@ai-sdk/harness-codex 1.0.109 → 1.0.110

package/dist/index.js

@@ -1,5 +1,5 @@
 // src/codex-harness.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import path from "path";
 import {
   commonTool,
@@ -151,6 +151,354 @@ function toCodexGatewayBaseUrl(baseUrl) {
   return trimmed.endsWith("/v1") ? trimmed : `${trimmed}/v1`;
 }
 
+// src/codex-subscription.ts
+import { spawn } from "child_process";
+import { createHash } from "crypto";
+import {
+  chmod,
+  mkdir,
+  readFile,
+  realpath,
+  rename,
+  writeFile
+} from "fs/promises";
+import { homedir } from "os";
+import { dirname, join, resolve } from "path";
+import {
+  getJwtExpiresAt,
+  isAccessTokenExpiringSoon,
+  isHarnessAuthenticationEnvironment as isHarnessAuthenticationEnvironment2,
+  isLinux,
+  isMacOS,
+  isWindows,
+  readLinuxSecretServicePassword,
+  readMacOSKeychainPassword,
+  readWindowsCredentialManagerPassword,
+  refreshOAuthAccessToken,
+  shouldResolveNativeSubscription
+} from "@ai-sdk/harness/utils";
+import { isRecord, safeParseJSON } from "@ai-sdk/provider-utils";
+var CHATGPT_CODEX_BASE_URL = "https://chatgpt.com/backend-api/codex";
+var OPENAI_TOKEN_URL = "https://auth.openai.com/oauth/token";
+var OPENAI_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+function createCodexSubscriptionRequestTransformations({
+  requestHeaders,
+  ...sources
+}) {
+  const transformations = createCodexRequestTransformations(sources);
+  if (requestHeaders == null) return transformations;
+  return transformations.map((transformation) => ({
+    ...transformation,
+    transform: {
+      ...transformation.transform,
+      headers: {
+        ...transformation.transform.headers,
+        ...requestHeaders
+      }
+    }
+  }));
+}
+async function resolveCodexAuthentication({
+  auth,
+  processEnv = process.env,
+  authCredentialsStoreMode,
+  readSubscription = readCodexSubscription
+}) {
+  const environment = resolveCodexEnv(auth, processEnv);
+  if (isHarnessAuthenticationEnvironment2(auth)) {
+    return { environment };
+  }
+  if (!shouldResolveNativeSubscription({
+    auth,
+    env: environment,
+    hasDirectCredential: environment.CODEX_API_KEY != null
+  })) {
+    return { environment };
+  }
+  return await readSubscription({ authCredentialsStoreMode }) ?? { environment };
+}
+async function readCodexSubscription({
+  env = process.env,
+  homeDirectory = homedir(),
+  authCredentialsStoreMode,
+  platform = process.platform,
+  keyring,
+  fetch
+} = {}) {
+  const codexHome = resolve(env.CODEX_HOME ?? join(homeDirectory, ".codex"));
+  const authPath = join(codexHome, "auth.json");
+  const storageMode = toCodexAuthCredentialsStoreMode(authCredentialsStoreMode) ?? await readCodexAuthCredentialsStoreMode({ codexHome }) ?? "file";
+  const stored = await readCodexAuthStore({
+    codexHome,
+    authPath,
+    storageMode,
+    keyring: keyring ?? createCodexKeyring({ platform })
+  });
+  if (stored == null) return void 0;
+  const credential = await toCodexCredential(stored.value);
+  if (credential == null) return void 0;
+  let accessToken = credential.accessToken;
+  if (isAccessTokenExpiringSoon({ expiresAt: credential.expiresAt })) {
+    const refreshed = await refreshOAuthAccessToken({
+      tokenUrl: OPENAI_TOKEN_URL,
+      clientId: OPENAI_CLIENT_ID,
+      refreshToken: credential.refreshToken,
+      requestFormat: "json",
+      ...fetch == null ? {} : { fetch }
+    });
+    accessToken = refreshed.accessToken;
+    await stored.write({
+      ...stored.value,
+      last_refresh: (/* @__PURE__ */ new Date()).toISOString(),
+      tokens: {
+        ...stored.value.tokens,
+        access_token: refreshed.accessToken,
+        refresh_token: refreshed.refreshToken ?? credential.refreshToken
+      }
+    });
+  }
+  return {
+    environment: {
+      CODEX_API_KEY: accessToken,
+      OPENAI_BASE_URL: CHATGPT_CODEX_BASE_URL
+    },
+    ...credential.accountId == null ? {} : {
+      requestHeaders: {
+        "ChatGPT-Account-ID": credential.accountId
+      }
+    }
+  };
+}
