@meetopenbot/codex 1.1.1 → 1.2.0

package/README.md

@@ -2,22 +2,21 @@
 
 OpenAI Codex runtime plugin for OpenBot. Each `agent:invoke` starts or resumes a Codex SDK thread in the channel workspace.
 
-## Config
+## Auth
+
+On cloud, `authMode: credits` (the default) uses your workspace credit balance via OpenBot. For BYOK, set `authMode: byok` and add `OPENAI_API_KEY` (or `CODEX_API_KEY`) under workspace settings — there is no API key field in plugin config.
 
-Set an API key with one of:
+Locally, Codex always uses BYOK from `CODEX_API_KEY` / `OPENAI_API_KEY`.
 
-- `apiKey` in plugin options
-- `CODEX_API_KEY`
-- `OPENAI_API_KEY`
+## Config
 
 Optional:
 
+- `authMode` — cloud only: `credits` (default) or `byok`
 - `model` — Codex model id (e.g. `gpt-5.6`). Omit to use the CLI default.
 - `sandboxMode` — `read-only` | `workspace-write` | `danger-full-access` (default `workspace-write`)
 - `approvalPolicy` — `never` | `on-request` | `on-failure` | `untrusted` (default `never`)
-- `workingDirectory` — override the channel cwd
 - `skipGitRepoCheck` — default `true` for non-git channel workspaces
-- `baseURL` — custom OpenAI-compatible endpoint
 - `codexPathOverride` — path to a local `codex` binary (`CODEX_PATH` / `CODEX_CLI_PATH` also work)
 
 Codex conversation state is stored as `codexThreadId` on the OpenBot thread, not as the OpenBot thread id.

