@elizaos/agent 2.0.0-alpha.98 → 2.0.0-beta.1

package/dist/packages/agent/src/auth/types.js

@@ -0,0 +1,149 @@
+/**
+ * Subscription auth types for eliza.
+ */
+export const SUBSCRIPTION_PROVIDER_IDS = [
+    "anthropic-subscription",
+    "openai-codex",
+    "gemini-cli",
+    "zai-coding",
+    "kimi-coding",
+    "deepseek-coding",
+];
+export const OAUTH_SUBSCRIPTION_PROVIDER_IDS = [
+    "anthropic-subscription",
+    "openai-codex",
+];
+export const CODING_PLAN_KEY_SUBSCRIPTION_PROVIDER_IDS = [
+    "zai-coding",
+    "kimi-coding",
+];
+export const EXTERNAL_CLI_SUBSCRIPTION_PROVIDER_IDS = [
+    "gemini-cli",
+];
+export const UNAVAILABLE_SUBSCRIPTION_PROVIDER_IDS = [
+    "deepseek-coding",
+];
+export const DIRECT_ACCOUNT_PROVIDER_IDS = [
+    "anthropic-api",
+    "openai-api",
+    "deepseek-api",
+    "zai-api",
+    "moonshot-api",
+];
+export const ACCOUNT_CREDENTIAL_PROVIDER_IDS = [
+    ...SUBSCRIPTION_PROVIDER_IDS,
+    ...DIRECT_ACCOUNT_PROVIDER_IDS,
+];
+export function isSubscriptionProvider(value) {
+    return SUBSCRIPTION_PROVIDER_IDS.includes(value);
+}
+export function isOAuthSubscriptionProvider(value) {
+    return OAUTH_SUBSCRIPTION_PROVIDER_IDS.includes(value);
+}
+export function isCodingPlanKeySubscriptionProvider(value) {
+    return CODING_PLAN_KEY_SUBSCRIPTION_PROVIDER_IDS.includes(value);
+}
+export function isExternalCliSubscriptionProvider(value) {
+    return EXTERNAL_CLI_SUBSCRIPTION_PROVIDER_IDS.includes(value);
+}
+export function isUnavailableSubscriptionProvider(value) {
+    return UNAVAILABLE_SUBSCRIPTION_PROVIDER_IDS.includes(value);
+}
+export function isAccountCredentialProvider(value) {
+    return ACCOUNT_CREDENTIAL_PROVIDER_IDS.includes(value);
+}
+export const DIRECT_ACCOUNT_PROVIDER_ENV = {
+    "anthropic-api": "ANTHROPIC_API_KEY",
+    "openai-api": "OPENAI_API_KEY",
+    "deepseek-api": "DEEPSEEK_API_KEY",
+    "zai-api": "ZAI_API_KEY",
+    "moonshot-api": "MOONSHOT_API_KEY",
+};
+/** Maps subscription provider IDs to their model provider short names. */
+export const SUBSCRIPTION_PROVIDER_MAP = {
+    "anthropic-subscription": "anthropic",
+    "openai-codex": "codex-cli",
+    "gemini-cli": "gemini-cli",
+    "zai-coding": "zai-coding",
+    "kimi-coding": "kimi-coding",
+    "deepseek-coding": "deepseek-coding",
+};
+export const CODING_PLAN_PROVIDER_BASE_URL = {
+    "zai-coding": "https://api.z.ai/api/coding/paas/v4",
+    "kimi-coding": "https://api.kimi.com/coding/v1",
+};
+export const SUBSCRIPTION_PROVIDER_METADATA = {
+    "anthropic-subscription": {
+        providerId: "anthropic-subscription",
+        displayName: "Claude Subscription",
+        selectionIds: ["anthropic-subscription"],
+        allowedClient: "Claude Code CLI",
+        billingMode: "subscription-coding-cli",
+        authMode: "oauth",
+        availability: "available",
+        setupHint: "Sign in through the app or run claude auth login.",
+        directProviderId: "anthropic-api",
+    },
+    "openai-codex": {
+        providerId: "openai-codex",
+        displayName: "OpenAI Codex",
+        selectionIds: ["openai-subscription"],
+        allowedClient: "Codex CLI / Codex-backed provider",
+        billingMode: "subscription-coding-cli",
+        authMode: "oauth",
+        availability: "available",
+        setupHint: "Sign in through the app or run codex login.",
+        directProviderId: "openai-api",
+    },
+    "gemini-cli": {
+        providerId: "gemini-cli",
+        displayName: "Gemini CLI",
+        selectionIds: ["gemini-subscription"],
+        allowedClient: "Gemini CLI",
+        billingMode: "subscription-coding-cli",
+        authMode: "external-cli",
+        availability: "external",
+        setupHint: "Run gemini auth login; tokens are not imported into API env vars.",
+    },
+    "zai-coding": {
+        providerId: "zai-coding",
+        displayName: "z.ai Coding Plan",
+        selectionIds: ["zai-coding-subscription"],
+        allowedClient: "z.ai Coding endpoint",
+        billingMode: "subscription-coding-plan",
+        authMode: "coding-plan-key",
+        availability: "available",
+        setupHint: "Add a z.ai Coding Plan credential for the dedicated coding endpoint.",
+        directProviderId: "zai-api",
+        defaultBaseUrl: CODING_PLAN_PROVIDER_BASE_URL["zai-coding"],
+        probePath: "/models",
+    },
+    "kimi-coding": {
+        providerId: "kimi-coding",
+        displayName: "Kimi Code",
+        selectionIds: ["kimi-coding-subscription"],
+        allowedClient: "Kimi Code endpoint",
+        billingMode: "subscription-coding-plan",
+        authMode: "coding-plan-key",
+        availability: "available",
+        setupHint: "Add a Kimi Code credential for the dedicated coding endpoint.",
+        directProviderId: "moonshot-api",
+        defaultBaseUrl: CODING_PLAN_PROVIDER_BASE_URL["kimi-coding"],
+        probePath: "/models",
+    },
+    "deepseek-coding": {
+        providerId: "deepseek-coding",
+        displayName: "DeepSeek Coding Plan",
+        selectionIds: ["deepseek-coding-subscription"],
+        allowedClient: "Unavailable",
+        billingMode: "subscription-coding-plan",
+        authMode: "unavailable",
+        availability: "unavailable",
+        setupHint: "Use the DeepSeek direct API-key provider if you have API billing.",
+        directProviderId: "deepseek-api",
+        availabilityReason: "No first-party DeepSeek coding subscription surface is available to integrate without substituting general API billing.",
+    },
+};
+export function getSubscriptionProviderMetadata(provider) {
+    return SUBSCRIPTION_PROVIDER_METADATA[provider];
+}