+async function readCodexAuthStore({
+  codexHome,
+  authPath,
+  storageMode,
+  keyring
+}) {
+  if (storageMode === "ephemeral") return void 0;
+  const readFileStore = async () => {
+    const value = await readCodexAuthFile(authPath);
+    return value == null ? void 0 : {
+      value,
+      write: (updated) => writeCodexAuthFile({ authPath, value: updated })
+    };
+  };
+  const readKeyringStore = async () => {
+    if (keyring == null) return void 0;
+    const canonicalHome = await realpath(codexHome).catch(() => codexHome);
+    const account = `cli|${createHash("sha256").update(canonicalHome).digest("hex").slice(0, 16)}`;
+    const text = await keyring.read({ service: "Codex Auth", account });
+    if (text == null) return void 0;
+    const value = await parseCodexAuthFile(text);
+    return value == null ? void 0 : {
+      value,
+      write: (updated) => keyring.write({
+        service: "Codex Auth",
+        account,
+        value: JSON.stringify(updated)
+      })
+    };
+  };
+  if (storageMode === "file") return readFileStore();
+  if (storageMode === "keyring") return readKeyringStore();
+  return await readKeyringStore() ?? readFileStore();
+}
+async function readCodexAuthCredentialsStoreMode({
+  codexHome
+}) {
+  const text = await readFile(join(codexHome, "config.toml"), "utf8").catch(
+    () => void 0
+  );
+  if (text == null) return void 0;
+  for (const line of text.split(/\r?\n/)) {
+    if (line.trimStart().startsWith("[")) return void 0;
+    const match = /^\s*cli_auth_credentials_store\s*=\s*["'](file|keyring|auto|ephemeral)["']\s*(?:#.*)?$/.exec(
+      line
+    );
+    if (match != null) {
+      return toCodexAuthCredentialsStoreMode(match[1]);
+    }
+  }
+  return void 0;
+}
+function toCodexAuthCredentialsStoreMode(value) {
+  return value === "file" || value === "keyring" || value === "auto" || value === "ephemeral" ? value : void 0;
+}
+async function readCodexAuthFile(authPath) {
+  const text = await readFile(authPath, "utf8").catch(() => void 0);
+  return text == null ? void 0 : parseCodexAuthFile(text);
+}
+async function parseCodexAuthFile(text) {
+  const parsed = await safeParseJSON({ text });
+  return parsed.success && isRecord(parsed.value) ? parsed.value : void 0;
+}
+async function toCodexCredential(value) {
+  if (value.auth_mode !== "chatgpt" || !isRecord(value.tokens)) {
+    return void 0;
+  }
+  const accessToken = value.tokens.access_token;
+  const refreshToken = value.tokens.refresh_token;
+  if (typeof accessToken !== "string" || typeof refreshToken !== "string") {
+    return void 0;
+  }
+  const expiresAt = await getJwtExpiresAt({ token: accessToken });
+  if (expiresAt == null) return void 0;
+  const accountId = value.tokens.account_id;
+  return {
+    accessToken,
+    refreshToken,
+    expiresAt,
+    ...typeof accountId === "string" ? { accountId } : {}
+  };
+}
+async function writeCodexAuthFile({
+  authPath,
+  value
+}) {
+  await mkdir(dirname(authPath), { recursive: true });
+  const temporaryPath = `${authPath}.${process.pid}.tmp`;
+  await writeFile(temporaryPath, `${JSON.stringify(value, null, 2)}
+`, {
+    mode: 384
+  });
+  await chmod(temporaryPath, 384);
+  await rename(temporaryPath, authPath);
+}
+function createCodexKeyring({
+  platform
+}) {
+  if (isMacOS(platform)) {
+    return {
+      async read({ service, account }) {
+        return readMacOSKeychainPassword({ service, account });
+      },
+      async write({ service, account, value }) {
+        const command = `add-generic-password -U -s ${shellQuoteForSecurity(service)} -a ${shellQuoteForSecurity(account)} -X ${Buffer.from(value, "utf8").toString("hex")}
+`;
+        await runCommandWithInput({
+          command: "/usr/bin/security",
+          args: ["-i"],
+          input: command
+        });
+      }
+    };
+  }
+  if (isLinux(platform)) {
+    return {
+      async read({ service, account }) {
+        return readLinuxSecretServicePassword({
+          attributes: {
+            service,
+            username: account,
