@meetopenbot/codex 1.1.0 → 1.2.0

package/README.md

@@ -2,22 +2,21 @@
 
 OpenAI Codex runtime plugin for OpenBot. Each `agent:invoke` starts or resumes a Codex SDK thread in the channel workspace.
 
-## Config
+## Auth
+
+On cloud, `authMode: credits` (the default) uses your workspace credit balance via OpenBot. For BYOK, set `authMode: byok` and add `OPENAI_API_KEY` (or `CODEX_API_KEY`) under workspace settings — there is no API key field in plugin config.
 
-Set an API key with one of:
+Locally, Codex always uses BYOK from `CODEX_API_KEY` / `OPENAI_API_KEY`.
 
-- `apiKey` in plugin options
-- `CODEX_API_KEY`
-- `OPENAI_API_KEY`
+## Config
 
 Optional:
 
+- `authMode` — cloud only: `credits` (default) or `byok`
 - `model` — Codex model id (e.g. `gpt-5.6`). Omit to use the CLI default.
 - `sandboxMode` — `read-only` | `workspace-write` | `danger-full-access` (default `workspace-write`)
 - `approvalPolicy` — `never` | `on-request` | `on-failure` | `untrusted` (default `never`)
-- `workingDirectory` — override the channel cwd
 - `skipGitRepoCheck` — default `true` for non-git channel workspaces
-- `baseURL` — custom OpenAI-compatible endpoint
 - `codexPathOverride` — path to a local `codex` binary (`CODEX_PATH` / `CODEX_CLI_PATH` also work)
 
 Codex conversation state is stored as `codexThreadId` on the OpenBot thread, not as the OpenBot thread id.