package/dist/packages/agent/src/auth/vendor/pi-oauth/anthropic-login.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Anthropic OAuth (Claude Pro/Max) — authorization code + PKCE.
+ * Inlined OAuth flow (MIT) — vendored to avoid a runtime dependency.
+ *
+ * Anthropic's OAuth uses a fixed redirect URI on `console.anthropic.com`
+ * that displays the auth code on completion — there's no loopback
+ * listener. The flow surfaces an `authUrl` plus a `submitCode()` hook
+ * the UI / CLI calls once the user has copied the code.
+ */
+export interface AnthropicOAuthCredentials {
+    refresh: string;
+    access: string;
+    expires: number;
+}
+/**
+ * Programmatic Anthropic OAuth flow.
+ *
+ * `authUrl` is ready immediately. The caller MUST eventually call
+ * either `submitCode(code)` (after the user has pasted the
+ * `code#state` blob from the redirect page) or `cancel()`. The
+ * `completion` promise rejects if the flow is cancelled.
+ */
+export interface AnthropicOAuthFlowHandle {
+    authUrl: string;
+    /** Pass `code#state` from the redirect page. */
+    submitCode: (code: string) => void;
+    /** Resolves with credentials once `submitCode` lands and the token exchange succeeds. */
+    completion: Promise<AnthropicOAuthCredentials>;
+    cancel: (reason?: string) => void;
+}
+/**
+ * Start an Anthropic OAuth flow. Returns immediately with the auth
+ * URL and a `submitCode` hook. The token exchange happens inside
+ * `completion` once the caller submits the code.
+ */
+export declare function startAnthropicOAuthFlowRaw(): Promise<AnthropicOAuthFlowHandle>;
+/**
+ * @param onAuthUrl - Receives the browser authorization URL
+ * @param onPromptCode - Resolves with pasted code (format: code#state)
+ *
+ * Thin compatibility wrapper around `startAnthropicOAuthFlowRaw` for
+ * the CLI entrypoint and any older callers. New code should use
+ * `startAnthropicOAuthFlowRaw` (or the higher-level
+ * `startAnthropicOAuthFlow` in `auth/oauth-flow.ts`) directly.
+ */
+export declare function loginAnthropic(onAuthUrl: (url: string) => void, onPromptCode: () => Promise<string>): Promise<AnthropicOAuthCredentials>;
+export declare function refreshAnthropicToken(refreshToken: string): Promise<AnthropicOAuthCredentials>;
+//# sourceMappingURL=anthropic-login.d.ts.map

