@pixelbyte-software/pixcode 1.30.2 → 1.31.0

package/server/modules/providers/list/codex/codex-auth.provider.ts

@@ -1,100 +1,115 @@
-import { readFile } from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-
-import spawn from 'cross-spawn';
-
-import type { IProviderAuth } from '@/shared/interfaces.js';
-import type { ProviderAuthStatus } from '@/shared/types.js';
-import { readObjectRecord, readOptionalString } from '@/shared/utils.js';
-
-type CodexCredentialsStatus = {
-  authenticated: boolean;
-  email: string | null;
-  method: string | null;
-  error?: string;
-};
-
-export class CodexProviderAuth implements IProviderAuth {
-  /**
-   * Checks whether Codex is available to the server runtime.
-   */
-  private checkInstalled(): boolean {
-    try {
-      spawn.sync('codex', ['--version'], { stdio: 'ignore', timeout: 5000 });
-      return true;
-    } catch {
-      return false;
-    }
-  }
-
-  /**
-   * Returns Codex SDK availability and credential status.
-   */
-  async getStatus(): Promise<ProviderAuthStatus> {
-    const installed = this.checkInstalled();
-    const credentials = await this.checkCredentials();
-
-    return {
-      installed,
-      provider: 'codex',
-      authenticated: credentials.authenticated,
-      email: credentials.email,
-      method: credentials.method,
-      error: credentials.authenticated ? undefined : credentials.error || 'Not authenticated',
-    };
-  }
-
-  /**
-   * Reads Codex auth.json and checks OAuth tokens or an API key fallback.
-   */
-  private async checkCredentials(): Promise<CodexCredentialsStatus> {
-    try {
-      const authPath = path.join(os.homedir(), '.codex', 'auth.json');
-      const content = await readFile(authPath, 'utf8');
-      const auth = readObjectRecord(JSON.parse(content)) ?? {};
-      const tokens = readObjectRecord(auth.tokens) ?? {};
-      const idToken = readOptionalString(tokens.id_token);
-      const accessToken = readOptionalString(tokens.access_token);
-
-      if (idToken || accessToken) {
-        return {
-          authenticated: true,
-          email: idToken ? this.readEmailFromIdToken(idToken) : 'Authenticated',
-          method: 'credentials_file',
-        };
-      }
-
-      if (readOptionalString(auth.OPENAI_API_KEY)) {
-        return { authenticated: true, email: 'API Key Auth', method: 'api_key' };
-      }
-
-      return { authenticated: false, email: null, method: null, error: 'No valid tokens found' };
-    } catch (error) {
-      const code = (error as NodeJS.ErrnoException).code;
-      return {
-        authenticated: false,
-        email: null,
-        method: null,
-        error: code === 'ENOENT' ? 'Codex not configured' : error instanceof Error ? error.message : 'Failed to read Codex auth',
-      };
-    }
-  }
-
-  /**
-   * Extracts the user email from a Codex id_token when a readable JWT payload exists.
-   */
-  private readEmailFromIdToken(idToken: string): string {
-    try {
-      const parts = idToken.split('.');
-      if (parts.length >= 2) {
-        const payload = readObjectRecord(JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8')));
-        return readOptionalString(payload?.email) ?? readOptionalString(payload?.user) ?? 'Authenticated';
-      }
-    } catch {
-      // Fall back to a generic authenticated marker if the token payload is not readable.
-    }
-
-    return 'Authenticated';
-  }
-}
+import { readFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+import spawn from 'cross-spawn';
+
+import type { IProviderAuth } from '@/shared/interfaces.js';
+import type { ProviderAuthStatus } from '@/shared/types.js';
+import { readObjectRecord, readOptionalString } from '@/shared/utils.js';
+// eslint-disable-next-line @typescript-eslint/ban-ts-comment
+// @ts-ignore — plain-JS module
+import { getProviderCredentials } from '@/services/provider-credentials.js';
+
+type CodexCredentialsStatus = {
+  authenticated: boolean;
+  email: string | null;
+  method: string | null;
+  error?: string;
+};
+
+export class CodexProviderAuth implements IProviderAuth {
+  /**
+   * Checks whether Codex is available to the server runtime.
