@yanzc/claude-pro 0.0.0-stage → 0.4.0

package/src/checkpoints.js

@@ -0,0 +1,184 @@
+// Checkpoints: before the agent edits a file (Write / Edit / NotebookEdit), the file's
+// previous content is saved, grouped by the user prompt that led to the edit. /rewind can
+// then put files back, rewind the conversation, or both. Changes made by shell commands
+// (Bash) are not tracked.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { estimateTokens } from './agent.js';
+
+const MAX_SNAPSHOT_BYTES = 200 * 1024 * 1024;
+const keyOf = (p) => (process.platform === 'win32' ? p.toLowerCase() : p);
+
+export class CheckpointStore {
+  // dir: where snapshot files are kept (created lazily).
+  constructor(dir) {
+    this.dir = dir;
+    // {id, label, time, messageIndex, conversationValid, orphaned, files: [{path, existed, snap, skipped}]}
+    this.entries = [];
+    this.counter = 0;
+    this.current = null;
+  }
+
+  // Start a checkpoint for a new user prompt. messageIndex is where its message will sit in
+  // the conversation, so rewinding the conversation can cut it off there.
+  beginTurn({ label, messageIndex }) {
+    const entry = {
+      id: ++this.counter,
+      label: String(label || '').replace(/\s+/g, ' ').trim().slice(0, 200),
+      time: Date.now(),
+      messageIndex,
+      conversationValid: true,
+      orphaned: false,
+      files: [],
+    };
+    this.entries.push(entry);
+    this.current = entry;
+    return entry;
+  }
+
+  // Record `file` as it is now, once per checkpoint. Call before the file is changed.
+  track(file) {
+    const entry = this.current;
+    if (!entry) return;
+    const abs = path.resolve(file);
+    if (entry.files.some((f) => keyOf(f.path) === keyOf(abs))) return;
+    let stat = null;
+    try { stat = fs.statSync(abs); } catch { /* does not exist yet */ }
+    if (!stat) { entry.files.push({ path: abs, existed: false }); this.writeIndex(); return; }
+    if (!stat.isFile()) return;
+    if (stat.size > MAX_SNAPSHOT_BYTES) { entry.files.push({ path: abs, existed: true, skipped: true }); return; }
+    const snap = `${entry.id}-${crypto.createHash('sha1').update(abs).digest('hex').slice(0, 12)}`;
+    try {
+      fs.mkdirSync(this.dir, { recursive: true });
+      fs.copyFileSync(abs, path.join(this.dir, snap));
+      entry.files.push({ path: abs, existed: true, snap });
+      this.writeIndex();
+    } catch {
+      entry.files.push({ path: abs, existed: true, skipped: true });
+    }
+  }
+
+  // The state to hand to the next process of a restarted session (see adopt).
+  snapshot() { return { dir: this.dir, entries: this.entries, counter: this.counter }; }
+
+  // Take over what the process before a restart had: its snapshots stay where they are on disk.
+  adopt({ dir, entries, counter } = {}) {
+    if (!dir || !Array.isArray(entries)) return false;
+    this.dir = dir;
+    this.entries = entries;
+    this.counter = Math.max(Number(counter) || 0, ...entries.map((e) => e.id || 0));
+    this.current = entries[entries.length - 1] || null;
+    return true;
+  }
+
+  // Checkpoints that are part of the current conversation, newest first.
+  list() { return this.entries.filter((e) => !e.orphaned).reverse(); }
+  get(id) { return this.entries.find((e) => e.id === id); }
+
+  // Files that rewinding to `id` would put back: every file touched by that checkpoint or a later one.
+  filesSince(id) {
+    const seen = new Map();
+    for (const e of this.entries) {
+      if (e.id < id) continue;
+      for (const f of e.files) if (!seen.has(keyOf(f.path))) seen.set(keyOf(f.path), f.path);
+    }
+    return [...seen.values()];
+  }
+
+  // Put every file touched since `id` back to how it was before that checkpoint.
+  // The oldest snapshot of each file decides its final state. Returns {restored, removed, skipped}.