package/dist/index.js

@@ -3,11 +3,86 @@ import {
   definePlugin,
   shouldHandleInvoke,
   agentOutput,
-  uiWidget
+  uiWidget,
+  toolTraceWidget,
+  buildDiffWidget,
+  diffFileFromWrite,
+  resolveRunDiffFiles,
+  snapshotWorkspace
 } from "@meetopenbot/plugin-sdk";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
 import {
   Codex
 } from "@openai/codex-sdk";
+
+// cloud-mode.ts
+var isCloudMode = () => process.env.OPENBOT_CLOUD_MODE === "1";
+var defaultAuthMode = () => isCloudMode() ? "credits" : "byok";
+function resolveAuthMode(config) {
+  if (config.authMode === "byok" || config.authMode === "credits") {
+    return config.authMode;
+  }
+  return defaultAuthMode();
+}
+
+// credits-auth.ts
+var INTEGRATIONS_TOKEN_HEADER = "x-openbot-integrations-token";
+var CREDITS_API_KEY_PLACEHOLDER = "openbot-credits";
+var CREDITS_PROVIDER_ID = "openbot_credits";
+function resolveCreditsAuthConfig() {
+  const baseUrl = process.env.OPENBOT_INTEGRATIONS_BASE_URL?.trim();
+  const token = process.env.OPENBOT_INTEGRATIONS_TOKEN?.trim();
+  if (!baseUrl || !token) return void 0;
+  return { baseUrl: baseUrl.replace(/\/$/, ""), token };
+}
+function creditsProviderBaseUrl(config) {
+  return `${config.baseUrl}/openai/v1`;
+}
+function buildCreditsCodexConfig(config) {
+  return {
+    model_provider: CREDITS_PROVIDER_ID,
+    model_providers: {
+      [CREDITS_PROVIDER_ID]: {
+        name: "OpenBot Credits",
+        base_url: creditsProviderBaseUrl(config),
+        env_key: "CODEX_API_KEY",
+        wire_api: "responses",
+        supports_websockets: false,
+        http_headers: {
+          [INTEGRATIONS_TOKEN_HEADER]: config.token
+        }
+      }
+    }
+  };
+}
+function isCreditsErrorMessage(message) {
+  const lower = message.toLowerCase();
+  return lower.includes("insufficient_credits") || lower.includes("insufficient credits") || lower.includes("402");
+}
+function isAuthErrorMessage(message) {
+  const lower = message.toLowerCase();
+  return lower.includes("api key") || lower.includes("apikey") || lower.includes("401") || lower.includes("unauthorized") || lower.includes("authentication") || lower.includes("not logged in") || lower.includes("login");
+}
+function isIntegrationsProviderError(message) {
+  const lower = message.toLowerCase();
+  return lower.includes("provider api key not configured") || lower.includes("503") && lower.includes("provider");
+}
+var CREDITS_NOT_CONFIGURED_MESSAGE = "OpenBot Credits is not configured on this runtime. The cloud host must set OPENBOT_INTEGRATIONS_BASE_URL and OPENBOT_INTEGRATIONS_TOKEN (try redeploying the workspace).";
+var CREDITS_PROVIDER_UNAVAILABLE_MESSAGE = "OpenBot Credits could not reach OpenAI \u2014 the platform provider API key is not configured yet. Try again later or switch this agent to BYOK mode.";
+var CREDITS_AUTH_FAILED_MESSAGE = "Codex could not authenticate via OpenBot Credits. Check your workspace credit balance in settings, or switch this agent to BYOK mode.";
+function creditsErrorMessage(message) {
+  if (isIntegrationsProviderError(message)) {
+    return CREDITS_PROVIDER_UNAVAILABLE_MESSAGE;
+  }
+  if (isCreditsErrorMessage(message)) {
+    return "Insufficient workspace credits. Add credits in workspace settings or switch this agent to BYOK mode.";
+  }
+  if (isAuthErrorMessage(message)) return CREDITS_AUTH_FAILED_MESSAGE;
+  return void 0;
+}
+
+// index.ts
 var SANDBOX_MODES = [
   "read-only",
   "workspace-write",
@@ -28,21 +103,8 @@ var LEGACY_APPROVAL = {
   always: "on-request",
   automatic: "on-request"
 };
-var AUTH_ERROR_PATTERNS = [
-  "api key",
-  "apikey",
-  "unauthorized",
-  "401",
-  "authentication",
-  "not logged in",
-  "login"
-];
 var asRecord = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : {};
 var asString = (value) => typeof value === "string" && value.trim() ? value.trim() : void 0;
-var isAuthErrorMessage = (message) => {
-  const lower = message.toLowerCase();
-  return AUTH_ERROR_PATTERNS.some((pattern) => lower.includes(pattern));
-};
 var readPersistedThreadId = (state) => {
   const source = state.threadDetails?.state ?? state.channelDetails?.state;
   const record = asRecord(source);
@@ -81,18 +143,41 @@ var parseModel = (value) => {
 var itemWidget = (item) => {
   switch (item.type) {
     case "command_execution":
-      return { title: "Command", body: item.command };
+      return {
+        title: "Command",
+        body: [item.command, item.aggregated_output].filter(Boolean).join("\n\n")
+      };
     case "file_change":
       return {
         title: "File change",
         body: item.changes.map((change) => `${change.kind} ${change.path}`).join("\n")
       };
+    case "mcp_tool_call":
+      return {
+        title: `${item.server}: ${item.tool}`,
+        body: item.error?.message ?? (item.result ? JSON.stringify(item.result, null, 2) : "")
+      };
+    case "web_search":
+      return { title: "Web search", body: item.query };
     case "error":
       return { title: "Error", body: item.message };
     default:
       return null;
   }
 };
+var collectCodexChange = (path, kind, cwd, files) => {
+  if (kind === "add") {
+    try {
+      files.set(path, diffFileFromWrite(path, readFileSync(join(cwd, path), "utf8")));
+      return;
+    } catch {
+    }
+  }
+  files.set(path, {
+    path,
+    status: kind === "delete" ? "deleted" : kind === "add" ? "added" : "modified"
+  });
+};
 var errorText = (error) => error instanceof Error ? error.message : "Codex request failed.";
 var buildApiKeyWidget = (agentId, threadId, reason) => uiWidget({
   agentId,
@@ -127,11 +212,14 @@ var plugin = definePlugin({
   configSchema: {
     type: "object",
     properties: {
