@alvax-ai/adapter-codex-local 0.1.5 → 0.1.6

package/dist/index.d.ts

@@ -2,9 +2,9 @@ import type { AdapterModelProfileDefinition } from "@alvax-ai/adapter-utils";
 export declare const type = "codex_local";
 export declare const label = "Codex (local)";
 export declare const SANDBOX_INSTALL_COMMAND = "npm install -g @openai/codex";
-export declare const DEFAULT_CODEX_LOCAL_MODEL = "gpt-5.5";
+export declare const DEFAULT_CODEX_LOCAL_MODEL = "gpt-6-astra";
 export declare const DEFAULT_CODEX_LOCAL_BYPASS_APPROVALS_AND_SANDBOX = true;
-export declare const CODEX_LOCAL_FAST_MODE_SUPPORTED_MODELS: readonly ["gpt-5.4"];
+export declare const CODEX_LOCAL_FAST_MODE_SUPPORTED_MODELS: readonly ["gpt-6-astra", "gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna", "gpt-5.5", "gpt-5.4"];
 export declare function isCodexLocalKnownModel(model: string | null | undefined): boolean;
 export declare function isCodexLocalManualModel(model: string | null | undefined): boolean;
 export declare function isCodexLocalFastModeSupported(model: string | null | undefined): boolean;
@@ -13,5 +13,5 @@ export declare const models: {
     label: string;
 }[];
 export declare const modelProfiles: AdapterModelProfileDefinition[];
-export declare const agentConfigurationDoc = "# codex_local agent configuration\n\nAdapter: codex_local\n\nCore fields:\n- cwd (string, optional): default absolute working directory fallback for the agent process (created if missing when possible)\n- instructionsFilePath (string, optional): absolute path to a markdown instructions file prepended to stdin prompt at runtime\n- model (string, optional): Codex model id\n- modelReasoningEffort (string, optional): reasoning effort override (minimal|low|medium|high|xhigh) passed via -c model_reasoning_effort=...\n- promptTemplate (string, optional): run prompt template\n- search (boolean, optional): run codex with --search\n- fastMode (boolean, optional): enable Codex Fast mode; supported on GPT-5.4 and passed through for manual model IDs\n- dangerouslyBypassApprovalsAndSandbox (boolean, optional): run with bypass flag\n- command (string, optional): defaults to \"codex\"\n- extraArgs (string[], optional): additional CLI args\n- env (object, optional): KEY=VALUE environment variables\n- workspaceStrategy (object, optional): execution workspace strategy; currently supports { type: \"git_worktree\", baseRef?, branchTemplate?, worktreeParentDir? }\n- workspaceRuntime (object, optional): reserved for workspace runtime metadata; workspace runtime services are manually controlled from the workspace UI and are not auto-started by heartbeats\n\nOperational fields:\n- timeoutSec (number, optional): run timeout in seconds\n- graceSec (number, optional): SIGTERM grace period in seconds\n\nNotes:\n- Prompts are piped via stdin (Codex receives \"-\" prompt argument).\n- If instructionsFilePath is configured, Alvax prepends that file's contents to the stdin prompt on every run.\n- Codex exec automatically applies repo-scoped AGENTS.md instructions from the active workspace. Alvax cannot suppress that discovery in exec mode, so repo AGENTS.md files may still apply even when you only configured an explicit instructionsFilePath.\n- Alvax injects desired local skills into the effective CODEX_HOME/skills/ directory at execution time so Codex can discover \"$alvax\" and related skills without polluting the project working directory. In managed-home mode (the default) this is ~/.alvax/instances/<id>/companies/<companyId>/codex-home/skills/; when CODEX_HOME is explicitly overridden in adapter config, that override is used instead.\n- Unless explicitly overridden in adapter config, Alvax runs Codex with a per-company managed CODEX_HOME under the active Alvax instance and seeds auth/config from the shared Codex home (the CODEX_HOME env var, when set, or ~/.codex).\n- Some model/tool combinations reject certain effort levels (for example minimal with web search enabled).\n- Fast mode is supported on GPT-5.4 and manual model IDs. When enabled for those models, Alvax applies `service_tier=\"fast\"` and `features.fast_mode=true`.\n- When Alvax realizes a workspace/runtime for a run, it injects ALVAX_WORKSPACE_* and ALVAX_RUNTIME_* env vars for agent-side tooling.\n";
+export declare const agentConfigurationDoc = "# codex_local agent configuration\n\nAdapter: codex_local\n\nCore fields:\n- cwd (string, optional): default absolute working directory fallback for the agent process (created if missing when possible)\n- instructionsFilePath (string, optional): absolute path to a markdown instructions file prepended to stdin prompt at runtime\n- model (string, optional): Codex model id\n- modelReasoningEffort (string, optional): reasoning effort override (low|medium|high|xhigh|max|ultra, as supported by the selected model) passed via -c model_reasoning_effort=...\n- promptTemplate (string, optional): run prompt template\n- search (boolean, optional): run codex with --search\n- fastMode (boolean, optional): enable Codex Fast mode; supported on current Codex models and passed through for manual model IDs\n- dangerouslyBypassApprovalsAndSandbox (boolean, optional): run with bypass flag\n- authMode (\"subscription\"|\"api_key\", optional): subscription masks inherited API keys; API keys are passed via CODEX_API_KEY for each invocation\n- command (string, optional): defaults to \"codex\"\n- extraArgs (string[], optional): additional CLI args\n- env (object, optional): KEY=VALUE environment variables\n- workspaceStrategy (object, optional): execution workspace strategy; currently supports { type: \"git_worktree\", baseRef?, branchTemplate?, worktreeParentDir? }\n- workspaceRuntime (object, optional): reserved for workspace runtime metadata; workspace runtime services are manually controlled from the workspace UI and are not auto-started by heartbeats\n\nOperational fields:\n- timeoutSec (number, optional): run timeout in seconds\n- graceSec (number, optional): SIGTERM grace period in seconds\n\nNotes:\n- Prompts are piped via stdin (Codex receives \"-\" prompt argument).\n- If instructionsFilePath is configured, Alvax prepends that file's contents to the stdin prompt on every run.\n- Codex exec automatically applies repo-scoped AGENTS.md instructions from the active workspace. Alvax cannot suppress that discovery in exec mode, so repo AGENTS.md files may still apply even when you only configured an explicit instructionsFilePath.\n- Alvax injects desired local skills into the effective CODEX_HOME/skills/ directory at execution time so Codex can discover \"$alvax\" and related skills without polluting the project working directory. In managed-home mode (the default) this is ~/.alvax/instances/<id>/companies/<companyId>/codex-home/skills/; when CODEX_HOME is explicitly overridden in adapter config, that override is used instead.\n- Alvax uses a per-company managed CODEX_HOME when file credentials can be shared. When subscription credentials are stored natively and no auth.json is available, Alvax keeps the original shared CODEX_HOME so the CLI can access its credential store. An explicit adapter CODEX_HOME always takes precedence. API-key invocations do not overwrite stored credentials.\n- Some model/tool combinations reject certain effort levels (for example minimal with web search enabled).\n- Fast mode is available on current Codex models and manual model IDs, subject to account and regional availability. When enabled for those models, Alvax applies `service_tier=\"fast\"` and `features.fast_mode=true`.\n- When Alvax realizes a workspace/runtime for a run, it injects ALVAX_WORKSPACE_* and ALVAX_RUNTIME_* env vars for agent-side tooling.\n";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC;AAE7E,eAAO,MAAM,IAAI,gBAAgB,CAAC;AAClC,eAAO,MAAM,KAAK,kBAAkB,CAAC;AAErC,eAAO,MAAM,uBAAuB,iCAAiC,CAAC;AAEtE,eAAO,MAAM,yBAAyB,YAAY,CAAC;AACnD,eAAO,MAAM,gDAAgD,OAAO,CAAC;AACrE,eAAO,MAAM,sCAAsC,sBAAuB,CAAC;AAM3E,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAIhF;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAGjF;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAMvF;AAED,eAAO,MAAM,MAAM;;;GASlB,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,6BAA6B,EAWxD,CAAC;AAEF,eAAO,MAAM,qBAAqB,i7FAgCjC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC;AAE7E,eAAO,MAAM,IAAI,gBAAgB,CAAC;AAClC,eAAO,MAAM,KAAK,kBAAkB,CAAC;AAErC,eAAO,MAAM,uBAAuB,iCAAiC,CAAC;AAEtE,eAAO,MAAM,yBAAyB,gBAAgB,CAAC;AACvD,eAAO,MAAM,gDAAgD,OAAO,CAAC;AACrE,eAAO,MAAM,sCAAsC,gGAAiG,CAAC;AAMrJ,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAIhF;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAGjF;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAMvF;AAGD,eAAO,MAAM,MAAM;;;GAMlB,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,6BAA6B,EAWxD,CAAC;AAEF,eAAO,MAAM,qBAAqB,uzGAiCjC,CAAC"}

