@wingman-ai/gateway 0.2.4 → 0.2.5

package/dist/providers/codex.cjs

@@ -34,6 +34,9 @@ const external_node_path_namespaceObject = require("node:path");
 const external_logger_cjs_namespaceObject = require("../logger.cjs");
 const CODEX_HOME_ENV = "CODEX_HOME";
 const CODEX_AUTH_FILE = "auth.json";
+const CODEX_REFRESH_TOKEN_URL_OVERRIDE_ENV = "CODEX_REFRESH_TOKEN_URL_OVERRIDE";
+const DEFAULT_CODEX_REFRESH_TOKEN_URL = "https://auth.openai.com/oauth/token";
+const TOKEN_REFRESH_BUFFER_MS = 300000;
 const DEFAULT_CODEX_INSTRUCTIONS = "You are Wingman, a coding assistant. Follow the user's request exactly and keep tool usage focused.";
 const logger = (0, external_logger_cjs_namespaceObject.createLogger)();
 function getCodexAuthPath() {
@@ -43,53 +46,77 @@ function getCodexAuthPath() {
 }
 function resolveCodexAuthFromFile() {
     const authPath = getCodexAuthPath();
-    if (!(0, external_node_fs_namespaceObject.existsSync)(authPath)) return {
+    const root = readCodexAuthRoot(authPath);
+    if (!root) return {
+        authPath
+    };
+    const tokens = root.tokens && "object" == typeof root.tokens ? root.tokens : void 0;
+    const accessToken = firstNonEmptyString([
+        tokens?.access_token,
+        root.access_token
+    ]);
+    const refreshToken = firstNonEmptyString([
+        tokens?.refresh_token,
+        root.refresh_token
+    ]);
+    const idToken = firstNonEmptyString([
+        tokens?.id_token,
+        root.id_token
+    ]);
+    const accountId = firstNonEmptyString([
+        tokens?.account_id,
+        root.account_id,
+        extractAccountIdFromIdToken(idToken)
+    ]);
+    return {
+        accessToken,
+        refreshToken,
+        idToken,
+        accountId,
         authPath
     };
-    try {
-        const parsed = JSON.parse((0, external_node_fs_namespaceObject.readFileSync)(authPath, "utf-8"));
-        if (!parsed || "object" != typeof parsed) return {
-            authPath
-        };
-        const root = parsed;
-        const tokens = root.tokens && "object" == typeof root.tokens ? root.tokens : void 0;
-        const accessToken = firstNonEmptyString([
-            tokens?.access_token,
-            root.access_token
-        ]);
-        const accountId = firstNonEmptyString([
-            tokens?.account_id,
-            root.account_id
-        ]);
-        return {
-            accessToken,
-            accountId,
-            authPath
-        };
-    } catch  {
-        return {
-            authPath
-        };
-    }
 }
 function createCodexFetch(options = {}) {
     const baseFetch = options.baseFetch || globalThis.fetch.bind(globalThis);
     return async (input, init)=>{
-        const codexAuth = resolveCodexAuthFromFile();
-        const accessToken = codexAuth.accessToken || options.fallbackToken;
-        const accountId = codexAuth.accountId || options.fallbackAccountId;
+        let codexAuth = await maybeRefreshCodexAuth({
+            authState: resolveCodexAuthFromFile(),
+            baseFetch
+        });
+        let accessToken = codexAuth.accessToken || options.fallbackToken;
+        let accountId = codexAuth.accountId || options.fallbackAccountId;
         if (!accessToken) throw new Error("Codex credentials missing. Run `codex login` or set CODEX_ACCESS_TOKEN.");
-        const headers = new Headers(init?.headers || {});
-        headers.delete("authorization");
-        headers.delete("x-api-key");
-        headers.set("Authorization", `Bearer ${accessToken}`);
-        if (accountId) headers.set("ChatGPT-Account-ID", accountId);
         const body = withCodexRequestDefaults(init?.body);
-        const response = await baseFetch(input, {
-            ...init,
-            headers,
+        let response = await dispatchCodexRequest({
+            input,
+            init,
+            baseFetch,
+            accessToken,
+            accountId,
             body
         });
