@demicodes/provider-codex 0.3.2 → 0.4.1

package/dist/index.d.mts

@@ -2,6 +2,23 @@ import { ModelPolicy, Provider, ProviderAuthState, ProviderCredentials, Provider
 import { FileCredentialPool } from "@demicodes/provider/credentials-pool";
 import "@demicodes/core";
 //#region src/auth.d.ts
+type CodexAuthMode = 'apiKey' | 'chatgpt' | 'chatgptAuthTokens' | 'agentIdentity' | 'personalAccessToken' | 'bedrockApiKey';
+interface CodexTokenData {
+  id_token?: string | Record<string, unknown>;
+  access_token?: string;
+  refresh_token?: string;
+  account_id?: string | null;
+}
+interface CodexAuthDotJson {
+  auth_mode?: CodexAuthMode;
+  OPENAI_API_KEY?: string | null;
+  tokens?: CodexTokenData | null;
+  last_refresh?: string | null;
+  agent_identity?: unknown;
+  personal_access_token?: string | null;
+  bedrock_api_key?: unknown;
+  [key: string]: unknown;
+}
 type CodexResolvedAuth = {
   kind: 'chatgpt';
   mode: 'chatgpt' | 'chatgptAuthTokens';
@@ -142,13 +159,29 @@ declare class PoolAwareCodexAuthStore implements CodexAuthStore {
 }
 declare function createCodexCredentials(pool: FileCredentialPool, authStore: CodexAuthStore, options?: {
   codexHome?: string;
-  loginCommand?: string;
-  loginArgs?: string[];
   quota?: ProviderQuota | null;
   onActiveChange?: () => void;
+  /** Injectable fetch for the device-code login flow (tests). */
+  loginFetch?: typeof fetch;
 }): ProviderCredentials;
 declare function openCodexCredentialPool(options?: {
   stateDir?: string;
 }): FileCredentialPool;
 //#endregion
-export { type CodexModelCatalogOptions, type CodexProviderOptions, type CodexQuotaOptions, type CodexResolvedAuth, type CodexTransportMode, type FileCodexAuthStoreOptions, PoolAwareCodexAuthStore, codexAuthStatus, createCodexCredentials, createCodexProvider, createCodexQuota, listCodexModels, mapCodexRateLimitHeaders, openCodexCredentialPool };
+//#region src/device-login.d.ts
+interface CodexDeviceLoginPending {
+  verificationUrl: string;
+  userCode: string;
+  expiresAt: string;
+}
+interface CodexDeviceLoginOptions {
+  signal?: AbortSignal;
+  /** Fires once with the URL + one-time code the user needs. */
+  onPending?: (pending: CodexDeviceLoginPending) => void;
+  fetch?: typeof fetch;
+  issuer?: string;
+}
+/** Runs the full device-code flow and returns vendor-shaped auth material. */
+declare function runCodexDeviceLogin(options?: CodexDeviceLoginOptions): Promise<CodexAuthDotJson>;
+//#endregion
+export { type CodexDeviceLoginOptions, type CodexDeviceLoginPending, type CodexModelCatalogOptions, type CodexProviderOptions, type CodexQuotaOptions, type CodexResolvedAuth, type CodexTransportMode, type FileCodexAuthStoreOptions, PoolAwareCodexAuthStore, codexAuthStatus, createCodexCredentials, createCodexProvider, createCodexQuota, listCodexModels, mapCodexRateLimitHeaders, openCodexCredentialPool, runCodexDeviceLogin };

package/dist/index.mjs

@@ -3,8 +3,8 @@ import { Buffer } from "node:buffer";
 import { chmod, mkdir, open, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
-import { applyModelPolicy, clampPromptCacheKey, clampUsedPercent, createProviderQuota, defineProvider, httpErrorCode, numberHeader, redactCredentialText, severityFromUsedPercent, unixSecondsToIso } from "@demicodes/provider";
-import { FileCredentialPool, credentialIdFromIdentity, runVendorLoginCommand } from "@demicodes/provider/credentials-pool";