package/dist/index.js

@@ -1,9 +1,9 @@
 export const type = "codex_local";
 export const label = "Codex (local)";
 export const SANDBOX_INSTALL_COMMAND = "npm install -g @openai/codex";
-export const DEFAULT_CODEX_LOCAL_MODEL = "gpt-5.5";
+export const DEFAULT_CODEX_LOCAL_MODEL = "gpt-6-astra";
 export const DEFAULT_CODEX_LOCAL_BYPASS_APPROVALS_AND_SANDBOX = true;
-export const CODEX_LOCAL_FAST_MODE_SUPPORTED_MODELS = ["gpt-5.4"];
+export const CODEX_LOCAL_FAST_MODE_SUPPORTED_MODELS = ["gpt-6-astra", "gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna", "gpt-5.5", "gpt-5.4"];
 function normalizeModelId(model) {
     return typeof model === "string" ? model.trim() : "";
 }
@@ -23,23 +23,21 @@ export function isCodexLocalFastModeSupported(model) {
     const normalizedModel = typeof model === "string" ? model.trim() : "";
     return CODEX_LOCAL_FAST_MODE_SUPPORTED_MODELS.includes(normalizedModel);
 }
+// Offline suggestions only. The server prefers the installed CLI's model/list catalog.
 export const models = [
-    { id: DEFAULT_CODEX_LOCAL_MODEL, label: "GPT-5.5" },
-    { id: "gpt-5.4", label: "GPT-5.4" },
-    { id: "gpt-5.4-mini", label: "GPT-5.4 Mini" },
-    { id: "gpt-5.4-nano", label: "GPT-5.4 Nano" },
-    { id: "gpt-5.3-codex", label: "GPT-5.3 Codex" },
-    { id: "gpt-5", label: "GPT-5" },
-    { id: "gpt-5-mini", label: "GPT-5 Mini" },
-    { id: "gpt-5-nano", label: "GPT-5 Nano" },
+    { id: DEFAULT_CODEX_LOCAL_MODEL, label: "GPT-6 Astra" },
+    { id: "gpt-5.6-sol", label: "GPT-5.6 Sol" },
+    { id: "gpt-5.6-terra", label: "GPT-5.6 Terra" },
+    { id: "gpt-5.6-luna", label: "GPT-5.6 Luna" },
+    { id: "gpt-5.5", label: "GPT-5.5" },
 ];
 export const modelProfiles = [
     {
         key: "cheap",
         label: "Cheap",
-        description: "Use the lowest-cost known Codex local model lane without changing the primary model.",
+        description: "Use an affordable Codex local model lane without changing the primary model.",
         adapterConfig: {
-            model: "gpt-5.4-mini",
+            model: "gpt-5.6-luna",
             modelReasoningEffort: "low",
         },
         source: "adapter_default",
@@ -53,11 +51,12 @@ Core fields:
 - cwd (string, optional): default absolute working directory fallback for the agent process (created if missing when possible)
 - instructionsFilePath (string, optional): absolute path to a markdown instructions file prepended to stdin prompt at runtime
 - model (string, optional): Codex model id
-- modelReasoningEffort (string, optional): reasoning effort override (minimal|low|medium|high|xhigh) passed via -c model_reasoning_effort=...
+- modelReasoningEffort (string, optional): reasoning effort override (low|medium|high|xhigh|max|ultra, as supported by the selected model) passed via -c model_reasoning_effort=...
 - promptTemplate (string, optional): run prompt template
 - search (boolean, optional): run codex with --search
-- fastMode (boolean, optional): enable Codex Fast mode; supported on GPT-5.4 and passed through for manual model IDs
+- fastMode (boolean, optional): enable Codex Fast mode; supported on current Codex models and passed through for manual model IDs
 - dangerouslyBypassApprovalsAndSandbox (boolean, optional): run with bypass flag
+- authMode ("subscription"|"api_key", optional): subscription masks inherited API keys; API keys are passed via CODEX_API_KEY for each invocation
 - command (string, optional): defaults to "codex"
 - extraArgs (string[], optional): additional CLI args
 - env (object, optional): KEY=VALUE environment variables
@@ -73,9 +72,9 @@ Notes:
 - If instructionsFilePath is configured, Alvax prepends that file's contents to the stdin prompt on every run.
 - Codex exec automatically applies repo-scoped AGENTS.md instructions from the active workspace. Alvax cannot suppress that discovery in exec mode, so repo AGENTS.md files may still apply even when you only configured an explicit instructionsFilePath.
 - Alvax injects desired local skills into the effective CODEX_HOME/skills/ directory at execution time so Codex can discover "$alvax" and related skills without polluting the project working directory. In managed-home mode (the default) this is ~/.alvax/instances/<id>/companies/<companyId>/codex-home/skills/; when CODEX_HOME is explicitly overridden in adapter config, that override is used instead.
-- Unless explicitly overridden in adapter config, Alvax runs Codex with a per-company managed CODEX_HOME under the active Alvax instance and seeds auth/config from the shared Codex home (the CODEX_HOME env var, when set, or ~/.codex).
+- Alvax uses a per-company managed CODEX_HOME when file credentials can be shared. When subscription credentials are stored natively and no auth.json is available, Alvax keeps the original shared CODEX_HOME so the CLI can access its credential store. An explicit adapter CODEX_HOME always takes precedence. API-key invocations do not overwrite stored credentials.
 - Some model/tool combinations reject certain effort levels (for example minimal with web search enabled).
-- Fast mode is supported on GPT-5.4 and manual model IDs. When enabled for those models, Alvax applies \`service_tier="fast"\` and \`features.fast_mode=true\`.
+- Fast mode is available on current Codex models and manual model IDs, subject to account and regional availability. When enabled for those models, Alvax applies \`service_tier="fast"\` and \`features.fast_mode=true\`.
 - When Alvax realizes a workspace/runtime for a run, it injects ALVAX_WORKSPACE_* and ALVAX_RUNTIME_* env vars for agent-side tooling.
 `;
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,IAAI,GAAG,aAAa,CAAC;AAClC,MAAM,CAAC,MAAM,KAAK,GAAG,eAAe,CAAC;AAErC,MAAM,CAAC,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AAEtE,MAAM,CAAC,MAAM,yBAAyB,GAAG,SAAS,CAAC;AACnD,MAAM,CAAC,MAAM,gDAAgD,GAAG,IAAI,CAAC;AACrE,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,SAAS,CAAU,CAAC;AAE3E,SAAS,gBAAgB,CAAC,KAAgC;IACxD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAgC;IACrE,MAAM,eAAe,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,CAAC,eAAe;QAAE,OAAO,KAAK,CAAC;IACnC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,eAAe,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAgC;IACtE,MAAM,eAAe,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAChD,OAAO,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,sBAAsB,CAAC,eAAe,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAAgC;IAC5E,IAAI,uBAAuB,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,MAAM,eAAe,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,OAAO,sCAAsC,CAAC,QAAQ,CACpD,eAA0E,CAC3E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,EAAE,EAAE,EAAE,yBAAyB,EAAE,KAAK,EAAE,SAAS,EAAE;IACnD,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE;IACnC,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE;IAC7C,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE;IAC7C,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,eAAe,EAAE;IAC/C,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE;IAC/B,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE;IACzC,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE;CAC1C,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAoC;IAC5D;QACE,GAAG,EAAE,OAAO;QACZ,KAAK,EAAE,OAAO;QACd,WAAW,EAAE,sFAAsF;QACnG,aAAa,EAAE;YACb,KAAK,EAAE,cAAc;YACrB,oBAAoB,EAAE,KAAK;SAC5B;QACD,MAAM,EAAE,iBAAiB;KAC1B;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgCpC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,IAAI,GAAG,aAAa,CAAC;AAClC,MAAM,CAAC,MAAM,KAAK,GAAG,eAAe,CAAC;AAErC,MAAM,CAAC,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AAEtE,MAAM,CAAC,MAAM,yBAAyB,GAAG,aAAa,CAAC;AACvD,MAAM,CAAC,MAAM,gDAAgD,GAAG,IAAI,CAAC;AACrE,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,CAAU,CAAC;AAErJ,SAAS,gBAAgB,CAAC,KAAgC;IACxD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAgC;IACrE,MAAM,eAAe,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,CAAC,eAAe;QAAE,OAAO,KAAK,CAAC;IACnC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,eAAe,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAgC;IACtE,MAAM,eAAe,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAChD,OAAO,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,sBAAsB,CAAC,eAAe,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAAgC;IAC5E,IAAI,uBAAuB,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,MAAM,eAAe,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,OAAO,sCAAsC,CAAC,QAAQ,CACpD,eAA0E,CAC3E,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,EAAE,EAAE,EAAE,yBAAyB,EAAE,KAAK,EAAE,aAAa,EAAE;IACvD,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE;IAC3C,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,eAAe,EAAE;IAC/C,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE;IAC7C,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE;CACpC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAoC;IAC5D;QACE,GAAG,EAAE,OAAO;QACZ,KAAK,EAAE,OAAO;QACd,WAAW,EAAE,8EAA8E;QAC3F,aAAa,EAAE;YACb,KAAK,EAAE,cAAc;YACrB,oBAAoB,EAAE,KAAK;SAC5B;QACD,MAAM,EAAE,iBAAiB;KAC1B;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiCpC,CAAC"}