package/dist/index.js

@@ -15,6 +15,74 @@ import { join } from "node:path";
 import {
   Codex
 } from "@openai/codex-sdk";
+
+// cloud-mode.ts
+var isCloudMode = () => process.env.OPENBOT_CLOUD_MODE === "1";
+var defaultAuthMode = () => isCloudMode() ? "credits" : "byok";
+function resolveAuthMode(config) {
+  if (config.authMode === "byok" || config.authMode === "credits") {
+    return config.authMode;
+  }
+  return defaultAuthMode();
+}
+
+// credits-auth.ts
+var INTEGRATIONS_TOKEN_HEADER = "x-openbot-integrations-token";
+var CREDITS_API_KEY_PLACEHOLDER = "openbot-credits";
+var CREDITS_PROVIDER_ID = "openbot_credits";
+function resolveCreditsAuthConfig() {
+  const baseUrl = process.env.OPENBOT_INTEGRATIONS_BASE_URL?.trim();
+  const token = process.env.OPENBOT_INTEGRATIONS_TOKEN?.trim();
+  if (!baseUrl || !token) return void 0;
+  return { baseUrl: baseUrl.replace(/\/$/, ""), token };
+}
+function creditsProviderBaseUrl(config) {
+  return `${config.baseUrl}/openai/v1`;
+}
+function buildCreditsCodexConfig(config) {
+  return {
+    model_provider: CREDITS_PROVIDER_ID,
+    model_providers: {
+      [CREDITS_PROVIDER_ID]: {
+        name: "OpenBot Credits",
+        base_url: creditsProviderBaseUrl(config),
+        env_key: "CODEX_API_KEY",
+        wire_api: "responses",
+        supports_websockets: false,
+        http_headers: {
+          [INTEGRATIONS_TOKEN_HEADER]: config.token
+        }
+      }
+    }
+  };
+}
+function isCreditsErrorMessage(message) {
+  const lower = message.toLowerCase();
+  return lower.includes("insufficient_credits") || lower.includes("insufficient credits") || lower.includes("402");
+}
+function isAuthErrorMessage(message) {
+  const lower = message.toLowerCase();
+  return lower.includes("api key") || lower.includes("apikey") || lower.includes("401") || lower.includes("unauthorized") || lower.includes("authentication") || lower.includes("not logged in") || lower.includes("login");
+}
+function isIntegrationsProviderError(message) {
+  const lower = message.toLowerCase();
+  return lower.includes("provider api key not configured") || lower.includes("503") && lower.includes("provider");
+}
+var CREDITS_NOT_CONFIGURED_MESSAGE = "OpenBot Credits is not configured on this runtime. The cloud host must set OPENBOT_INTEGRATIONS_BASE_URL and OPENBOT_INTEGRATIONS_TOKEN (try redeploying the workspace).";
+var CREDITS_PROVIDER_UNAVAILABLE_MESSAGE = "OpenBot Credits could not reach OpenAI \u2014 the platform provider API key is not configured yet. Try again later or switch this agent to BYOK mode.";
+var CREDITS_AUTH_FAILED_MESSAGE = "Codex could not authenticate via OpenBot Credits. Check your workspace credit balance in settings, or switch this agent to BYOK mode.";
+function creditsErrorMessage(message) {
+  if (isIntegrationsProviderError(message)) {
+    return CREDITS_PROVIDER_UNAVAILABLE_MESSAGE;
+  }
+  if (isCreditsErrorMessage(message)) {
+    return "Insufficient workspace credits. Add credits in workspace settings or switch this agent to BYOK mode.";
+  }
+  if (isAuthErrorMessage(message)) return CREDITS_AUTH_FAILED_MESSAGE;
+  return void 0;
+}
+
+// index.ts
 var SANDBOX_MODES = [
   "read-only",
   "workspace-write",
@@ -35,21 +103,8 @@ var LEGACY_APPROVAL = {
   always: "on-request",
   automatic: "on-request"
 };
-var AUTH_ERROR_PATTERNS = [
-  "api key",
-  "apikey",
-  "unauthorized",
-  "401",
-  "authentication",
-  "not logged in",
-  "login"
-];
 var asRecord = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : {};
 var asString = (value) => typeof value === "string" && value.trim() ? value.trim() : void 0;
-var isAuthErrorMessage = (message) => {
-  const lower = message.toLowerCase();
-  return AUTH_ERROR_PATTERNS.some((pattern) => lower.includes(pattern));
-};
 var readPersistedThreadId = (state) => {
   const source = state.threadDetails?.state ?? state.channelDetails?.state;
   const record = asRecord(source);
@@ -157,11 +212,14 @@ var plugin = definePlugin({
   configSchema: {
     type: "object",
     properties: {
-      apiKey: {
-        type: "string",
-        description: "OpenAI API key (falls back to CODEX_API_KEY / OPENAI_API_KEY)",
-        format: "password"
-      },
+      ...isCloudMode() ? {
+        authMode: {
+          type: "string",
+          description: "Credits \u2014 use your workspace credit balance via OpenBot. BYOK \u2014 bring your own OpenAI API key.",
+          enum: ["credits", "byok"],
+          default: "credits"
+        }
+      } : {},
       model: {
         type: "string",
         description: "Codex model id (e.g. gpt-5.6). Leave empty to use the CLI default."
@@ -178,19 +236,11 @@ var plugin = definePlugin({
         description: "When to require approval: never | on-request | on-failure | untrusted",
         default: "never"
       },
-      workingDirectory: {
-        type: "string",
-        description: "Override the channel working directory"
-      },
       skipGitRepoCheck: {
         type: "boolean",
         description: "Skip the Codex git-repo check (needed for non-git channel workspaces)",
         default: true
       },
-      baseURL: {
-        type: "string",
-        description: "Custom OpenAI-compatible endpoint"
-      },
       codexPathOverride: {
         type: "string",
         description: "Path to a local Codex CLI binary"
@@ -199,24 +249,27 @@ var plugin = definePlugin({
   },
   factory: (context) => {