+        if ((401 === response.status || 403 === response.status) && canRetryCodexRequest(body) && codexAuth.refreshToken) {
+            const refreshed = await maybeRefreshCodexAuth({
+                authState: codexAuth,
+                baseFetch,
+                force: true
+            });
+            const refreshedAccessToken = refreshed.accessToken || options.fallbackToken;
+            const refreshedAccountId = refreshed.accountId || options.fallbackAccountId;
+            if (refreshedAccessToken && refreshedAccessToken !== accessToken) {
+                codexAuth = refreshed;
+                accessToken = refreshedAccessToken;
+                accountId = refreshedAccountId;
+                response = await dispatchCodexRequest({
+                    input,
+                    init,
+                    baseFetch,
+                    accessToken,
+                    accountId,
+                    body
+                });
+            }
+        }
         if (!response.ok) {
             let responseBody = "";
             try {
@@ -105,6 +132,172 @@ function createCodexFetch(options = {}) {
         return response;
     };
 }
+async function dispatchCodexRequest(input) {
+    const headers = new Headers(input.init?.headers || {});
+    headers.delete("authorization");
+    headers.delete("x-api-key");
+    headers.set("Authorization", `Bearer ${input.accessToken}`);
+    if (input.accountId) headers.set("ChatGPT-Account-ID", input.accountId);
+    return input.baseFetch(input.input, {
+        ...input.init,
+        headers,
+        body: input.body
+    });
+}
+function canRetryCodexRequest(body) {
+    return null == body || "string" == typeof body || body instanceof URLSearchParams;
+}
+async function maybeRefreshCodexAuth(input) {
+    const { authState, baseFetch, force = false } = input;
+    if (!authState.refreshToken) return authState;
+    const shouldRefresh = force || !authState.accessToken || isTokenExpiredOrExpiring(authState.accessToken);
+    if (!shouldRefresh) return authState;
+    try {
+        const refreshed = await refreshCodexAuthToken(authState, baseFetch);
+        if (refreshed) return refreshed;
+    } catch (error) {
+        logger.warn("Failed to refresh Codex token", {
+            error: error instanceof Error ? error.message : String(error)
+        });
+    }
+    return authState;
+}
+async function refreshCodexAuthToken(authState, baseFetch) {
+    const refreshToken = authState.refreshToken;
+    if (!refreshToken) return;
+    const clientId = extractClientIdForRefresh(authState);
+    const tokenUrl = resolveCodexRefreshTokenUrl();
+    const form = new URLSearchParams({
+        grant_type: "refresh_token",
+        refresh_token: refreshToken
+    });
+    if (clientId) form.set("client_id", clientId);
+    const response = await baseFetch(tokenUrl, {
+        method: "POST",
+        headers: {
+            Accept: "application/json",
+            "Content-Type": "application/x-www-form-urlencoded"
+        },
+        body: form.toString()
+    });
+    if (!response.ok) {
+        const preview = await readResponsePreview(response);
+        logger.warn("Codex token refresh failed", {
+            status: response.status,
+            statusText: response.statusText || null,
+            bodyPreview: preview || null
+        });
+        return;
+    }
+    const payload = await response.json();
+    const accessToken = firstNonEmptyString([
+        payload.access_token
+    ]);
+    if (!accessToken) return void logger.warn("Codex token refresh failed: missing access_token");
+    const idToken = firstNonEmptyString([
+        payload.id_token,
+        authState.idToken
+    ]);
+    const refreshed = {
+        accessToken,
+        refreshToken: firstNonEmptyString([
+            payload.refresh_token,
+            authState.refreshToken
+        ]),
+        idToken,
+        accountId: firstNonEmptyString([