package/dist/server/app-server.d.ts

@@ -0,0 +1,21 @@
+export declare class CodexRpcClient {
+    private proc;
+    private ready;
+    private nextId;
+    private buffer;
+    private pending;
+    private closed;
+    constructor(options?: {
+        command?: string;
+        cwd?: string;
+        env?: NodeJS.ProcessEnv;
+        ephemeralAuth?: boolean;
+        configArgs?: string[];
+    });
+    private fail;
+    private onStdout;
+    request(method: string, params?: Record<string, unknown>, timeoutMs?: number): Promise<Record<string, unknown>>;
+    initialize(): Promise<void>;
+    shutdown(): Promise<void>;
+}
+//# sourceMappingURL=app-server.d.ts.map

package/dist/server/app-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-server.d.ts","sourceRoot":"","sources":["../../src/server/app-server.ts"],"names":[],"mappings":"AASA,qBAAa,cAAc;IACzB,OAAO,CAAC,IAAI,CAAkC;IAC9C,OAAO,CAAC,KAAK,CAAgB;IAC7B,OAAO,CAAC,MAAM,CAAK;IACnB,OAAO,CAAC,MAAM,CAAM;IACpB,OAAO,CAAC,OAAO,CAAqC;IACpD,OAAO,CAAC,MAAM,CAAsB;gBAGlC,OAAO,GAAE;QACP,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;QACxB,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;KAClB;IAmCR,OAAO,CAAC,IAAI;IASZ,OAAO,CAAC,QAAQ;IAwCV,OAAO,CACX,MAAM,EAAE,MAAM,EACd,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EACpC,SAAS,SAAQ,GAChB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAgB7B,UAAU;IAKV,QAAQ;CAiBf"}