+            target: "default"
+          }
+        });
+      },
+      async write({ service, account, value }) {
+        await runCommandWithInput({
+          command: "secret-tool",
+          args: [
+            "store",
+            "--label",
+            `${account}@${service}:default`,
+            "service",
+            service,
+            "username",
+            account,
+            "target",
+            "default",
+            "application",
+            "rust-keyring"
+          ],
+          input: value
+        });
+      }
+    };
+  }
+  if (isWindows(platform)) {
+    return createWindowsCodexKeyring();
+  }
+  return void 0;
+}
+function shellQuoteForSecurity(value) {
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+async function runCommandWithInput({
+  command,
+  args,
+  input,
+  env
+}) {
+  await new Promise((resolvePromise, reject) => {
+    const child = spawn(command, args, {
+      stdio: ["pipe", "ignore", "pipe"],
+      ...env == null ? {} : { env }
+    });
+    let stderr = "";
+    child.stderr.setEncoding("utf8");
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk;
+    });
+    child.once("error", reject);
+    child.once("close", (code) => {
+      if (code === 0) resolvePromise();
+      else reject(new Error(stderr || `${command} exited with code ${code}.`));
+    });
+    child.stdin.end(input);
+  });
+}
+function createWindowsCodexKeyring() {
+  const source = `
+using System;
+using System.Runtime.InteropServices;
+using System.Text;
+public static class CodexCredentialManager {
+  [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
+  public struct Credential {
+    public UInt32 Flags; public UInt32 Type; public string TargetName;
+    public string Comment; public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;
+    public UInt32 CredentialBlobSize; public IntPtr CredentialBlob;
+    public UInt32 Persist; public UInt32 AttributeCount; public IntPtr Attributes;
+    public string TargetAlias; public string UserName;
+  }
+  [DllImport("advapi32.dll", EntryPoint = "CredWriteW", CharSet = CharSet.Unicode, SetLastError = true)]
+  static extern bool CredWrite(ref Credential credential, UInt32 flags);
+  public static void Write(string target, string userName, string value) {
+    byte[] bytes = Encoding.Unicode.GetBytes(value);
+    IntPtr blob = Marshal.AllocHGlobal(bytes.Length);
+    try {
+      Marshal.Copy(bytes, 0, blob, bytes.Length);
+      Credential credential = new Credential {
+        Type = 1, TargetName = target, CredentialBlobSize = (UInt32)bytes.Length,
+        CredentialBlob = blob, Persist = 3, UserName = userName
+      };
+      if (!CredWrite(ref credential, 0)) throw new System.ComponentModel.Win32Exception();
+    } finally { Marshal.FreeHGlobal(blob); }
+  }
+}`;
+  return {
+    async read({ service, account }) {
+      return readWindowsCredentialManagerPassword({
+        targetName: `${account}.${service}`
+      });
+    },
+    async write({ service, account, value }) {
+      const script = `Add-Type -TypeDefinition $env:AI_SDK_CODEX_CREDENTIAL_SOURCE; $value = [Console]::In.ReadToEnd(); [CodexCredentialManager]::Write($env:AI_SDK_CODEX_CREDENTIAL_TARGET, $env:AI_SDK_CODEX_CREDENTIAL_USER, $value)`;
+      await runCommandWithInput({
+        command: "powershell.exe",
+        args: ["-NoProfile", "-NonInteractive", "-Command", script],
+        input: value,
+        env: {
+          ...process.env,
+          AI_SDK_CODEX_CREDENTIAL_SOURCE: source,
+          AI_SDK_CODEX_CREDENTIAL_TARGET: `${account}.${service}`,
+          AI_SDK_CODEX_CREDENTIAL_USER: account
+        }
+      });
+    }
+  };
+}
+
 // src/codex-bridge-protocol.ts
 import {
   harnessV1BridgeInboundCommandSchemas,
@@ -183,7 +531,7 @@ var inboundMessageSchema = z.discriminatedUnion("type", [
 var CLI_SHIM_FILENAME = "harness-tool.mjs";
 
 // src/version.ts
-var VERSION = true ? "1.0.109" : "0.0.0-test";
+var VERSION = true ? "1.0.110" : "0.0.0-test";
 
 // src/codex-harness.ts
 var DEFAULT_CODEX_MODEL = "gpt-5.5";