-      apiKey: {
-        type: "string",
-        description: "OpenAI API key (falls back to CODEX_API_KEY / OPENAI_API_KEY)",
-        format: "password"
-      },
+      ...isCloudMode() ? {
+        authMode: {
+          type: "string",
+          description: "Credits \u2014 use your workspace credit balance via OpenBot. BYOK \u2014 bring your own OpenAI API key.",
+          enum: ["credits", "byok"],
+          default: "credits"
+        }
+      } : {},
       model: {
         type: "string",
         description: "Codex model id (e.g. gpt-5.6). Leave empty to use the CLI default."
@@ -148,19 +236,11 @@ var plugin = definePlugin({
         description: "When to require approval: never | on-request | on-failure | untrusted",
         default: "never"
       },
-      workingDirectory: {
-        type: "string",
-        description: "Override the channel working directory"
-      },
       skipGitRepoCheck: {
         type: "boolean",
         description: "Skip the Codex git-repo check (needed for non-git channel workspaces)",
         default: true
       },
-      baseURL: {
-        type: "string",
-        description: "Custom OpenAI-compatible endpoint"
-      },
       codexPathOverride: {
         type: "string",
         description: "Path to a local Codex CLI binary"
@@ -169,24 +249,27 @@ var plugin = definePlugin({
   },
   factory: (context) => {
     const config = context.config;
-    const apiKey = asString(config.apiKey) ?? process.env.CODEX_API_KEY ?? process.env.OPENAI_API_KEY;
+    const authMode = resolveAuthMode(config);
     const codexPathOverride = asString(config.codexPathOverride) ?? process.env.CODEX_PATH ?? process.env.CODEX_CLI_PATH;
     const model = parseModel(config.model);
     const sandboxMode = parseSandboxMode(config.sandboxMode);
     const approvalPolicy = parseApprovalPolicy(config.approvalPolicy);
     const skipGitRepoCheck = config.skipGitRepoCheck !== false;
-    const workingDirectoryOverride = asString(config.workingDirectory);
-    const baseUrl = asString(config.baseURL);
-    let client;
-    const getClient = () => {
-      if (!client) {
-        client = new Codex({
-          ...apiKey && { apiKey },
+    const createClient = () => {
+      if (authMode === "credits") {
+        const credits = resolveCreditsAuthConfig();
+        if (!credits) return CREDITS_NOT_CONFIGURED_MESSAGE;
+        return new Codex({
+          apiKey: credits.token || CREDITS_API_KEY_PLACEHOLDER,
           ...codexPathOverride && { codexPathOverride },
-          ...baseUrl && { baseUrl }
+          config: buildCreditsCodexConfig(credits)
         });
       }
-      return client;
+      const apiKey = process.env.CODEX_API_KEY ?? process.env.OPENAI_API_KEY;
+      return new Codex({
+        ...asString(apiKey) && { apiKey: asString(apiKey) },
+        ...codexPathOverride && { codexPathOverride }
+      });
     };
     return (builder) => {
       builder.on("agent:invoke", async function* (event, ctx) {
@@ -201,7 +284,16 @@ var plugin = definePlugin({
           });
           return;
         }
-        const workingDirectory = workingDirectoryOverride || ctx.state.channelDetails?.cwd || process.cwd();
+        const clientOrError = createClient();
+        if (typeof clientOrError === "string") {
+          yield agentOutput({
+            agentId: context.agentId,
+            content: clientOrError,
+            threadId: openbotThreadId
+          });
+          return;
+        }
+        const workingDirectory = ctx.state.channelDetails?.cwd || process.cwd();
         const threadOptions = {
           workingDirectory,
           skipGitRepoCheck,
@@ -210,8 +302,16 @@ var plugin = definePlugin({
           ...model && { model }
         };
         const savedId = readPersistedThreadId(ctx.state);
-        const thread = savedId ? getClient().resumeThread(savedId, threadOptions) : getClient().startThread(threadOptions);
+        const thread = savedId ? clientOrError.resumeThread(savedId, threadOptions) : clientOrError.startThread(threadOptions);
         const fail = function* (message) {
+          if (authMode === "credits") {
+            yield agentOutput({
+              agentId: context.agentId,
+              content: creditsErrorMessage(message) ?? `Error: ${message}`,
+              threadId: openbotThreadId
+            });
+            return;
+          }
           if (isAuthErrorMessage(message)) {
             yield buildApiKeyWidget(context.agentId, openbotThreadId, message);
           }
@@ -225,6 +325,8 @@ var plugin = definePlugin({
           const { events } = await thread.runStreamed(content, {
             signal: context.abortSignal
           });
+          const snapshot = snapshotWorkspace(workingDirectory);
+          const changedFiles = /* @__PURE__ */ new Map();
           for await (const chunk of events) {
             if (chunk.type === "thread.started") {
               await persistThreadId(ctx.state, context.storage, chunk.thread_id);
@@ -238,34 +340,98 @@ var plugin = definePlugin({
               yield* fail(chunk.message);
               return;
             }
-            if (chunk.type !== "item.completed") continue;
+            if (chunk.type !== "item.started" && chunk.type !== "item.completed") continue;
             if (chunk.item.type === "agent_message") {
-              yield agentOutput({
-                agentId: context.agentId,
-                content: chunk.item.text,
-                threadId: openbotThreadId
-              });
+              if (chunk.type === "item.completed") {
+                yield agentOutput({
+                  agentId: context.agentId,
+                  content: chunk.item.text,