package/dist/server/app-server.js

@@ -0,0 +1,131 @@
+import { spawn } from "node:child_process";
+import { ensurePathInEnv, resolveSpawnTarget } from "@alvax-ai/adapter-utils/server-utils";
+export class CodexRpcClient {
+    proc;
+    ready;
+    nextId = 1;
+    buffer = "";
+    pending = new Map();
+    closed = null;
+    constructor(options = {}) {
+        const args = [
+            "-s",
+            "read-only",
+            "-a",
+            "never",
+            ...(options.configArgs ?? []),
+            ...(options.ephemeralAuth ? ["-c", 'cli_auth_credentials_store="ephemeral"'] : []),
+            "app-server",
+        ];
+        const env = ensurePathInEnv(options.env ?? process.env);
+        this.ready = resolveSpawnTarget(options.command ?? "codex", args, options.cwd ?? process.cwd(), env)
+            .then((target) => {
+            this.proc = spawn(target.command, target.args, {
+                stdio: ["pipe", "pipe", "pipe"],
+                cwd: options.cwd,
+                env,
+            });
+            this.proc.stdout.setEncoding("utf8");
+            this.proc.stdout.on("data", (chunk) => this.onStdout(chunk));
+            // Drain diagnostics without retaining secrets or unbounded logs.
+            this.proc.stderr.resume();
+            this.proc.on("exit", () => this.fail(new Error("Codex app-server closed unexpectedly")));
+            this.proc.on("error", (error) => this.fail(error));
+            this.proc.stdin.on("error", (error) => this.fail(error));
+        })
+            .catch((error) => this.fail(error));
+    }
+    fail(error) {
+        this.closed ??= error;
+        for (const request of this.pending.values()) {
+            clearTimeout(request.timer);
+            request.reject(error);
+        }
+        this.pending.clear();
+    }
+    onStdout(chunk) {
+        this.buffer += chunk;
+        while (true) {
+            const newline = this.buffer.indexOf("\n");
+            if (newline < 0)
+                break;
+            const line = this.buffer.slice(0, newline).trim();
+            this.buffer = this.buffer.slice(newline + 1);
+            if (!line)
+                continue;
+            let message;
+            try {
+                const parsed = JSON.parse(line);
+                if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+                    continue;
+                message = parsed;
+            }
+            catch {
+                continue;
+            }
+            if (typeof message.id !== "number")
+                continue;
+            const pending = this.pending.get(message.id);
+            if (!pending)
+                continue;
+            this.pending.delete(message.id);
+            clearTimeout(pending.timer);
+            if (message.error) {
+                const error = message.error;
+                pending.reject(new Error(error.message || "Codex app-server request failed"));
+            }
+            else if (message.result &&
+                typeof message.result === "object" &&
+                !Array.isArray(message.result)) {
+                pending.resolve(message.result);
+            }
+            else {
+                pending.reject(new Error("Invalid Codex app-server response"));
+            }
+        }
+        if (this.buffer.length > 4 * 1024 * 1024) {
+            this.fail(new Error("Codex app-server response exceeded buffer limit"));
+            this.proc.kill("SIGTERM");
+        }
+    }
+    async request(method, params = {}, timeoutMs = 8_000) {
+        await this.ready;
+        if (this.closed)
+            throw this.closed;
+        const id = this.nextId++;
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                this.pending.delete(id);
+                reject(new Error(`Codex app-server timed out on ${method}`));
+            }, timeoutMs);
+            this.pending.set(id, { resolve, reject, timer });
+            this.proc.stdin.write(JSON.stringify({ id, method, params }) + "\n", (error) => {
+                if (error)
+                    this.fail(error);
+            });
+        });
+    }
+    async initialize() {
+        await this.request("initialize", { clientInfo: { name: "alvax", version: "0.1.5" } });
+        this.proc.stdin.write(JSON.stringify({ method: "initialized" }) + "\n");
+    }
+    async shutdown() {
+        await this.ready;
+        this.fail(new Error("Codex app-server client closed"));
+        if (!this.proc || this.proc.exitCode !== null || this.proc.signalCode !== null)
+            return;
+        await new Promise((resolve) => {
+            const timer = setTimeout(() => {
+                this.proc.kill("SIGKILL");
+                resolve();
+            }, 1_000);
+            this.proc.once("exit", () => {
+                clearTimeout(timer);
+                resolve();
+            });
+            this.proc.stdin.end();
+            this.proc.kill("SIGTERM");
+        });
+    }
+}
+//# sourceMappingURL=app-server.js.map

package/dist/server/app-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-server.js","sourceRoot":"","sources":["../../src/server/app-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAuC,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAQ3F,MAAM,OAAO,cAAc;IACjB,IAAI,CAAkC;IACtC,KAAK,CAAgB;IACrB,MAAM,GAAG,CAAC,CAAC;IACX,MAAM,GAAG,EAAE,CAAC;IACZ,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC5C,MAAM,GAAiB,IAAI,CAAC;IAEpC,YACE,UAMI,EAAE;QAEN,MAAM,IAAI,GAAG;YACX,IAAI;YACJ,WAAW;YACX,IAAI;YACJ,OAAO;YACP,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;YAC7B,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,wCAAwC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,YAAY;SACb,CAAC;QACF,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;QACxD,IAAI,CAAC,KAAK,GAAG,kBAAkB,CAC7B,OAAO,CAAC,OAAO,IAAI,OAAO,EAC1B,IAAI,EACJ,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAC5B,GAAG,CACJ;aACE,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YACf,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE;gBAC7C,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;gBAC/B,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,GAAG;aACJ,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YACrE,iEAAiE;YACjE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YAC1B,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC,CAAC,CAAC;YACzF,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACnD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3D,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAY,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/C,CAAC;IAEO,IAAI,CAAC,KAAY;QACvB,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC;QACtB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC5C,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAEO,QAAQ,CAAC,KAAa;QAC5B,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC;QACrB,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,OAAO,GAAG,CAAC;gBAAE,MAAM;YACvB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAClD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;YAC7C,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,IAAI,OAAgC,CAAC;YACrC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACzC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;oBAAE,SAAS;gBAC7E,OAAO,GAAG,MAAiC,CAAC;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ;gBAAE,SAAS;YAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC7C,IAAI,CAAC,OAAO;gBAAE,SAAS;YACvB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAChC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBAClB,MAAM,KAAK,GAAG,OAAO,CAAC,KAA6B,CAAC;gBACpD,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,IAAI,iCAAiC,CAAC,CAAC,CAAC;YAChF,CAAC;iBAAM,IACL,OAAO,CAAC,MAAM;gBACd,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;gBAClC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAC9B,CAAC;gBACD,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAiC,CAAC,CAAC;YAC7D,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC,CAAC;YACxE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CACX,MAAc,EACd,SAAkC,EAAE,EACpC,SAAS,GAAG,KAAK;QAEjB,MAAM,IAAI,CAAC,KAAK,CAAC;QACjB,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,CAAC,MAAM,CAAC;QACnC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACxB,MAAM,CAAC,IAAI,KAAK,CAAC,iCAAiC,MAAM,EAAE,CAAC,CAAC,CAAC;YAC/D,CAAC,EAAE,SAAS,CAAC,CAAC;YACd,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC7E,IAAI,KAAK;oBAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QACtF,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAC1E,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,IAAI,CAAC,KAAK,CAAC;QACjB,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,KAAK,IAAI;YAAE,OAAO;QACvF,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC1B,OAAO,EAAE,CAAC;YACZ,CAAC,EAAE,KAAK,CAAC,CAAC;YACV,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;gBAC1B,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/server/auth.d.ts

