agentbox-sdk 0.1.323 → 0.1.500

package/README.md

@@ -145,6 +145,62 @@ await agent.run({
 
 `xhigh` requires a model that supports it (e.g. Claude Opus 4.7+, Codex `gpt-5.4`).
 
+### Open-source & custom models (OpenRouter, OSS)
+
+Codex isn't limited to OpenAI models — it can route through any
+OpenAI-compatible endpoint (OpenRouter, a local Ollama/LM Studio/vLLM
+server, a proxy). Just like the opencode provider lights up OpenRouter
+from `OPENROUTER_API_KEY`, the codex provider does too: set the key in the
+agent env and pass an OpenRouter model slug.
+
+```ts
+const agent = new Agent("codex", {
+  sandbox,
+  cwd: "/workspace",
+  approvalMode: "auto",
+  env: { OPENROUTER_API_KEY: process.env.OPENROUTER_API_KEY! },
+});
+
+await agent.run({
+  model: "openai/gpt-5.3-codex", // any OpenRouter model slug
+  input: "Explain the project structure.",
+});
+```
+
+When `OPENROUTER_API_KEY` is present (and `OPENAI_API_KEY` is not), AgentBox
+auto-registers an `openrouter` model provider pointing at
+`https://openrouter.ai/api/v1` and selects it. Override the endpoint with
+`OPENROUTER_BASE_URL`.
+
+For any other OpenAI-compatible endpoint, declare providers explicitly via
+`provider.modelProviders` and pick one with `provider.modelProvider`:
+
+```ts
+new Agent("codex", {
+  sandbox,
+  cwd: "/workspace",
+  env: { TOGETHER_API_KEY: process.env.TOGETHER_API_KEY! },
+  provider: {
+    modelProvider: "together",
+    modelProviders: {
+      together: {
+        name: "Together",
+        baseUrl: "https://api.together.xyz/v1",
+        envKey: "TOGETHER_API_KEY",
+        wireApi: "responses", // codex removed the "chat" wire API
+      },
+    },
+  },
+});
+```
+
+These are written into Codex's `config.toml` as `[model_providers.*]`
+blocks, which the codex app-server reads via `CODEX_HOME`. The model slug
+stays a per-run value; the provider is agent-level config. Note that codex
+dropped the Chat Completions wire API in early 2026 — providers must speak
+the Responses API (`wire_api = "responses"`), which OpenRouter and LM
+Studio support; chat-only backends need a responses→chat proxy.
+
 ## Sandboxes
 
 Five sandbox providers are supported. Each gives you an isolated environment with the same interface:

package/dist/agents/index.d.ts

@@ -1,5 +1,5 @@
-import { o as AgentProviderName, h as AgentOptions, t as AgentRunConfig, s as AgentRun, r as AgentResult, a3 as RawAgentEvent, b as AgentAttachRequest, y as AttachedRun, aa as SetupLayout } from '../types-t01PuLUJ.js';
-export { a as AgentApprovalMode, c as AgentCommandConfig, d as AgentCostData, e as AgentExecutionRequest, f as AgentLocalMcpConfig, g as AgentMcpConfig, i as AgentOptionsBase, j as AgentOptionsMap, k as AgentPermissionDecision, l as AgentPermissionKind, m as AgentPermissionResponse, n as AgentProviderAdapter, p as AgentReasoningEffort, q as AgentRemoteMcpConfig, u as AgentRunSink, v as AgentSetupRequest, w as AgentSkillConfig, x as AgentSubAgentConfig, C as ClaudeCodeAgentOptions, z as ClaudeCodeHookConfig, B as ClaudeCodeHookEvent, D as ClaudeCodeHookHandler, E as ClaudeCodeHookMatcherGroup, F as ClaudeCodeHooksConfig, G as ClaudeCodeProviderOptions, H as CodexAgentOptions, I as CodexCommandHook, J as CodexHookEvent, K as CodexHookMatcherGroup, L as CodexHooksConfig, M as CodexProviderOptions, N as DataContent, O as EmbeddedSkillConfig, P as FilePart, Q as ImagePart, X as OpenCodeAgentOptions, Y as OpenCodePluginConfig, Z as OpenCodePluginEvent, _ as OpenCodePluginHookConfig, $ as OpenCodeProviderOptions, a0 as OpenRouterPlugin, a5 as RepoSkillConfig, ac as TextPart, ag as UserContent, ah as UserContentPart } from '../types-t01PuLUJ.js';
+import { o as AgentProviderName, h as AgentOptions, t as AgentRunConfig, s as AgentRun, r as AgentResult, a4 as RawAgentEvent, b as AgentAttachRequest, y as AttachedRun, ab as SetupLayout } from '../types-1seasIwq.js';
+export { a as AgentApprovalMode, c as AgentCommandConfig, d as AgentCostData, e as AgentExecutionRequest, f as AgentLocalMcpConfig, g as AgentMcpConfig, i as AgentOptionsBase, j as AgentOptionsMap, k as AgentPermissionDecision, l as AgentPermissionKind, m as AgentPermissionResponse, n as AgentProviderAdapter, p as AgentReasoningEffort, q as AgentRemoteMcpConfig, u as AgentRunSink, v as AgentSetupRequest, w as AgentSkillConfig, x as AgentSubAgentConfig, C as ClaudeCodeAgentOptions, z as ClaudeCodeHookConfig, B as ClaudeCodeHookEvent, D as ClaudeCodeHookHandler, E as ClaudeCodeHookMatcherGroup, F as ClaudeCodeHooksConfig, G as ClaudeCodeProviderOptions, H as CodexAgentOptions, I as CodexCommandHook, J as CodexHookEvent, K as CodexHookMatcherGroup, L as CodexHooksConfig, M as CodexModelProviderConfig, N as CodexProviderOptions, O as DataContent, P as EmbeddedSkillConfig, Q as FilePart, R as ImagePart, Y as OpenCodeAgentOptions, Z as OpenCodePluginConfig, _ as OpenCodePluginEvent, $ as OpenCodePluginHookConfig, a0 as OpenCodeProviderOptions, a1 as OpenRouterPlugin, a6 as RepoSkillConfig, ad as TextPart, ah as UserContent, ai as UserContentPart } from '../types-1seasIwq.js';
 import { S as Sandbox } from '../Sandbox-DcKAU-E3.js';
 export { AgentProvider } from '../enums.js';
 import 'e2b';

package/dist/agents/index.js

@@ -2,7 +2,7 @@ import {
   Agent,
   agentboxRoot,
   getAgentLayout
-} from "../chunk-XONT46YC.js";
+} from "../chunk-JYI7MRGO.js";
 import "../chunk-775FIGGL.js";
 import {
   AGENT_RESERVED_PORTS,