+  restoreCode(id) {
+    const idx = this.entries.findIndex((e) => e.id === id);
+    if (idx < 0) throw new Error(`No checkpoint ${id}`);
+    const oldest = new Map();
+    for (let i = idx; i < this.entries.length; i++) {
+      for (const f of this.entries[i].files) if (!oldest.has(keyOf(f.path))) oldest.set(keyOf(f.path), f);
+    }
+    const result = { restored: [], removed: [], skipped: [] };
+    for (const f of oldest.values()) {
+      try {
+        if (f.skipped) { result.skipped.push(f.path); continue; }
+        if (f.existed) {
+          fs.mkdirSync(path.dirname(f.path), { recursive: true });
+          fs.copyFileSync(path.join(this.dir, f.snap), f.path);
+          result.restored.push(f.path);
+        } else {
+          fs.rmSync(f.path, { force: true });
+          result.removed.push(f.path);
+        }
+      } catch (e) {
+        result.skipped.push(`${f.path} (${e.message})`);
+      }
+    }
+    // Those changes no longer exist on disk, so later checkpoints have nothing left to undo.
+    for (let i = idx; i < this.entries.length; i++) this.entries[i].files = [];
+    this.writeIndex();
+    return result;
+  }
+
+  // Forget checkpoint `id` and everything after it (their turns were removed from the conversation).
+  discardFrom(id) {
+    this.entries = this.entries.filter((e) => e.id < id);
+    this.current = this.entries[this.entries.length - 1] || null;
+    this.writeIndex();
+  }
+
+  // The conversation was rewound to before `id` but the files were left alone: keep the
+  // snapshots (the edits are still on disk) but stop listing those turns.
+  orphanFrom(id) {
+    for (const e of this.entries) if (e.id >= id) e.orphaned = true;
+    this.writeIndex();
+  }
+
+  // The conversation was compacted or replaced: it can no longer be rewound to older points,
+  // but file snapshots remain valid.
+  markConversationStale() {
+    for (const e of this.entries) e.conversationValid = false;
+  }
+
+  reset() {
+    this.entries = [];
+    this.current = null;
+    this.writeIndex();
+  }
+
+  writeIndex() {
+    try {
+      fs.mkdirSync(this.dir, { recursive: true });
+      fs.writeFileSync(path.join(this.dir, 'index.json'), JSON.stringify(this.entries, null, 1));
+    } catch { /* best effort: the index only helps manual recovery */ }
+  }
+}
+
+// Apply a rewind to a running agent. mode: 'both' | 'code' | 'conversation'.
+// Returns {restore, prompt, conversation}: what was restored, the prompt text (so the UI can put it
+// back in the input box) and whether the conversation was cut.
+export function rewind(agent, store, id, mode = 'both') {
+  const entry = store.get(id);
+  if (!entry) throw new Error(`No checkpoint ${id}`);
+  if (mode !== 'code' && !entry.conversationValid) {
+    throw new Error('The conversation was compacted after this point, so it can no longer be rewound to it. You can still restore the code.');
+  }
+  const out = { restore: null, prompt: entry.label, conversation: false };
+  if (mode !== 'conversation') {
+    out.restore = store.restoreCode(id);
+    // Files changed behind the agent's back: make it read them again before editing.
+    agent.fileState.clear();
+  }
+  if (mode !== 'code') {
+    agent.replaceMessages(agent.messages.slice(0, entry.messageIndex));
+    agent.todos = [];
+    agent.lastContextTokens = estimateTokens(agent.messages);
+    agent.tokensSinceUsage = 0;
+    if (mode === 'both') store.discardFrom(id); else store.orphanFrom(id);
+    out.conversation = true;
+  } else {
+    agent.pushMessage({
+      role: 'user',
+      content: [{ type: 'text', text: `<system-reminder>The user rewound the code: ${out.restore.restored.length} file(s) were restored to their state before the prompt "${entry.label}" and ${out.restore.removed.length} file(s) created since then were deleted. Files may differ from what you last read; read them again before editing.</system-reminder>` }],
+    });
+  }
+  return out;
+}

package/src/claude-code.js

@@ -0,0 +1,60 @@
+// Read an existing Claude Code subscription login. There is no login flow here and no subprocess: signing
+// in is the official application's. Renewing the access token with the refresh token stored beside it is
+// done by oauth.js, which is the only code that writes the credentials file; this reads it.