+            extractAccountIdFromIdToken(idToken),
+            authState.accountId
+        ])
+    };
+    persistCodexAuthUpdate(authState.authPath, refreshed);
+    return resolveCodexAuthFromFile();
+}
+async function readResponsePreview(response) {
+    try {
+        const text = await response.text();
+        return text.trim().slice(0, 1200);
+    } catch  {
+        return "";
+    }
+}
+function persistCodexAuthUpdate(authPath, updated) {
+    const root = readCodexAuthRoot(authPath) || {};
+    const existingTokens = root.tokens && "object" == typeof root.tokens && !Array.isArray(root.tokens) ? root.tokens : {};
+    const tokens = {
+        ...existingTokens,
+        access_token: updated.accessToken
+    };
+    if (updated.refreshToken) tokens.refresh_token = updated.refreshToken;
+    if (updated.idToken) tokens.id_token = updated.idToken;
+    if (updated.accountId) tokens.account_id = updated.accountId;
+    root.tokens = tokens;
+    root.last_refresh = new Date().toISOString();
+    (0, external_node_fs_namespaceObject.writeFileSync)(authPath, `${JSON.stringify(root, null, 2)}\n`, "utf-8");
+}
+function readCodexAuthRoot(authPath) {
+    if (!(0, external_node_fs_namespaceObject.existsSync)(authPath)) return;
+    try {
+        const parsed = JSON.parse((0, external_node_fs_namespaceObject.readFileSync)(authPath, "utf-8"));
+        if (!parsed || "object" != typeof parsed || Array.isArray(parsed)) return;
+        return parsed;
+    } catch  {
+        return;
+    }
+}
+function resolveCodexRefreshTokenUrl() {
+    const override = process.env[CODEX_REFRESH_TOKEN_URL_OVERRIDE_ENV];
+    if (override?.trim()) return override.trim();
+    return DEFAULT_CODEX_REFRESH_TOKEN_URL;
+}
+function extractClientIdForRefresh(authState) {
+    const accessTokenClaims = parseJwtPayload(authState.accessToken);
+    const accessTokenClientId = accessTokenClaims && "string" == typeof accessTokenClaims.client_id ? accessTokenClaims.client_id : void 0;
+    if (accessTokenClientId?.trim()) return accessTokenClientId.trim();
+    const idTokenClaims = parseJwtPayload(authState.idToken);
+    if (!idTokenClaims) return;
+    const aud = idTokenClaims.aud;
+    if ("string" == typeof aud && aud.trim()) return aud.trim();
+    if (Array.isArray(aud)) {
+        for (const value of aud)if ("string" == typeof value && value.trim()) return value.trim();
+    }
+}
+function isTokenExpiredOrExpiring(token) {
+    const expiryMs = extractTokenExpiryMs(token);
+    if (!expiryMs) return false;
+    return expiryMs <= Date.now() + TOKEN_REFRESH_BUFFER_MS;
+}
+function extractTokenExpiryMs(token) {
+    const payload = parseJwtPayload(token);
+    if (!payload || "number" != typeof payload.exp) return;
+    return 1000 * payload.exp;
+}
+function extractAccountIdFromIdToken(idToken) {
+    const payload = parseJwtPayload(idToken);
+    if (!payload) return;
+    const nested = payload["https://api.openai.com/auth"];
+    if (nested && "object" == typeof nested && !Array.isArray(nested)) {
+        const accountId = nested.chatgpt_account_id;
+        if ("string" == typeof accountId && accountId.trim()) return accountId.trim();
+    }
+    const direct = payload.chatgpt_account_id;
+    if ("string" == typeof direct && direct.trim()) return direct.trim();
+}
+function parseJwtPayload(token) {
+    if (!token) return;
+    const parts = token.split(".");
+    if (3 !== parts.length) return;
+    try {
+        const payload = parts[1];
+        const normalized = payload + "=".repeat((4 - payload.length % 4) % 4);
+        const decoded = Buffer.from(normalized, "base64url").toString("utf-8");
+        const parsed = JSON.parse(decoded);
+        if (!parsed || "object" != typeof parsed || Array.isArray(parsed)) return;
+        return parsed;
+    } catch  {
+        return;
+    }
+}
 function withCodexRequestDefaults(body) {
     if ("string" != typeof body || !body.trim()) return body;
     try {