package/dist/{chunk-XONT46YC.js → chunk-JYI7MRGO.js}

@@ -583,6 +583,9 @@ function buildClaudeHookSettings(hooks) {
   }
   return { hooks };
 }
+function buildClaudeWorkflowSettings(ultracode) {
+  return ultracode ? { enableWorkflows: true, ultracode: true } : {};
+}
 function buildCodexHooksFile(hooks) {
   if (!hasHookEntries(hooks)) {
     return void 0;
@@ -702,6 +705,47 @@ function tomlString(value) {
 function tomlStringArray(values) {
   return `[${values.map(tomlString).join(", ")}]`;
 }
+function tomlInlineTable(values) {
+  const entries = Object.entries(values).map(
+    ([key, value]) => `${tomlString(key)} = ${tomlString(value)}`
+  );
+  return `{ ${entries.join(", ")} }`;
+}
+function appendCodexModelProviderBlock(blocks, id, cfg) {
+  assertSafeTomlKey(id, "Model provider");
+  blocks.push(`[model_providers.${id}]`);
+  blocks.push(`name = ${tomlString(cfg.name ?? id)}`);
+  if (cfg.baseUrl) {
+    blocks.push(`base_url = ${tomlString(cfg.baseUrl)}`);
+  }
+  if (cfg.envKey) {
+    blocks.push(`env_key = ${tomlString(cfg.envKey)}`);
+  }
+  if (cfg.wireApi) {
+    blocks.push(`wire_api = ${tomlString(cfg.wireApi)}`);
+  }
+  if (cfg.queryParams && Object.keys(cfg.queryParams).length > 0) {
+    blocks.push(`query_params = ${tomlInlineTable(cfg.queryParams)}`);
+  }
+  if (cfg.httpHeaders && Object.keys(cfg.httpHeaders).length > 0) {
+    blocks.push(`http_headers = ${tomlInlineTable(cfg.httpHeaders)}`);
+  }
+  if (cfg.envHttpHeaders && Object.keys(cfg.envHttpHeaders).length > 0) {
+    blocks.push(`env_http_headers = ${tomlInlineTable(cfg.envHttpHeaders)}`);
+  }
+  if (cfg.requestMaxRetries !== void 0) {
+    blocks.push(`request_max_retries = ${Math.trunc(cfg.requestMaxRetries)}`);
+  }
+  if (cfg.streamMaxRetries !== void 0) {
+    blocks.push(`stream_max_retries = ${Math.trunc(cfg.streamMaxRetries)}`);
+  }
+  if (cfg.streamIdleTimeoutMs !== void 0) {
+    blocks.push(
+      `stream_idle_timeout_ms = ${Math.trunc(cfg.streamIdleTimeoutMs)}`
+    );
+  }
+  blocks.push("");
+}
 function buildClaudeMcpConfig(mcps) {
   if (!mcps || mcps.length === 0) {
     return void 0;
@@ -777,13 +821,27 @@ function buildCodexConfigToml(opts = {}) {
     enableHooks = false,
     enableSkills = false,
     enableMultiAgent = false,
-    openAiBaseUrl
+    openAiBaseUrl,
+    model,
+    modelProvider,
+    modelProviders
   } = opts;
   const blocks = [];
   if (openAiBaseUrl) {
     blocks.push(`openai_base_url = ${tomlString(openAiBaseUrl)}`);
     blocks.push("");
   }
+  if (model) {
+    blocks.push(`model = ${tomlString(model)}`);
+    blocks.push("");
+  }
+  if (modelProvider) {
+    blocks.push(`model_provider = ${tomlString(modelProvider)}`);
+    blocks.push("");
+  }
+  for (const [id, cfg] of Object.entries(modelProviders ?? {})) {
+    appendCodexModelProviderBlock(blocks, id, cfg);
+  }
   for (const mcp of mcps ?? []) {
     if (mcp.enabled === false) {
       continue;
@@ -1228,13 +1286,14 @@ async function preflightSetup(target, setupId, daemon) {
       ];
       if (daemon) {
         const url = `http://127.0.0.1:${daemon.port}${daemon.healthPath}`;
+        const auth = daemon.curlAuthArg ? `${daemon.curlAuthArg} ` : "";
         if (daemon.expectedVersionMatch) {
           checks.push(
-            `curl -fsS --max-time 2 ${shellQuote(url)} 2>/dev/null | grep -q ${shellQuote(daemon.expectedVersionMatch)}`
+            `curl -fsS --max-time 2 ${auth}${shellQuote(url)} 2>/dev/null | grep -q ${shellQuote(daemon.expectedVersionMatch)}`
           );
         } else {
           checks.push(
-            `curl -fsS --max-time 2 ${shellQuote(url)} >/dev/null 2>&1`
+            `curl -fsS --max-time 2 ${auth}${shellQuote(url)} >/dev/null 2>&1`
           );
         }
       }
@@ -1467,12 +1526,18 @@ function buildOpenCodeSubagentConfig(subAgents) {
         mode: "subagent",
         description: subAgent.description,
         prompt: subAgent.instructions,
+        // opencode reads a per-agent `model` as a "<providerID>/<modelID>"
+        // string (e.g. "openrouter/deepseek/deepseek-v4-flash"). Without it,
+        // the sub-agent silently inherits the orchestrator's model instead of
+        // the one it was configured with — unlike claude-code (frontmatter
+        // `model`) and codex (TOML `model`), which both carry it through.
+        ...subAgent.model ? { model: subAgent.model } : {},
         ...mapOpenCodeTools(subAgent.tools) ? { tools: mapOpenCodeTools(subAgent.tools) } : {}
       }
     ])
   );
 }
-function buildCodexSubagentArtifacts(subAgents, layout) {
+function buildCodexSubagentArtifacts(subAgents, layout, defaultModel) {
   const artifacts = [];
   const agentSections = [];
   for (const subAgent of subAgents ?? []) {
@@ -1485,8 +1550,9 @@ function buildCodexSubagentArtifacts(subAgents, layout) {
     const tomlLines = [
       `model_instructions_file = ${tomlString2(roleConfigPromptPath)}`
     ];
-    if (subAgent.model) {
-      tomlLines.push(`model = ${tomlString2(subAgent.model)}`);
+    const model = subAgent.model ?? defaultModel;
+    if (model) {
+      tomlLines.push(`model = ${tomlString2(model)}`);
     }
     tomlLines.push(
       `model_reasoning_effort = ${tomlString2("medium")}`,
@@ -1513,6 +1579,46 @@ function buildCodexSubagentArtifacts(subAgents, layout) {
   };
 }
 
+// src/agents/config/capability-token.ts
+import crypto from "crypto";
+var tokenCache = /* @__PURE__ */ new WeakMap();
+async function readCapabilityTokenFile(sandbox, tokenFilePath) {
+  const result = await sandbox.run(
+    `if [ -f ${shellQuote(tokenFilePath)} ]; then cat ${shellQuote(tokenFilePath)}; fi`
+  );
+  if (result.exitCode !== 0) return void 0;
+  const value = result.stdout.trim();
+  return value.length > 0 ? value : void 0;
+}
+function resolveCapabilityToken(sandbox, tokenFilePath, create) {
+  let byPath = tokenCache.get(sandbox);
+  if (!byPath) {
+    byPath = /* @__PURE__ */ new Map();
+    tokenCache.set(sandbox, byPath);
+  }
+  const map = byPath;
+  let cached = map.get(tokenFilePath);
+  if (!cached) {
+    const pending = (async () => {
+      const existing = await readCapabilityTokenFile(sandbox, tokenFilePath);
+      if (existing) return existing;
+      if (create) return crypto.randomBytes(32).toString("hex");
+      throw new Error(
+        `Capability token file is missing at ${tokenFilePath}. setup() must run before connecting to this sandbox server.`
+      );
+    })().catch((error) => {
+      map.delete(tokenFilePath);
+      throw error;
+    });
+    map.set(tokenFilePath, pending);
+    cached = pending;
+  }
+  return cached;
+}
+function withBearerToken(base, token) {
+  return { ...base, Authorization: `Bearer ${token}` };
+}
+
 // src/agents/cost.ts
 function addIfNumber(target, key, value) {
   if (typeof value !== "number" || !Number.isFinite(value)) {
@@ -1643,11 +1749,12 @@ function extractOpenCodeCostData(events) {
 }
 