@@ -0,0 +1,11 @@
+/** Resolve credentials once for both connection probes and agent execution. */
+export declare function resolveCodexAuthEnv(config: Record<string, unknown>, inherited?: NodeJS.ProcessEnv): Record<string, string>;
+/** Check the selected mode without changing or logging out the saved account. */
+export declare function assertCodexAuthMode(config: Record<string, unknown>, options: {
+    command: string;
+    cwd: string;
+    env: Record<string, string>;
+    target?: import("@alvax-ai/adapter-utils/execution-target").AdapterExecutionTarget | null;
+    runId: string;
+}): Promise<void>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/server/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAIA,+EAA+E;AAC/E,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,SAAS,GAAE,MAAM,CAAC,UAAwB,GACzC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAqBxB;AAED,iFAAiF;AACjF,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,OAAO,EAAE;IACP,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,MAAM,CAAC,EAAE,OAAO,0CAA0C,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC1F,KAAK,EAAE,MAAM,CAAC;CACf,GACA,OAAO,CAAC,IAAI,CAAC,CAkDf"}

package/dist/server/auth.js

@@ -0,0 +1,73 @@
+import { codexConfigurationArgs } from "./codex-args.js";
+import { CodexRpcClient } from "./app-server.js";
+import { runAdapterExecutionTargetProcess } from "@alvax-ai/adapter-utils/execution-target";
+/** Resolve credentials once for both connection probes and agent execution. */
+export function resolveCodexAuthEnv(config, inherited = process.env) {
+    const rawEnv = typeof config.env === "object" && config.env !== null ? config.env : {};
+    const env = Object.fromEntries(Object.entries(rawEnv).filter((entry) => typeof entry[1] === "string"));
+    const merged = { ...inherited, ...env };
+    const configuredKey = env.CODEX_API_KEY?.trim() || env.OPENAI_API_KEY?.trim();
+    const apiKey = configuredKey || merged.CODEX_API_KEY?.trim() || merged.OPENAI_API_KEY?.trim() || "";
+    // Empty overrides deliberately mask inherited credentials when subscription is selected.
+    if (config.authMode === "subscription") {
+        env.CODEX_API_KEY = "";
+        env.OPENAI_API_KEY = "";
+    }
+    else if (apiKey) {
+        env.CODEX_API_KEY = apiKey;
+        if (configuredKey || merged.OPENAI_API_KEY)
+            env.OPENAI_API_KEY = configuredKey || merged.OPENAI_API_KEY;
+    }
+    return env;
+}
+/** Check the selected mode without changing or logging out the saved account. */
+export async function assertCodexAuthMode(config, options) {
+    const mode = config.authMode;
+    if (mode !== "subscription" && mode !== "api_key")
+        return;
+    if (mode === "api_key" && options.env.CODEX_API_KEY)
+        return;
+    let accountType = null;
+    if (options.target?.kind === "remote") {
+        const status = await runAdapterExecutionTargetProcess(`${options.runId}-auth`, options.target, "sh", [
+            "-c",
+            'if [ -n "${CODEX_API_KEY:-}" ]; then printf "%s\\n" "Logged in using API key"; else exec "$0" "$@"; fi',
+            options.command,
+            ...codexConfigurationArgs(config),
+            "login",
+            "status",
+        ], { cwd: options.cwd, env: options.env, timeoutSec: 8, graceSec: 1, onLog: async () => { } });
+        // Login status is read-only. Do not expose its output: API login status may contain a key prefix.
+        if (status.exitCode === 0 && !status.timedOut) {
+            const text = `${status.stdout}\n${status.stderr}`;
+            if (/logged in using chatgpt/i.test(text))
+                accountType = "chatgpt";
+            else if (/logged in using (?:an? )?api key/i.test(text))
+                accountType = "apiKey";
+        }
+    }
+    else {
+        const client = new CodexRpcClient({
+            command: options.command,
+            cwd: options.cwd,
+            configArgs: codexConfigurationArgs(config),
+            env: { ...process.env, ...options.env },
+        });
+        try {
+            await client.initialize();
+            const result = await client.request("account/read");
+            const account = result.account;
+            accountType = account?.type ?? null;
+        }
+        finally {
+            await client.shutdown();
+        }
+    }
+    const expected = mode === "subscription" ? "chatgpt" : "apiKey";
+    if (accountType !== expected) {
+        throw new Error(mode === "subscription"
+            ? "Subscription requires a ChatGPT login. Run `codex login` with this runtime's CODEX_HOME, then test again."
+            : "API Key mode requires a configured key or a native API-key login. Save a key or run `codex login --with-api-key`, then test again.");
+    }
+}
+//# sourceMappingURL=auth.js.map

package/dist/server/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,gCAAgC,EAAE,MAAM,0CAA0C,CAAC;AAE5F,+EAA+E;AAC/E,MAAM,UAAU,mBAAmB,CACjC,MAA+B,EAC/B,YAA+B,OAAO,CAAC,GAAG;IAE1C,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACvF,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAC5B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAC3B,CAAC,KAAK,EAA6B,EAAE,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CACnE,CACF,CAAC;IACF,MAAM,MAAM,GAAG,EAAE,GAAG,SAAS,EAAE,GAAG,GAAG,EAAE,CAAC;IACxC,MAAM,aAAa,GAAG,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IAC9E,MAAM,MAAM,GACV,aAAa,IAAI,MAAM,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACvF,yFAAyF;IACzF,IAAI,MAAM,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;QACvC,GAAG,CAAC,aAAa,GAAG,EAAE,CAAC;QACvB,GAAG,CAAC,cAAc,GAAG,EAAE,CAAC;IAC1B,CAAC;SAAM,IAAI,MAAM,EAAE,CAAC;QAClB,GAAG,CAAC,aAAa,GAAG,MAAM,CAAC;QAC3B,IAAI,aAAa,IAAI,MAAM,CAAC,cAAc;YACxC,GAAG,CAAC,cAAc,GAAG,aAAa,IAAI,MAAM,CAAC,cAAe,CAAC;IACjE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAA+B,EAC/B,OAMC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC7B,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO;IAC1D,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa;QAAE,OAAO;IAC5D,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,OAAO,CAAC,MAAM,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,gCAAgC,CACnD,GAAG,OAAO,CAAC,KAAK,OAAO,EACvB,OAAO,CAAC,MAAM,EACd,IAAI,EACJ;YACE,IAAI;YACJ,wGAAwG;YACxG,OAAO,CAAC,OAAO;YACf,GAAG,sBAAsB,CAAC,MAAM,CAAC;YACjC,OAAO;YACP,QAAQ;SACT,EACD,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,EAAE,CAC1F,CAAC;QACF,kGAAkG;QAClG,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YAClD,IAAI,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,WAAW,GAAG,SAAS,CAAC;iBAC9D,IAAI,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,WAAW,GAAG,QAAQ,CAAC;QAClF,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC;YAChC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,UAAU,EAAE,sBAAsB,CAAC,MAAM,CAAC;YAC1C,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE;SACxC,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YACpD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAmC,CAAC;YAC3D,WAAW,GAAG,OAAO,EAAE,IAAI,IAAI,IAAI,CAAC;QACtC,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;IAChE,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,IAAI,KAAK,cAAc;YACrB,CAAC,CAAC,2GAA2G;YAC7G,CAAC,CAAC,oIAAoI,CACzI,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/server/codex-args.d.ts