+import { applyModelPolicy, clampPromptCacheKey, clampUsedPercent, createProviderQuota, defineProvider, httpErrorCode, normalizeErrorCode, numberHeader, redactCredentialText, severityFromUsedPercent, unixSecondsToIso } from "@demicodes/provider";
+import { FileCredentialPool, credentialIdFromIdentity } from "@demicodes/provider/credentials-pool";
 import { randomUUID } from "node:crypto";
 //#region src/auth.ts
 async function codexAuthStatus(options = {}) {
@@ -15,8 +15,12 @@ const SECRET_FIELD_PATTERNS = ["OPENAI_API_KEY"];
 function redactCodexSecretText(text) {
 	return redactCredentialText(text, SECRET_FIELD_PATTERNS);
 }
-const TOKEN_REFRESH_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+const CODEX_OAUTH_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 const TOKEN_REFRESH_URL = "https://auth.openai.com/oauth/token";
+/** OAuth client id shared by token refresh and device-code login. */
+function codexOauthClientId() {
+	return process.env.CODEX_APP_SERVER_LOGIN_CLIENT_ID || CODEX_OAUTH_CLIENT_ID;
+}
 const REFRESH_EXPIRY_SKEW_MS = 300 * 1e3;
 const REFRESH_STALENESS_MS = 11520 * 60 * 1e3;
 var FileCodexAuthStore = class {
@@ -218,7 +222,7 @@ async function refreshCodexToken(refreshToken, signal) {
 		method: "POST",
 		headers: { "content-type": "application/json" },
 		body: JSON.stringify({
-			client_id: process.env.CODEX_APP_SERVER_LOGIN_CLIENT_ID || TOKEN_REFRESH_CLIENT_ID,
+			client_id: codexOauthClientId(),
 			grant_type: "refresh_token",
 			refresh_token: refreshToken
 		}),
@@ -501,6 +505,113 @@ function defaultModelCatalogUserAgent() {
 	return `demi-provider-codex/0.0.0`;
 }
 //#endregion
+//#region src/device-login.ts
+const DEVICE_LOGIN_ISSUER = "https://auth.openai.com";
+const DEVICE_LOGIN_MAX_WAIT_MS = 900 * 1e3;
+const DEVICE_LOGIN_FALLBACK_INTERVAL_S = 5;
+async function postJson(fetchImpl, url, body, signal) {
+	return fetchImpl(url, {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify(body),
+		signal
+	});
+}
+async function jsonBody(response, what) {
+	const body = await response.json().catch(() => null);
+	if (!isRecord(body)) throw new CodexAuthError("auth_login_failed", `${what} response is not a JSON object`);
+	return body;
+}
+async function requestUserCode(fetchImpl, issuer, clientId, signal) {
+	const response = await postJson(fetchImpl, `${issuer}/api/accounts/deviceauth/usercode`, { client_id: clientId }, signal);
+	if (response.status === 404) throw new CodexAuthError("auth_unsupported", "Device-code login is not enabled for this Codex account");
+	if (!response.ok) throw new CodexAuthError("auth_login_failed", `Device code request failed with HTTP ${response.status}`);
+	const body = await jsonBody(response, "Device code");
+	const deviceAuthId = nonEmptyString(body.device_auth_id);
+	const userCode = nonEmptyString(body.user_code) ?? nonEmptyString(body.usercode);
+	if (!deviceAuthId || !userCode) throw new CodexAuthError("auth_login_failed", "Device code response is missing device_auth_id or user_code");
+	const interval = Number(typeof body.interval === "string" ? body.interval.trim() : body.interval);
+	return {
+		deviceAuthId,
+		userCode,
+		intervalSeconds: Number.isFinite(interval) && interval >= 0 ? interval : DEVICE_LOGIN_FALLBACK_INTERVAL_S
+	};
+}
+async function pollForAuthorization(fetchImpl, issuer, userCode, startedAt, signal) {
+	for (;;) {
+		signal?.throwIfAborted();