package/dist/packages/agent/src/auth/vendor/pi-oauth/anthropic-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"anthropic-login.d.ts","sourceRoot":"","sources":["../../../../../../../src/auth/vendor/pi-oauth/anthropic-login.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAWH,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,yFAAyF;IACzF,UAAU,EAAE,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAC/C,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC;AAED;;;;GAIG;AACH,wBAAsB,0BAA0B,IAAI,OAAO,CAAC,wBAAwB,CAAC,CA6DpF;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAChC,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,GAClC,OAAO,CAAC,yBAAyB,CAAC,CAMpC;AAED,wBAAsB,qBAAqB,CACzC,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,yBAAyB,CAAC,CAwBpC"}

package/dist/packages/agent/src/auth/vendor/pi-oauth/anthropic-login.js

@@ -0,0 +1,113 @@
+/**
+ * Anthropic OAuth (Claude Pro/Max) — authorization code + PKCE.
+ * Inlined OAuth flow (MIT) — vendored to avoid a runtime dependency.
+ *
+ * Anthropic's OAuth uses a fixed redirect URI on `console.anthropic.com`
+ * that displays the auth code on completion — there's no loopback
+ * listener. The flow surfaces an `authUrl` plus a `submitCode()` hook
+ * the UI / CLI calls once the user has copied the code.
+ */
+import { generatePKCE } from "./pkce.js";
+const decode = (s) => atob(s);
+const CLIENT_ID = decode("OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl");
+const AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
+const TOKEN_URL = "https://console.anthropic.com/v1/oauth/token";
+const REDIRECT_URI = "https://console.anthropic.com/oauth/code/callback";
+const SCOPES = "org:create_api_key user:profile user:inference";
+/**
+ * Start an Anthropic OAuth flow. Returns immediately with the auth
+ * URL and a `submitCode` hook. The token exchange happens inside
+ * `completion` once the caller submits the code.
+ */
+export async function startAnthropicOAuthFlowRaw() {
+    const { verifier, challenge } = await generatePKCE();
+    const authParams = new URLSearchParams({
+        code: "true",
+        client_id: CLIENT_ID,
+        response_type: "code",
+        redirect_uri: REDIRECT_URI,
+        scope: SCOPES,
+        code_challenge: challenge,
+        code_challenge_method: "S256",
+        state: verifier,
+    });
+    const authUrl = `${AUTHORIZE_URL}?${authParams.toString()}`;
+    let resolveCode = null;
+    let rejectCode = null;
+    const codePromise = new Promise((resolve, reject) => {
+        resolveCode = resolve;
+        rejectCode = reject;
+    });
+    const completion = (async () => {
+        const authCode = await codePromise;
+        const splits = authCode.split("#");
+        const code = splits[0];
+        const state = splits[1];
+        const tokenResponse = await fetch(TOKEN_URL, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                grant_type: "authorization_code",
+                client_id: CLIENT_ID,
+                code,
+                state,
+                redirect_uri: REDIRECT_URI,
+                code_verifier: verifier,
+            }),
+        });
+        if (!tokenResponse.ok) {
+            const errText = await tokenResponse.text();
+            throw new Error(`Token exchange failed: ${errText}`);
+        }
+        const tokenData = (await tokenResponse.json());
+        const expiresAt = Date.now() + tokenData.expires_in * 1000 - 5 * 60 * 1000;
+        return {
+            refresh: tokenData.refresh_token,
+            access: tokenData.access_token,
+            expires: expiresAt,
+        };
+    })();
+    return {
+        authUrl,
+        submitCode: (code) => resolveCode?.(code),
+        completion,
+        cancel: (reason = "Cancelled") => rejectCode?.(new Error(reason)),
+    };
+}
+/**
+ * @param onAuthUrl - Receives the browser authorization URL
+ * @param onPromptCode - Resolves with pasted code (format: code#state)
+ *
+ * Thin compatibility wrapper around `startAnthropicOAuthFlowRaw` for
+ * the CLI entrypoint and any older callers. New code should use
+ * `startAnthropicOAuthFlowRaw` (or the higher-level
+ * `startAnthropicOAuthFlow` in `auth/oauth-flow.ts`) directly.
+ */
+export async function loginAnthropic(onAuthUrl, onPromptCode) {
+    const handle = await startAnthropicOAuthFlowRaw();
+    onAuthUrl(handle.authUrl);
+    const code = await onPromptCode();
+    handle.submitCode(code);
+    return handle.completion;
+}
+export async function refreshAnthropicToken(refreshToken) {
+    const response = await fetch(TOKEN_URL, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+            grant_type: "refresh_token",
+            client_id: CLIENT_ID,
+            refresh_token: refreshToken,
+        }),
+    });
+    if (!response.ok) {
+        const errText = await response.text();
+        throw new Error(`Anthropic token refresh failed: ${errText}`);
+    }
+    const data = (await response.json());
+    return {
+        refresh: data.refresh_token,
+        access: data.access_token,
+        expires: Date.now() + data.expires_in * 1000 - 5 * 60 * 1000,
+    };
+}

