@ljoukov/llm 7.0.18 → 7.0.19

package/README.md

@@ -108,13 +108,22 @@ refresh-token rotation and serves short-lived access tokens.
 - `CHATGPT_AUTH_TOKEN_PROVIDER_URL` (example: `https://chatgpt-auth.<your-domain>`)
 - `CHATGPT_AUTH_API_KEY` (shared secret; sent as `Authorization: Bearer ...` and `x-chatgpt-auth: ...`)
 - `CHATGPT_AUTH_TOKEN_PROVIDER_STORE` (`kv` or `d1`, defaults to `kv`)
+- `CHATGPT_CODEX_PROXY_URL` (optional Vercel proxy endpoint, for example `https://<project>.vercel.app/api/codex/responses`)
+- `CHATGPT_CODEX_PROXY_API_KEY` (bearer token for `CHATGPT_CODEX_PROXY_URL`)
+- `CHATGPT_CODEX_ENDPOINT` (optional direct endpoint override; defaults to `https://chatgpt.com/backend-api/codex/responses`)
 - `CHATGPT_RESPONSES_WEBSOCKET_MODE` (`auto` | `off` | `only`, default: `auto`)
 
 This repo includes a Cloudflare Workers token provider implementation in `workers/chatgpt-auth/`.
+It also includes a minimal Vercel streaming proxy app in `vercel/codex-proxy/`.
 
 If `CHATGPT_AUTH_TOKEN_PROVIDER_URL` + `CHATGPT_AUTH_API_KEY` are set, `chatgpt-*` models will fetch tokens from the
 token provider and will not read the local Codex auth store.
 
+If `CHATGPT_CODEX_PROXY_URL` + `CHATGPT_CODEX_PROXY_API_KEY` are set, `chatgpt-*` text requests are sent through that
+proxy and the local process does not need access to the Codex auth store or token provider. The Vercel proxy fetches
+short-lived ChatGPT access tokens from `workers/chatgpt-auth` and streams the upstream Codex response body back to the
+caller.
+
 ### Responses transport
 
 For OpenAI and `chatgpt-*` model paths, this library now tries **Responses WebSocket transport first** and falls back

package/dist/index.cjs

@@ -712,6 +712,10 @@ function resolveOpenAiImagePriceResolution(imageSize) {
 var import_node_os2 = __toESM(require("os"), 1);
 var import_node_util = require("util");
 
+// src/utils/env.ts
+var import_node_fs = __toESM(require("fs"), 1);
+var import_node_path = __toESM(require("path"), 1);
+
 // src/utils/runtimeSingleton.ts
 var runtimeSingletonStoreKey = /* @__PURE__ */ Symbol.for("@ljoukov/llm.runtimeSingletonStore");
 function getRuntimeSingletonStore() {
@@ -740,16 +744,7 @@ function getRuntimeSingleton(key, create) {
   return createdValue;
 }
 
-// src/openai/chatgpt-auth.ts
-var import_node_buffer = require("buffer");
-var import_node_fs2 = __toESM(require("fs"), 1);
-var import_node_os = __toESM(require("os"), 1);
-var import_node_path2 = __toESM(require("path"), 1);
-var import_zod = require("zod");
-
 // src/utils/env.ts
-var import_node_fs = __toESM(require("fs"), 1);
-var import_node_path = __toESM(require("path"), 1);
 var envState = getRuntimeSingleton(/* @__PURE__ */ Symbol.for("@ljoukov/llm.envState"), () => ({
   envLoaded: false
 }));
@@ -811,6 +806,11 @@ function parseEnvLine(line) {
 }
 
 // src/openai/chatgpt-auth.ts
+var import_node_buffer = require("buffer");
+var import_node_fs2 = __toESM(require("fs"), 1);
+var import_node_os = __toESM(require("os"), 1);
+var import_node_path2 = __toESM(require("path"), 1);
+var import_zod = require("zod");
 var CHATGPT_AUTH_TOKEN_PROVIDER_URL_ENV = "CHATGPT_AUTH_TOKEN_PROVIDER_URL";
 var CHATGPT_AUTH_TOKEN_PROVIDER_STORE_ENV = "CHATGPT_AUTH_TOKEN_PROVIDER_STORE";
 var CHATGPT_AUTH_API_KEY_ENV = "CHATGPT_AUTH_API_KEY";
@@ -1718,19 +1718,21 @@ function createAbortError(reason) {
 