+		const response = await postJson(fetchImpl, `${issuer}/api/accounts/deviceauth/token`, {
+			device_auth_id: userCode.deviceAuthId,
+			user_code: userCode.userCode
+		}, signal);
+		if (response.ok) {
+			const body = await jsonBody(response, "Device authorization");
+			const authorizationCode = nonEmptyString(body.authorization_code);
+			const codeVerifier = nonEmptyString(body.code_verifier);
+			if (!authorizationCode || !codeVerifier) throw new CodexAuthError("auth_login_failed", "Device authorization response is missing authorization_code or code_verifier");
+			return {
+				authorizationCode,
+				codeVerifier
+			};
+		}
+		if (response.status !== 403 && response.status !== 404) throw new CodexAuthError("auth_login_failed", `Device authorization failed with HTTP ${response.status}`);
+		if (Date.now() - startedAt >= DEVICE_LOGIN_MAX_WAIT_MS) throw new CodexAuthError("auth_login_failed", "Device-code login timed out after 15 minutes");
+		await delay(userCode.intervalSeconds * 1e3);
+	}
+}
+async function exchangeAuthorizationCode(fetchImpl, issuer, clientId, authorization, signal) {
+	const params = new URLSearchParams({
+		grant_type: "authorization_code",
+		code: authorization.authorizationCode,
+		redirect_uri: `${issuer}/deviceauth/callback`,
+		client_id: clientId,
+		code_verifier: authorization.codeVerifier
+	});
+	const response = await fetchImpl(`${issuer}/oauth/token`, {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded" },
+		body: params.toString(),
+		signal
+	});
+	if (!response.ok) throw new CodexAuthError("auth_login_failed", `Device-code token exchange failed with HTTP ${response.status}`);
+	const body = await jsonBody(response, "Token exchange");
+	const idToken = nonEmptyString(body.id_token);
+	const accessToken = nonEmptyString(body.access_token);
+	const refreshToken = nonEmptyString(body.refresh_token);
+	if (!idToken || !accessToken || !refreshToken) throw new CodexAuthError("auth_login_failed", "Token exchange response is missing id_token, access_token, or refresh_token");
+	return {
+		idToken,
+		accessToken,
+		refreshToken
+	};
+}
+/** Runs the full device-code flow and returns vendor-shaped auth material. */
+async function runCodexDeviceLogin(options = {}) {
+	const fetchImpl = options.fetch ?? fetch;
+	const issuer = (options.issuer ?? DEVICE_LOGIN_ISSUER).replace(/\/+$/, "");
+	const clientId = codexOauthClientId();
+	const startedAt = Date.now();
+	const userCode = await requestUserCode(fetchImpl, issuer, clientId, options.signal);
+	options.onPending?.({
+		verificationUrl: `${issuer}/codex/device`,
+		userCode: userCode.userCode,
+		expiresAt: new Date(startedAt + DEVICE_LOGIN_MAX_WAIT_MS).toISOString()
+	});
+	const tokens = await exchangeAuthorizationCode(fetchImpl, issuer, clientId, await pollForAuthorization(fetchImpl, issuer, userCode, startedAt, options.signal), options.signal);
+	const accountId = parseChatGptClaims(tokens.accessToken).accountId ?? parseIdTokenClaims(tokens.idToken).accountId;
+	return {
+		auth_mode: "chatgpt",
+		OPENAI_API_KEY: null,
+		tokens: {
+			id_token: tokens.idToken,
+			access_token: tokens.accessToken,
+			refresh_token: tokens.refreshToken,
+			account_id: accountId
+		},
+		last_refresh: (/* @__PURE__ */ new Date()).toISOString()
+	};
+}
+//#endregion
 //#region src/credentials.ts
 /**
 * Auth store that prefers the demi pool active entry; falls back to vendor ~/.codex.