@@ -8,4 +8,6 @@ export type BuildCodexExecArgsResult = {
 export declare function buildCodexExecArgs(config: unknown, options?: {
     resumeSessionId?: string | null;
 }): BuildCodexExecArgsResult;
+/** Only global configuration options apply to both exec and app-server. */
+export declare function codexConfigurationArgs(config: unknown): string[];
 //# sourceMappingURL=codex-args.d.ts.map

package/dist/server/codex-args.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-args.d.ts","sourceRoot":"","sources":["../../src/server/codex-args.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,EAAE,OAAO,CAAC;IAC3B,eAAe,EAAE,OAAO,CAAC;IACzB,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC,CAAC;AAkBF,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,OAAO,EACf,OAAO,GAAE;IAAE,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GAChD,wBAAwB,CAwC1B"}
+{"version":3,"file":"codex-args.d.ts","sourceRoot":"","sources":["../../src/server/codex-args.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,EAAE,OAAO,CAAC;IAC3B,eAAe,EAAE,OAAO,CAAC;IACzB,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC,CAAC;AAkBF,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,OAAO,EACf,OAAO,GAAE;IAAE,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GAChD,wBAAwB,CAwC1B;AAGD,2EAA2E;AAC3E,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,EAAE,CAahE"}

package/dist/server/codex-args.js

@@ -52,4 +52,20 @@ export function buildCodexExecArgs(config, options = {}) {
             : null,
     };
 }
+/** Only global configuration options apply to both exec and app-server. */
+export function codexConfigurationArgs(config) {
+    const args = readExtraArgs(config);
+    const result = [];
+    const flags = new Set(["-c", "--config", "--enable", "--disable"]);
+    for (let index = 0; index < args.length; index++) {
+        const arg = args[index];
+        if (flags.has(arg) && args[index + 1] !== undefined) {
+            result.push(arg, args[++index]);
+        }
+        else if (/^--(?:config|enable|disable)=/.test(arg) || /^-c.+/.test(arg)) {
+            result.push(arg);
+        }
+    }
+    return result;
+}
 //# sourceMappingURL=codex-args.js.map

package/dist/server/codex-args.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-args.js","sourceRoot":"","sources":["../../src/server/codex-args.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AAC1F,OAAO,EACL,sCAAsC,EACtC,6BAA6B,GAC9B,MAAM,aAAa,CAAC;AAUrB,SAAS,aAAa,CAAC,MAAe;IACpC,MAAM,aAAa,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC;IAChE,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,aAAa,CAAC;IACnD,OAAO,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,SAAS,6BAA6B;IACpC,OAAO,GAAG,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,mCAAmC,CAAC;AACjG,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,MAAe,EACf,UAA+C,EAAE;IAEjD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,MAAM,oBAAoB,GAAG,QAAQ,CACnC,MAAM,CAAC,oBAAoB,EAC3B,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,EAAE,CAAC,CACrC,CAAC,IAAI,EAAE,CAAC;IACT,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC/C,MAAM,iBAAiB,GAAG,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC5D,MAAM,eAAe,GAAG,iBAAiB,IAAI,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,SAAS,CACtB,MAAM,CAAC,oCAAoC,EAC3C,SAAS,CAAC,MAAM,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAClD,CAAC;IACF,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAExC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAChC,IAAI,MAAM;QAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,MAAM;QAAE,IAAI,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IACpE,IAAI,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACvC,IAAI,oBAAoB,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,0BAA0B,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,eAAe,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,yBAAyB,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC;IAClD,IAAI,OAAO,CAAC,eAAe;QAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;;QAC1E,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEpB,OAAO;QACL,IAAI;QACJ,KAAK;QACL,iBAAiB;QACjB,eAAe;QACf,qBAAqB,EACnB,iBAAiB,IAAI,CAAC,eAAe;YACnC,CAAC,CAAC,uDAAuD,6BAA6B,EAAE,oCAAoC,KAAK,IAAI,WAAW,GAAG;YACnJ,CAAC,CAAC,IAAI;KACX,CAAC;AACJ,CAAC"}
+{"version":3,"file":"codex-args.js","sourceRoot":"","sources":["../../src/server/codex-args.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AAC1F,OAAO,EACL,sCAAsC,EACtC,6BAA6B,GAC9B,MAAM,aAAa,CAAC;AAUrB,SAAS,aAAa,CAAC,MAAe;IACpC,MAAM,aAAa,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC;IAChE,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,aAAa,CAAC;IACnD,OAAO,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,SAAS,6BAA6B;IACpC,OAAO,GAAG,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,mCAAmC,CAAC;AACjG,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,MAAe,EACf,UAA+C,EAAE;IAEjD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,MAAM,oBAAoB,GAAG,QAAQ,CACnC,MAAM,CAAC,oBAAoB,EAC3B,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,EAAE,CAAC,CACrC,CAAC,IAAI,EAAE,CAAC;IACT,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC/C,MAAM,iBAAiB,GAAG,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC5D,MAAM,eAAe,GAAG,iBAAiB,IAAI,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,SAAS,CACtB,MAAM,CAAC,oCAAoC,EAC3C,SAAS,CAAC,MAAM,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAClD,CAAC;IACF,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAExC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAChC,IAAI,MAAM;QAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,MAAM;QAAE,IAAI,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IACpE,IAAI,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACvC,IAAI,oBAAoB,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,0BAA0B,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,eAAe,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,yBAAyB,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC;IAClD,IAAI,OAAO,CAAC,eAAe;QAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;;QAC1E,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEpB,OAAO;QACL,IAAI;QACJ,KAAK;QACL,iBAAiB;QACjB,eAAe;QACf,qBAAqB,EACnB,iBAAiB,IAAI,CAAC,eAAe;YACnC,CAAC,CAAC,uDAAuD,6BAA6B,EAAE,oCAAoC,KAAK,IAAI,WAAW,GAAG;YACnJ,CAAC,CAAC,IAAI;KACX,CAAC;AACJ,CAAC;AAGD,2EAA2E;AAC3E,MAAM,UAAU,sBAAsB,CAAC,MAAe;IACpD,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;IACnE,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAE,CAAC;QACzB,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YACpD,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,KAAK,CAAE,CAAC,CAAC;QACnC,CAAC;aAAM,IAAI,+BAA+B,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1E,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/server/codex-home.d.ts

@@ -2,14 +2,8 @@ import type { AdapterExecutionContext } from "@alvax-ai/adapter-utils";
 export declare function pathExists(candidate: string): Promise<boolean>;
 export declare function resolveSharedCodexHomeDir(env?: NodeJS.ProcessEnv): string;
 export declare function resolveManagedCodexHomeDir(env: NodeJS.ProcessEnv, companyId?: string): string;
-/**
- * Writes an `auth.json` containing only `OPENAI_API_KEY` so the codex CLI can
- * authenticate via API key. Overwrites any existing file or symlink at that
- * path. Required because the codex CLI (>= 0.122) ignores the `OPENAI_API_KEY`
- * environment variable and only reads credentials from `$CODEX_HOME/auth.json`.
- */
-export declare function writeApiKeyAuthJson(home: string, apiKey: string): Promise<void>;
 export declare function prepareManagedCodexHome(env: NodeJS.ProcessEnv, onLog: AdapterExecutionContext["onLog"], companyId?: string, options?: {
     apiKey?: string | null;
+    allowSharedHome?: boolean;
 }): Promise<string>;
 //# sourceMappingURL=codex-home.d.ts.map

