agentbox-sdk 0.1.316 → 0.1.318

package/dist/agents/index.js

@@ -2,7 +2,7 @@ import {
   Agent,
   agentboxRoot,
   getAgentLayout
-} from "../chunk-SCT2IJ4Q.js";
+} from "../chunk-MDHCTHCY.js";
 import "../chunk-2DH5OVG4.js";
 import {
   AGENT_RESERVED_PORTS,

package/dist/{chunk-SCT2IJ4Q.js → chunk-MDHCTHCY.js}

@@ -2571,6 +2571,7 @@ var ClaudeCodeAgentAdapter = class {
 };
 
 // src/agents/providers/codex.ts
+import crypto from "crypto";
 import path9 from "path";
 
 // src/agents/transports/app-server.ts
@@ -2797,6 +2798,61 @@ function codexConfigDir(options) {
 }
 var REMOTE_CODEX_APP_SERVER_PORT = 43181;
 var REMOTE_CODEX_APP_SERVER_ID = "shared-app-server";
+var CODEX_APP_SERVER_TOKEN_FILENAME = "codex-app-server-token";
+function defaultRemoteCodexTokenPath() {
+  return path9.posix.join(
+    agentboxRoot(AgentProvider.Codex, true),
+    CODEX_APP_SERVER_TOKEN_FILENAME
+  );
+}
+var codexAppServerTokenCache = /* @__PURE__ */ new WeakMap();
+async function readCodexAppServerTokenFile(sandbox, tokenFilePath) {
+  const result = await sandbox.run(
+    `if [ -f ${shellQuote(tokenFilePath)} ]; then cat ${shellQuote(tokenFilePath)}; fi`
+  );
+  if (result.exitCode !== 0) {
+    return void 0;
+  }
+  const value = result.stdout.trim();
+  return value.length > 0 ? value : void 0;
+}
+function resolveCodexAppServerToken(sandbox, tokenFilePath, create) {
+  let cached = codexAppServerTokenCache.get(sandbox);
+  if (!cached) {
+    cached = (async () => {
+      const existing = await readCodexAppServerTokenFile(
+        sandbox,
+        tokenFilePath
+      );
+      if (existing) {
+        return existing;
+      }
+      if (create) {
+        return crypto.randomBytes(32).toString("hex");
+      }
+      throw new Error(
+        `Codex app-server token file is missing at ${tokenFilePath}. setup() must run before connecting to the codex app-server.`
+      );
+    })().catch((error) => {
+      codexAppServerTokenCache.delete(sandbox);
+      throw error;
+    });
+    codexAppServerTokenCache.set(sandbox, cached);
+  }
+  return cached;
+}
+function ensureCodexAppServerToken(sandbox, tokenFilePath) {
+  return resolveCodexAppServerToken(sandbox, tokenFilePath, true);
+}
+function getCodexAppServerToken(sandbox, tokenFilePath = defaultRemoteCodexTokenPath()) {
+  return resolveCodexAppServerToken(sandbox, tokenFilePath, false);
+}
+function withCodexAppServerAuthHeaders(base, token) {
+  return {
+    ...base,
+    Authorization: `Bearer ${token}`
+  };
+}
 function compactEnv(values) {
   return Object.fromEntries(
     Object.entries(values).filter(([, value]) => value !== void 0)
@@ -3131,9 +3187,10 @@ async function withCodexAppServer(request, body) {
     );
   }
   const previewUrl = await sandbox.getPreviewLink(REMOTE_CODEX_APP_SERVER_PORT);
+  const token = await getCodexAppServerToken(sandbox);
   const transport = await connectJsonRpcWebSocket(
     toRemoteCodexWebSocketUrl(previewUrl),
-    { headers: sandbox.previewHeaders }
+    { headers: withCodexAppServerAuthHeaders(sandbox.previewHeaders, token) }
   );
   const client = new JsonRpcLineClient(
     transport.source,
@@ -3219,7 +3276,19 @@ async function setupCodex(request) {
       ...sharedTarget.env,
       ...options.provider?.env ?? {}
     });
-    const { artifacts: serverArtifacts } = buildArtifactsFor(sharedTarget);
+    const tokenFilePath = path9.posix.join(
+      sharedTarget.layout.rootDir,
+      CODEX_APP_SERVER_TOKEN_FILENAME
+    );
+    const appServerToken = await ensureCodexAppServerToken(
+      sandbox,
+      tokenFilePath
+    );
+    const { artifacts: baseServerArtifacts } = buildArtifactsFor(sharedTarget);
+    const serverArtifacts = [
+      ...baseServerArtifacts,
+      { path: tokenFilePath, content: appServerToken }
+    ];
     const { artifacts: skillArtifacts2, installCommands: installCommands2 } = await prepareSkillArtifacts(provider, options.skills, target2.layout);
     const enableRtk2 = options.enableRtk === true;
     const daemonInfo = {
@@ -3260,6 +3329,7 @@ async function setupCodex(request) {
           `mkdir -p ${shellQuote(sharedTarget.layout.rootDir)}`,
           `if curl -fsS http://127.0.0.1:${REMOTE_CODEX_APP_SERVER_PORT}/readyz >/dev/null 2>&1; then exit 0; fi`,
           `if [ -f ${shellQuote(pidFilePath)} ]; then kill "$(cat ${shellQuote(pidFilePath)})" >/dev/null 2>&1 || true; rm -f ${shellQuote(pidFilePath)}; fi`,
+          `chmod 600 ${shellQuote(tokenFilePath)}`,
           `(${[
             `nohup ${[
               "env",
@@ -3268,7 +3338,15 @@ async function setupCodex(request) {
                 [
                   "app-server",
                   "--listen",
-                  `ws://0.0.0.0:${REMOTE_CODEX_APP_SERVER_PORT}`
+                  `ws://0.0.0.0:${REMOTE_CODEX_APP_SERVER_PORT}`,
+                  // Auth on non-loopback listeners is opt-in in codex; without
+                  // these flags the 0.0.0.0 app-server accepts unauthenticated
+                  // clients. Requires codex >= 0.133 (`--ws-auth` flag); older
+                  // pinned binaries will fail to launch on the unknown arg.
+                  "--ws-auth",
+                  "capability-token",
+                  "--ws-token-file",
+                  tokenFilePath
                 ],
                 options
               )
@@ -3343,9 +3421,10 @@ async function createRuntime(request, inputParts) {
       "getPreviewLink app-server",
       () => sandbox.getPreviewLink(REMOTE_CODEX_APP_SERVER_PORT)
     );
+    const token = await getCodexAppServerToken(sandbox);
     const transport = await connectRemoteCodexAppServer(
       toRemoteCodexWebSocketUrl(previewUrl),
-      sandbox.previewHeaders
+      withCodexAppServerAuthHeaders(sandbox.previewHeaders, token)
     );
     debugCodex("\u2605 codex transport established");
     return {
@@ -3790,12 +3869,74 @@ var CodexAgentAdapter = class {
 };
 