@@ -536,8 +647,6 @@ var PoolAwareCodexAuthStore = class {
 };
 function createCodexCredentials(pool, authStore, options = {}) {
 	const vendorHome = options.codexHome ?? defaultCodexHome();
-	const loginCommand = options.loginCommand ?? "codex";
-	const loginArgs = options.loginArgs ?? ["login"];
 	const capability = () => ({
 		mode: "supported",
 		canBeginLogin: true,
@@ -593,17 +702,27 @@ function createCodexCredentials(pool, authStore, options = {}) {
 		getActive,
 		setActive,
 		beginLogin: async (loginOptions) => {
-			const result = await runVendorLoginCommand(loginCommand, loginArgs, { signal: loginOptions?.signal });
-			if (result.status === "completed") return { status: "completed" };
-			if (result.status === "cancelled") return { status: "cancelled" };
-			if (result.status === "unavailable") return {
-				status: "unavailable",
-				message: result.message ?? "Login unavailable"
-			};
-			return {
-				status: "failed",
-				message: result.message ?? "Login failed"
-			};
+			try {
+				const auth = await runCodexDeviceLogin({
+					signal: loginOptions?.signal,
+					onPending: loginOptions?.onPending,
+					fetch: options.loginFetch
+				});
+				return {
+					status: "completed",
+					credentialId: (await importFromAuthJson(`${JSON.stringify(auth, null, 2)}\n`, "login:device")).id
+				};
+			} catch (error) {
+				if (loginOptions?.signal?.aborted) return { status: "cancelled" };
+				if (error instanceof CodexAuthError && error.code === "auth_unsupported") return {
+					status: "unavailable",
+					message: error.message
+				};
+				return {
+					status: "failed",
+					message: errorMessage(error)
+				};
+			}
 		},
 		importDefault: async () => {
 			const authFile = join(vendorHome, "auth.json");
@@ -1081,14 +1200,6 @@ function errorEventFromFailedResponse(response) {
 		code: normalizeErrorCode(stringOrNull(error?.code) ?? stringOrNull(error?.type), message)
 	};
 }
-function normalizeErrorCode(code, message) {
-	const value = `${code ?? ""} ${message}`.toLowerCase();
-	if (/context|maximum context|too long|max.*token/.test(value)) return "context_length_exceeded";
-	if (/rate|quota|usage|limit|billing|balance/.test(value)) return "rate_limit";
-	if (/unauth|auth|expired|invalid.*token/.test(value)) return "auth_expired";
-	if (/overload|unavailable|timeout/.test(value)) return "overloaded";
-	return code;
-}
 function incompleteReason(response) {
 	if (isRecord(response) && isRecord(response.incomplete_details) && typeof response.incomplete_details.reason === "string") return response.incomplete_details.reason;
 	return "unknown";
@@ -1582,10 +1693,11 @@ function providerErrorFromUnknown(error) {
 		message: redactCodexSecretText(error.message),
 		code: httpErrorCode(error.status, error.message)
 	};
+	const message = error instanceof Error ? error.message : String(error);
 	return {
 		type: "error",
-		message: redactCodexSecretText(error instanceof Error ? error.message : String(error)),
-		code: null
+		message: redactCodexSecretText(message),
+		code: normalizeErrorCode(null, message)
 	};
 }
 function isRetryableHttpStatus(status) {
@@ -1605,4 +1717,4 @@ function sleep(ms, signal) {
 	});
 }
 //#endregion
-export { PoolAwareCodexAuthStore, codexAuthStatus, createCodexCredentials, createCodexProvider, createCodexQuota, listCodexModels, mapCodexRateLimitHeaders, openCodexCredentialPool };
+export { PoolAwareCodexAuthStore, codexAuthStatus, createCodexCredentials, createCodexProvider, createCodexQuota, listCodexModels, mapCodexRateLimitHeaders, openCodexCredentialPool, runCodexDeviceLogin };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@demicodes/provider-codex",
   "description": "Codex provider adapter for Demi.",
-  "version": "0.3.2",
+  "version": "0.4.1",
   "private": false,
   "type": "module",
   "exports": {
@@ -12,11 +12,11 @@
   },
   "dependencies": {
     "@demicodes/core": "^0.3.2",
-    "@demicodes/provider": "^0.3.2",
+    "@demicodes/provider": "^0.4.2",
     "@demicodes/utils": "^0.3.2"
   },
   "devDependencies": {
-    "@demicodes/agent": "^0.3.2",
+    "@demicodes/agent": "^0.3.3",
     "@demicodes/shell": "^0.3.2"
   },
   "license": "Apache-2.0",