@skaile/workspaces 5.10.0 → 5.12.0

package/dist/bridge/drivers/codex.js

@@ -1,28 +1,28 @@
 import { CodexAppServerClient } from '../../chunk-K4O6L3WH.js';
 import { freshBudget, decide, spend } from '../../chunk-IZCR27MU.js';
-import { managedCodexRegistryViolation, parseCodexCredential, prepareNativePolicy, prepareCodexInstance, codexInstanceEnvironment, isNativeApprovalPolicyActive, activateNativeApprovalPolicy, parseCodexRefreshResult, allowsNativeApprovalPath } from '../../chunk-NWDSLXOX.js';
+import { managedCodexRegistryViolation, parseCodexCredential, prepareNativePolicy, prepareCodexInstance, codexInstanceEnvironment, isNativeApprovalPolicyActive, activateNativeApprovalPolicy, parseCodexRefreshResult, allowsNativeApprovalPath } from '../../chunk-PHRNUTSG.js';
 import { CodexNativeStateUnavailable } from '../../chunk-LOO5CB5M.js';
-import { fetchProviderModels } from '../../chunk-OOWHXOK6.js';
+import { fetchProviderModels } from '../../chunk-NJXR5OAM.js';
 import { ReconfigureLedger, stripRunnerPrivateEnv, classifyGenericErrorMessage } from '../../chunk-B4X2N7JQ.js';
 import '../../chunk-YROR332M.js';
-import { BUILTIN_DRIVER_CATALOG, AgentDriver, TOOL_ALLOWLIST_UNSUPPORTED, getBridgeLogger, registryCredentialEnv, entryCredentialValue, registryDriverConfig, getProviderPreset, providerCredentialEnvName } from '../../chunk-HJ5MCB3L.js';
+import { BUILTIN_DRIVER_CATALOG, AgentDriver, TOOL_ALLOWLIST_UNSUPPORTED, getBridgeLogger, registryCredentialEnv, entryCredentialValue, registryDriverConfig, getProviderPreset, providerCredentialEnvName } from '../../chunk-MF54ZHWT.js';
 import '../../chunk-6E6PKKAD.js';
-import '../../chunk-32XKCNCL.js';
-import '../../chunk-2FMEGSBN.js';
+import '../../chunk-6VLHITAM.js';
+import { installCommandFor } from '../../chunk-T5TSLSRO.js';
 import '../../chunk-4GY63JU6.js';
-import '../../chunk-GFCXNFTW.js';
+import '../../chunk-SHQMPGOL.js';
 import '../../chunk-PMECEZK3.js';
 import '../../chunk-5BEFNLOR.js';
 import '../../chunk-A2ULN3KX.js';
-import '../../chunk-JZCSNEHK.js';
+import '../../chunk-PNOGX36L.js';
 import { globalSkaileDir } from '../../chunk-L5VSIPQD.js';
 import '../../chunk-CPSIPIX7.js';
-import '../../chunk-IXWODEED.js';
+import '../../chunk-CTP3XBMF.js';
 import '../../chunk-RVRB27AN.js';
-import '../../chunk-Y34MSWEZ.js';
-import '../../chunk-4OV5DSBB.js';
+import '../../chunk-XTVSNWLL.js';
+import '../../chunk-PNTXHTBC.js';
 import '../../chunk-ICSCSM5D.js';
-import '../../chunk-DALV4HHP.js';
+import '../../chunk-DKXNKFKP.js';
 import { resolveEntryBaseUrl, registryEntries, parseModelRef, isEntryEnabled } from '../../chunk-MJHSLODD.js';
 import '../../chunk-C3CAXQMA.js';
 import '../../chunk-BOFL7GIF.js';
@@ -518,6 +518,7 @@ var ManagedCodexDriver = class extends AgentDriver {
     const handlers = {
       "account/chatgptAuthTokens/refresh": async (params, signal) => {
         const active = this.active;
+        if (!active && !this.starting) throw failure("CODEX_AUTH_UNAVAILABLE");
         if (!active) this.startupAuthAttempted = true;
         const cancellation = AbortSignal.any([
           signal,
@@ -1272,6 +1273,10 @@ var CODEX_WIRE_API = {
   "openai-responses": "responses",
   "azure-openai-responses": "responses"
 };
+var CODEX_RESERVED_PROVIDER_IDS = /* @__PURE__ */ new Set(["openai", "ollama", "lmstudio"]);
+function codexProviderTableId(id) {
+  return CODEX_RESERVED_PROVIDER_IDS.has(id) ? `skaile-${id}` : id;
+}
 var ENV_DELIVERED_CREDENTIALS = {
   api_key_header: true,
   bearer: true,
@@ -1310,7 +1315,7 @@ function buildCodexConfigDocument(input) {
   for (const [id, entry] of entries) {
     const rendered = renderCodexProviderTable(id, entry);