 // src/agents/providers/claude-code.ts
-var DAEMON_PROTOCOL_VERSION = "2";
+var DAEMON_PROTOCOL_VERSION = "3";
 var DAEMON_PORT = 43180;
 var DAEMON_PATH = "/tmp/agentbox/claude-code/daemon.mjs";
 var DAEMON_LOG_PATH = "/tmp/agentbox/claude-code/daemon.log";
 var DAEMON_PID_PATH = "/tmp/agentbox/claude-code/daemon.pid";
+var DAEMON_TOKEN_PATH = "/tmp/agentbox/claude-code/daemon-token";
 var DAEMON_READY_TIMEOUT_MS = 3e4;
 var DAEMON_READY_POLL_INTERVAL_MS = 250;
 function claudeConfigDir(options) {
@@ -1672,6 +1779,7 @@ function buildClaudeQueryOptions(params) {
     extraArgs["append-system-prompt"] = run.systemPrompt;
   }
   const includeHookEvents = provider?.includeHookEvents ?? false;
+  const effort = provider?.ultracode ? "xhigh" : run.reasoning;
   return {
     cwd: params.cwd ?? params.request.options.cwd,
     env: params.env,
@@ -1684,7 +1792,7 @@ function buildClaudeQueryOptions(params) {
     thinking: { type: "adaptive", display: "summarized" },
     ...provider?.additionalDirectories?.length ? { additionalDirectories: provider.additionalDirectories } : {},
     ...run.model ? { model: run.model } : {},
-    ...run.reasoning ? { effort: run.reasoning } : {},
+    ...effort ? { effort } : {},
     ...provider?.permissionMode ? { permissionMode: provider.permissionMode } : {},
     ...provider?.permissionMode === "bypassPermissions" ? { allowDangerouslySkipPermissions: true } : {},
     ...provider?.allowedTools?.length ? { allowedTools: provider.allowedTools } : {},
@@ -1741,11 +1849,30 @@ function createClaudeCodeDaemonScript() {
   const version = JSON.stringify(DAEMON_PROTOCOL_VERSION);
   return `import http from "node:http";
 import { execSync } from "node:child_process";
-import { existsSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
+import { timingSafeEqual } from "node:crypto";
 import { query, getSessionInfo } from "@anthropic-ai/claude-agent-sdk";
 
 const VERSION = ${version};
 const port = Number(process.argv[2] ?? "${DAEMON_PORT}");
+// Capability token: every route except the loopback /__version probe
+// requires \`Authorization: Bearer <token>\`. Loaded once at boot from the
+// 0600 file the host writes alongside this script. Fails closed (rejects
+// all run-control requests) when the file is missing or empty.
+const tokenFilePath = process.argv[3] ?? "";
+let AUTH_TOKEN = "";
+try { if (tokenFilePath) AUTH_TOKEN = readFileSync(tokenFilePath, "utf8").trim(); } catch {}
+
+function isAuthorized(req) {
+  if (!AUTH_TOKEN) return false;
+  const header = req.headers["authorization"] || "";
+  const presented = header.startsWith("Bearer ") ? header.slice(7) : "";
+  if (!presented) return false;
+  const a = Buffer.from(presented);
+  const b = Buffer.from(AUTH_TOKEN);
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+
 const liveRuns = new Map();
 
 // The SDK's default spawn does \`existsSync(pathToClaudeCodeExecutable)\`
@@ -1982,6 +2109,14 @@ const server = http.createServer((req, res) => {
     res.end(VERSION);
     return;
   }
+  // Capability-token gate for every run-control route. The /__version probe
+  // above stays open: it carries no secret and the host probes it over
+  // loopback (no bearer) to detect daemon liveness/version.
+  if (!isAuthorized(req)) {
+    res.writeHead(401, { "content-type": "text/plain" });
+    res.end("unauthorized");
+    return;
+  }
   const url = req.url ?? "";
   let m;
   if (req.method === "POST" && (m = url.match(/^\\/runs\\/([^/]+)\\/start$/))) {
@@ -2052,6 +2187,11 @@ async function ensureClaudeCodeDaemonUncached(options, env) {
       );
       return;
     }
+    const daemonToken = await resolveCapabilityToken(
+      sandbox,
+      DAEMON_TOKEN_PATH,
+      true
+    );
     const daemonDir = path8.posix.dirname(DAEMON_PATH);
     const daemonNodeModules = `${daemonDir}/node_modules/@anthropic-ai`;
     const launchCommand = [
@@ -2059,13 +2199,18 @@ async function ensureClaudeCodeDaemonUncached(options, env) {
       `if [ -z "$NPM_ROOT" ] || [ ! -d "$NPM_ROOT/@anthropic-ai/claude-agent-sdk" ]; then echo "claude-code daemon launch: @anthropic-ai/claude-agent-sdk not found under $NPM_ROOT" >&2; exit 1; fi`,
       `mkdir -p ${shellQuote(daemonNodeModules)}`,
       `ln -sfn "$NPM_ROOT/@anthropic-ai/claude-agent-sdk" ${shellQuote(daemonNodeModules + "/claude-agent-sdk")}`,
+      // The base uploadAndRun only chmods execute-bit artifacts, so the 0600
+      // tarball mode is dropped on Daytona (and other non-Modal providers).
+      // Tighten the just-written token file explicitly — matching codex —
+      // so the bearer is never group/world-readable inside the sandbox.
+      `chmod 600 ${shellQuote(DAEMON_TOKEN_PATH)}`,
       `if [ -f ${shellQuote(DAEMON_PID_PATH)} ]; then kill -TERM "$(cat ${shellQuote(DAEMON_PID_PATH)})" 2>/dev/null || true; fi`,
       `(fuser -k -n tcp ${DAEMON_PORT} 2>/dev/null || true)`,
       // Brief grace so the kernel releases the port before the new
       // daemon's listen() — only matters on warm-sandbox respawns;
       // adds 200ms otherwise.
       `sleep 0.2`,
-      `(nohup node ${shellQuote(DAEMON_PATH)} ${DAEMON_PORT} > ${shellQuote(DAEMON_LOG_PATH)} 2>&1 & echo $! > ${shellQuote(DAEMON_PID_PATH)})`
+      `(nohup node ${shellQuote(DAEMON_PATH)} ${DAEMON_PORT} ${shellQuote(DAEMON_TOKEN_PATH)} > ${shellQuote(DAEMON_LOG_PATH)} 2>&1 & echo $! > ${shellQuote(DAEMON_PID_PATH)})`
     ].join(" && ");
     const launch = await time(
       debugRelay,
@@ -2076,6 +2221,11 @@ async function ensureClaudeCodeDaemonUncached(options, env) {
             path: DAEMON_PATH,
             content: createClaudeCodeDaemonScript(),
             mode: 420
+          },
+          {
+            path: DAEMON_TOKEN_PATH,
+            content: daemonToken,
+            mode: 384
           }
         ],
         launchCommand,
@@ -2171,6 +2321,10 @@ async function daemonBaseUrl(sandbox) {
   const url = await sandbox.getPreviewLink(DAEMON_PORT);
   return url.replace(/\/$/, "");
 }
+async function daemonAuthHeaders(sandbox) {
+  const token = await resolveCapabilityToken(sandbox, DAEMON_TOKEN_PATH, false);
+  return withBearerToken(sandbox.previewHeaders, token);
+}
 var ClaudeCodeAgentAdapter = class {
   /**
    * Sandbox-side preparation. Uploads `.claude/` artifacts and ensures
@@ -2223,12 +2377,19 @@ var ClaudeCodeAgentAdapter = class {
         () => prepareSkillArtifacts(provider, options.skills, target.layout)
       );
       const hookSettings = buildClaudeHookSettings(hooks) ?? {};
+      const workflowSettings = buildClaudeWorkflowSettings(
+        options.provider?.ultracode
+      );
+      const claudeSettings = { ...hookSettings, ...workflowSettings };
       const mcpConfigJson = buildClaudeMcpConfig(options.mcps) ?? JSON.stringify({ mcpServers: {} }, null, 2);
       const artifacts = [
         ...skillArtifacts,
         ...buildClaudeCommandArtifacts(options.commands, target.layout),
         ...buildClaudeSubagentArtifacts(options.subAgents, target.layout),
-        { path: settingsPath, content: JSON.stringify(hookSettings, null, 2) },
+        {
+          path: settingsPath,
+          content: JSON.stringify(claudeSettings, null, 2)
+        },
         { path: mcpConfigPath, content: mcpConfigJson }
       ];
       const enableRtk = options.enableRtk === true;
@@ -2283,6 +2444,12 @@ var ClaudeCodeAgentAdapter = class {
       // user inside our images.
       IS_SANDBOX: "1"
     };
+    const customHeaders = request.options.customHeaders;
+    if (customHeaders && Object.keys(customHeaders).length > 0) {
+      const serialized = Object.entries(customHeaders).map(([name, value]) => `${name}: ${value}`).join("\n");
+      env.ANTHROPIC_CUSTOM_HEADERS = env.ANTHROPIC_CUSTOM_HEADERS ? `${env.ANTHROPIC_CUSTOM_HEADERS}
+${serialized}` : serialized;
+    }
     const inputParts = await time(
       debugClaude,
       "validateProviderUserInput",
@@ -2297,6 +2464,7 @@ var ClaudeCodeAgentAdapter = class {
       "getPreviewLink daemon",
       () => daemonBaseUrl(sandbox)
     );
+    const authHeaders = await daemonAuthHeaders(sandbox);
     const startUrl = `${baseUrl}/runs/${encodeURIComponent(request.runId)}/start`;
     const sdkOptions = buildClaudeQueryOptions({
       request,
@@ -2328,7 +2496,7 @@ var ClaudeCodeAgentAdapter = class {
       try {
         await fetch(
           `${baseUrl}/runs/${encodeURIComponent(request.runId)}/abort`,
-          { method: "POST", headers: sandbox.previewHeaders }
+          { method: "POST", headers: authHeaders }
         );
       } catch {
       }
@@ -2345,7 +2513,7 @@ var ClaudeCodeAgentAdapter = class {
           method: "POST",
           headers: {
             "content-type": "application/json",
-            ...sandbox.previewHeaders
+            ...authHeaders
           },
           body: JSON.stringify({ content: mapped })
         }
@@ -2360,7 +2528,7 @@ var ClaudeCodeAgentAdapter = class {
         signal: fetchAbort.signal,
         headers: {
           "content-type": "application/json",
-          ...sandbox.previewHeaders
+          ...authHeaders
         },
         body: JSON.stringify(requestBody)
       })
@@ -2588,6 +2756,7 @@ var ClaudeCodeAgentAdapter = class {
    */
   async attachAbort(request) {
     const baseUrl = await daemonBaseUrl(request.sandbox);
+    const authHeaders = await daemonAuthHeaders(request.sandbox);
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), 3e3);
     try {
@@ -2596,7 +2765,7 @@ var ClaudeCodeAgentAdapter = class {
         {
           method: "POST",
           signal: controller.signal,
-          headers: request.sandbox.previewHeaders
+          headers: authHeaders
         }
       ).catch((error) => {
         debugClaude("attachAbort POST failed: %o", error);
@@ -2613,6 +2782,7 @@ var ClaudeCodeAgentAdapter = class {
    */
   async attachSendMessage(request, content) {
     const baseUrl = await daemonBaseUrl(request.sandbox);
+    const authHeaders = await daemonAuthHeaders(request.sandbox);
     const inputParts = await validateProviderUserInput(
       AgentProvider.ClaudeCode,
       content
@@ -2624,7 +2794,7 @@ var ClaudeCodeAgentAdapter = class {
         method: "POST",
         headers: {
           "content-type": "application/json",
-          ...request.sandbox.previewHeaders
+          ...authHeaders
         },
         body: JSON.stringify({ content: mapped })
       }
@@ -2638,7 +2808,7 @@ var ClaudeCodeAgentAdapter = class {
 };
 