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+
+export const CLAUDE_CODE_API_URL = 'https://api.anthropic.com';
+export const CLAUDE_CODE_SYSTEM = "You are Claude Code, Anthropic's official CLI for Claude.";
+export const CLAUDE_CODE_BETAS = 'claude-code-20250219,oauth-2025-04-20,interleaved-thinking-2025-05-14';
+const sessionIds = new WeakMap();
+let installedVersion;
+
+function readJson(file, label) {
+  let text;
+  try { text = fs.readFileSync(file, 'utf8'); }
+  catch { throw new Error(`Could not read existing Claude Code ${label}: ${file}. Select the existing login with CLAUDE_PRO_CLAUDE_CONFIG_FILE / CLAUDE_PRO_CLAUDE_CREDENTIALS_FILE.`); }
+  // JSON.parse errors can contain an excerpt of the token. Never echo them.
+  try { return JSON.parse(text.replace(/^\uFEFF/, '')); }
+  catch { throw new Error(`Invalid JSON in Claude Code ${label}: ${file}.`); }
+}
+
+function clientVersion(config, metadata) {
+  if (config.env.CLAUDE_PRO_CLAUDE_CODE_VERSION) return config.env.CLAUDE_PRO_CLAUDE_CODE_VERSION;
+  if (installedVersion) return installedVersion;
+  for (const dir of (process.env.PATH || process.env.Path || '').split(path.delimiter).filter(Boolean)) {
+    try {
+      const pkg = JSON.parse(fs.readFileSync(path.join(dir.replace(/^"|"$/g, ''), 'node_modules', '@anthropic-ai', 'claude-code', 'package.json'), 'utf8'));
+      if (/^\d+\.\d+\.\d+$/.test(pkg.version)) return (installedVersion = pkg.version);
+    } catch { /* native installs do not have an npm package */ }
+  }
+  return /^\d+\.\d+\.\d+$/.test(metadata.lastOnboardingVersion || '') ? metadata.lastOnboardingVersion : '2.1.289';
+}
+
+export function readClaudeCodeLogin(config) {
+  const metadata = readJson(config.claudeCodeConfigFile, 'account configuration');
+  const credentials = readJson(config.claudeCodeCredentialsFile, 'credentials');
+  const oauth = credentials?.claudeAiOauth;
+  if (!oauth || typeof oauth.accessToken !== 'string' || !oauth.accessToken.trim()) {
+    throw new Error(`No existing Claude Code subscription access token in ${config.claudeCodeCredentialsFile}. The .claude.json file contains account metadata; the token is in .claude/.credentials.json.`);
+  }
+  if (oauth.expiresAt && Number(oauth.expiresAt) <= Date.now()) {
+    throw new Error('The existing Claude Code access token has expired and cannot be renewed from here (the credentials file has no refresh token, or CLAUDE_PRO_DISABLE_TOKEN_REFRESH is set). Run `claude` and use /login to sign in again; this project will read the updated file automatically.');
+  }
+  if (!sessionIds.has(config)) sessionIds.set(config, crypto.randomUUID());
+  return {
+    accessToken: oauth.accessToken,
+    expiresAt: Number(oauth.expiresAt) || null, // ms since epoch; the token lives 8 hours
+    userId: JSON.stringify({ device_id: metadata.userID || '', account_uuid: metadata.oauthAccount?.accountUuid || '', session_id: sessionIds.get(config) }),
+    version: clientVersion(config, metadata),
+  };
+}
+
+export function claudeCodeHeaders(login) {
+  return {
+    'anthropic-beta': CLAUDE_CODE_BETAS,
+    'user-agent': `claude-cli/${login.version} (external, cli)`,
+    'x-app': 'cli',
+  };
+}

package/src/codex/client.js

@@ -0,0 +1,300 @@
+// The local Codex (ChatGPT) subscription login as a provider: Anthropic Messages requests from the SDK are
+// translated to OpenAI Responses requests for the Codex backend, and the Responses stream back to Anthropic SSE,
+// so that the rest of the program (api.js, the agent loop) works unchanged. Hooked in as the SDK's `fetch`.