     if ("skipped" in rendered) skipped.push({ id, reason: rendered.skipped });
-    else document.model_providers[id] = rendered.table;
+    else document.model_providers[codexProviderTableId(id)] = rendered.table;
   }
   if (!input.registry) return { document, skipped, warnings: [] };
   const selected = parseModelRef(
@@ -1320,8 +1325,9 @@ function buildCodexConfigDocument(input) {
   );
   if (!selected) return { document, skipped, warnings: [] };
   const warnings = selected.warnings;
-  if (!document.model_providers[selected.providerId]) return { document, skipped, warnings };
-  document.model_provider = selected.providerId;
+  const tableId = codexProviderTableId(selected.providerId);
+  if (!document.model_providers[tableId]) return { document, skipped, warnings };
+  document.model_provider = tableId;
   if (selected.providerModelId) document.model = selected.providerModelId;
   return {
     document,
@@ -1345,11 +1351,11 @@ function codexSessionHome(config) {
 }
 function writeCodexConfigToml(home, document) {
   const path = join(home, "config.toml");
+  mkdirSync(home, { recursive: true, mode: 448 });
   if (Object.keys(document.model_providers).length === 0) {
     rmSync(path, { force: true });
     return void 0;
   }
-  mkdirSync(home, { recursive: true, mode: 448 });
   const temporary = join(home, "config.toml.new");
   rmSync(temporary, { force: true });
   writeFileSync(temporary, renderCodexConfigToml(document), { mode: 384, flag: "wx" });
@@ -1368,9 +1374,23 @@ function buildCodexChildEnv(parent, codexHome) {
   for (const [key, value] of Object.entries(parent)) {
     if (key.startsWith("PI_") && typeof value === "string") out[key] = value;
   }
+  for (const key of ["OPENAI_API_KEY", "CODEX_API_KEY"]) {
+    const v = parent[key];
+    if (v) out[key] = v;
+  }
   out.CODEX_HOME = codexHome;
   return out;
 }
+function missingCodexCredential(build, env) {
+  const table = build.providerId ? build.document.model_providers[codexProviderTableId(build.providerId)] : void 0;
+  if (table) {
+    if (table.requires_openai_auth) return void 0;
+    if (!table.env_key || env[table.env_key]) return void 0;
+    return `codex driver: the AI provider entry '${build.providerId}' has no credential; export the variable its credential names (see \`skaile providers test ${build.providerId}\`)`;
+  }
+  if (env.OPENAI_API_KEY || env.CODEX_API_KEY) return void 0;
+  return "codex driver needs OPENAI_API_KEY (or an AI provider entry with a credential); a ChatGPT login of the codex CLI is not shared with skaile";
+}
 var CodexDriver = class extends AgentDriver {
   driverInfo = {
     id: "codex",
@@ -1420,7 +1440,9 @@ var CodexDriver = class extends AgentDriver {
       sdk = await import('@openai/codex-sdk');
     } catch (err) {
       this.log.error("codex SDK load failed", err);
-      throw new Error("Codex SDK not installed. Run: bun add @openai/codex-sdk");
+      throw new Error(
+        `Codex SDK not installed. Run: ${installCommandFor("@openai/codex-sdk", this.config.cwd)}`
+      );
     }
     const codexHome = codexSessionHome(this.config);
     const build = buildCodexConfigDocument({
@@ -1442,6 +1464,11 @@ var CodexDriver = class extends AgentDriver {
       registryCredentialEnv(this.config.registry ?? {}, { env: { ...process.env, ...env } })
     );
     stripRunnerPrivateEnv(env);
+    const missing = missingCodexCredential(build, env);
+    if (missing) {
+      this.log.error("codex credential missing", { reason: missing });
+      throw Object.assign(new Error(missing), { category: "config", hint: missing });
+    }
     const instructionsFile = this.writeInstructionsFile();
     const client = new sdk.Codex({
       apiKey: env.OPENAI_API_KEY,