@meetopenbot/codex 1.1.1 → 1.2.1

package/README.md

@@ -2,22 +2,21 @@
 
 OpenAI Codex runtime plugin for OpenBot. Each `agent:invoke` starts or resumes a Codex SDK thread in the channel workspace.
 
-## Config
+## Auth
+
+On cloud, `authMode: credits` (the default) uses your workspace credit balance via OpenBot. For BYOK, set `authMode: byok` and add `OPENAI_API_KEY` (or `CODEX_API_KEY`) under workspace settings — there is no API key field in plugin config.
 
-Set an API key with one of:
+Locally, Codex always uses BYOK from `CODEX_API_KEY` / `OPENAI_API_KEY`.
 
-- `apiKey` in plugin options
-- `CODEX_API_KEY`
-- `OPENAI_API_KEY`
+## Config
 
 Optional:
 
+- `authMode` — cloud only: `credits` (default) or `byok`
 - `model` — Codex model id (e.g. `gpt-5.6`). Omit to use the CLI default.
 - `sandboxMode` — `read-only` | `workspace-write` | `danger-full-access` (default `workspace-write`)
 - `approvalPolicy` — `never` | `on-request` | `on-failure` | `untrusted` (default `never`)
-- `workingDirectory` — override the channel cwd
 - `skipGitRepoCheck` — default `true` for non-git channel workspaces
-- `baseURL` — custom OpenAI-compatible endpoint
 - `codexPathOverride` — path to a local `codex` binary (`CODEX_PATH` / `CODEX_CLI_PATH` also work)
 
 Codex conversation state is stored as `codexThreadId` on the OpenBot thread, not as the OpenBot thread id.

