@ai-sdk/harness-codex 1.0.72 → 1.0.74

package/dist/index.js

@@ -1,8 +1,6 @@
 // src/codex-harness.ts
 import { randomBytes } from "crypto";
-import { readFile } from "fs/promises";
 import path from "path";
-import { fileURLToPath } from "url";
 import {
   commonTool,
   HarnessCapabilityUnsupportedError,
@@ -15,30 +13,97 @@ import {
   drainBridgeProcessStream,
   forwardBridgeProcessStream,
   markBridgeStarting,
+  maskSandboxCredentials,
   resolveSandboxHomeDir,
   SandboxChannel,
   shellQuote,
+  warnCredentialBrokeringUnavailable,
   waitForBridgeReady,
   writeSkills as writeHarnessSkills
 } from "@ai-sdk/harness/utils";
 import { WebSocket } from "ws";
 import { z as z2 } from "zod/v4";
 
+// src/codex-bootstrap.ts
+import { readFile } from "fs/promises";
+import { fileURLToPath } from "url";
+var CODEX_BOOTSTRAP_DIR = ".harness-bootstrap/codex";
+var cachedBootstrap;
+async function getCodexBootstrap() {
+  if (cachedBootstrap != null) return cachedBootstrap;
+  const [pkg, lock, bridge] = await Promise.all([
+    readBridgeAsset("package.json"),
+    readBridgeAsset("pnpm-lock.yaml"),
+    readBridgeAsset("index.mjs")
+  ]);
+  cachedBootstrap = {
+    harnessId: "codex",
+    bootstrapDir: CODEX_BOOTSTRAP_DIR,
+    files: [
+      { path: `${CODEX_BOOTSTRAP_DIR}/package.json`, content: pkg },
+      { path: `${CODEX_BOOTSTRAP_DIR}/pnpm-lock.yaml`, content: lock },
+      { path: `${CODEX_BOOTSTRAP_DIR}/bridge.mjs`, content: bridge }
+    ],
+    commands: [
+      {
+        command: "pnpm install --frozen-lockfile --store-dir .pnpm-store"
+      }
+    ]
+  };
+  return cachedBootstrap;
+}
+async function readBridgeAsset(name) {
+  const candidates = [
+    new URL(`./bridge/${name}`, import.meta.url),
+    new URL(`../bridge/${name}`, import.meta.url)
+  ];
+  let lastErr;
+  for (const url of candidates) {
+    try {
+      return await readFile(fileURLToPath(url), "utf8");
+    } catch (err) {
+      const code = err.code;
+      if (code !== "ENOENT") throw err;
+      lastErr = err;
+    }
+  }
+  throw lastErr ?? new Error(`bridge asset not found: ${name}`);
+}
+
 // src/codex-auth.ts
-import { getAiGatewayAuthFromEnv } from "@ai-sdk/harness/utils";
+import {
+  createCredentialRequestTransformation,
+  getAiGatewayAuthFromEnv
+} from "@ai-sdk/harness/utils";
+var DEFAULT_AI_GATEWAY_BASE_URL = "https://ai-gateway.vercel.sh/v1";
+var DEFAULT_OPENAI_BASE_URL = "https://api.openai.com/v1";
+var CODEX_CREDENTIAL_ENVIRONMENT_VARIABLES = [
+  "AI_GATEWAY_API_KEY",
+  "CODEX_API_KEY"
+];
+function createCodexRequestTransformations(env, auth) {
+  if (!env.CODEX_API_KEY) return [];
+  return [
+    createCredentialRequestTransformation({
+      baseUrl: env.OPENAI_BASE_URL ?? (auth === "ai-gateway" ? DEFAULT_AI_GATEWAY_BASE_URL : DEFAULT_OPENAI_BASE_URL),
+      headers: { Authorization: `Bearer ${env.CODEX_API_KEY}` }