package/dist/providers/codex.d.ts

@@ -1,6 +1,8 @@
 type FetchLike = (input: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]) => ReturnType<typeof fetch>;
 export interface CodexAuthState {
     accessToken?: string;
+    refreshToken?: string;
+    idToken?: string;
     accountId?: string;
     authPath: string;
 }

package/dist/providers/codex.js

@@ -1,9 +1,12 @@
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { createLogger } from "../logger.js";
 const CODEX_HOME_ENV = "CODEX_HOME";
 const CODEX_AUTH_FILE = "auth.json";
+const CODEX_REFRESH_TOKEN_URL_OVERRIDE_ENV = "CODEX_REFRESH_TOKEN_URL_OVERRIDE";
+const DEFAULT_CODEX_REFRESH_TOKEN_URL = "https://auth.openai.com/oauth/token";
+const TOKEN_REFRESH_BUFFER_MS = 300000;
 const DEFAULT_CODEX_INSTRUCTIONS = "You are Wingman, a coding assistant. Follow the user's request exactly and keep tool usage focused.";
 const logger = createLogger();
 function getCodexAuthPath() {
@@ -13,53 +16,77 @@ function getCodexAuthPath() {
 }
 function resolveCodexAuthFromFile() {
     const authPath = getCodexAuthPath();
-    if (!existsSync(authPath)) return {
+    const root = readCodexAuthRoot(authPath);
+    if (!root) return {
+        authPath
+    };
+    const tokens = root.tokens && "object" == typeof root.tokens ? root.tokens : void 0;
+    const accessToken = firstNonEmptyString([
+        tokens?.access_token,
+        root.access_token
+    ]);
+    const refreshToken = firstNonEmptyString([
+        tokens?.refresh_token,
+        root.refresh_token
+    ]);
+    const idToken = firstNonEmptyString([
+        tokens?.id_token,
+        root.id_token
+    ]);
+    const accountId = firstNonEmptyString([
+        tokens?.account_id,
+        root.account_id,
+        extractAccountIdFromIdToken(idToken)
+    ]);
+    return {
+        accessToken,
+        refreshToken,
+        idToken,
+        accountId,
         authPath
     };
-    try {
-        const parsed = JSON.parse(readFileSync(authPath, "utf-8"));
-        if (!parsed || "object" != typeof parsed) return {
-            authPath
-        };
-        const root = parsed;
-        const tokens = root.tokens && "object" == typeof root.tokens ? root.tokens : void 0;
-        const accessToken = firstNonEmptyString([
-            tokens?.access_token,
-            root.access_token
-        ]);
-        const accountId = firstNonEmptyString([
-            tokens?.account_id,
-            root.account_id
-        ]);
-        return {
-            accessToken,
-            accountId,
-            authPath
-        };
-    } catch  {
-        return {
-            authPath
-        };
-    }
 }
 function createCodexFetch(options = {}) {
     const baseFetch = options.baseFetch || globalThis.fetch.bind(globalThis);
     return async (input, init)=>{
-        const codexAuth = resolveCodexAuthFromFile();
-        const accessToken = codexAuth.accessToken || options.fallbackToken;
-        const accountId = codexAuth.accountId || options.fallbackAccountId;
+        let codexAuth = await maybeRefreshCodexAuth({
+            authState: resolveCodexAuthFromFile(),
+            baseFetch
+        });
+        let accessToken = codexAuth.accessToken || options.fallbackToken;
+        let accountId = codexAuth.accountId || options.fallbackAccountId;
         if (!accessToken) throw new Error("Codex credentials missing. Run `codex login` or set CODEX_ACCESS_TOKEN.");
-        const headers = new Headers(init?.headers || {});
-        headers.delete("authorization");
-        headers.delete("x-api-key");
-        headers.set("Authorization", `Bearer ${accessToken}`);
-        if (accountId) headers.set("ChatGPT-Account-ID", accountId);
         const body = withCodexRequestDefaults(init?.body);
-        const response = await baseFetch(input, {
-            ...init,
-            headers,
+        let response = await dispatchCodexRequest({
+            input,
+            init,