+// The login is the one `codex login` wrote to $CODEX_HOME/auth.json; its access token is renewed with the
+// refresh token stored there, and the renewed tokens are written back for the Codex CLI to use too.
+
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { buildResponsesRequest, toolNameMap } from './translate-request.js';
+import { ResponsesToAnthropic, parseSSE } from './translate-stream.js';
+
+export const CODEX_RESPONSES_URL = 'https://chatgpt.com/backend-api/codex/responses';
+const OAUTH_URL = 'https://auth.openai.com/oauth/token';
+const OAUTH_CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann';
+const REFRESH_MARGIN_MS = 5 * 60_000;
+const EFFORTS = ['none', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max', 'ultra'];
+const LOWER_EFFORT = { ultra: 'max', max: 'xhigh', xhigh: 'high', high: 'medium', minimal: 'low', none: 'low', low: 'medium' };
+
+export const codexHome = (env = process.env) => env.CODEX_HOME || path.join(os.homedir(), '.codex');
+export const codexAuthFile = (env = process.env) => path.join(codexHome(env), 'auth.json');
+
+export function decodeJwt(token) {
+  try {
+    return JSON.parse(Buffer.from(String(token).split('.')[1], 'base64url').toString('utf8'));
+  } catch {
+    return null;
+  }
+}
+
+const expiresSoon = (token) => {
+  const exp = decodeJwt(token)?.exp;
+  return !exp || exp * 1000 - Date.now() < REFRESH_MARGIN_MS;
+};
+
+function readAuth(file) {
+  let text;
+  try {
+    text = fs.readFileSync(file, 'utf8');
+  } catch (e) {
+    if (e.code === 'ENOENT') throw Object.assign(new Error(`No Codex login: ${file} does not exist. Run \`codex login\` (ChatGPT plan), then try again.`), { status: 401 });
+    throw e;
+  }
+  try {
+    return JSON.parse(text);
+  } catch (e) {
+    throw Object.assign(new Error(`Cannot parse ${file}: ${e.message}`), { status: 401 });
+  }
+}
+
+function writeAuth(file, data) {
+  const body = JSON.stringify(data, null, 2);
+  const tmp = `${file}.claude-pro-${process.pid}.tmp`;
+  try {
+    fs.writeFileSync(tmp, body, { mode: 0o600 });
+    fs.renameSync(tmp, file);
+  } catch {
+    try { fs.unlinkSync(tmp); } catch { /* not there */ }
+    fs.writeFileSync(file, body, { mode: 0o600 });
+  }
+}
+
+const accountIdOf = (tokens) => tokens.account_id
+  || decodeJwt(tokens.id_token)?.['https://api.openai.com/auth']?.chatgpt_account_id
+  || decodeJwt(tokens.access_token)?.['https://api.openai.com/auth']?.chatgpt_account_id
+  || '';
+
+// What /status shows about the login (nothing secret).
+export function codexLoginSummary(env = process.env) {
+  const file = codexAuthFile(env);
+  try {
+    const data = readAuth(file);
+    const claims = decodeJwt(data.tokens?.id_token)?.['https://api.openai.com/auth'] || {};
+    const email = decodeJwt(data.tokens?.id_token)?.email || null;
+    if (data.tokens?.access_token) return { ok: true, file, plan: claims.chatgpt_plan_type || null, email };
+    if (data.OPENAI_API_KEY) return { ok: true, file, plan: 'api key' };
+    return { ok: false, file, error: 'no tokens in it' };
+  } catch (e) {
+    return { ok: false, file, error: e.message };
+  }
+}
+
+let refreshing = null;
+
+async function refresh(file, stale, fetchImpl) {
+  const data = readAuth(file);
+  const tokens = data.tokens || {};
+  // The Codex CLI or app may have renewed it already.