+                  threadId: openbotThreadId
+                });
+              }
               continue;
             }
+            if (chunk.type === "item.completed" && chunk.item.type === "file_change" && chunk.item.status === "completed") {
+              for (const change of chunk.item.changes) {
+                collectCodexChange(change.path, change.kind, workingDirectory, changedFiles);
+              }
+            }
             const widget = itemWidget(chunk.item);
             if (!widget) continue;
             yield uiWidget({
               agentId: context.agentId,
               threadId: openbotThreadId,
-              widget: {
-                kind: "message",
+              widget: toolTraceWidget({
                 widgetId: `codex_${chunk.item.id}`,
+                groupId: "codex:tools",
                 title: widget.title,
                 body: widget.body,
-                variant: "basic",
-                display: "collapsed"
-              }
+                state: chunk.type === "item.completed" && (chunk.item.type === "command_execution" && chunk.item.status === "failed" || chunk.item.type === "file_change" && chunk.item.status === "failed" || chunk.item.type === "mcp_tool_call" && chunk.item.status === "failed" || chunk.item.type === "error") ? "error" : chunk.type === "item.completed" ? "submitted" : void 0
+              })
+            });
+          }
+          const diff = buildDiffWidget({
+            widgetId: `codex-diff:${openbotThreadId ?? "run"}:${Date.now()}`,
+            files: resolveRunDiffFiles({
+              snapshot,
+              fallback: changedFiles.values()
+            })
+          });
+          if (diff) {
+            yield uiWidget({
+              agentId: context.agentId,
+              threadId: openbotThreadId,
+              widget: diff
             });
           }
         } catch (error) {
           yield* fail(errorText(error));
         }
       });
+      builder.on("client:ui:widget:response", async function* (event, ctx) {
+        const { metadata, values, widgetId } = event.data ?? {};
+        if (!metadata || metadata.type !== "api_key_request") return;
+        if (metadata.source !== "codex") return;
+        const apiKey = values?.apiKey;
+        if (typeof apiKey !== "string" || !apiKey) return;
+        const envVar = typeof metadata.envVar === "string" ? metadata.envVar : "OPENAI_API_KEY";
+        const storage = context.storage;
+        if (!storage) {
+          yield agentOutput({
+            agentId: context.agentId,
+            content: "[codex] no storage available; cannot persist API key.",
+            threadId: ctx.state.threadId
+          });
+          return;
+        }
+        try {
+          await storage.createVariable({ key: envVar, value: apiKey, secret: true });
+          process.env[envVar] = apiKey;
+          process.env.CODEX_API_KEY = apiKey;
+          yield uiWidget({
+            agentId: context.agentId,
+            widget: {
+              widgetId: widgetId ?? `codex_api_key_saved_${Date.now()}`,
+              kind: "message",
+              title: "API Key Saved",
+              body: `Saved ${envVar} as a workspace variable. You can now continue the conversation.`,
+              state: "submitted"
+            }
+          });
+          yield agentOutput({
+            agentId: context.agentId,
+            content: "Saved OpenAI API key to workspace variables. Re-send your last message to retry.",
+            threadId: ctx.state.threadId
+          });
+        } catch (error) {
+          const errorMessage = error instanceof Error ? error.message : String(error);
+          yield agentOutput({
+            agentId: context.agentId,
+            content: `[codex] failed to save API key: ${errorMessage}`,
+            threadId: ctx.state.threadId
+          });
+        }
+      });
     };
   }
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meetopenbot/codex",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "type": "module",
   "description": "OpenAI Codex agent plugin for OpenBot",
   "main": "./dist/index.js",
@@ -17,20 +17,19 @@
   "files": [
     "dist"
   ],
-  "scripts": {
-    "build": "esbuild index.ts --bundle --platform=node --format=esm --outfile=dist/index.js --external:@meetopenbot/plugin-sdk --external:@openai/codex-sdk --external:zod && node ../../scripts/write-plugin-declaration.mjs",
-    "dev": "esbuild index.ts --bundle --platform=node --format=esm --outfile=dist/index.js --external:@meetopenbot/plugin-sdk --external:@openai/codex-sdk --external:zod --watch",
-    "typecheck": "tsc --noEmit --allowImportingTsExtensions --module ESNext --moduleResolution Bundler --target ES2022 --skipLibCheck index.ts",
-    "prepack": "pnpm build"
-  },
   "dependencies": {
-    "@meetopenbot/plugin-sdk": "workspace:^",
-    "@openai/codex-sdk": "0.148.0"
+    "@openai/codex-sdk": "0.148.0",
+    "@meetopenbot/plugin-sdk": "^0.2.0"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",
     "esbuild": "^0.21.0",
     "zod": "^4.4.3"
   },
-  "types": "./dist/index.d.ts"
-}
+  "types": "./dist/index.d.ts",
+  "scripts": {
+    "build": "esbuild index.ts --bundle --platform=node --format=esm --outfile=dist/index.js --external:@meetopenbot/plugin-sdk --external:@openai/codex-sdk --external:zod && node ../../scripts/write-plugin-declaration.mjs",
+    "dev": "esbuild index.ts --bundle --platform=node --format=esm --outfile=dist/index.js --external:@meetopenbot/plugin-sdk --external:@openai/codex-sdk --external:zod --watch",
+    "typecheck": "tsc --noEmit --allowImportingTsExtensions --module ESNext --moduleResolution Bundler --target ES2022 --skipLibCheck index.ts"
+  }
+}