package/dist/index.js

@@ -1,20 +1,11 @@
-// index.ts
+// src/index.ts
+import { defineAgentPlugin } from "@meetopenbot/plugin-sdk";
+
+// src/config.ts
 import {
-  definePlugin,
-  shouldHandleInvoke,
-  agentOutput,
-  uiWidget,
-  toolTraceWidget,
-  buildDiffWidget,
-  diffFileFromWrite,
-  resolveRunDiffFiles,
-  snapshotWorkspace
+  trimmedString,
+  vendorModelId
 } from "@meetopenbot/plugin-sdk";
-import { readFileSync } from "node:fs";
-import { join } from "node:path";
-import {
-  Codex
-} from "@openai/codex-sdk";
 var SANDBOX_MODES = [
   "read-only",
   "workspace-write",
@@ -26,303 +17,139 @@ var APPROVAL_MODES = [
   "on-failure",
   "untrusted"
 ];
-var LEGACY_SANDBOX = {
-  "workspace-read": "read-only",
-  "full-read": "read-only",
-  "full-write": "danger-full-access"
-};
-var LEGACY_APPROVAL = {
-  always: "on-request",
-  automatic: "on-request"
-};
-var AUTH_ERROR_PATTERNS = [
-  "api key",
-  "apikey",
-  "unauthorized",
-  "401",
-  "authentication",
-  "not logged in",
-  "login"
-];
-var asRecord = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : {};
-var asString = (value) => typeof value === "string" && value.trim() ? value.trim() : void 0;
-var isAuthErrorMessage = (message) => {
-  const lower = message.toLowerCase();
-  return AUTH_ERROR_PATTERNS.some((pattern) => lower.includes(pattern));
-};
-var readPersistedThreadId = (state) => {
-  const source = state.threadDetails?.state ?? state.channelDetails?.state;
-  const record = asRecord(source);
-  return asString(record.codexThreadId);
-};
-var persistThreadId = async (state, storage, codexThreadId) => {
-  if (!storage || !state.channelId) return;
-  const patch = { codexThreadId };
-  if (state.threadId) {
-    await storage.patchThreadState({
-      channelId: state.channelId,
-      threadId: state.threadId,
-      state: patch
-    });
-    return;
-  }
-  await storage.patchChannelState({ channelId: state.channelId, state: patch });
-};
-var parseSandboxMode = (value) => {
-  const raw = asString(value);
-  if (!raw) return "workspace-write";
-  if (SANDBOX_MODES.includes(raw)) return raw;
-  return LEGACY_SANDBOX[raw] ?? "workspace-write";
-};
-var parseApprovalPolicy = (value) => {
-  const raw = asString(value);
-  if (!raw) return "never";
-  if (APPROVAL_MODES.includes(raw)) return raw;
-  return LEGACY_APPROVAL[raw] ?? "never";
-};
-var parseModel = (value) => {
-  const raw = asString(value);
-  if (!raw) return void 0;
-  return raw.split("/").pop() || void 0;
-};
-var itemWidget = (item) => {
-  switch (item.type) {
-    case "command_execution":
-      return {
-        title: "Command",
-        body: [item.command, item.aggregated_output].filter(Boolean).join("\n\n")
-      };
-    case "file_change":
-      return {
-        title: "File change",
-        body: item.changes.map((change) => `${change.kind} ${change.path}`).join("\n")
-      };
-    case "mcp_tool_call":
-      return {
-        title: `${item.server}: ${item.tool}`,
-        body: item.error?.message ?? (item.result ? JSON.stringify(item.result, null, 2) : "")
-      };
-    case "web_search":
-      return { title: "Web search", body: item.query };
-    case "error":
-      return { title: "Error", body: item.message };
-    default:
-      return null;
+var pluginConfigSchema = {
+  type: "object",
+  properties: {
+    sandboxMode: {
+      type: "string",
+      enum: [...SANDBOX_MODES],
+      description: "Filesystem sandbox: read-only | workspace-write | danger-full-access",
+      default: "workspace-write"
+    },
+    approvalPolicy: {
+      type: "string",
+      enum: [...APPROVAL_MODES],
+      description: "When to require approval: never | on-request | on-failure | untrusted",
+      default: "never"
+    }
   }
 };
-var collectCodexChange = (path, kind, cwd, files) => {
-  if (kind === "add") {
-    try {
-      files.set(path, diffFileFromWrite(path, readFileSync(join(cwd, path), "utf8")));
-      return;
-    } catch {
+function resolveCodexConfig(config) {
+  const sandboxRaw = trimmedString(config.sandboxMode);
+  const approvalRaw = trimmedString(config.approvalPolicy);
+  return {
+    model: vendorModelId(trimmedString(config.model)),
+    sandboxMode: sandboxRaw && SANDBOX_MODES.includes(sandboxRaw) ? sandboxRaw : "workspace-write",