+    })
+  ];
+}
 function resolveCodexEnv(auth, processEnv = process.env) {
-  if (auth?.openaiCompatible) {
-    return pickOpenAICompatible(auth.openaiCompatible, processEnv);
+  const normalizedAuth = normalizeCodexAuthToLegacyAuth(auth);
+  if (normalizedAuth?.openaiCompatible) {
+    return pickOpenAICompatible(normalizedAuth.openaiCompatible, processEnv);
   }
-  if (auth?.openai) {
-    return pickOpenAI({ explicit: auth.openai, processEnv });
+  if (normalizedAuth?.openai) {
+    return pickOpenAI({ explicit: normalizedAuth.openai, processEnv });
   }
   const gatewayAuthFromEnv = getAiGatewayAuthFromEnv({
     env: processEnv
   });
-  if (auth?.gateway) {
+  if (normalizedAuth?.gateway) {
     return pickGateway({
-      explicit: auth.gateway,
+      explicit: normalizedAuth.gateway,
       gatewayAuthFromEnv
     });
   }
@@ -50,6 +115,37 @@ function resolveCodexEnv(auth, processEnv = process.env) {
   }
   return pickOpenAI({ processEnv });
 }
+function resolveCodexAuthenticationMode(auth, processEnv = process.env) {
+  if (typeof auth !== "string" && auth?.openaiCompatible) {
+    return "direct";
+  }
+  if (auth === "direct" || typeof auth !== "string" && auth?.openai) {
+    return "direct";
+  }
+  if (auth === "ai-gateway" || typeof auth !== "string" && auth?.gateway) {
+    return "ai-gateway";
+  }
+  return getAiGatewayAuthFromEnv({ env: processEnv }).apiKey ? "ai-gateway" : "direct";
+}
+function normalizeCodexAuthToLegacyAuth(auth) {
+  if (auth == null || auth === "auto") {
+    return void 0;
+  }
+  if (typeof auth === "string") {
+    switch (auth) {
+      case "direct":
+        return { openai: {} };
+      case "ai-gateway":
+        return { gateway: {} };
+      default:
+        return void 0;
+    }
+  }
+  console.warn(
+    '[codex] Passing an object to auth options is deprecated. Use a string mode ("auto" | "direct" | "ai-gateway") instead, and pass credentials via environment variables.'
+  );
+  return auth;
+}
 function pickOpenAICompatible(explicit, processEnv) {
   const env = {};
   const apiKey = explicit.apiKey ?? processEnv.OPENAI_API_KEY ?? processEnv.CODEX_API_KEY;
@@ -90,6 +186,7 @@ function pickGateway({
     env.CODEX_API_KEY = apiKey;
   }
   env.AI_GATEWAY_BASE_URL = baseUrl;
+  env.OPENAI_BASE_URL = baseUrl;
   return env;
 }
 function toCodexGatewayBaseUrl(baseUrl) {
@@ -110,6 +207,7 @@ var startMessageSchema = harnessV1BridgeStartBaseSchema.extend({
   instructions: z.string().optional(),
   reasoningEffort: z.enum(["low", "medium", "high"]).optional(),
   webSearch: z.boolean().optional(),
+  codexConfig: z.record(z.string(), z.unknown()).optional(),
   mcpServers: z.record(z.string(), z.unknown()).optional(),
   // Resume signal. When supplied, the bridge calls
   // `codex.resumeThread(resumeThreadId, …)` instead of starting a fresh thread.