+  if (tokens.access_token && tokens.access_token !== stale && !expiresSoon(tokens.access_token)) return;
+  if (!tokens.refresh_token) throw Object.assign(new Error('The Codex login has no refresh token. Run `codex login` again.'), { status: 401 });
+  const res = await fetchImpl(OAUTH_URL, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json', accept: 'application/json' },
+    body: JSON.stringify({ client_id: OAUTH_CLIENT_ID, grant_type: 'refresh_token', refresh_token: tokens.refresh_token, scope: 'openid profile email' }),
+  });
+  const text = await res.text();
+  if (!res.ok) {
+    let reason = text.slice(0, 200);
+    try { const j = JSON.parse(text); reason = j.error_description || j.error?.message || j.error || reason; } catch { /* as it is */ }
+    throw Object.assign(new Error(`Renewing the Codex login failed (HTTP ${res.status}: ${reason}). Run \`codex login\` again.`), { status: 401 });
+  }
+  const j = JSON.parse(text);
+  const next = { ...data, tokens: { ...tokens } };
+  for (const k of ['access_token', 'id_token', 'refresh_token']) if (j[k]) next.tokens[k] = j[k];
+  next.last_refresh = new Date().toISOString();
+  writeAuth(file, next);
+}
+
+export async function codexCredentials(file, { force = false, fetchImpl = globalThis.fetch } = {}) {
+  const data = readAuth(file);
+  const tokens = data.tokens;
+  if (tokens?.access_token && data.auth_mode !== 'apikey') {
+    if (force || expiresSoon(tokens.access_token)) {
+      refreshing ??= refresh(file, tokens.access_token, fetchImpl).finally(() => { refreshing = null; });
+      await refreshing;
+      const fresh = readAuth(file).tokens;
+      return { mode: 'chatgpt', accessToken: fresh.access_token, accountId: accountIdOf(fresh) };
+    }
+    return { mode: 'chatgpt', accessToken: tokens.access_token, accountId: accountIdOf(tokens) };
+  }
+  if (data.OPENAI_API_KEY) return { mode: 'apikey', apiKey: data.OPENAI_API_KEY };
+  throw Object.assign(new Error(`No usable credentials in ${file}. Run \`codex login\`.`), { status: 401 });
+}
+
+// A file's parsed contents, read again only when it changes (the footer asks for the model on every frame).
+const fileCache = new Map();
+function readCached(file, parse, fallback) {
+  let st;
+  try { st = fs.statSync(file); } catch { return fallback; }
+  const hit = fileCache.get(file);
+  if (hit && hit.mtimeMs === st.mtimeMs && hit.size === st.size) return hit.value;
+  let value;
+  try { value = parse(fs.readFileSync(file, 'utf8')); } catch { value = fallback; }
+  fileCache.set(file, { mtimeMs: st.mtimeMs, size: st.size, value });
+  return value;
+}
+
+// The models the local Codex install knows (models_cache.json): efforts, context window, base instructions.
+export function codexModels(env = process.env) {
+  return readCached(path.join(codexHome(env), 'models_cache.json'), parseModelsCache, { clientVersion: null, models: [] });
+}
+
+function parseModelsCache(text) {
+  {
+    const j = JSON.parse(text);
+    const list = Array.isArray(j) ? j : j.models || [];
+    return {
+      clientVersion: /^\d+\.\d+\.\d+$/.test(String(j.client_version)) ? j.client_version : null,
+      models: list.filter((m) => m && typeof m.slug === 'string').map((m) => ({
+        slug: m.slug,
+        hidden: /^hid/i.test(m.visibility || ''),
+        efforts: (m.supported_reasoning_levels || []).map((r) => (typeof r === 'string' ? r : r?.effort)).filter(Boolean),
+        defaultEffort: m.default_reasoning_level || null,
+        contextWindow: m.context_window || null,
+        baseInstructions: typeof m.base_instructions === 'string' ? m.base_instructions : null,
+      })),
+    };
+  }
+}
+
+// The model and effort set in the Codex config.toml (top-level `model` / `model_reasoning_effort`).