+            baseFetch,
+            accessToken,
+            accountId,
             body
         });
+        if ((401 === response.status || 403 === response.status) && canRetryCodexRequest(body) && codexAuth.refreshToken) {
+            const refreshed = await maybeRefreshCodexAuth({
+                authState: codexAuth,
+                baseFetch,
+                force: true
+            });
+            const refreshedAccessToken = refreshed.accessToken || options.fallbackToken;
+            const refreshedAccountId = refreshed.accountId || options.fallbackAccountId;
+            if (refreshedAccessToken && refreshedAccessToken !== accessToken) {
+                codexAuth = refreshed;
+                accessToken = refreshedAccessToken;
+                accountId = refreshedAccountId;
+                response = await dispatchCodexRequest({
+                    input,
+                    init,
+                    baseFetch,
+                    accessToken,
+                    accountId,
+                    body
+                });
+            }
+        }
         if (!response.ok) {
             let responseBody = "";
             try {
@@ -75,6 +102,172 @@ function createCodexFetch(options = {}) {
         return response;
     };
 }
+async function dispatchCodexRequest(input) {
+    const headers = new Headers(input.init?.headers || {});
+    headers.delete("authorization");
+    headers.delete("x-api-key");
+    headers.set("Authorization", `Bearer ${input.accessToken}`);
+    if (input.accountId) headers.set("ChatGPT-Account-ID", input.accountId);
+    return input.baseFetch(input.input, {
+        ...input.init,
+        headers,
+        body: input.body
+    });
+}
+function canRetryCodexRequest(body) {
+    return null == body || "string" == typeof body || body instanceof URLSearchParams;
+}
+async function maybeRefreshCodexAuth(input) {
+    const { authState, baseFetch, force = false } = input;
+    if (!authState.refreshToken) return authState;
+    const shouldRefresh = force || !authState.accessToken || isTokenExpiredOrExpiring(authState.accessToken);
+    if (!shouldRefresh) return authState;
+    try {
+        const refreshed = await refreshCodexAuthToken(authState, baseFetch);
+        if (refreshed) return refreshed;
+    } catch (error) {
+        logger.warn("Failed to refresh Codex token", {
+            error: error instanceof Error ? error.message : String(error)
+        });
+    }
+    return authState;
+}
+async function refreshCodexAuthToken(authState, baseFetch) {
+    const refreshToken = authState.refreshToken;
+    if (!refreshToken) return;
+    const clientId = extractClientIdForRefresh(authState);
+    const tokenUrl = resolveCodexRefreshTokenUrl();
+    const form = new URLSearchParams({
+        grant_type: "refresh_token",
+        refresh_token: refreshToken
+    });
+    if (clientId) form.set("client_id", clientId);
+    const response = await baseFetch(tokenUrl, {
+        method: "POST",
+        headers: {
+            Accept: "application/json",
+            "Content-Type": "application/x-www-form-urlencoded"
+        },
+        body: form.toString()
+    });
+    if (!response.ok) {
+        const preview = await readResponsePreview(response);
+        logger.warn("Codex token refresh failed", {
+            status: response.status,
+            statusText: response.statusText || null,
+            bodyPreview: preview || null
+        });
+        return;
+    }
+    const payload = await response.json();
+    const accessToken = firstNonEmptyString([
+        payload.access_token
+    ]);
+    if (!accessToken) return void logger.warn("Codex token refresh failed: missing access_token");
+    const idToken = firstNonEmptyString([
+        payload.id_token,
+        authState.idToken
+    ]);
+    const refreshed = {
+        accessToken,
+        refreshToken: firstNonEmptyString([
+            payload.refresh_token,