 // src/agents/providers/codex.ts
-import crypto from "crypto";
+import crypto2 from "crypto";
 import path9 from "path";
 
 // src/agents/transports/app-server.ts
@@ -2895,7 +3065,7 @@ function resolveCodexAppServerToken(sandbox, tokenFilePath, create) {
         return existing;
       }
       if (create) {
-        return crypto.randomBytes(32).toString("hex");
+        return crypto2.randomBytes(32).toString("hex");
       }
       throw new Error(
         `Codex app-server token file is missing at ${tokenFilePath}. setup() must run before connecting to the codex app-server.`
@@ -3216,6 +3386,45 @@ async function materializeCodexImage(options, part, index) {
 function resolveCodexOpenAiBaseUrlFromOptions(options) {
   return options.env?.OPENAI_BASE_URL ?? options.provider?.env?.OPENAI_BASE_URL;
 }
+function codexCredentialEnv(options) {
+  return { ...options.env ?? {}, ...options.provider?.env ?? {} };
+}
+function resolveCodexModelProviders(options) {
+  const modelProviders = {
+    ...options.provider?.modelProviders ?? {}
+  };
+  const modelProvider = options.provider?.modelProvider;
+  const customHeaders = options.customHeaders;
+  if (customHeaders && Object.keys(customHeaders).length > 0) {
+    for (const [id, cfg] of Object.entries(modelProviders)) {
+      modelProviders[id] = {
+        ...cfg,
+        httpHeaders: { ...cfg.httpHeaders ?? {}, ...customHeaders }
+      };
+    }
+  }
+  return { modelProviders, modelProvider };
+}
+function hashCodexProviderCredentials(options, modelProviders) {
+  const env = codexCredentialEnv(options);
+  const envKeyNames = /* @__PURE__ */ new Set(["OPENAI_API_KEY"]);
+  for (const cfg of Object.values(modelProviders)) {
+    if (cfg.envKey) {
+      envKeyNames.add(cfg.envKey);
+    }
+    for (const envVar of Object.values(cfg.envHttpHeaders ?? {})) {
+      envKeyNames.add(envVar);
+    }
+  }
+  const hasher = crypto2.createHash("sha256");
+  for (const name of [...envKeyNames].sort()) {
+    if (env[name] !== void 0) {
+      hasher.update(`${name}=${env[name]}
+`);
+    }
+  }
+  return hasher.digest("hex");
+}
 async function ensureCodexLoginViaConfig(request, target) {
   const options = request.options;
   const openAiApiKey = options.env?.OPENAI_API_KEY ?? options.provider?.env?.OPENAI_API_KEY;
@@ -3300,9 +3509,19 @@ async function setupCodex(request) {
   const provider = request.provider;
   const hooks = assertHooksSupported(provider, options);
   assertCommandsSupported(provider, options.commands);
+  const { modelProviders, modelProvider } = resolveCodexModelProviders(options);
+  const providerCredHash = hashCodexProviderCredentials(
+    options,
+    modelProviders
+  );
   const usesRemoteWebSocket = options.sandbox && options.sandbox.provider !== SandboxProvider.LocalDocker;
   function buildArtifactsFor(layoutTarget) {
-    const { artifacts: subAgentArtifacts, agentSections } = buildCodexSubagentArtifacts(options.subAgents, layoutTarget.layout);
+    const defaultModel = options.provider?.defaultModel;
+    const { artifacts: subAgentArtifacts, agentSections } = buildCodexSubagentArtifacts(
+      options.subAgents,
+      layoutTarget.layout,
+      defaultModel
+    );
     const hooksFile = buildCodexHooksFile(hooks);
     const enableMultiAgent = (options.subAgents?.length ?? 0) > 0;
     const enableSkills = (options.skills?.length ?? 0) > 0;
@@ -3313,7 +3532,10 @@ async function setupCodex(request) {
       enableHooks: Boolean(hooksFile),
       enableSkills,
       enableMultiAgent,
-      openAiBaseUrl
+      openAiBaseUrl,
+      model: defaultModel,
+      modelProvider,
+      modelProviders
     });
     const artifacts = [...subAgentArtifacts];
     if (configToml) {
@@ -3366,7 +3588,7 @@ async function setupCodex(request) {
       artifacts: [...serverArtifacts, ...skillArtifacts2],
       installCommands: installCommands2,
       daemon: daemonInfo,
-      extras: [`enableRtk:${enableRtk2}`]
+      extras: [`enableRtk:${enableRtk2}`, `providerCreds:${providerCredHash}`]
     });
     if (await preflightSetup(sharedTarget, setupId2, daemonInfo)) {
       debugCodex("codex remote setup() preflight hit \u2014 skipping");
@@ -3390,12 +3612,18 @@ async function setupCodex(request) {
     const serverCwd = sharedTarget.layout.rootDir;
     const launchResult = await time(
       debugCodex,
-      "launch app-server (probe + spawn-if-cold)",
+      "restart app-server after setup miss",
       () => sandbox.run(
         [
           `mkdir -p ${shellQuote(sharedTarget.layout.rootDir)}`,
-          `if curl -fsS http://127.0.0.1:${REMOTE_CODEX_APP_SERVER_PORT}/readyz >/dev/null 2>&1; then exit 0; fi`,
-          `if [ -f ${shellQuote(pidFilePath)} ]; then kill "$(cat ${shellQuote(pidFilePath)})" >/dev/null 2>&1 || true; rm -f ${shellQuote(pidFilePath)}; fi`,
+          [
+            `if curl -fsS http://127.0.0.1:${REMOTE_CODEX_APP_SERVER_PORT}/readyz >/dev/null 2>&1; then`,
+            `  if [ -f ${shellQuote(pidFilePath)} ]; then kill "$(cat ${shellQuote(pidFilePath)})" >/dev/null 2>&1 || true; else fuser -k -n tcp ${REMOTE_CODEX_APP_SERVER_PORT} >/dev/null 2>&1 || true; fi`,
+            `  for i in 1 2 3 4 5; do if ! curl -fsS http://127.0.0.1:${REMOTE_CODEX_APP_SERVER_PORT}/readyz >/dev/null 2>&1; then break; fi; sleep 0.2; done`,
+            `  if curl -fsS http://127.0.0.1:${REMOTE_CODEX_APP_SERVER_PORT}/readyz >/dev/null 2>&1; then if [ -f ${shellQuote(pidFilePath)} ]; then kill -9 "$(cat ${shellQuote(pidFilePath)})" >/dev/null 2>&1 || true; else fuser -k -n tcp ${REMOTE_CODEX_APP_SERVER_PORT} >/dev/null 2>&1 || true; fi; fi`,
+            `  rm -f ${shellQuote(pidFilePath)}`,
+            `fi`
+          ].join("\n"),
           `chmod 600 ${shellQuote(tokenFilePath)}`,
           `(${[
             `nohup ${[
@@ -3452,7 +3680,7 @@ async function setupCodex(request) {
   const setupId = computeSetupId({
     artifacts: allArtifacts,
     installCommands,
-    extras: [`enableRtk:${enableRtk}`]
+    extras: [`enableRtk:${enableRtk}`, `providerCreds:${providerCredHash}`]
   });
   if (await preflightSetup(target, setupId)) {
     debugCodex("codex local setup() preflight hit \u2014 skipping");
@@ -3967,6 +4195,37 @@ var LOCAL_OPENCODE_PORT = 4096;
 var SANDBOX_OPENCODE_READY_TIMEOUT_MS = 9e4;
 var LOCAL_OPENCODE_READY_TIMEOUT_MS = 2e4;
 var SHARED_OPENCODE_TARGET_ID = "shared-opencode-server";
+var OPENCODE_AUTH_USERNAME = "opencode";
+function opencodeServerTokenPath() {
+  return path10.posix.join(
+    agentboxRoot(AgentProvider.OpenCode, true),
+    "opencode-auth-token"
+  );
+}
+function opencodeCurlAuthArg() {
+  return `-u "opencode:$(cat ${shellQuote(opencodeServerTokenPath())} 2>/dev/null)"`;
+}
+function opencodeHealthCurl(port) {
+  return `curl -fsS --max-time 2 ${opencodeCurlAuthArg()} http://127.0.0.1:${port}/global/health >/dev/null 2>&1`;
+}
+async function isSandboxOpenCodeServerAuthEnforced(sandbox, cwd, port) {
+  const probe = await sandbox.run(
+    `test "$(curl -s -o /dev/null -w '%{http_code}' --max-time 2 http://127.0.0.1:${port}/global/health)" = "401"`,
+    { cwd, timeoutMs: 5e3 }
+  ).catch(() => void 0);
+  return probe?.exitCode === 0;
+}
+async function opencodeAuthHeaders(sandbox) {
+  const token = await resolveCapabilityToken(
+    sandbox,
+    opencodeServerTokenPath(),
+    false
+  );
+  const basic = Buffer.from(`${OPENCODE_AUTH_USERNAME}:${token}`).toString(
+    "base64"
+  );
+  return { ...sandbox.previewHeaders, Authorization: `Basic ${basic}` };
+}
 var LLM_API_KEY_ENV_VARS = [
   "OPENROUTER_API_KEY",
   "OPENAI_API_KEY",
@@ -4017,10 +4276,10 @@ async function killSandboxOpenCodeServer(sandbox, pidFilePath, cwd, port) {