+   */
+  private checkInstalled(): boolean {
+    try {
+      const result = spawn.sync('codex', ['--version'], { stdio: 'ignore', timeout: 5000 });
+      return !result.error && result.status === 0;
+    } catch {
+      return false;
+    }
+  }
+
+  /**
+   * Returns Codex SDK availability and credential status.
+   */
+  async getStatus(): Promise<ProviderAuthStatus> {
+    const installed = this.checkInstalled();
+    const credentials = await this.checkCredentials();
+
+    return {
+      installed,
+      provider: 'codex',
+      authenticated: credentials.authenticated,
+      email: credentials.email,
+      method: credentials.method,
+      error: credentials.authenticated ? undefined : credentials.error || 'Not authenticated',
+    };
+  }
+
+  /**
+   * Reads Codex auth.json and checks OAuth tokens or an API key fallback.
+   */
+  private async checkCredentials(): Promise<CodexCredentialsStatus> {
+    // Pixcode-UI-saved OpenAI credentials count as authenticated — covers
+    // users who paste a key through our Settings > Agents form.
+    try {
+      const creds = await getProviderCredentials('codex');
+      if (creds?.apiKey) {
+        const label = creds.baseUrl
+          ? `API Key · ${(() => { try { return new URL(creds.baseUrl).host; } catch { return creds.baseUrl; } })()}`
+          : 'API Key Auth';
+        return { authenticated: true, email: label, method: 'pixcode_store' };
+      }
+    } catch { /* fall through */ }
+
+    try {
+      const authPath = path.join(os.homedir(), '.codex', 'auth.json');
+      const content = await readFile(authPath, 'utf8');
+      const auth = readObjectRecord(JSON.parse(content)) ?? {};
+      const tokens = readObjectRecord(auth.tokens) ?? {};
+      const idToken = readOptionalString(tokens.id_token);
+      const accessToken = readOptionalString(tokens.access_token);
+
+      if (idToken || accessToken) {
+        return {
+          authenticated: true,
+          email: idToken ? this.readEmailFromIdToken(idToken) : 'Authenticated',
+          method: 'credentials_file',
+        };
+      }
+
+      if (readOptionalString(auth.OPENAI_API_KEY)) {
+        return { authenticated: true, email: 'API Key Auth', method: 'api_key' };
+      }
+
+      return { authenticated: false, email: null, method: null, error: 'No valid tokens found' };
+    } catch (error) {
+      const code = (error as NodeJS.ErrnoException).code;
+      return {
+        authenticated: false,
+        email: null,
+        method: null,
+        error: code === 'ENOENT' ? 'Codex not configured' : error instanceof Error ? error.message : 'Failed to read Codex auth',
+      };
+    }
+  }
+
+  /**
+   * Extracts the user email from a Codex id_token when a readable JWT payload exists.
+   */
+  private readEmailFromIdToken(idToken: string): string {
+    try {
+      const parts = idToken.split('.');
+      if (parts.length >= 2) {
+        const payload = readObjectRecord(JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8')));
+        return readOptionalString(payload?.email) ?? readOptionalString(payload?.user) ?? 'Authenticated';
+      }
+    } catch {
+      // Fall back to a generic authenticated marker if the token payload is not readable.