package/dist/server/codex-home.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-home.d.ts","sourceRoot":"","sources":["../../src/server/codex-home.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAWvE,wBAAsB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEpE;AAED,wBAAgB,yBAAyB,CACvC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAGR;AAMD,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,CAMR;AAqCD;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKrF;AAED,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,KAAK,EAAE,uBAAuB,CAAC,OAAO,CAAC,EACvC,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GACvC,OAAO,CAAC,MAAM,CAAC,CAiDjB"}
+{"version":3,"file":"codex-home.d.ts","sourceRoot":"","sources":["../../src/server/codex-home.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAWvE,wBAAsB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEpE;AAED,wBAAgB,yBAAyB,CACvC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAGR;AAMD,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,CAMR;AAqCD,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,KAAK,EAAE,uBAAuB,CAAC,OAAO,CAAC,EACvC,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,CAAA;CAAO,GAClE,OAAO,CAAC,MAAM,CAAC,CA+CjB"}

package/dist/server/codex-home.js

@@ -56,22 +56,16 @@ async function ensureCopiedFile(target, source) {
     await ensureParentDir(target);
     await fs.copyFile(source, target);
 }
-/**
- * Writes an `auth.json` containing only `OPENAI_API_KEY` so the codex CLI can
- * authenticate via API key. Overwrites any existing file or symlink at that
- * path. Required because the codex CLI (>= 0.122) ignores the `OPENAI_API_KEY`
- * environment variable and only reads credentials from `$CODEX_HOME/auth.json`.
- */
-export async function writeApiKeyAuthJson(home, apiKey) {
-    await fs.mkdir(home, { recursive: true });
-    const target = path.join(home, "auth.json");
-    await fs.rm(target, { force: true });
-    await fs.writeFile(target, JSON.stringify({ OPENAI_API_KEY: apiKey }), { mode: 0o600 });
-}
 export async function prepareManagedCodexHome(env, onLog, companyId, options = {}) {
     const targetHome = resolveManagedCodexHomeDir(env, companyId);
     const apiKey = nonEmpty(options.apiKey ?? undefined);
     const sourceHome = resolveSharedCodexHomeDir(env);
+    // Keyring credentials belong to the original Codex home. Changing CODEX_HOME
+    // when there is no file to share disconnects an otherwise logged-in CLI.
+    if (options.allowSharedHome !== false && !apiKey && !(await pathExists(path.join(sourceHome, "auth.json")))) {
+        await onLog("stdout", `[alvax] Using shared Codex home "${sourceHome}" for native credential storage.\n`);
+        return sourceHome;
+    }
     const seedFromShared = path.resolve(sourceHome) !== path.resolve(targetHome);
     await fs.mkdir(targetHome, { recursive: true });
     // If a previous run wrote an apikey-mode auth.json (regular file) and this
@@ -100,10 +94,6 @@ export async function prepareManagedCodexHome(env, onLog, companyId, options = {
         }
         await onLog("stdout", `[alvax] Using ${isWorktreeMode(env) ? "worktree-isolated" : "Alvax-managed"} Codex home "${targetHome}" (seeded from "${sourceHome}").\n`);
     }
-    if (apiKey) {
-        await writeApiKeyAuthJson(targetHome, apiKey);
-        await onLog("stdout", `[alvax] Wrote API-key auth.json into Codex home "${targetHome}" from configured OPENAI_API_KEY.\n`);
-    }
     return targetHome;
 }
 //# sourceMappingURL=codex-home.js.map

package/dist/server/codex-home.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-home.js","sourceRoot":"","sources":["../../src/server/codex-home.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAC3C,MAAM,mBAAmB,GAAG,CAAC,aAAa,EAAE,iBAAiB,CAAU,CAAC;AACxE,MAAM,sBAAsB,GAAG,CAAC,WAAW,EAAE,aAAa,CAAU,CAAC;AACrE,MAAM,yBAAyB,GAAG,SAAS,CAAC;AAE5C,SAAS,QAAQ,CAAC,KAAyB;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACpF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,SAAiB;IAChD,OAAO,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzC,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,cAAc,CAAC,GAAsB;IAC5C,OAAO,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,GAAsB,EACtB,SAAkB;IAElB,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;IACnF,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,yBAAyB,CAAC;IAChF,OAAO,SAAS;QACd,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,CAAC;QACxF,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,MAAc;IAC3C,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,MAAc;IACzD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;QAC/B,MAAM,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC/D,IAAI,CAAC,UAAU;QAAE,OAAO;IAExB,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC;IAC1E,IAAI,kBAAkB,KAAK,MAAM;QAAE,OAAO;IAE1C,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxB,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACnC,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,MAAc,EAAE,MAAc;IAC5D,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,QAAQ;QAAE,OAAO;IACrB,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAY,EAAE,MAAc;IACpE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC5C,MAAM,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrC,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAsB,EACtB,KAAuC,EACvC,SAAkB,EAClB,UAAsC,EAAE;IAExC,MAAM,UAAU,GAAG,0BAA0B,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC;IAErD,MAAM,UAAU,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;IAClD,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAE7E,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEhD,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,IAAI,CAAC,MAAM,IAAI,cAAc,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;YAC3C,MAAM,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,IAAI,cAAc,EAAE,CAAC;QACnB,KAAK,MAAM,IAAI,IAAI,sBAAsB,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YAC3C,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;gBAAE,SAAS;YAC1C,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3D,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,mBAAmB,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YAC3C,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;gBAAE,SAAS;YAC1C,MAAM,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,KAAK,CACT,QAAQ,EACR,iBAAiB,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,eAAe,gBAAgB,UAAU,mBAAmB,UAAU,OAAO,CAC3I,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,mBAAmB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,KAAK,CACT,QAAQ,EACR,oDAAoD,UAAU,qCAAqC,CACpG,CAAC;IACJ,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC"}
+{"version":3,"file":"codex-home.js","sourceRoot":"","sources":["../../src/server/codex-home.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAC3C,MAAM,mBAAmB,GAAG,CAAC,aAAa,EAAE,iBAAiB,CAAU,CAAC;AACxE,MAAM,sBAAsB,GAAG,CAAC,WAAW,EAAE,aAAa,CAAU,CAAC;AACrE,MAAM,yBAAyB,GAAG,SAAS,CAAC;AAE5C,SAAS,QAAQ,CAAC,KAAyB;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACpF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,SAAiB;IAChD,OAAO,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzC,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,cAAc,CAAC,GAAsB;IAC5C,OAAO,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,GAAsB,EACtB,SAAkB;IAElB,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;IACnF,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,yBAAyB,CAAC;IAChF,OAAO,SAAS;QACd,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,CAAC;QACxF,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,MAAc;IAC3C,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,MAAc;IACzD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;QAC/B,MAAM,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC/D,IAAI,CAAC,UAAU;QAAE,OAAO;IAExB,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC;IAC1E,IAAI,kBAAkB,KAAK,MAAM;QAAE,OAAO;IAE1C,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxB,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACnC,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,MAAc,EAAE,MAAc;IAC5D,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,QAAQ;QAAE,OAAO;IACrB,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAsB,EACtB,KAAuC,EACvC,SAAkB,EAClB,UAAiE,EAAE;IAEnE,MAAM,UAAU,GAAG,0BAA0B,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC;IAErD,MAAM,UAAU,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;IAClD,6EAA6E;IAC7E,yEAAyE;IACzE,IAAI,OAAO,CAAC,eAAe,KAAK,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5G,MAAM,KAAK,CAAC,QAAQ,EAAE,oCAAoC,UAAU,oCAAoC,CAAC,CAAC;QAC1G,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAE7E,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEhD,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,IAAI,CAAC,MAAM,IAAI,cAAc,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;YAC3C,MAAM,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,IAAI,cAAc,EAAE,CAAC;QACnB,KAAK,MAAM,IAAI,IAAI,sBAAsB,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YAC3C,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;gBAAE,SAAS;YAC1C,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3D,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,mBAAmB,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YAC3C,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;gBAAE,SAAS;YAC1C,MAAM,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,KAAK,CACT,QAAQ,EACR,iBAAiB,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,eAAe,gBAAgB,UAAU,mBAAmB,UAAU,OAAO,CAC3I,CAAC;IACJ,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/server/execute.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execute.d.ts","sourceRoot":"","sources":["../../src/server/execute.ts"],"names":[],"mappings":"AAGA,OAAO,EAA+B,KAAK,uBAAuB,EAAE,KAAK,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAuKjI,KAAK,gCAAgC,GAAG;IACtC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5E,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/D,CAAC;AAgDF,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,uBAAuB,CAAC,OAAO,CAAC,EACvC,OAAO,GAAE,gCAAqC,iBA6D/C;AAED,wBAAsB,OAAO,CAAC,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAujB3F"}
+{"version":3,"file":"execute.d.ts","sourceRoot":"","sources":["../../src/server/execute.ts"],"names":[],"mappings":"AAGA,OAAO,EAA+B,KAAK,uBAAuB,EAAE,KAAK,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAwKjI,KAAK,gCAAgC,GAAG;IACtC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5E,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/D,CAAC;AAgDF,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,uBAAuB,CAAC,OAAO,CAAC,EACvC,OAAO,GAAE,gCAAqC,iBA6D/C;AAED,wBAAsB,OAAO,CAAC,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAojB3F"}