+            authState.refreshToken
+        ]),
+        idToken,
+        accountId: firstNonEmptyString([
+            extractAccountIdFromIdToken(idToken),
+            authState.accountId
+        ])
+    };
+    persistCodexAuthUpdate(authState.authPath, refreshed);
+    return resolveCodexAuthFromFile();
+}
+async function readResponsePreview(response) {
+    try {
+        const text = await response.text();
+        return text.trim().slice(0, 1200);
+    } catch  {
+        return "";
+    }
+}
+function persistCodexAuthUpdate(authPath, updated) {
+    const root = readCodexAuthRoot(authPath) || {};
+    const existingTokens = root.tokens && "object" == typeof root.tokens && !Array.isArray(root.tokens) ? root.tokens : {};
+    const tokens = {
+        ...existingTokens,
+        access_token: updated.accessToken
+    };
+    if (updated.refreshToken) tokens.refresh_token = updated.refreshToken;
+    if (updated.idToken) tokens.id_token = updated.idToken;
+    if (updated.accountId) tokens.account_id = updated.accountId;
+    root.tokens = tokens;
+    root.last_refresh = new Date().toISOString();
+    writeFileSync(authPath, `${JSON.stringify(root, null, 2)}\n`, "utf-8");
+}
+function readCodexAuthRoot(authPath) {
+    if (!existsSync(authPath)) return;
+    try {
+        const parsed = JSON.parse(readFileSync(authPath, "utf-8"));
+        if (!parsed || "object" != typeof parsed || Array.isArray(parsed)) return;
+        return parsed;
+    } catch  {
+        return;
+    }
+}
+function resolveCodexRefreshTokenUrl() {
+    const override = process.env[CODEX_REFRESH_TOKEN_URL_OVERRIDE_ENV];
+    if (override?.trim()) return override.trim();
+    return DEFAULT_CODEX_REFRESH_TOKEN_URL;
+}
+function extractClientIdForRefresh(authState) {
+    const accessTokenClaims = parseJwtPayload(authState.accessToken);
+    const accessTokenClientId = accessTokenClaims && "string" == typeof accessTokenClaims.client_id ? accessTokenClaims.client_id : void 0;
+    if (accessTokenClientId?.trim()) return accessTokenClientId.trim();
+    const idTokenClaims = parseJwtPayload(authState.idToken);
+    if (!idTokenClaims) return;
+    const aud = idTokenClaims.aud;
+    if ("string" == typeof aud && aud.trim()) return aud.trim();
+    if (Array.isArray(aud)) {
+        for (const value of aud)if ("string" == typeof value && value.trim()) return value.trim();
+    }
+}
+function isTokenExpiredOrExpiring(token) {
+    const expiryMs = extractTokenExpiryMs(token);
+    if (!expiryMs) return false;
+    return expiryMs <= Date.now() + TOKEN_REFRESH_BUFFER_MS;
+}
+function extractTokenExpiryMs(token) {
+    const payload = parseJwtPayload(token);
+    if (!payload || "number" != typeof payload.exp) return;
+    return 1000 * payload.exp;
+}
+function extractAccountIdFromIdToken(idToken) {
+    const payload = parseJwtPayload(idToken);
+    if (!payload) return;
+    const nested = payload["https://api.openai.com/auth"];
+    if (nested && "object" == typeof nested && !Array.isArray(nested)) {
+        const accountId = nested.chatgpt_account_id;
+        if ("string" == typeof accountId && accountId.trim()) return accountId.trim();
+    }
+    const direct = payload.chatgpt_account_id;
+    if ("string" == typeof direct && direct.trim()) return direct.trim();
+}
+function parseJwtPayload(token) {
+    if (!token) return;
+    const parts = token.split(".");
+    if (3 !== parts.length) return;
+    try {
+        const payload = parts[1];
+        const normalized = payload + "=".repeat((4 - payload.length % 4) % 4);
+        const decoded = Buffer.from(normalized, "base64url").toString("utf-8");
+        const parsed = JSON.parse(decoded);
+        if (!parsed || "object" != typeof parsed || Array.isArray(parsed)) return;
+        return parsed;
+    } catch  {
+        return;
+    }
+}
 function withCodexRequestDefaults(body) {
     if ("string" != typeof body || !body.trim()) return body;
     try {