@@ -263,7 +611,11 @@ function createCodex(settings = {}) {
       const turnConfigurationFingerprint = typeof resumeData?.turnConfigurationFingerprint === "string" ? resumeData.turnConfigurationFingerprint : void 0;
       const coords = resumeData?.bridge;
       const authenticationMode = resolveCodexAuthenticationMode(settings.auth);
-      const resolvedAuthEnvironment = resolveCodexEnv(settings.auth);
+      const resolvedAuthentication = await resolveCodexAuthentication({
+        auth: settings.auth,
+        authCredentialsStoreMode: settings.codexConfig?.cli_auth_credentials_store
+      });
+      const resolvedAuthEnvironment = resolvedAuthentication.environment;
       let sandboxAuthEnvironment = resolvedAuthEnvironment;
       let sandboxCredentialEnvironment;
       let credentialsBrokered = false;
@@ -277,10 +629,11 @@ function createCodex(settings = {}) {
           ...resolvedAuthEnvironment,
           ...sandboxCredentialEnvironment
         };
-        const requestTransformations = createCodexRequestTransformations({
+        const requestTransformations = createCodexSubscriptionRequestTransformations({
           env: resolvedAuthEnvironment,
           sandboxEnv: sandboxAuthEnvironment,
-          auth: authenticationMode
+          auth: authenticationMode,
+          requestHeaders: resolvedAuthentication.requestHeaders
         });
         if (requestTransformations.length > 0) {
           await sandboxSession.addRequestTransformations(
@@ -545,13 +898,13 @@ function openWebSocket({
   url,
   headers
 }) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const ws = new WebSocket(url, {
       headers: headers == null ? void 0 : { ...headers }
     });
     const onOpen = () => {
       ws.off("error", onError);
-      resolve(ws);
+      resolve2(ws);
     };
     const onError = (err) => {
       ws.off("open", onOpen);
@@ -625,8 +978,8 @@ function createSession({
   const wireTurn = (turnOpts) => {
     let pendingResolve;
     let pendingReject;
-    const done = new Promise((resolve, reject) => {
-      pendingResolve = resolve;
+    const done = new Promise((resolve2, reject) => {
+      pendingResolve = resolve2;
       pendingReject = reject;
     });
     const unsubs = [];
@@ -906,8 +1259,8 @@ function createSession({
           if (proc) {
             await Promise.race([
               proc.wait(),
-              new Promise((resolve) => {
-                stopTimer = setTimeout(resolve, 5e3);
+              new Promise((resolve2) => {
+                stopTimer = setTimeout(resolve2, 5e3);
                 stopTimer.unref?.();
               })
             ]);
@@ -931,7 +1284,7 @@ function createSession({
       }
       stopped = true;
       channel.beginClose();
-      const data = channel.isClosed() ? {} : await new Promise((resolve, reject) => {
+      const data = channel.isClosed() ? {} : await new Promise((resolve2, reject) => {
         const timer = setTimeout(() => {
           unsub();
           reject(
@@ -944,7 +1297,7 @@ function createSession({
         const unsub = channel.on("bridge-stop", (msg) => {
           clearTimeout(timer);
           unsub();
-          resolve(msg.data);
+          resolve2(msg.data);
         });
         try {
           channel.send({ type: "stop" });
@@ -959,8 +1312,8 @@ function createSession({
         if (proc) {
           await Promise.race([
             proc.wait(),
-            new Promise((resolve) => {
-              stopTimer = setTimeout(resolve, 5e3);
+            new Promise((resolve2) => {
+              stopTimer = setTimeout(resolve2, 5e3);
               stopTimer.unref?.();
             })
           ]);
@@ -1022,7 +1375,7 @@ function fingerprintCodexTurnConfiguration({
   instructions,
   tools
 }) {
-  return createHash("sha256").update(JSON.stringify({ instructions: instructions ?? null, tools })).digest("hex");
+  return createHash2("sha256").update(JSON.stringify({ instructions: instructions ?? null, tools })).digest("hex");
 }
 function frameInitialPromptGuidance({
   toolUsageBlock,