package/dist/packages/agent/src/auth/vendor/pi-oauth/openai-codex-login.d.ts

@@ -0,0 +1,26 @@
+/**
+ * OpenAI Codex (ChatGPT OAuth) — local callback on :1455 + PKCE.
+ * Inlined OAuth flow (MIT) — vendored to avoid a runtime dependency.
+ */
+export interface OpenAiCodexOAuthCredentials {
+    access: string;
+    refresh: string;
+    expires: number;
+    accountId: string;
+}
+export interface OAuthPrompt {
+    message: string;
+    placeholder?: string;
+}
+export declare function loginOpenAICodex(options: {
+    onAuth: (info: {
+        url: string;
+        instructions?: string;
+    }) => void;
+    onPrompt: (prompt: OAuthPrompt) => Promise<string>;
+    onProgress?: (message: string) => void;
+    onManualCodeInput?: () => Promise<string>;
+    originator?: string;
+}): Promise<OpenAiCodexOAuthCredentials>;
+export declare function refreshOpenAICodexToken(refreshToken: string): Promise<OpenAiCodexOAuthCredentials>;
+//# sourceMappingURL=openai-codex-login.d.ts.map

package/dist/packages/agent/src/auth/vendor/pi-oauth/openai-codex-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openai-codex-login.d.ts","sourceRoot":"","sources":["../../../../../../../src/auth/vendor/pi-oauth/openai-codex-login.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAsCH,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAgRD,wBAAsB,gBAAgB,CAAC,OAAO,EAAE;IAC9C,MAAM,EAAE,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IAC/D,QAAQ,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACnD,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAmFvC;AAED,wBAAsB,uBAAuB,CAC3C,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,2BAA2B,CAAC,CAetC"}

