAAa;IAEb,IAAI,IAA6B,CAAC;IAClC,IAAI,CAAC;QACH,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,OAAO,MAAM,EAAE,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IACxF,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,6BAA6B,CAAC,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC,MAAM,CACpG,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,CACxE,CAAC;IACF,IAAI,CAAC,UAAU,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACzF,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAChH,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAC1E,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,CACxE,CAAC;IACF,MAAM,GAAG,GAAG,OAAO,MAAM,EAAE,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/F,OAAO;QACL,WAAW;QACX,SAAS;QACT,QAAQ,EAAE,QAAQ,IAAI,IAAI;QAC1B,kBAAkB,EAAE,UAAU,CAAC,cAAc;QAC7C,SAAS,EAAE,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK;KAC7C,CAAC;AACJ,CAAC"}

package/dist/src/app-server/index.d.ts

@@ -0,0 +1,70 @@
+import type { ChildProcess } from "node:child_process";
+import { type AppServerTransport, type StdioOptions, type WebSocketOptions } from "./transports.ts";
+export declare function codexServiceTier(fastMode: boolean): {
+    serviceTier: "priority" | "default";
+};
+export declare class CodexRpcError extends Error {
+    readonly code: number | undefined;
+    constructor(message: string, code?: number);
+}
+export declare class CodexTransportError extends Error {
+    readonly kind: "protocol" | "transport" | "timeout" | "limit" | "closed";
+    constructor(kind: CodexTransportError["kind"], message: string);
+}
+export interface CodexClientOptions {
+    onNotification?(method: string, params: unknown): void | Promise<void>;
+    onRequest?(method: string, params: unknown): Promise<unknown>;
+    redactValues?: readonly string[];
+    maxFrameBytes?: number;
+    maxPendingRequests?: number;
+    maxQueuedBytes?: number;
+    requestTimeoutMs?: number;
+}
+export interface CodexAppServerOptions extends CodexClientOptions, StdioOptions {
+}
+export interface HostedCodexAppServerOptions extends CodexClientOptions, WebSocketOptions {
+}
+export interface CodexRequestOptions {
+    timeoutMs?: number;
+    signal?: AbortSignal;
+}
+export declare class CodexAppServerClient {
+    private readonly pending;
+    private readonly serverRequests;
+    private readonly threadTails;
+    private readonly secrets;
+    private readonly maxFrameBytes;
+    private readonly maxPending;
+    private readonly maxQueuedBytes;
+    private readonly timeoutMs;
+    private nextId;
+    private queuedBytes;
+    private inboundBytes;
+    private callbacks;
+    private writeTail;
+    private eventTail;
+    private closed;
+    private closeError;
+    private closing;
+    private readonly transport;
+    private readonly options;
+    constructor(transport: AppServerTransport, options?: CodexClientOptions);
+    addRedactions(values: readonly string[]): void;
+    error(): Error | null;
+    drainNotifications(): Promise<void>;
+    initialize(): Promise<void>;
+    request<T = unknown>(method: string, params?: unknown, options?: CodexRequestOptions): Promise<T>;
+    notify(method: string, params?: unknown): Promise<void>;
+    close(): Promise<void>;
+    private receiveFrame;
+    private queueRequest;
+    private send;
+    private redact;
+    private rejectPending;
+    private fail;
+}
+export declare class CodexAppServer extends CodexAppServerClient {
+    readonly process: ChildProcess;
+    constructor(options: CodexAppServerOptions);
+}
+export declare function connectCodexAppServer(options: HostedCodexAppServerOptions): Promise<CodexAppServerClient>;