+    approvalPolicy: approvalRaw && APPROVAL_MODES.includes(approvalRaw) ? approvalRaw : "never",
+    skipGitRepoCheck: true,
+    codexPathOverride: trimmedString(process.env.CODEX_PATH) ?? trimmedString(process.env.CODEX_CLI_PATH)
+  };
+}
+
+// src/runtime.ts
+import {
+  isCloudMode,
+  llmAuthNotConfiguredMessage,
+  resolveByokApiKey
+} from "@meetopenbot/plugin-sdk";
+import { Codex } from "@openai/codex-sdk";
+
+// src/credits.ts
+import {
+  CREDITS_API_KEY_PLACEHOLDER,
+  CREDITS_NOT_CONFIGURED_MESSAGE,
+  INTEGRATIONS_TOKEN_HEADER,
+  creditsErrorMessage as mapCreditsError,
+  creditsProviderBaseUrl,
+  isAuthErrorMessage,
+  resolveCreditsAuthConfig
+} from "@meetopenbot/plugin-sdk";
+var CREDITS_PROVIDER_ID = "openbot_credits";
+function buildCreditsCodexConfig(config) {
+  return {
+    model_provider: CREDITS_PROVIDER_ID,
+    model_providers: {
+      [CREDITS_PROVIDER_ID]: {
+        name: "OpenBot Credits",
+        base_url: creditsProviderBaseUrl(config),
+        env_key: "CODEX_API_KEY",
+        wire_api: "responses",
+        supports_websockets: false,
+        http_headers: {
+          [INTEGRATIONS_TOKEN_HEADER]: config.token
+        }
+      }
     }
+  };
+}
+function creditsErrorMessage(message) {
+  return mapCreditsError(message, { agentName: "Codex", providerLabel: "OpenAI" });
+}
+
+// src/session.ts
+import { threadSession } from "@meetopenbot/plugin-sdk";
+var codexSession = threadSession("codexThreadId");
+
+// src/runtime.ts
+async function runCodexTurn({
+  prompt,
+  handlerCtx,
+  context
+}) {
+  const byok = resolveByokApiKey("openai", ["CODEX_API_KEY"]);
+  const credits = !byok && isCloudMode() ? resolveCreditsAuthConfig() : void 0;
+  if (!byok && !credits) {
+    return llmAuthNotConfiguredMessage("OPENAI_API_KEY");
   }
-  files.set(path, {
-    path,
-    status: kind === "delete" ? "deleted" : kind === "add" ? "added" : "modified"
+  const config = resolveCodexConfig(context.config);
+  const client = new Codex({
+    apiKey: byok ?? credits?.token ?? CREDITS_API_KEY_PLACEHOLDER,
+    ...config.codexPathOverride && { codexPathOverride: config.codexPathOverride },
+    ...credits ? { config: buildCreditsCodexConfig(credits) } : {}
   });
-};
-var errorText = (error) => error instanceof Error ? error.message : "Codex request failed.";
-var buildApiKeyWidget = (agentId, threadId, reason) => uiWidget({
-  agentId,
-  threadId,
-  widget: {
-    kind: "form",
-    widgetId: `codex_api_key_request_${Date.now()}`,
-    title: "OpenAI API Key Required",
-    description: `Codex could not authenticate (${reason}). Provide an OpenAI API key to continue. You can get one from the OpenAI dashboard. The key is stored as a workspace variable on your machine and never leaves your local runtime.`,
-    fields: [
-      {
-        id: "apiKey",
-        label: "API Key",
-        type: "password",
-        placeholder: "sk-...",
-        required: true
-      }
-    ],
-    submitLabel: "Save API Key",
-    metadata: {
-      type: "api_key_request",
-      provider: "openai",
-      envVar: "OPENAI_API_KEY",
-      source: "codex"
+  const workingDirectory = handlerCtx.state.channelDetails?.cwd || process.cwd();
+  const threadOptions = {
+    workingDirectory,
+    skipGitRepoCheck: config.skipGitRepoCheck,
+    sandboxMode: config.sandboxMode,
+    approvalPolicy: config.approvalPolicy,
+    ...config.model && { model: config.model }
+  };
+  const savedId = codexSession.read(handlerCtx.state);
+  const thread = savedId ? client.resumeThread(savedId, threadOptions) : client.startThread(threadOptions);
+  const { events } = await thread.runStreamed(prompt, {
+    signal: context.abortSignal
+  });
+  let text = "";
+  for await (const chunk of events) {
+    if (chunk.type === "thread.started") {
+      await codexSession.write(handlerCtx.state, context.storage, chunk.thread_id);
+      continue;
+    }
+    if (chunk.type === "turn.failed") {
+      return creditsErrorMessage(chunk.error.message) ?? chunk.error.message;
+    }
+    if (chunk.type === "error") {
+      return creditsErrorMessage(chunk.message) ?? chunk.message;
+    }
+    if (chunk.type === "item.completed" && chunk.item.type === "agent_message" && chunk.item.text.trim()) {
+      text = chunk.item.text.trim();
     }
   }
-});
-var plugin = definePlugin({
-  id: "codex",
+  return text;