     const config = context.config;
-    const apiKey = asString(config.apiKey) ?? process.env.CODEX_API_KEY ?? process.env.OPENAI_API_KEY;
+    const authMode = resolveAuthMode(config);
     const codexPathOverride = asString(config.codexPathOverride) ?? process.env.CODEX_PATH ?? process.env.CODEX_CLI_PATH;
     const model = parseModel(config.model);
     const sandboxMode = parseSandboxMode(config.sandboxMode);
     const approvalPolicy = parseApprovalPolicy(config.approvalPolicy);
     const skipGitRepoCheck = config.skipGitRepoCheck !== false;
-    const workingDirectoryOverride = asString(config.workingDirectory);
-    const baseUrl = asString(config.baseURL);
-    let client;
-    const getClient = () => {
-      if (!client) {
-        client = new Codex({
-          ...apiKey && { apiKey },
+    const createClient = () => {
+      if (authMode === "credits") {
+        const credits = resolveCreditsAuthConfig();
+        if (!credits) return CREDITS_NOT_CONFIGURED_MESSAGE;
+        return new Codex({
+          apiKey: credits.token || CREDITS_API_KEY_PLACEHOLDER,
           ...codexPathOverride && { codexPathOverride },
-          ...baseUrl && { baseUrl }
+          config: buildCreditsCodexConfig(credits)
         });
       }
-      return client;
+      const apiKey = process.env.CODEX_API_KEY ?? process.env.OPENAI_API_KEY;
+      return new Codex({
+        ...asString(apiKey) && { apiKey: asString(apiKey) },
+        ...codexPathOverride && { codexPathOverride }
+      });
     };
     return (builder) => {
       builder.on("agent:invoke", async function* (event, ctx) {
@@ -231,7 +284,16 @@ var plugin = definePlugin({
           });
           return;
         }
-        const workingDirectory = workingDirectoryOverride || ctx.state.channelDetails?.cwd || process.cwd();
+        const clientOrError = createClient();
+        if (typeof clientOrError === "string") {
+          yield agentOutput({
+            agentId: context.agentId,
+            content: clientOrError,
+            threadId: openbotThreadId
+          });
+          return;
+        }
+        const workingDirectory = ctx.state.channelDetails?.cwd || process.cwd();
         const threadOptions = {
           workingDirectory,
           skipGitRepoCheck,
@@ -240,8 +302,16 @@ var plugin = definePlugin({
           ...model && { model }
         };
         const savedId = readPersistedThreadId(ctx.state);
-        const thread = savedId ? getClient().resumeThread(savedId, threadOptions) : getClient().startThread(threadOptions);
+        const thread = savedId ? clientOrError.resumeThread(savedId, threadOptions) : clientOrError.startThread(threadOptions);
         const fail = function* (message) {
+          if (authMode === "credits") {
+            yield agentOutput({
+              agentId: context.agentId,
+              content: creditsErrorMessage(message) ?? `Error: ${message}`,
+              threadId: openbotThreadId
+            });
+            return;
+          }
           if (isAuthErrorMessage(message)) {
             yield buildApiKeyWidget(context.agentId, openbotThreadId, message);
           }
@@ -318,6 +388,50 @@ var plugin = definePlugin({
           yield* fail(errorText(error));
         }
       });
+      builder.on("client:ui:widget:response", async function* (event, ctx) {
+        const { metadata, values, widgetId } = event.data ?? {};
+        if (!metadata || metadata.type !== "api_key_request") return;
+        if (metadata.source !== "codex") return;
+        const apiKey = values?.apiKey;
+        if (typeof apiKey !== "string" || !apiKey) return;
+        const envVar = typeof metadata.envVar === "string" ? metadata.envVar : "OPENAI_API_KEY";
+        const storage = context.storage;
+        if (!storage) {
+          yield agentOutput({
+            agentId: context.agentId,
+            content: "[codex] no storage available; cannot persist API key.",
+            threadId: ctx.state.threadId
+          });
+          return;
+        }
+        try {
+          await storage.createVariable({ key: envVar, value: apiKey, secret: true });
+          process.env[envVar] = apiKey;
+          process.env.CODEX_API_KEY = apiKey;
+          yield uiWidget({
+            agentId: context.agentId,
+            widget: {
+              widgetId: widgetId ?? `codex_api_key_saved_${Date.now()}`,
+              kind: "message",
+              title: "API Key Saved",
+              body: `Saved ${envVar} as a workspace variable. You can now continue the conversation.`,
+              state: "submitted"
+            }
+          });
+          yield agentOutput({
+            agentId: context.agentId,
+            content: "Saved OpenAI API key to workspace variables. Re-send your last message to retry.",
+            threadId: ctx.state.threadId
+          });
+        } catch (error) {
+          const errorMessage = error instanceof Error ? error.message : String(error);
+          yield agentOutput({
+            agentId: context.agentId,
+            content: `[codex] failed to save API key: ${errorMessage}`,
+            threadId: ctx.state.threadId
+          });
+        }
+      });
     };
   }
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meetopenbot/codex",
-  "version": "1.1.1",
+  "version": "1.2.0",
   "type": "module",
   "description": "OpenAI Codex agent plugin for OpenBot",
   "main": "./dist/index.js",