+    }
+
+    return 'Authenticated';
+  }
+}

package/server/modules/providers/list/codex/codex-mcp.provider.ts

@@ -1,135 +1,135 @@
-import { mkdir, readFile, writeFile } from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-
-import TOML from '@iarna/toml';
-
-import { McpProvider } from '@/modules/providers/shared/mcp/mcp.provider.js';
-import type { McpScope, ProviderMcpServer, UpsertProviderMcpServerInput } from '@/shared/types.js';
-import {
-  AppError,
-  readObjectRecord,
-  readOptionalString,
-  readStringArray,
-  readStringRecord,
-} from '@/shared/utils.js';
-
-const readTomlConfig = async (filePath: string): Promise<Record<string, unknown>> => {
-  try {
-    const content = await readFile(filePath, 'utf8');
-    const parsed = TOML.parse(content) as Record<string, unknown>;
-    return readObjectRecord(parsed) ?? {};
-  } catch (error) {
-    const code = (error as NodeJS.ErrnoException).code;
-    if (code === 'ENOENT') {
-      return {};
-    }
-    throw error;
-  }
-};
-
-const writeTomlConfig = async (filePath: string, data: Record<string, unknown>): Promise<void> => {
-  await mkdir(path.dirname(filePath), { recursive: true });
-  const toml = TOML.stringify(data as never);
-  await writeFile(filePath, toml, 'utf8');
-};
-
-export class CodexMcpProvider extends McpProvider {
-  constructor() {
-    super('codex', ['user', 'project'], ['stdio', 'http']);
-  }
-
-  protected async readScopedServers(scope: McpScope, workspacePath: string): Promise<Record<string, unknown>> {
-    const filePath = scope === 'user'
-      ? path.join(os.homedir(), '.codex', 'config.toml')
-      : path.join(workspacePath, '.codex', 'config.toml');
-    const config = await readTomlConfig(filePath);
-    return readObjectRecord(config.mcp_servers) ?? {};
-  }
-
-  protected async writeScopedServers(
-    scope: McpScope,
-    workspacePath: string,
-    servers: Record<string, unknown>,
-  ): Promise<void> {
-    const filePath = scope === 'user'
-      ? path.join(os.homedir(), '.codex', 'config.toml')
-      : path.join(workspacePath, '.codex', 'config.toml');
-    const config = await readTomlConfig(filePath);
-    config.mcp_servers = servers;
-    await writeTomlConfig(filePath, config);
-  }
-
-  protected buildServerConfig(input: UpsertProviderMcpServerInput): Record<string, unknown> {
-    if (input.transport === 'stdio') {
-      if (!input.command?.trim()) {
-        throw new AppError('command is required for stdio MCP servers.', {
-          code: 'MCP_COMMAND_REQUIRED',
-          statusCode: 400,
-        });
-      }
-
-      return {
-        command: input.command,
-        args: input.args ?? [],
-        env: input.env ?? {},
-        env_vars: input.envVars ?? [],
-        cwd: input.cwd,
-      };
-    }
-
-    if (!input.url?.trim()) {
-      throw new AppError('url is required for http MCP servers.', {
-        code: 'MCP_URL_REQUIRED',
-        statusCode: 400,
-      });
-    }
-
-    return {
-      url: input.url,
-      bearer_token_env_var: input.bearerTokenEnvVar,
-      http_headers: input.headers ?? {},
-      env_http_headers: input.envHttpHeaders ?? {},
-    };
-  }
-
-  protected normalizeServerConfig(
-    scope: McpScope,
-    name: string,
-    rawConfig: unknown,
-  ): ProviderMcpServer | null {
-    if (!rawConfig || typeof rawConfig !== 'object') {
-      return null;
-    }
-
-    const config = rawConfig as Record<string, unknown>;
-    if (typeof config.command === 'string') {
-      return {
-        provider: 'codex',
-        name,
-        scope,
-        transport: 'stdio',
-        command: config.command,
-        args: readStringArray(config.args),
-        env: readStringRecord(config.env),
-        cwd: readOptionalString(config.cwd),
-        envVars: readStringArray(config.env_vars),
-      };
-    }
-
-    if (typeof config.url === 'string') {
-      return {
-        provider: 'codex',
-        name,
-        scope,
-        transport: 'http',
-        url: config.url,
-        headers: readStringRecord(config.http_headers),
-        bearerTokenEnvVar: readOptionalString(config.bearer_token_env_var),