     ).catch(() => void 0);
     const deadline = Date.now() + 5e3;
     while (Date.now() < deadline) {
-      const probe = await sandbox.run(
-        `curl -fsS --max-time 2 http://127.0.0.1:${port}/global/health >/dev/null 2>&1`,
-        { cwd, timeoutMs: 5e3 }
-      );
+      const probe = await sandbox.run(opencodeHealthCurl(port), {
+        cwd,
+        timeoutMs: 5e3
+      });
       if (probe.exitCode !== 0) {
         return;
       }
@@ -4127,6 +4386,8 @@ function buildOpenCodeConfig(options, interactiveApproval) {
     transforms: ["middle-out"],
     ...openRouterPlugins ? { plugins: openRouterPlugins } : {}
   };
+  const customHeaders = options.customHeaders && Object.keys(options.customHeaders).length > 0 ? options.customHeaders : void 0;
+  const headerOpts = customHeaders ? { headers: customHeaders } : {};
   return {
     $schema: "https://opencode.ai/config.json",
     ...mcpConfig ? { mcp: mcpConfig } : {},
@@ -4135,10 +4396,12 @@ function buildOpenCodeConfig(options, interactiveApproval) {
       openrouter: {
         options: {
           baseURL: openRouterBaseUrl || "https://openrouter.ai/api/v1",
-          extraBody: openRouterExtraBody
+          extraBody: openRouterExtraBody,
+          ...headerOpts
         }
       },
-      ...googleBaseUrl ? { google: { options: { baseURL: googleBaseUrl } } } : {}
+      ...googleBaseUrl ? { google: { options: { baseURL: googleBaseUrl, ...headerOpts } } } : {},
+      ...customHeaders ? { anthropic: { options: { ...headerOpts } } } : {}
     },
     agent: {
       agentbox: baseAgent,
@@ -4160,6 +4423,12 @@ async function ensureSandboxOpenCodeServer(request) {
       SHARED_OPENCODE_TARGET_ID,
       options
     );
+    const serverTokenPath = opencodeServerTokenPath();
+    const serverToken = await resolveCapabilityToken(
+      sandbox,
+      serverTokenPath,
+      true
+    );
     const { artifacts: skillArtifacts, installCommands } = await prepareSkillArtifacts(
       request.provider,
       options.skills,
@@ -4177,10 +4446,18 @@ async function ensureSandboxOpenCodeServer(request) {
       {
         path: configPath,
         content: JSON.stringify(openCodeConfig, null, 2)
+      },
+      {
+        path: serverTokenPath,
+        content: serverToken
       }
     ];
     const enableRtk = options.enableRtk === true;
-    const daemonInfo = { port, healthPath: "/global/health" };
+    const daemonInfo = {
+      port,
+      healthPath: "/global/health",
+      curlAuthArg: opencodeCurlAuthArg()
+    };
     const setupId = computeSetupId({
       artifacts: allArtifacts,
       installCommands,
@@ -4195,10 +4472,15 @@ async function ensureSandboxOpenCodeServer(request) {
       return;
     }
     if (await isSandboxOpenCodeServerHealthy(sandbox, options.cwd, port)) {
+      if (await isSandboxOpenCodeServerAuthEnforced(sandbox, options.cwd, port)) {
+        debugOpencode(
+          "opencode server already running but setup drifted \u2014 reusing it without restart; call agent.killServer() to apply the new config"
+        );
+        return;
+      }
       debugOpencode(
-        "opencode server already running but setup drifted \u2014 reusing it without restart; call agent.killServer() to apply the new config"
+        "opencode server running without capability auth \u2014 restarting to enforce it"
       );
-      return;
     }
     const commonEnv = {
       OPENCODE_CONFIG: configPath,
@@ -4218,9 +4500,18 @@ async function ensureSandboxOpenCodeServer(request) {
       target.layout.rootDir,
       "opencode-serve.log"
     );
-    const serveEnv = { ...options.env ?? {}, ...commonEnv };
+    const serveEnv = {
+      ...options.env ?? {},
+      ...commonEnv,
+      // Native opencode HTTP basic auth. The host presents this token on
+      // every request (see opencodeAuthHeaders); the in-sandbox health probes
+      // present it too (see opencodeHealthCurl).
+      OPENCODE_SERVER_USERNAME: OPENCODE_AUTH_USERNAME,
+      OPENCODE_SERVER_PASSWORD: serverToken
+    };
     const launchCommand = [
       `mkdir -p ${shellQuote(target.layout.rootDir)}`,
+      `chmod 600 ${shellQuote(serverTokenPath)} 2>/dev/null || true`,
       `(${[
         `setsid nohup ${[
           binary,
@@ -4263,10 +4554,10 @@ async function ensureSandboxOpenCodeServer(request) {
             );
           }
           while (Date.now() < readyDeadline) {
-            const probe = await sandbox.run(
-              `curl -fsS http://127.0.0.1:${port}/global/health >/dev/null 2>&1`,
-              { cwd: options.cwd, timeoutMs: 5e3 }
-            );
+            const probe = await sandbox.run(opencodeHealthCurl(port), {
+              cwd: options.cwd,
+              timeoutMs: 5e3
+            });
             if (probe.exitCode === 0) {
               debugOpencode("ready on attempt %d", attempt);
               return true;
@@ -4308,6 +4599,18 @@ opencode log:
 ${lastLog}` : "")
       );
     }
+    if (!await isSandboxOpenCodeServerAuthEnforced(sandbox, options.cwd, port)) {
+      await killSandboxOpenCodeServer(
+        sandbox,
+        pidFilePath,
+        options.cwd,
+        port
+      ).catch(() => void 0);
+      await target.cleanup().catch(() => void 0);
+      throw new Error(
+        "OpenCode server started but is not enforcing the capability token (OPENCODE_SERVER_PASSWORD ignored). Upgrade opencode-ai to a version that supports server authentication."
+      );
+    }
     await markSetupComplete(target, setupId);
   });
 }
@@ -4399,10 +4702,7 @@ async function setupOpenCode(request) {
   await ensureLocalOpenCodeServer(request);
 }
 async function isSandboxOpenCodeServerHealthy(sandbox, cwd, port) {
-  const probe = await sandbox.run(
-    `curl -fsS --max-time 2 http://127.0.0.1:${port}/global/health >/dev/null 2>&1`,
-    { cwd, timeoutMs: 5e3 }
-  ).catch(() => void 0);
+  const probe = await sandbox.run(opencodeHealthCurl(port), { cwd, timeoutMs: 5e3 }).catch(() => void 0);
   return probe?.exitCode === 0;
 }
 async function isLocalOpenCodeServerHealthy() {
@@ -4443,7 +4743,7 @@ async function buildOpenCodeRuntime(options) {
     const baseUrl2 = (await sandbox.getPreviewLink(SANDBOX_OPENCODE_PORT)).replace(/\/$/, "");
     return {
       baseUrl: baseUrl2,
-      previewHeaders: sandbox.previewHeaders,
+      previewHeaders: await opencodeAuthHeaders(sandbox),
       raw: { baseUrl: baseUrl2, port: SANDBOX_OPENCODE_PORT }
     };
   }
@@ -4977,6 +5277,7 @@ var OpenCodeAgentAdapter = class {
       );
     }
     const baseUrl = (await request.sandbox.getPreviewLink(SANDBOX_OPENCODE_PORT)).replace(/\/$/, "");
+    const authHeaders = await opencodeAuthHeaders(request.sandbox);
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), 3e3);
     try {
@@ -4985,7 +5286,7 @@ var OpenCodeAgentAdapter = class {
         signal: controller.signal,
         headers: {
           "content-type": "application/json",
-          ...request.sandbox.previewHeaders
+          ...authHeaders
         }
       }).catch((error) => {
         debugOpencode(
@@ -5016,12 +5317,13 @@ var OpenCodeAgentAdapter = class {
       content
     );
     const parts = mapToOpenCodeParts(inputParts);
+    const authHeaders = await opencodeAuthHeaders(request.sandbox);
     const url = `${baseUrl}/session/${request.sessionId}/prompt_async`;
     const response = await fetch(url, {
       method: "POST",
       headers: {
         "content-type": "application/json",
-        ...request.sandbox.previewHeaders
+        ...authHeaders
       },
       body: JSON.stringify({
         agent: openCodeAgentSlug(void 0),