@@ -126,7 +224,7 @@ var inboundMessageSchema = z.discriminatedUnion("type", [
 var CLI_SHIM_FILENAME = "harness-tool.mjs";
 
 // src/version.ts
-var VERSION = true ? "1.0.72" : "0.0.0-test";
+var VERSION = true ? "1.0.74" : "0.0.0-test";
 
 // src/codex-harness.ts
 var DEFAULT_CODEX_MODEL = "gpt-5.5";
@@ -145,7 +243,6 @@ var CODEX_BUILTIN_TOOLS = {
     inputSchema: z2.object({ query: z2.string() })
   })
 };
-var BOOTSTRAP_DIR = ".harness-bootstrap/codex";
 var codexBridgeCoordsSchema = z2.object({
   port: z2.number(),
   token: z2.string(),
@@ -157,36 +254,13 @@ var codexResumeStateSchema = z2.object({
   bridge: codexBridgeCoordsSchema.optional()
 });
 function createCodex(settings = {}) {
-  let cachedBootstrap;
   return {
     specificationVersion: "harness-v1",
     harnessId: "codex",
     builtinTools: CODEX_BUILTIN_TOOLS,
     supportsBuiltinToolApprovals: false,
     lifecycleStateSchema: codexResumeStateSchema,
-    getBootstrap: async () => {
-      if (cachedBootstrap != null) return cachedBootstrap;
-      const [pkg, lock, bridge] = await Promise.all([
-        readBridgeAsset("package.json"),
-        readBridgeAsset("pnpm-lock.yaml"),
-        readBridgeAsset("index.mjs")
-      ]);
-      cachedBootstrap = {
-        harnessId: "codex",
-        bootstrapDir: BOOTSTRAP_DIR,
-        files: [
-          { path: `${BOOTSTRAP_DIR}/package.json`, content: pkg },
-          { path: `${BOOTSTRAP_DIR}/pnpm-lock.yaml`, content: lock },
-          { path: `${BOOTSTRAP_DIR}/bridge.mjs`, content: bridge }
-        ],
-        commands: [
-          {
-            command: "pnpm install --frozen-lockfile --store-dir .pnpm-store"
-          }
-        ]
-      };
-      return cachedBootstrap;
-    },
+    getBootstrap: getCodexBootstrap,
     doStart: async (startOpts) => {
       if (startOpts.builtinToolFiltering != null) {
         throw new HarnessCapabilityUnsupportedError({
@@ -201,11 +275,34 @@ function createCodex(settings = {}) {
         });
       }
       const sandboxSession = startOpts.sandboxSession;
+      const authenticationMode = resolveCodexAuthenticationMode(settings.auth);
+      const resolvedAuthEnvironment = resolveCodexEnv(settings.auth);
+      let sandboxAuthEnvironment = resolvedAuthEnvironment;
+      if (sandboxSession.addRequestTransformations != null) {
+        const requestTransformations = createCodexRequestTransformations(
+          resolvedAuthEnvironment,
+          authenticationMode
+        );
+        if (requestTransformations.length > 0) {
+          await sandboxSession.addRequestTransformations(
+            requestTransformations
+          );
+        }
+        sandboxAuthEnvironment = maskSandboxCredentials({
+          environment: resolvedAuthEnvironment,
+          credentialEnvironmentVariables: CODEX_CREDENTIAL_ENVIRONMENT_VARIABLES
+        });
+        if (requestTransformations.length > 0 && authenticationMode === "direct" && resolvedAuthEnvironment.OPENAI_BASE_URL == null) {
+          sandboxAuthEnvironment.OPENAI_BASE_URL = DEFAULT_OPENAI_BASE_URL;
+        }
+      } else {
+        warnCredentialBrokeringUnavailable();
+      }
       const session = sandboxSession.restricted();
       const sandboxId = sandboxSession.id;
       const bootstrapDir = path.posix.resolve(
         sandboxSession.defaultWorkingDirectory,
-        BOOTSTRAP_DIR
+        CODEX_BOOTSTRAP_DIR
       );
       const lifecycleState = startOpts.continueFrom ?? startOpts.resumeFrom;
       const isResume = lifecycleState != null;
@@ -233,12 +330,16 @@ function createCodex(settings = {}) {
       });
       if (coords) {
         try {
-          const attachUrl = await sandboxSession.getPortUrl({
+          const endpoint2 = await sandboxSession.getPortEndpoint({
             port: coords.port,
             protocol: "ws"
-          }) + `?agent_bridge_token=${encodeURIComponent(coords.token)}`;
+          });
+          const attachEndpoint = withBridgeToken({
+            endpoint: endpoint2,
+            token: coords.token
+          });
           const attachChannel = new SandboxChannel({
-            connect: () => openWebSocket(attachUrl),
+            connect: () => openWebSocket(attachEndpoint),
             outboundSchema: outboundMessageSchema,