package/dist/server/execute.js

@@ -8,6 +8,7 @@ import { parseCodexJsonl, extractCodexRetryNotBefore, isCodexTransientUpstreamEr
 import { pathExists, prepareManagedCodexHome, resolveManagedCodexHomeDir, resolveSharedCodexHomeDir } from "./codex-home.js";
 import { resolveCodexDesiredSkillNames } from "./skills.js";
 import { buildCodexExecArgs } from "./codex-args.js";
+import { assertCodexAuthMode, resolveCodexAuthEnv } from "./auth.js";
 import { SANDBOX_INSTALL_COMMAND } from "../index.js";
 const __moduleDir = path.dirname(fileURLToPath(import.meta.url));
 const CODEX_ROLLOUT_NOISE_RE = /^\d{4}-\d{2}-\d{2}T[^\s]+\s+ERROR\s+codex_core::rollout::list:\s+state db missing rollout path for thread\s+[a-z0-9-]+$/i;
@@ -38,7 +39,7 @@ function hasNonEmptyEnvValue(env, key) {
 }
 function resolveCodexBillingType(env) {
     // Codex uses API-key auth when OPENAI_API_KEY is present; otherwise rely on local login/session auth.
-    return hasNonEmptyEnvValue(env, "OPENAI_API_KEY") ? "api" : "subscription";
+    return (hasNonEmptyEnvValue(env, "CODEX_API_KEY") || hasNonEmptyEnvValue(env, "OPENAI_API_KEY")) ? "api" : "subscription";
 }
 function resolveCodexBiller(env, billingType) {
     const openAiCompatibleBiller = inferOpenAiCompatibleBiller(env, "openai");
@@ -209,25 +210,23 @@ export async function execute(ctx) {
     const useConfiguredInsteadOfAgentHome = workspaceSource === "agent_home" && configuredCwd.length > 0;
     const effectiveWorkspaceCwd = useConfiguredInsteadOfAgentHome ? "" : workspaceCwd;
     const cwd = effectiveWorkspaceCwd || configuredCwd || process.cwd();
-    const envConfig = parseObject(config.env);
     const executionTarget = readAdapterExecutionTarget({
         executionTarget: ctx.executionTarget,
         legacyRemoteExecution: ctx.executionTransport?.remoteExecution,
     });
     const executionTargetIsRemote = adapterExecutionTargetIsRemote(executionTarget);
+    const envConfig = resolveCodexAuthEnv(config, executionTargetIsRemote ? {} : process.env);
     const configuredCodexHome = typeof envConfig.CODEX_HOME === "string" && envConfig.CODEX_HOME.trim().length > 0
         ? path.resolve(envConfig.CODEX_HOME.trim())
         : null;
     const codexSkillEntries = await readAlvaxRuntimeSkillEntries(config, __moduleDir);
     const desiredSkillNames = resolveCodexDesiredSkillNames(config, codexSkillEntries);
     await ensureAbsoluteDirectory(cwd, { createIfMissing: true });
-    const configuredOpenAiApiKey = typeof envConfig.OPENAI_API_KEY === "string" && envConfig.OPENAI_API_KEY.trim().length > 0
-        ? envConfig.OPENAI_API_KEY.trim()
-        : null;
     const preparedManagedCodexHome = configuredCodexHome
         ? null
         : await prepareManagedCodexHome(process.env, onLog, agent.companyId, {
-            apiKey: configuredOpenAiApiKey,
+            apiKey: envConfig.CODEX_API_KEY,
+            allowSharedHome: !executionTargetIsRemote,
         });
     const defaultCodexHome = resolveManagedCodexHomeDir(process.env, agent.companyId);
     const effectiveCodexHome = configuredCodexHome ?? preparedManagedCodexHome ?? defaultCodexHome;
@@ -375,7 +374,7 @@ export async function execute(ctx) {
         }
     }
     const effectiveEnv = Object.fromEntries(Object.entries({ ...process.env, ...env }).filter((entry) => typeof entry[1] === "string"));
-    const billingType = resolveCodexBillingType(effectiveEnv);
+    const billingType = config.authMode === "api_key" ? "api" : resolveCodexBillingType(effectiveEnv);
     const runtimeEnv = Object.fromEntries(Object.entries(ensurePathInEnv(effectiveEnv)).filter((entry) => typeof entry[1] === "string"));
     await ensureAdapterExecutionTargetRuntimeCommandInstalled({
         runId,
@@ -551,6 +550,7 @@ export async function execute(ctx) {
                 context,
             });
         }
+        await assertCodexAuthMode(config, { command, cwd, env, target: executionTarget, runId });
         const proc = await runAdapterExecutionTargetProcess(runId, executionTarget, command, args, {
             cwd,
             env,