package/dist/packages/agent/src/auth/vendor/pi-oauth/openai-codex-login.js

@@ -0,0 +1,343 @@
+/**
+ * OpenAI Codex (ChatGPT OAuth) — local callback on :1455 + PKCE.
+ * Inlined OAuth flow (MIT) — vendored to avoid a runtime dependency.
+ */
+let _randomBytes = null;
+let _http = null;
+if (typeof process !== "undefined" &&
+    (process.versions?.node || process.versions?.bun)) {
+    void import("node:crypto").then((m) => {
+        _randomBytes = m.randomBytes;
+    });
+    void import("node:http").then((m) => {
+        _http = m;
+    });
+}
+import { logger } from "@elizaos/core";
+import { generatePKCE } from "./pkce.js";
+const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+const AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize";
+const TOKEN_URL = "https://auth.openai.com/oauth/token";
+const REDIRECT_URI = "http://localhost:1455/auth/callback";
+const SCOPE = "openid profile email offline_access";
+const JWT_CLAIM_PATH = "https://api.openai.com/auth";
+const SUCCESS_HTML = `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>Authentication successful</title>
+</head>
+<body>
+  <p>Authentication successful. Return to your terminal to continue.</p>
+</body>
+</html>`;
+function createState() {
+    if (!_randomBytes) {
+        throw new Error("OpenAI Codex OAuth is only available in Node.js environments");
+    }
+    return _randomBytes(16).toString("hex");
+}
+function parseAuthorizationInput(input) {
+    const value = input.trim();
+    if (!value)
+        return {};
+    try {
+        const url = new URL(value);
+        return {
+            code: url.searchParams.get("code") ?? undefined,
+            state: url.searchParams.get("state") ?? undefined,
+        };
+    }
+    catch {
+        /* not a URL */
+    }
+    if (value.includes("#")) {
+        const [code, state] = value.split("#", 2);
+        return { code, state };
+    }
+    if (value.includes("code=")) {
+        const params = new URLSearchParams(value);
+        return {
+            code: params.get("code") ?? undefined,
+            state: params.get("state") ?? undefined,
+        };
+    }
+    return { code: value };
+}
+function decodeJwt(token) {
+    try {
+        const parts = token.split(".");
+        if (parts.length !== 3)
+            return null;
+        const payload = parts[1] ?? "";
+        const decoded = atob(payload);
+        return JSON.parse(decoded);
+    }
+    catch {
+        return null;
+    }
+}
+async function exchangeAuthorizationCode(code, verifier, redirectUri = REDIRECT_URI) {
+    const response = await fetch(TOKEN_URL, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+            grant_type: "authorization_code",
+            client_id: CLIENT_ID,
+            code,
+            code_verifier: verifier,
+            redirect_uri: redirectUri,
+        }),
+    });
+    if (!response.ok) {
+        const text = await response.text().catch(() => "");
+        logger.error(`[openai-codex] code->token failed: ${response.status} ${text}`);
+        return { type: "failed" };
+    }
+    const json = (await response.json());
+    if (!json.access_token ||
+        !json.refresh_token ||
+        typeof json.expires_in !== "number") {
+        logger.error(`[openai-codex] token response missing fields: ${JSON.stringify(json)}`);
+        return { type: "failed" };
+    }
+    return {
+        type: "success",
+        access: json.access_token,
+        refresh: json.refresh_token,
+        expires: Date.now() + json.expires_in * 1000,
+    };
+}
+async function refreshAccessToken(refreshToken) {
+    try {
+        const response = await fetch(TOKEN_URL, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({
+                grant_type: "refresh_token",
+                refresh_token: refreshToken,
+                client_id: CLIENT_ID,
+            }),
+        });
+        if (!response.ok) {
+            const text = await response.text().catch(() => "");
+            logger.error(`[openai-codex] Token refresh failed: ${response.status} ${text}`);
+            return { type: "failed" };
+        }
+        const json = (await response.json());
+        if (!json.access_token ||
+            !json.refresh_token ||
+            typeof json.expires_in !== "number") {
+            logger.error(`[openai-codex] Token refresh response missing fields: ${JSON.stringify(json)}`);
+            return { type: "failed" };
+        }
+        return {
+            type: "success",
+            access: json.access_token,
+            refresh: json.refresh_token,
+            expires: Date.now() + json.expires_in * 1000,
+        };
+    }
+    catch (error) {
+        logger.error(`[openai-codex] Token refresh error: ${String(error)}`);
+        return { type: "failed" };
+    }
+}
+async function createAuthorizationFlow(originator = "pi") {
+    const { verifier, challenge } = await generatePKCE();
+    const state = createState();
+    const url = new URL(AUTHORIZE_URL);
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("client_id", CLIENT_ID);
+    url.searchParams.set("redirect_uri", REDIRECT_URI);
+    url.searchParams.set("scope", SCOPE);
+    url.searchParams.set("code_challenge", challenge);
+    url.searchParams.set("code_challenge_method", "S256");
+    url.searchParams.set("state", state);
+    url.searchParams.set("id_token_add_organizations", "true");
+    url.searchParams.set("codex_cli_simplified_flow", "true");
+    url.searchParams.set("originator", originator);
+    return { verifier, state, url: url.toString() };
+}
+function startLocalOAuthServer(state) {
+    if (!_http) {
+        throw new Error("OpenAI Codex OAuth is only available in Node.js environments");
+    }
+    let lastCode = null;
+    let cancelled = false;
+    const server = _http.createServer((req, res) => {
+        try {
+            const url = new URL(req.url || "", "http://localhost");
+            if (url.pathname !== "/auth/callback") {