+export function codexConfigDefaults(env = process.env) {
+  return readCached(path.join(codexHome(env), 'config.toml'), (text) => {
+    const top = text.split(/^\s*\[/m)[0];
+    const pick = (key) => new RegExp(`^\\s*${key}\\s*=\\s*"([^"]+)"`, 'm').exec(top)?.[1] || null;
+    return { model: pick('model'), effort: pick('model_reasoning_effort') };
+  }, { model: null, effort: null });
+}
+
+function clampEffort(effort, supported) {
+  if (!effort || !supported?.length || supported.includes(effort)) return effort;
+  const want = EFFORTS.indexOf(effort);
+  return supported.reduce((best, s) => (Math.abs(EFFORTS.indexOf(s) - want) < Math.abs(EFFORTS.indexOf(best) - want) ? s : best), supported[0]);
+}
+
+// An Anthropic-shaped error response, which the SDK turns into an APIError with this status.
+function errorResponse(status, type, message, headers = {}) {
+  return new Response(JSON.stringify({ type: 'error', error: { type, message } }), { status, headers: { 'content-type': 'application/json', ...headers } });
+}
+
+function upstreamError(status, text, headers) {
+  let message = text.slice(0, 500) || `HTTP ${status}`;
+  let code = '';
+  let resetsIn = null;
+  try {
+    const j = JSON.parse(text);
+    message = j.error?.message || j.detail || j.message || message;
+    code = j.error?.type || j.error?.code || '';
+    resetsIn = j.error?.resets_in_seconds ?? null;
+  } catch { /* not JSON */ }
+  const extra = {};
+  if (resetsIn != null) extra['retry-after'] = String(resetsIn);
+  else if (headers.get('retry-after')) extra['retry-after'] = headers.get('retry-after');
+  if (status === 429 || /usage_limit|rate_limit/i.test(code)) return { status: 429, type: 'rate_limit_error', message: `Codex: ${message}`, headers: extra, upstreamMessage: message };
+  if (status === 401 || status === 403) return { status, type: 'authentication_error', message: `Codex login refused (${status}): ${message}. Run \`codex login\` again if this persists.`, headers: extra, upstreamMessage: message };
+  return { status, type: status >= 500 ? 'api_error' : 'invalid_request_error', message: `Codex: ${message}`, headers: extra, upstreamMessage: message };
+}
+
+// The SDK's fetch for the codex provider. `options.env` is the configuration's environment (CODEX_HOME).
+export function createCodexFetch({ env = process.env, url = CODEX_RESPONSES_URL, fetchImpl = globalThis.fetch, sessionId = crypto.randomUUID() } = {}) {
+  const sticky = { instructionsMode: 'custom', removedParams: new Set() };
+  return async function codexFetch(input, init = {}) {
+    const target = String(input?.url ?? input);
+    const { pathname } = new URL(target);
+    if (!/\/v1\/messages$/.test(pathname)) return errorResponse(404, 'not_found_error', `The codex provider does not support ${pathname}`);
+    let anth;
+    try { anth = JSON.parse(typeof init.body === 'string' ? init.body : await new Response(init.body).text()); } catch { return errorResponse(400, 'invalid_request_error', 'Request body is not valid JSON'); }
+    const file = codexAuthFile(env);
+    const known = codexModels(env);
+    const model = String(anth.model || '').replace(/\[1m\]$/i, '');
+    const info = known.models.find((m) => m.slug === model);
+    // No effort sent ("auto", and side queries such as titles): the model's own default, as with Claude.
