@zvada/agent-server 0.3.4 → 0.3.6

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.3.6
+
+- Unsupported Codex app-server requests now receive an explicit protocol error.
+  Previously, requests such as MCP elicitations were treated as file-edit
+  approvals and could leave a turn waiting in the permission broker. Command
+  and file approvals and host-managed credential refresh keep their existing behavior.
+
+## 0.3.5
+
+- Switching Codex ChatGPT accounts or API keys now recreates the native process
+  and resumes the same conversation. Native Codex keeps model WebSockets
+  authenticated as the account that opened them, so a login update alone could
+  keep using the previous account. Renewing a token for the same account remains
+  warm; no credential fields are added to the public protocol.
+
 ## 0.3.4
 
 - Update the managed Codex CLI and development SDK to 0.153.4. This clears

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@zvada/agent-server",
-	"version": "0.3.4",
+	"version": "0.3.6",
 	"description": "Harness-agnostic agent execution engine: run Claude Code, Codex (SDK/CLI + app-server), and any ACP agent behind one interface with a normalized event stream, multi-turn sessions, and resume. Root export is the wire contract; /core, /server, /client are the seats.",
 	"license": "MIT",
 	"type": "module",

package/src/core/agents/codex-app-server/codex-app-server-agent.ts

@@ -39,8 +39,8 @@ export interface AppServerSession {
 	sandbox: string;
 	systemPromptAppend?: string;
 	envFingerprint: string;
-	/** Native CLI auth and externally managed tokens cannot share a warm process. */
-	authMode?: CodexAppServerAuth["type"];
+	/** Native model connections retain the identity used at their first handshake. */
+	authFingerprint?: string;
 	/** Credentials and permission broker belong only to the current execute. */
 	turn?: AppServerTurn;
 	idleTimer?: ReturnType<typeof setTimeout>;
@@ -169,6 +169,13 @@ export interface CodexChatGptAuth {
 
 export type CodexAppServerAuth = { type: "apiKey"; apiKey: string } | CodexChatGptAuth;
 
+function authFingerprint(auth: CodexAppServerAuth | undefined): string | undefined {
+	if (!auth) return undefined;
+	return configFingerprint(
+		auth.type === "apiKey" ? auth : { type: auth.type, accountId: auth.tokens.chatgptAccountId },
+	);
+}
+
 export interface CodexAppServerAgentOptions {
 	createClient?: (options: CodexAppServerClientOptions) => CodexAppServerClient;
 	idleTimeoutMs?: number;
@@ -186,7 +193,8 @@ export interface CodexAppServerAgentOptions {
 	 * Resolve the selected API key or ChatGPT account before EVERY turn, including warm
 	 * sessions. Operator-only: neither callbacks nor tokens belong in RunConfig.
 	 * Return undefined to select native CLI auth; throw when the selected external
-	 * account is unavailable. Switching back to native auth recreates the process.
+	 * account is unavailable. Changing accounts, API keys, or auth modes recreates
+	 * the process and resumes the same conversation.
 	 */
 	resolveAuth?: (sessionId: string) => Promise<CodexAppServerAuth | undefined>;
 }
@@ -228,12 +236,13 @@ export class CodexAppServerAgent extends BaseAgent {
 		const approvalPolicy = approvalPolicyFor(options);
 		const sandbox = mapSandbox(options.permissionMode);
 		const existing = this.sessions.get(options.sessionId);
-		// Reuse a warm subprocess only when its (immutable) approval posture
-		// matches; otherwise recreate it, resuming the same thread so context
-		// survives. `resumeThreadId` carries that over to the spawn below.
+		const identity = authFingerprint(turn.auth);
+		// Codex caches an authenticated model WebSocket across turns. Login alone
+		// cannot switch its identity: restart on account/key changes and resume
+		// the same thread. Same-account token renewal can keep the process warm.
 		let resumeThreadId = options.resumeSessionId;
 		if (existing && !existing.client.closed) {
-			if (appServerSessionCompatible(existing, options) && existing.authMode === turn.auth?.type) {
+			if (appServerSessionCompatible(existing, options) && existing.authFingerprint === identity) {
 				this.sessions.clearIdle(existing);
 				existing.turn = turn;
 				const onAbort = () => existing.client.close();
@@ -284,7 +293,7 @@ export class CodexAppServerAgent extends BaseAgent {
 			sandbox,
 			systemPromptAppend: options.systemPromptAppend,
 			envFingerprint: configFingerprint(options.env),
-			authMode: turn.auth?.type,
+			authFingerprint: identity,
 			turn,
 		};
 		this.bindRequests(session);
@@ -386,6 +395,16 @@ export class CodexAppServerAgent extends BaseAgent {
 					chatgptPlanType: tokens.chatgptPlanType ?? null,
 				};
 			}
+			// Elicitations and other server requests have their own response shapes.
+			// Sending them to the approval broker can leave a turn waiting forever.
+			if (
+				method !== "item/commandExecution/requestApproval" &&
+				method !== "item/fileChange/requestApproval" &&
+				method !== "execCommandApproval" &&
+				method !== "applyPatchApproval"
+			) {
+				throw new Error(`Unsupported Codex server request: ${method}`);
+			}
 			const requestThread = params.threadId ?? params.conversationId;
 			const v2 = method.startsWith("item/");
 			const decline = v2 ? { decision: "decline" } : { decision: "denied" };