+                res.statusCode = 404;
+                res.end("Not found");
+                return;
+            }
+            if (url.searchParams.get("state") !== state) {
+                res.statusCode = 400;
+                res.end("State mismatch");
+                return;
+            }
+            const code = url.searchParams.get("code");
+            if (!code) {
+                res.statusCode = 400;
+                res.end("Missing authorization code");
+                return;
+            }
+            res.statusCode = 200;
+            res.setHeader("Content-Type", "text/html; charset=utf-8");
+            res.end(SUCCESS_HTML);
+            lastCode = code;
+        }
+        catch {
+            res.statusCode = 500;
+            res.end("Internal error");
+        }
+    });
+    return new Promise((resolve) => {
+        server
+            .listen(1455, "127.0.0.1", () => {
+            resolve({
+                close: () => server.close(),
+                cancelWait: () => {
+                    cancelled = true;
+                },
+                waitForCode: async () => {
+                    const sleep = () => new Promise((r) => setTimeout(r, 100));
+                    for (let i = 0; i < 600; i += 1) {
+                        if (lastCode)
+                            return { code: lastCode };
+                        if (cancelled)
+                            return null;
+                        await sleep();
+                    }
+                    return null;
+                },
+            });
+        })
+            .on("error", (err) => {
+            logger.error(`[openai-codex] Failed to bind http://127.0.0.1:1455 (${err.code}) Falling back to manual paste.`);
+            resolve({
+                close: () => {
+                    try {
+                        server.close();
+                    }
+                    catch {
+                        /* ignore */
+                    }
+                },
+                cancelWait: () => { },
+                waitForCode: async () => null,
+            });
+        });
+    });
+}
+function getAccountId(accessToken) {
+    const payload = decodeJwt(accessToken);
+    const auth = payload?.[JWT_CLAIM_PATH];
+    const accountId = auth?.chatgpt_account_id;
+    return typeof accountId === "string" && accountId.length > 0
+        ? accountId
+        : null;
+}
+export async function loginOpenAICodex(options) {
+    const { verifier, state, url } = await createAuthorizationFlow(options.originator);
+    const server = await startLocalOAuthServer(state);
+    options.onAuth({
+        url,
+        instructions: "A browser window should open. Complete login to finish.",
+    });
+    let code;
+    try {
+        if (options.onManualCodeInput) {
+            let manualCode;
+            let manualError;
+            const manualPromise = options
+                .onManualCodeInput()
+                .then((input) => {
+                manualCode = input;
+                server.cancelWait();
+            })
+                .catch((err) => {
+                manualError = err instanceof Error ? err : new Error(String(err));
+                server.cancelWait();
+            });
+            const result = await server.waitForCode();
+            if (manualError)
+                throw manualError;
+            if (result?.code) {
+                code = result.code;
+            }
+            else if (manualCode) {
+                const parsed = parseAuthorizationInput(manualCode);
+                if (parsed.state && parsed.state !== state) {
+                    throw new Error("State mismatch");
+                }
+                code = parsed.code;
+            }
+            if (!code) {
+                await manualPromise;
+                if (manualError)
+                    throw manualError;
+                if (manualCode) {
+                    const parsed = parseAuthorizationInput(manualCode);
+                    if (parsed.state && parsed.state !== state) {
+                        throw new Error("State mismatch");
+                    }
+                    code = parsed.code;
+                }
+            }
+        }
+        else {
+            const result = await server.waitForCode();
+            if (result?.code)
+                code = result.code;
+        }
+        if (!code) {
+            const input = await options.onPrompt({
+                message: "Paste the authorization code (or full redirect URL):",
+            });
+            const parsed = parseAuthorizationInput(input);
+            if (parsed.state && parsed.state !== state) {
+                throw new Error("State mismatch");
+            }
+            code = parsed.code;
+        }
+        if (!code)
+            throw new Error("Missing authorization code");
+        const tokenResult = await exchangeAuthorizationCode(code, verifier);
+        if (tokenResult.type !== "success") {
+            throw new Error("Token exchange failed");
+        }
+        const accountId = getAccountId(tokenResult.access);
+        if (!accountId) {
+            throw new Error("Failed to extract accountId from token");
+        }
+        return {
+            access: tokenResult.access,
+            refresh: tokenResult.refresh,
+            expires: tokenResult.expires,
+            accountId,
+        };
+    }
+    finally {
+        server.close();
+    }
+}
+export async function refreshOpenAICodexToken(refreshToken) {
+    const result = await refreshAccessToken(refreshToken);
+    if (result.type !== "success") {
+        throw new Error("Failed to refresh OpenAI Codex token");
+    }
+    const accountId = getAccountId(result.access);
+    if (!accountId) {
+        throw new Error("Failed to extract accountId from token");
+    }
+    return {
+        access: result.access,
+        refresh: result.refresh,
+        expires: result.expires,
+        accountId,
+    };
+}