+}
+
+// src/index.ts
+var plugin = await defineAgentPlugin({
   name: "Codex",
   description: "OpenAI Codex agent. Uses the Codex SDK to read code, edit files, and run shell commands inside the channel's workspace.",
-  configSchema: {
-    type: "object",
-    properties: {
-      apiKey: {
-        type: "string",
-        description: "OpenAI API key (falls back to CODEX_API_KEY / OPENAI_API_KEY)",
-        format: "password"
-      },
-      model: {
-        type: "string",
-        description: "Codex model id (e.g. gpt-5.6). Leave empty to use the CLI default."
-      },
-      sandboxMode: {
-        type: "string",
-        enum: [...SANDBOX_MODES],
-        description: "Filesystem sandbox: read-only | workspace-write | danger-full-access",
-        default: "workspace-write"
-      },
-      approvalPolicy: {
-        type: "string",
-        enum: [...APPROVAL_MODES],
-        description: "When to require approval: never | on-request | on-failure | untrusted",
-        default: "never"
-      },
-      workingDirectory: {
-        type: "string",
-        description: "Override the channel working directory"
-      },
-      skipGitRepoCheck: {
-        type: "boolean",
-        description: "Skip the Codex git-repo check (needed for non-git channel workspaces)",
-        default: true
-      },
-      baseURL: {
-        type: "string",
-        description: "Custom OpenAI-compatible endpoint"
-      },
-      codexPathOverride: {
-        type: "string",
-        description: "Path to a local Codex CLI binary"
-      }
-    }
-  },
-  factory: (context) => {
-    const config = context.config;
-    const apiKey = asString(config.apiKey) ?? process.env.CODEX_API_KEY ?? process.env.OPENAI_API_KEY;
-    const codexPathOverride = asString(config.codexPathOverride) ?? process.env.CODEX_PATH ?? process.env.CODEX_CLI_PATH;
-    const model = parseModel(config.model);
-    const sandboxMode = parseSandboxMode(config.sandboxMode);
-    const approvalPolicy = parseApprovalPolicy(config.approvalPolicy);
-    const skipGitRepoCheck = config.skipGitRepoCheck !== false;
-    const workingDirectoryOverride = asString(config.workingDirectory);
-    const baseUrl = asString(config.baseURL);
-    let client;
-    const getClient = () => {
-      if (!client) {
-        client = new Codex({
-          ...apiKey && { apiKey },
-          ...codexPathOverride && { codexPathOverride },
-          ...baseUrl && { baseUrl }
-        });
-      }
-      return client;
-    };
-    return (builder) => {
-      builder.on("agent:invoke", async function* (event, ctx) {
-        if (!shouldHandleInvoke(event, context.agentId)) return;
-        const content = asString(event.data?.content);
-        const openbotThreadId = event.meta?.threadId || ctx.state.threadId;
-        if (!content) {
-          yield agentOutput({
-            agentId: context.agentId,
-            content: "No content provided.",
-            threadId: openbotThreadId
-          });
-          return;
-        }
-        const workingDirectory = workingDirectoryOverride || ctx.state.channelDetails?.cwd || process.cwd();
-        const threadOptions = {
-          workingDirectory,
-          skipGitRepoCheck,
-          sandboxMode,
-          approvalPolicy,
-          ...model && { model }
-        };
-        const savedId = readPersistedThreadId(ctx.state);
-        const thread = savedId ? getClient().resumeThread(savedId, threadOptions) : getClient().startThread(threadOptions);
-        const fail = function* (message) {
-          if (isAuthErrorMessage(message)) {
-            yield buildApiKeyWidget(context.agentId, openbotThreadId, message);
-          }
-          yield agentOutput({
-            agentId: context.agentId,
-            content: `Error: ${message}`,
-            threadId: openbotThreadId
-          });
-        };
-        try {
-          const { events } = await thread.runStreamed(content, {
-            signal: context.abortSignal
-          });
-          const snapshot = snapshotWorkspace(workingDirectory);
-          const changedFiles = /* @__PURE__ */ new Map();
-          for await (const chunk of events) {
-            if (chunk.type === "thread.started") {
-              await persistThreadId(ctx.state, context.storage, chunk.thread_id);
-              continue;