package/dist/events/index.d.ts

@@ -1,4 +1,4 @@
-export { A as AISDKEvent, R as MessageCompletedEvent, S as MessageInjectedEvent, T as MessageStartedEvent, U as NormalizedAgentEvent, V as NormalizedAgentEventBase, W as NormalizedAgentEventType, a1 as PermissionRequestedEvent, a2 as PermissionResolvedEvent, a3 as RawAgentEvent, a4 as ReasoningDeltaEvent, a6 as RunCancelledEvent, a7 as RunCompletedEvent, a8 as RunErrorEvent, a9 as RunStartedEvent, ab as TextDeltaEvent, ad as ToolCallCompletedEvent, ae as ToolCallDeltaEvent, af as ToolCallStartedEvent, ai as createNormalizedEvent, aj as normalizeRawAgentEvent, ak as toAISDKEvent, al as toAISDKStream } from '../types-t01PuLUJ.js';
+export { A as AISDKEvent, S as MessageCompletedEvent, T as MessageInjectedEvent, U as MessageStartedEvent, V as NormalizedAgentEvent, W as NormalizedAgentEventBase, X as NormalizedAgentEventType, a2 as PermissionRequestedEvent, a3 as PermissionResolvedEvent, a4 as RawAgentEvent, a5 as ReasoningDeltaEvent, a7 as RunCancelledEvent, a8 as RunCompletedEvent, a9 as RunErrorEvent, aa as RunStartedEvent, ac as TextDeltaEvent, ae as ToolCallCompletedEvent, af as ToolCallDeltaEvent, ag as ToolCallStartedEvent, aj as createNormalizedEvent, ak as normalizeRawAgentEvent, al as toAISDKEvent, am as toAISDKStream } from '../types-1seasIwq.js';
 import { AgentProvider } from '../enums.js';
 import '../Sandbox-DcKAU-E3.js';
 import 'e2b';