 // src/openai/chatgpt-codex.ts
 var CHATGPT_CODEX_ENDPOINT = "https://chatgpt.com/backend-api/codex/responses";
+var CHATGPT_CODEX_ENDPOINT_ENV = "CHATGPT_CODEX_ENDPOINT";
+var CHATGPT_CODEX_PROXY_URL_ENV = "CHATGPT_CODEX_PROXY_URL";
+var CHATGPT_CODEX_PROXY_API_KEY_ENV = "CHATGPT_CODEX_PROXY_API_KEY";
 var CHATGPT_RESPONSES_EXPERIMENTAL_HEADER = "responses=experimental";
 var chatGptCodexState = getRuntimeSingleton(/* @__PURE__ */ Symbol.for("@ljoukov/llm.chatGptCodexState"), () => ({
   cachedResponsesWebSocketMode: null,
   chatGptResponsesWebSocketDisabled: false
 }));
 async function streamChatGptCodexResponse(options) {
-  const { access, accountId } = await getChatGptAuthProfile();
+  const endpointConfig = await resolveChatGptCodexEndpointConfig();
   const mode = resolveChatGptResponsesWebSocketMode();
   const fallbackStreamFactory = () => {
     const streamPromise = streamChatGptCodexResponseSse({
       request: options.request,
-      access,
-      accountId,
+      endpointConfig,
       sessionId: options.sessionId,
       signal: options.signal
     });
@@ -1752,15 +1754,14 @@ async function streamChatGptCodexResponse(options) {
     return fallbackStreamFactory();
   }
   const websocketHeaders = buildChatGptCodexHeaders({
-    access,
-    accountId,
+    endpointConfig,
     sessionId: options.sessionId,
     useWebSocket: true
   });
   return createAdaptiveResponsesStream({
     mode,
     createWebSocketStream: async () => await createResponsesWebSocketStream({
-      url: toWebSocketUrl(CHATGPT_CODEX_ENDPOINT),
+      url: toWebSocketUrl(endpointConfig.url),
       headers: websocketHeaders,
       request: options.request,
       signal: options.signal
@@ -1773,14 +1774,13 @@ async function streamChatGptCodexResponse(options) {
 }
 async function streamChatGptCodexResponseSse(options) {
   const headers = buildChatGptCodexHeaders({
-    access: options.access,
-    accountId: options.accountId,
+    endpointConfig: options.endpointConfig,
     sessionId: options.sessionId,
     useWebSocket: false
   });
   headers.Accept = "text/event-stream";
   headers["Content-Type"] = "application/json";
-  const response = await fetch(CHATGPT_CODEX_ENDPOINT, {
+  const response = await fetch(options.endpointConfig.url, {
     method: "POST",
     headers,
     body: JSON.stringify(options.request),
@@ -1800,24 +1800,66 @@ function resolveChatGptResponsesWebSocketMode() {
   if (chatGptCodexState.cachedResponsesWebSocketMode) {
     return chatGptCodexState.cachedResponsesWebSocketMode;
   }
+  const explicitMode = process.env.CHATGPT_RESPONSES_WEBSOCKET_MODE ?? process.env.OPENAI_RESPONSES_WEBSOCKET_MODE;
+  const defaultMode = resolveChatGptCodexProxyConfig() ? "off" : "auto";
   chatGptCodexState.cachedResponsesWebSocketMode = resolveResponsesWebSocketMode(
-    process.env.CHATGPT_RESPONSES_WEBSOCKET_MODE ?? process.env.OPENAI_RESPONSES_WEBSOCKET_MODE,
-    "auto"
+    explicitMode,
+    defaultMode
   );
   return chatGptCodexState.cachedResponsesWebSocketMode;
 }
+async function resolveChatGptCodexEndpointConfig() {
+  const proxy = resolveChatGptCodexProxyConfig();
+  if (proxy) {
+    return proxy;
+  }
+  const { access, accountId } = await getChatGptAuthProfile();
+  return {
+    kind: "direct",
+    url: resolveChatGptCodexEndpoint(),
+    access,
+    accountId
+  };
+}
+function resolveChatGptCodexEndpoint() {
+  loadLocalEnv();
+  return process.env[CHATGPT_CODEX_ENDPOINT_ENV]?.trim() || CHATGPT_CODEX_ENDPOINT;
+}
+function resolveChatGptCodexProxyConfig() {
+  loadLocalEnv();
+  const url = process.env[CHATGPT_CODEX_PROXY_URL_ENV]?.trim();
+  if (!url) {
+    return null;
+  }
+  const apiKey = process.env[CHATGPT_CODEX_PROXY_API_KEY_ENV]?.trim();
+  if (!apiKey) {
+    throw new Error(
+      `${CHATGPT_CODEX_PROXY_API_KEY_ENV} must be provided when ${CHATGPT_CODEX_PROXY_URL_ENV} is set.`
+    );
+  }
+  return {
+    kind: "proxy",
+    url,
+    apiKey
+  };
+}
 function buildChatGptCodexHeaders(options) {
   const openAiBeta = options.useWebSocket ? mergeOpenAiBetaHeader(
     CHATGPT_RESPONSES_EXPERIMENTAL_HEADER,
     OPENAI_BETA_RESPONSES_WEBSOCKETS_V2
   ) : CHATGPT_RESPONSES_EXPERIMENTAL_HEADER;
   const headers = {
-    Authorization: `Bearer ${options.access}`,
-    "chatgpt-account-id": options.accountId,
     "OpenAI-Beta": openAiBeta,
     originator: "llm",
     "User-Agent": buildUserAgent()
   };
+  if (options.endpointConfig.kind === "proxy") {
+    headers.Authorization = `Bearer ${options.endpointConfig.apiKey}`;
+    headers["x-codex-proxy-auth"] = options.endpointConfig.apiKey;
+  } else {
+    headers.Authorization = `Bearer ${options.endpointConfig.access}`;
+    headers["chatgpt-account-id"] = options.endpointConfig.accountId;
+  }
   if (options.sessionId) {
     headers.session_id = options.sessionId;
   }