-        envHttpHeaders: readStringRecord(config.env_http_headers),
-      };
-    }
-
-    return null;
-  }
-}
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+import TOML from '@iarna/toml';
+
+import { McpProvider } from '@/modules/providers/shared/mcp/mcp.provider.js';
+import type { McpScope, ProviderMcpServer, UpsertProviderMcpServerInput } from '@/shared/types.js';
+import {
+  AppError,
+  readObjectRecord,
+  readOptionalString,
+  readStringArray,
+  readStringRecord,
+} from '@/shared/utils.js';
+
+const readTomlConfig = async (filePath: string): Promise<Record<string, unknown>> => {
+  try {
+    const content = await readFile(filePath, 'utf8');
+    const parsed = TOML.parse(content) as Record<string, unknown>;
+    return readObjectRecord(parsed) ?? {};
+  } catch (error) {
+    const code = (error as NodeJS.ErrnoException).code;
+    if (code === 'ENOENT') {
+      return {};
+    }
+    throw error;
+  }
+};
+
+const writeTomlConfig = async (filePath: string, data: Record<string, unknown>): Promise<void> => {
+  await mkdir(path.dirname(filePath), { recursive: true });
+  const toml = TOML.stringify(data as never);
+  await writeFile(filePath, toml, 'utf8');
+};
+
+export class CodexMcpProvider extends McpProvider {
+  constructor() {
+    super('codex', ['user', 'project'], ['stdio', 'http']);
+  }
+
+  protected async readScopedServers(scope: McpScope, workspacePath: string): Promise<Record<string, unknown>> {
+    const filePath = scope === 'user'
+      ? path.join(os.homedir(), '.codex', 'config.toml')
+      : path.join(workspacePath, '.codex', 'config.toml');
+    const config = await readTomlConfig(filePath);
+    return readObjectRecord(config.mcp_servers) ?? {};
+  }
+
+  protected async writeScopedServers(
+    scope: McpScope,
+    workspacePath: string,
+    servers: Record<string, unknown>,
+  ): Promise<void> {
+    const filePath = scope === 'user'
+      ? path.join(os.homedir(), '.codex', 'config.toml')
+      : path.join(workspacePath, '.codex', 'config.toml');
+    const config = await readTomlConfig(filePath);
+    config.mcp_servers = servers;
+    await writeTomlConfig(filePath, config);
+  }
+
+  protected buildServerConfig(input: UpsertProviderMcpServerInput): Record<string, unknown> {
+    if (input.transport === 'stdio') {
+      if (!input.command?.trim()) {
+        throw new AppError('command is required for stdio MCP servers.', {
+          code: 'MCP_COMMAND_REQUIRED',
+          statusCode: 400,
+        });
+      }
+
+      return {
+        command: input.command,
+        args: input.args ?? [],
+        env: input.env ?? {},
+        env_vars: input.envVars ?? [],
+        cwd: input.cwd,
+      };
+    }
+
+    if (!input.url?.trim()) {
+      throw new AppError('url is required for http MCP servers.', {
+        code: 'MCP_URL_REQUIRED',
+        statusCode: 400,
+      });
+    }
+
+    return {
+      url: input.url,
+      bearer_token_env_var: input.bearerTokenEnvVar,
+      http_headers: input.headers ?? {},
+      env_http_headers: input.envHttpHeaders ?? {},
+    };
+  }
+
+  protected normalizeServerConfig(
+    scope: McpScope,
+    name: string,
+    rawConfig: unknown,
+  ): ProviderMcpServer | null {
+    if (!rawConfig || typeof rawConfig !== 'object') {
+      return null;
+    }
+
+    const config = rawConfig as Record<string, unknown>;
+    if (typeof config.command === 'string') {
+      return {
+        provider: 'codex',
+        name,
+        scope,
+        transport: 'stdio',
+        command: config.command,
+        args: readStringArray(config.args),
+        env: readStringRecord(config.env),
+        cwd: readOptionalString(config.cwd),
+        envVars: readStringArray(config.env_vars),
+      };
+    }
+
+    if (typeof config.url === 'string') {
+      return {
+        provider: 'codex',
+        name,
+        scope,
+        transport: 'http',
+        url: config.url,
+        headers: readStringRecord(config.http_headers),
+        bearerTokenEnvVar: readOptionalString(config.bearer_token_env_var),
+        envHttpHeaders: readStringRecord(config.env_http_headers),
+      };
+    }
+
+    return null;
+  }
+}