+    const wanted = anth.output_config?.effort || info?.defaultEffort || null;
+    const o = {
+      model,
+      effort: clampEffort(wanted, info?.efforts),
+      summary: 'auto',
+      sessionId,
+      instructionsMode: sticky.instructionsMode,
+      codexInstructions: sticky.instructionsMode === 'codex' ? info?.baseInstructions : null,
+      removedParams: new Set(sticky.removedParams),
+      dropReasoning: false,
+      webSearch: false,
+      parallelToolCalls: true,
+    };
+    const triedEfforts = new Set([o.effort]);
+    let refreshed = false; // a 401 renews the token once
+    let force = false;
+    let res;
+    for (let attempt = 0; ; attempt++) {
+      let creds;
+      try { creds = await codexCredentials(file, { force, fetchImpl }); } catch (e) { return errorResponse(e.status || 401, 'authentication_error', e.message); }
+      force = false;
+      const headers = {
+        'content-type': 'application/json',
+        accept: 'text/event-stream',
+        'openai-beta': 'responses=experimental',
+        originator: 'codex_cli_rs',
+        version: known.clientVersion || '0.162.0',
+        'user-agent': `codex_cli_rs/${known.clientVersion || '0.162.0'} (${os.type()} ${os.release()}; ${os.arch()}) claude-pro`,
+        session_id: sessionId,
+        authorization: `Bearer ${creds.mode === 'chatgpt' ? creds.accessToken : creds.apiKey}`,
+      };
+      if (creds.accountId) headers['chatgpt-account-id'] = creds.accountId;
+      const payload = buildResponsesRequest(anth, o);
+      res = await fetchImpl(creds.mode === 'chatgpt' ? url : 'https://api.openai.com/v1/responses', { method: 'POST', headers, body: JSON.stringify(payload), signal: init.signal });
+      if (res.ok) break;
+      const text = await res.text();
+      const err = upstreamError(res.status, text, res.headers);
+      if (attempt >= 5) return errorResponse(err.status, err.type, err.message, err.headers);
+      if (res.status === 401 && !refreshed) { refreshed = force = true; continue; }
+      if (res.status === 400) {
+        const m = err.upstreamMessage;
+        if (/instruction/i.test(m) && o.instructionsMode !== 'codex' && info?.baseInstructions) {
+          o.instructionsMode = sticky.instructionsMode = 'codex';
+          o.codexInstructions = info.baseInstructions;
+          continue;
+        }
+        if (/encrypted|reasoning item|could not be (verified|decrypted)/i.test(m) && !o.dropReasoning) { o.dropReasoning = true; continue; }
+        const param = m.match(/unsupported parameter:?\s*['"`]?([\w.]+)/i)?.[1];
+        if (param && !o.removedParams.has(param) && !['model', 'input', 'stream'].includes(param)) {
+          o.removedParams.add(param);
+          sticky.removedParams.add(param);
+          continue;
+        }
+        const lower = LOWER_EFFORT[o.effort];
+        if (/effort/i.test(m) && lower && !triedEfforts.has(lower)) { o.effort = lower; triedEfforts.add(lower); continue; }
+      }
+      return errorResponse(err.status, err.type, err.message, err.headers);
+    }
+
+    const toolNames = toolNameMap(anth);
+    const encoder = new TextEncoder();
+    const body = new ReadableStream({
+      async start(controller) {
+        const conv = new ResponsesToAnthropic({
+          model: anth.model,
+          toolNames,
+          emitThinking: true,
+          onEvent: (name, data) => controller.enqueue(encoder.encode(`event: ${name}\ndata: ${JSON.stringify(data)}\n\n`)),
+        });
+        conv.start();
+        try {
+          for await (const ev of parseSSE(res.body)) {
+            conv.handle(ev);
+            if (conv.done) break;
+          }
+          conv.end();
+        } catch (e) {
+          if (init.signal?.aborted) { controller.error(e); return; }
+          conv.fail(`Codex stream error: ${e.message}`);
+        }
+        controller.close();
+      },
+      cancel() { res.body?.cancel?.().catch(() => {}); },
+    });
+    return new Response(body, { status: 200, headers: { 'content-type': 'text/event-stream; charset=utf-8' } });
+  };
+}