             initialLastSeenEventId: coords.lastSeenEventId,
             onDiagnostic,
@@ -254,6 +355,7 @@ function createCodex(settings = {}) {
             model: settings.model ?? DEFAULT_CODEX_MODEL,
             reasoningEffort: settings.reasoningEffort,
             webSearch: settings.webSearch,
+            codexConfig: settings.codexConfig,
             mcpServers: settings.mcpServers,
             resumeThreadId: resumeThreadIdString,
             isResume: true,
@@ -288,7 +390,7 @@ function createCodex(settings = {}) {
         abortSignal: startOpts.abortSignal
       }) : void 0;
       const env = {
-        ...resolveCodexEnv(settings.auth),
+        ...sandboxAuthEnvironment,
         AI_SDK_HARNESS_CLIENT_APP: CODEX_CLIENT_APP,
         BRIDGE_CHANNEL_TOKEN: token,
         BRIDGE_WS_PORT: String(port),
@@ -345,12 +447,13 @@ function createCodex(settings = {}) {
         })
       });
       void drainBridgeProcessStream(proc.stdout);
-      const wsUrl = await sandboxSession.getPortUrl({
+      const endpoint = await sandboxSession.getPortEndpoint({
         port: boundPort,
         protocol: "ws"
-      }) + `?agent_bridge_token=${encodeURIComponent(token)}`;
+      });
+      const bridgeEndpoint = withBridgeToken({ endpoint, token });
       const channel = new SandboxChannel({
-        connect: () => openWebSocket(wsUrl),
+        connect: () => openWebSocket(bridgeEndpoint),
         outboundSchema: outboundMessageSchema,
         onDiagnostic,
         onBridgeError,
@@ -370,6 +473,7 @@ function createCodex(settings = {}) {
         model: settings.model ?? DEFAULT_CODEX_MODEL,
         reasoningEffort: settings.reasoningEffort,
         webSearch: settings.webSearch,
+        codexConfig: settings.codexConfig,
         mcpServers: settings.mcpServers,
         resumeThreadId: resumeThreadIdString,
         isResume: respawnStrategy !== void 0,
@@ -392,23 +496,6 @@ function resolveBridgePort(sandboxSession, override) {
     message: "The codex harness needs a TCP port exposed by the sandbox. Create the sandbox with `ports: [<port>]` or pass `createCodex({ port })`."
   });
 }
-async function readBridgeAsset(name) {
-  const candidates = [
-    new URL(`./bridge/${name}`, import.meta.url),
-    new URL(`../bridge/${name}`, import.meta.url)
-  ];
-  let lastErr;
-  for (const url of candidates) {
-    try {
-      return await readFile(fileURLToPath(url), "utf8");
-    } catch (err) {
-      const code = err.code;
-      if (code !== "ENOENT") throw err;
-      lastErr = err;
-    }
-  }
-  throw lastErr ?? new Error(`bridge asset not found: ${name}`);
-}
 async function writeCodexSkills({
   sandbox,
   skills,
@@ -434,9 +521,14 @@ async function writeCodexSkills({
     codexHomeDir
   };
 }
-function openWebSocket(url) {
+function openWebSocket({
+  url,
+  headers
+}) {
   return new Promise((resolve, reject) => {
-    const ws = new WebSocket(url);
+    const ws = new WebSocket(url, {
+      headers: headers == null ? void 0 : { ...headers }
+    });
     const onOpen = () => {
       ws.off("error", onError);
       resolve(ws);
@@ -449,6 +541,14 @@ function openWebSocket(url) {
     ws.once("error", onError);
   });
 }
+function withBridgeToken({
+  endpoint,
+  token
+}) {
+  const bridgeUrl = new URL(endpoint.url);
+  bridgeUrl.searchParams.set("agent_bridge_token", token);
+  return { ...endpoint, url: bridgeUrl.toString() };
+}
 function createSession({
   sessionId,
   channel,
@@ -457,6 +557,7 @@ function createSession({
   model,
   reasoningEffort,
   webSearch,
+  codexConfig,
   mcpServers,
   resumeThreadId,
   isResume,
@@ -635,6 +736,7 @@ function createSession({
         model,
         reasoningEffort,
         webSearch,
+        ...codexConfig == null ? {} : { codexConfig },
         ...mcpServers == null ? {} : { mcpServers },
         ...permissionMode ? { permissionMode } : {},
         ...pendingResumeThreadId ? { resumeThreadId: pendingResumeThreadId } : {},
@@ -672,6 +774,7 @@ function createSession({
             model,
             reasoningEffort,
             webSearch,
+            ...codexConfig == null ? {} : { codexConfig },
             ...mcpServers == null ? {} : { mcpServers },
             ...permissionMode ? { permissionMode } : {},
             ...threadId ? { resumeThreadId: threadId } : {},