 // src/agents/providers/opencode.ts
+import { createHash as createHash2 } from "crypto";
 import path10 from "path";
 var SANDBOX_OPENCODE_PORT = 4096;
 var LOCAL_OPENCODE_PORT = 4096;
 var SANDBOX_OPENCODE_READY_TIMEOUT_MS = 9e4;
 var LOCAL_OPENCODE_READY_TIMEOUT_MS = 2e4;
 var SHARED_OPENCODE_TARGET_ID = "shared-opencode-server";
+var LLM_API_KEY_ENV_VARS = [
+  "OPENROUTER_API_KEY",
+  "OPENAI_API_KEY",
+  "ANTHROPIC_API_KEY",
+  "GOOGLE_GENERATIVE_AI_API_KEY",
+  "GEMINI_API_KEY"
+];
+function hashLlmApiKeys(env) {
+  const hasher = createHash2("sha256");
+  for (const key of LLM_API_KEY_ENV_VARS) {
+    if (env?.[key] !== void 0) {
+      hasher.update(`${key}=${env[key]}
+`);
+    }
+  }
+  return hasher.digest("hex");
+}
+async function killLocalOpenCodeServer() {
+  await time(debugOpencode, "kill local opencode server", async () => {
+    const killer = spawnCommand({
+      command: "sh",
+      args: [
+        "-c",
+        `lsof -ti tcp:${LOCAL_OPENCODE_PORT} | xargs kill 2>/dev/null || true`
+      ]
+    });
+    await killer.wait().catch(() => void 0);
+    await waitFor(
+      async () => {
+        try {
+          const res = await fetch(
+            `http://127.0.0.1:${LOCAL_OPENCODE_PORT}/global/health`
+          );
+          return !res.ok;
+        } catch {
+          return true;
+        }
+      },
+      { timeoutMs: 5e3, intervalMs: 200 }
+    ).catch(() => void 0);
+  });
+}
+async function killSandboxOpenCodeServer(sandbox, pidFilePath, cwd, port) {
+  await time(debugOpencode, "kill sandbox opencode server", async () => {
+    await sandbox.run(
+      `kill -- -"$(cat ${shellQuote(pidFilePath)})" 2>/dev/null || kill "$(cat ${shellQuote(pidFilePath)})" 2>/dev/null || true`,
+      { cwd, timeoutMs: 5e3 }
+    ).catch(() => void 0);
+    const deadline = Date.now() + 5e3;
+    while (Date.now() < deadline) {
+      const probe = await sandbox.run(
+        `curl -fsS --max-time 2 http://127.0.0.1:${port}/global/health >/dev/null 2>&1`,
+        { cwd, timeoutMs: 5e3 }
+      );
+      if (probe.exitCode !== 0) {
+        return;
+      }
+      await sleep(200);
+    }
+  });
+}
 function toRawEvent3(runId, payload, type) {
   return {
     provider: AgentProvider.OpenCode,
@@ -3891,6 +4032,10 @@ function buildOpenCodeConfig(options, interactiveApproval) {
   const googleBaseUrl = options.env?.GOOGLE_BASE_URL;
   const openRouterBaseUrl = options.env?.OPENROUTER_BASE_URL;
   const openRouterPlugins = options.openRouterPlugins && options.openRouterPlugins.length > 0 ? options.openRouterPlugins : void 0;
+  const openRouterExtraBody = {
+    transforms: ["middle-out"],
+    ...openRouterPlugins ? { plugins: openRouterPlugins } : {}
+  };
   return {
     $schema: "https://opencode.ai/config.json",
     ...mcpConfig ? { mcp: mcpConfig } : {},
@@ -3899,7 +4044,7 @@ function buildOpenCodeConfig(options, interactiveApproval) {
       openrouter: {
         options: {
           baseURL: openRouterBaseUrl || "https://openrouter.ai/api/v1",
-          ...openRouterPlugins ? { plugins: openRouterPlugins } : {}
+          extraBody: openRouterExtraBody
         }
       },