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { A as AISDKEvent, a as AgentApprovalMode, b as AgentAttachRequest, c as AgentCommandConfig, d as AgentCostData, e as AgentExecutionRequest, f as AgentLocalMcpConfig, g as AgentMcpConfig, h as AgentOptions, i as AgentOptionsBase, j as AgentOptionsMap, k as AgentPermissionDecision, l as AgentPermissionKind, m as AgentPermissionResponse, n as AgentProviderAdapter, o as AgentProviderName, p as AgentReasoningEffort, q as AgentRemoteMcpConfig, r as AgentResult, s as AgentRun, t as AgentRunConfig, u as AgentRunSink, v as AgentSetupRequest, w as AgentSkillConfig, x as AgentSubAgentConfig, y as AttachedRun, C as ClaudeCodeAgentOptions, z as ClaudeCodeHookConfig, B as ClaudeCodeHookEvent, D as ClaudeCodeHookHandler, E as ClaudeCodeHookMatcherGroup, F as ClaudeCodeHooksConfig, G as ClaudeCodeProviderOptions, H as CodexAgentOptions, I as CodexCommandHook, J as CodexHookEvent, K as CodexHookMatcherGroup, L as CodexHooksConfig, M as CodexProviderOptions, N as DataContent, O as EmbeddedSkillConfig, P as FilePart, Q as ImagePart, R as MessageCompletedEvent, S as MessageInjectedEvent, T as MessageStartedEvent, U as NormalizedAgentEvent, V as NormalizedAgentEventBase, W as NormalizedAgentEventType, X as OpenCodeAgentOptions, Y as OpenCodePluginConfig, Z as OpenCodePluginEvent, _ as OpenCodePluginHookConfig, $ as OpenCodeProviderOptions, a0 as OpenRouterPlugin, a1 as PermissionRequestedEvent, a2 as PermissionResolvedEvent, a3 as RawAgentEvent, a4 as ReasoningDeltaEvent, a5 as RepoSkillConfig, a6 as RunCancelledEvent, a7 as RunCompletedEvent, a8 as RunErrorEvent, a9 as RunStartedEvent, aa as SetupLayout, ab as TextDeltaEvent, ac as TextPart, ad as ToolCallCompletedEvent, ae as ToolCallDeltaEvent, af as ToolCallStartedEvent, ag as UserContent, ah as UserContentPart, ai as createNormalizedEvent, aj as normalizeRawAgentEvent, ak as toAISDKEvent, al as toAISDKStream } from './types-t01PuLUJ.js';
+export { A as AISDKEvent, a as AgentApprovalMode, b as AgentAttachRequest, c as AgentCommandConfig, d as AgentCostData, e as AgentExecutionRequest, f as AgentLocalMcpConfig, g as AgentMcpConfig, h as AgentOptions, i as AgentOptionsBase, j as AgentOptionsMap, k as AgentPermissionDecision, l as AgentPermissionKind, m as AgentPermissionResponse, n as AgentProviderAdapter, o as AgentProviderName, p as AgentReasoningEffort, q as AgentRemoteMcpConfig, r as AgentResult, s as AgentRun, t as AgentRunConfig, u as AgentRunSink, v as AgentSetupRequest, w as AgentSkillConfig, x as AgentSubAgentConfig, y as AttachedRun, C as ClaudeCodeAgentOptions, z as ClaudeCodeHookConfig, B as ClaudeCodeHookEvent, D as ClaudeCodeHookHandler, E as ClaudeCodeHookMatcherGroup, F as ClaudeCodeHooksConfig, G as ClaudeCodeProviderOptions, H as CodexAgentOptions, I as CodexCommandHook, J as CodexHookEvent, K as CodexHookMatcherGroup, L as CodexHooksConfig, M as CodexModelProviderConfig, N as CodexProviderOptions, O as DataContent, P as EmbeddedSkillConfig, Q as FilePart, R as ImagePart, S as MessageCompletedEvent, T as MessageInjectedEvent, U as MessageStartedEvent, V as NormalizedAgentEvent, W as NormalizedAgentEventBase, X as NormalizedAgentEventType, Y as OpenCodeAgentOptions, Z as OpenCodePluginConfig, _ as OpenCodePluginEvent, $ as OpenCodePluginHookConfig, a0 as OpenCodeProviderOptions, a1 as OpenRouterPlugin, a2 as PermissionRequestedEvent, a3 as PermissionResolvedEvent, a4 as RawAgentEvent, a5 as ReasoningDeltaEvent, a6 as RepoSkillConfig, a7 as RunCancelledEvent, a8 as RunCompletedEvent, a9 as RunErrorEvent, aa as RunStartedEvent, ab as SetupLayout, ac as TextDeltaEvent, ad as TextPart, ae as ToolCallCompletedEvent, af as ToolCallDeltaEvent, ag as ToolCallStartedEvent, ah as UserContent, ai as UserContentPart, aj as createNormalizedEvent, ak as normalizeRawAgentEvent, al as toAISDKEvent, am as toAISDKStream } from './types-1seasIwq.js';
 export { AGENT_RESERVED_PORTS, Agent, agentboxRoot, collectAllAgentReservedPorts, getAgentLayout } from './agents/index.js';
 export { A as AsyncCommandHandle, C as CommandEvent, a as CommandOptions, b as CommandResult, D as DaytonaProviderOptions, c as DaytonaSandboxOptions, E as E2bProviderOptions, d as E2bSandboxOptions, G as GitCloneOptions, L as LocalDockerProviderOptions, e as LocalDockerSandboxOptions, M as ModalProviderOptions, f as ModalSandboxOptions, S as Sandbox, g as SandboxDescriptor, h as SandboxListOptions, i as SandboxOptions, j as SandboxOptionsBase, k as SandboxOptionsMap, l as SandboxProviderName, m as SandboxRaw, n as SandboxRawMap, o as SandboxResourceSpec, T as TarballEntry, V as VercelGitSource, p as VercelProviderOptions, q as VercelSandboxOptions } from './Sandbox-DcKAU-E3.js';
 export { SandboxAdapter, buildGitCloneCommand } from './sandboxes/index.js';

package/dist/index.js

@@ -2,7 +2,7 @@ import {
   Agent,
   agentboxRoot,
   getAgentLayout
-} from "./chunk-XONT46YC.js";
+} from "./chunk-JYI7MRGO.js";
 import {
   ProviderLogAssembler,
   createNormalizedEvent,