-            }
-            if (chunk.type === "turn.failed") {
-              yield* fail(chunk.error.message);
-              return;
-            }
-            if (chunk.type === "error") {
-              yield* fail(chunk.message);
-              return;
-            }
-            if (chunk.type !== "item.started" && chunk.type !== "item.completed") continue;
-            if (chunk.item.type === "agent_message") {
-              if (chunk.type === "item.completed") {
-                yield agentOutput({
-                  agentId: context.agentId,
-                  content: chunk.item.text,
-                  threadId: openbotThreadId
-                });
-              }
-              continue;
-            }
-            if (chunk.type === "item.completed" && chunk.item.type === "file_change" && chunk.item.status === "completed") {
-              for (const change of chunk.item.changes) {
-                collectCodexChange(change.path, change.kind, workingDirectory, changedFiles);
-              }
-            }
-            const widget = itemWidget(chunk.item);
-            if (!widget) continue;
-            yield uiWidget({
-              agentId: context.agentId,
-              threadId: openbotThreadId,
-              widget: toolTraceWidget({
-                widgetId: `codex_${chunk.item.id}`,
-                groupId: "codex:tools",
-                title: widget.title,
-                body: widget.body,
-                state: chunk.type === "item.completed" && (chunk.item.type === "command_execution" && chunk.item.status === "failed" || chunk.item.type === "file_change" && chunk.item.status === "failed" || chunk.item.type === "mcp_tool_call" && chunk.item.status === "failed" || chunk.item.type === "error") ? "error" : chunk.type === "item.completed" ? "submitted" : void 0
-              })
-            });
-          }
-          const diff = buildDiffWidget({
-            widgetId: `codex-diff:${openbotThreadId ?? "run"}:${Date.now()}`,
-            files: resolveRunDiffFiles({
-              snapshot,
-              fallback: changedFiles.values()
-            })
-          });
-          if (diff) {
-            yield uiWidget({
-              agentId: context.agentId,
-              threadId: openbotThreadId,
-              widget: diff
-            });
-          }
-        } catch (error) {
-          yield* fail(errorText(error));
-        }
-      });
-    };
-  }
+  models: { providers: ["openai"], default: "openai/gpt-5.6-luna" },
+  configSchema: pluginConfigSchema,
+  emptyPrompt: "Send a message to run Codex in this workspace.",
+  run: runCodexTurn
 });
-var plugin_codex_default = plugin;
+var src_default = plugin;
 export {
-  plugin_codex_default as default,
+  src_default as default,
   plugin
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meetopenbot/codex",
-  "version": "1.1.1",
+  "version": "1.2.1",
   "type": "module",
   "description": "OpenAI Codex agent plugin for OpenBot",
   "main": "./dist/index.js",
@@ -19,7 +19,7 @@
   ],
   "dependencies": {
     "@openai/codex-sdk": "0.148.0",
-    "@meetopenbot/plugin-sdk": "^0.2.0"
+    "@meetopenbot/plugin-sdk": "^0.3.0"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",
@@ -28,8 +28,8 @@
   },
   "types": "./dist/index.d.ts",
   "scripts": {
-    "build": "esbuild index.ts --bundle --platform=node --format=esm --outfile=dist/index.js --external:@meetopenbot/plugin-sdk --external:@openai/codex-sdk --external:zod && node ../../scripts/write-plugin-declaration.mjs",
-    "dev": "esbuild index.ts --bundle --platform=node --format=esm --outfile=dist/index.js --external:@meetopenbot/plugin-sdk --external:@openai/codex-sdk --external:zod --watch",
-    "typecheck": "tsc --noEmit --allowImportingTsExtensions --module ESNext --moduleResolution Bundler --target ES2022 --skipLibCheck index.ts"
+    "build": "esbuild src/index.ts --bundle --platform=node --format=esm --outfile=dist/index.js --external:@meetopenbot/plugin-sdk --external:@openai/codex-sdk --external:zod && node ../../scripts/write-plugin-declaration.mjs",
+    "dev": "esbuild src/index.ts --bundle --platform=node --format=esm --outfile=dist/index.js --external:@meetopenbot/plugin-sdk --external:@openai/codex-sdk --external:zod --watch",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
   }
 }