       ...googleBaseUrl ? { google: { options: { baseURL: googleBaseUrl } } } : {}
@@ -3949,7 +4094,10 @@ async function ensureSandboxOpenCodeServer(request) {
       artifacts: allArtifacts,
       installCommands,
       daemon: daemonInfo,
-      extras: [`enableRtk:${enableRtk}`]
+      extras: [
+        `enableRtk:${enableRtk}`,
+        `apiKeys:${hashLlmApiKeys(options.env)}`
+      ]
     });
     if (await preflightSetup(target, setupId, daemonInfo)) {
       debugOpencode("opencode setup() preflight hit \u2014 skipping");
@@ -3990,13 +4138,14 @@ async function ensureSandboxOpenCodeServer(request) {
         `disown 2>/dev/null || true`
       ].join(" ")})`
     ].join(" && ");
+    await killSandboxOpenCodeServer(sandbox, pidFilePath, options.cwd, port);
     const launchResult = await time(
       debugOpencode,
       "spawn opencode serve",
       () => sandbox.run(launchCommand, {
         cwd: options.cwd,
         env: serveEnv,
-        timeoutMs: 1e4
+        timeoutMs: 2e4
       })
     );
     if (launchResult.exitCode !== 0) {
@@ -4030,16 +4179,6 @@ async function ensureSandboxOpenCodeServer(request) {
 }
 async function ensureLocalOpenCodeServer(request) {
   const options = request.options;
-  try {
-    await waitForHttpReady(
-      `http://127.0.0.1:${LOCAL_OPENCODE_PORT}/global/health`,
-      { timeoutMs: 1e3 }
-    );
-    debugOpencode("local opencode server already running \u2014 reusing");
-    return;
-  } catch {
-    debugOpencode("local opencode server not running \u2014 cold-spawning");
-  }
   const plugins = assertHooksSupported(request.provider, options);
   assertCommandsSupported(request.provider, options.commands);
   const interactiveApproval = isInteractiveApproval(options);
@@ -4072,14 +4211,23 @@ async function ensureLocalOpenCodeServer(request) {
       content: JSON.stringify(openCodeConfig, null, 2)
     }
   ];
+  const daemonInfo = {
+    port: LOCAL_OPENCODE_PORT,
+    healthPath: "/global/health"
+  };
   const setupId = computeSetupId({
     artifacts: allArtifacts,
-    installCommands
+    installCommands,
+    daemon: daemonInfo,
+    extras: [`apiKeys:${hashLlmApiKeys(options.env)}`]
   });
-  const preflightHit = await preflightSetup(target, setupId);
-  if (!preflightHit) {
-    await applyDifferentialSetup(target, allArtifacts, installCommands);
+  if (await preflightSetup(target, setupId, daemonInfo)) {
+    debugOpencode("local opencode server up-to-date \u2014 reusing");
+    return;
   }
+  debugOpencode("local opencode server drifted/absent \u2014 (re)spawning");
+  await applyDifferentialSetup(target, allArtifacts, installCommands);
+  await killLocalOpenCodeServer();
   spawnCommand({
     command: options.provider?.binary ?? "opencode",
     args: [

package/dist/index.js

@@ -2,7 +2,7 @@ import {
   Agent,
   agentboxRoot,
   getAgentLayout
-} from "./chunk-SCT2IJ4Q.js";
+} from "./chunk-MDHCTHCY.js";
 import {
   ProviderLogAssembler,
   createNormalizedEvent,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentbox-sdk",
-  "version": "0.1.316",
+  "version": "0.1.318",
   "description": "Swappable coding agents and sandbox providers for Bun and TypeScript.",
   "license": "MIT",
   "repository": {