package/dist/{types-t01PuLUJ.d.ts → types-1seasIwq.d.ts}

@@ -264,6 +264,48 @@ interface CodexHookMatcherGroup {
     hooks: CodexCommandHook[];
 }
 type CodexHooksConfig = Partial<Record<CodexHookEvent, CodexHookMatcherGroup[]>>;
+/**
+ * One OpenAI-compatible model provider for Codex, serialized into a
+ * `[model_providers.<id>]` block in config.toml. Mirrors codex's
+ * `ModelProviderInfo` (which uses snake_case keys and
+ * `deny_unknown_fields`) but with the camelCase field names AgentBox
+ * exposes publicly. Use it to point Codex at a local Ollama/LM Studio/vLLM
+ * server or any other OpenAI-compatible endpoint.
+ */
+interface CodexModelProviderConfig {
+    /** Friendly display name. Defaults to the provider id when omitted. */
+    name?: string;
+    /** Base URL of the OpenAI-compatible API (e.g. `http://localhost:8000/v1`). */
+    baseUrl?: string;
+    /**
+     * Name of the environment variable holding the API key. The variable
+     * must be present in the agent env (`options.env` / `provider.env`) so
+     * the codex process can read it — AgentBox never writes the secret into
+     * config.toml.
+     */
+    envKey?: string;
+    /**
+     * Wire protocol the endpoint speaks. Codex removed the `"chat"` (Chat
+     * Completions) wire API in Feb 2026 and now rejects it at config load,
+     * so prefer `"responses"` (the Responses API) — what LM Studio and modern
+     * Ollama expose. Omit to use codex's default
+     * (`"responses"`). `"chat"` remains in the type only for older codex
+     * builds / chat→responses proxies.
+     */
+    wireApi?: "chat" | "responses" | "responses_websocket";
+    /** Extra query-string params appended to every request. */
+    queryParams?: Record<string, string>;
+    /** Static HTTP headers added to every request. */
+    httpHeaders?: Record<string, string>;
+    /** HTTP headers whose values come from env vars (header name -> env var name). */
+    envHttpHeaders?: Record<string, string>;
+    /** Maximum number of times to retry a failed request. */
+    requestMaxRetries?: number;
+    /** Maximum number of reconnect attempts for a dropped stream. */
+    streamMaxRetries?: number;
+    /** Idle timeout (ms) before a stalled stream is treated as lost. */
+    streamIdleTimeoutMs?: number;
+}
 type OpenCodePluginEvent = "command.executed" | "file.edited" | "file.watcher.updated" | "installation.updated" | "lsp.client.diagnostics" | "lsp.updated" | "message.part.removed" | "message.part.updated" | "message.removed" | "message.updated" | "permission.asked" | "permission.replied" | "server.connected" | "session.created" | "session.compacted" | "session.deleted" | "session.diff" | "session.error" | "session.idle" | "session.status" | "session.updated" | "todo.updated" | "shell.env" | "tool.execute.after" | "tool.execute.before" | "tui.prompt.append" | "tui.command.execute" | "tui.toast.show" | "experimental.session.compacting";
 interface OpenCodePluginHookConfig {
     event: OpenCodePluginEvent;
@@ -367,6 +409,22 @@ interface AgentOptionsBase {
      * is a no-op when already active. Toggle invalidates the setup cache.
      */
     enableRtk?: boolean;
+    /**
+     * Custom HTTP headers to attach to the agent's outbound LLM API requests.
+     *
+     * Forwarded per provider via whatever native mechanism each CLI exposes:
+     * - claude-code: `ANTHROPIC_CUSTOM_HEADERS` (applies to all Anthropic calls)
+     * - codex: `http_headers` on the active `[model_providers.*]` block in
+     *   config.toml. When Codex falls back to its built-in `openai` provider,
+     *   there is no provider block to carry headers, so headers are ignored.
+     * - open-code: `provider.<id>.options.headers` in the opencode config
+     *
+     * Typical use: spend-tracking / routing tags for an LLM gateway, e.g.
+     * `{ "x-litellm-tags": "task:123" }`. Whether a header actually reaches the
+     * upstream depends on the CLI and provider; open-code's config-level headers
+     * in particular are subject to upstream support.
+     */
+    customHeaders?: Record<string, string>;
     approvalMode?: AgentApprovalMode;
     mcps?: AgentMcpConfig[];
     skills?: AgentSkillConfig[];
@@ -379,6 +437,37 @@ interface CodexProviderOptions {
     brokerEndpoint?: string;
     useBroker?: boolean;
     hooks?: CodexHooksConfig;
+    /**
+     * Extra OpenAI-compatible model providers, written as
+     * `[model_providers.<id>]` blocks in Codex's config.toml. Lets Codex
+     * talk to a local Ollama/LM Studio/vLLM server or another
+     * OpenAI-compatible endpoint.
+     */
+    modelProviders?: Record<string, CodexModelProviderConfig>;
+    /**
+     * Top-level `model_provider` written into Codex's config.toml — selects
+     * which {@link modelProviders} table Codex routes every run through (the
+     * per-run {@link AgentRunConfig.model} stays a plain model slug).
+     *
+     * When omitted, Codex falls back to its built-in `openai` provider.
+     */
+    modelProvider?: string;
+    /**
+     * Default model slug written as the top-level `model` in Codex's
+     * config.toml and used as the fallback `model` for any sub-agent
+     * ({@link AgentSubAgentConfig}) that does not set its own.
+     *
+     * Why this exists: when Codex spawns a *named* sub-agent it reloads the
+     * child config from the on-disk config-layer stack (config.toml + the
+     * role's TOML) and drops the parent turn's runtime model. If neither
+     * layer carries a `model`, the child's model resolves to `None` and
+     * `spawn_agent` fails service-tier validation with "could not resolve the
+     * child model". Setting this guarantees a resolvable model is always on
+     * disk. The per-run {@link AgentRunConfig.model} still overrides it for
+     * the root turn via `thread/start`; this only backstops role spawns and
+     * runs that omit a model.
+     */
+    defaultModel?: string;
     /**
      * When `false`, writes `supports_websockets = false` into Codex's
      * config.toml. Useful in environments where outbound WebSocket
@@ -418,6 +507,18 @@ interface ClaudeCodeProviderOptions {
      * silence them when hook noise drowns out the rest of the event stream.
      */
     includeHookEvents?: boolean;
+    /**
+     * Enable "ultracode" for claude-code runs: xhigh reasoning effort plus
+     * standing dynamic-workflow orchestration (the built-in `Workflow` tool).
+     *
+     * When `true`, agentbox writes `enableWorkflows: true` + `ultracode: true`
+     * into the managed `settings.json` and forces `effort: "xhigh"` on the query.
+     *
+     * Requires an xhigh-capable model (e.g. Opus) and a recent runtime — the
+     * Workflows feature shipped around Claude Code 2.1.154 / Agent SDK 0.3.149.
+     * On older CLIs the settings keys are simply ignored.
+     */
+    ultracode?: boolean;
 }
 interface CodexAgentOptions extends AgentOptionsBase {
     provider?: CodexProviderOptions;
@@ -629,4 +730,4 @@ interface AgentProviderAdapter<P extends AgentProviderName = AgentProviderName>
     attachSendMessage(request: AgentAttachRequest<P>, content: UserContent): Promise<void>;
 }
 
-export { type OpenCodeProviderOptions as $, type AISDKEvent as A, type ClaudeCodeHookEvent as B, type ClaudeCodeAgentOptions as C, type ClaudeCodeHookHandler as D, type ClaudeCodeHookMatcherGroup as E, type ClaudeCodeHooksConfig as F, type ClaudeCodeProviderOptions as G, type CodexAgentOptions as H, type CodexCommandHook as I, type CodexHookEvent as J, type CodexHookMatcherGroup as K, type CodexHooksConfig as L, type CodexProviderOptions as M, type DataContent as N, type EmbeddedSkillConfig as O, type FilePart as P, type ImagePart as Q, type MessageCompletedEvent as R, type MessageInjectedEvent as S, type MessageStartedEvent as T, type NormalizedAgentEvent as U, type NormalizedAgentEventBase as V, type NormalizedAgentEventType as W, type OpenCodeAgentOptions as X, type OpenCodePluginConfig as Y, type OpenCodePluginEvent as Z, type OpenCodePluginHookConfig as _, type AgentApprovalMode as a, type OpenRouterPlugin as a0, type PermissionRequestedEvent as a1, type PermissionResolvedEvent as a2, type RawAgentEvent as a3, type ReasoningDeltaEvent as a4, type RepoSkillConfig as a5, type RunCancelledEvent as a6, type RunCompletedEvent as a7, type RunErrorEvent as a8, type RunStartedEvent as a9, type SetupLayout as aa, type TextDeltaEvent as ab, type TextPart as ac, type ToolCallCompletedEvent as ad, type ToolCallDeltaEvent as ae, type ToolCallStartedEvent as af, type UserContent as ag, type UserContentPart as ah, createNormalizedEvent as ai, normalizeRawAgentEvent as aj, toAISDKEvent as ak, toAISDKStream as al, type AgentAttachRequest as b, type AgentCommandConfig as c, type AgentCostData as d, type AgentExecutionRequest as e, type AgentLocalMcpConfig as f, type AgentMcpConfig as g, type AgentOptions as h, type AgentOptionsBase as i, type AgentOptionsMap as j, type AgentPermissionDecision as k, type AgentPermissionKind as l, type AgentPermissionResponse as m, type AgentProviderAdapter as n, type AgentProviderName as o, type AgentReasoningEffort as p, type AgentRemoteMcpConfig as q, type AgentResult as r, type AgentRun as s, type AgentRunConfig as t, type AgentRunSink as u, type AgentSetupRequest as v, type AgentSkillConfig as w, type AgentSubAgentConfig as x, type AttachedRun as y, type ClaudeCodeHookConfig as z };
+export { type OpenCodePluginHookConfig as $, type AISDKEvent as A, type ClaudeCodeHookEvent as B, type ClaudeCodeAgentOptions as C, type ClaudeCodeHookHandler as D, type ClaudeCodeHookMatcherGroup as E, type ClaudeCodeHooksConfig as F, type ClaudeCodeProviderOptions as G, type CodexAgentOptions as H, type CodexCommandHook as I, type CodexHookEvent as J, type CodexHookMatcherGroup as K, type CodexHooksConfig as L, type CodexModelProviderConfig as M, type CodexProviderOptions as N, type DataContent as O, type EmbeddedSkillConfig as P, type FilePart as Q, type ImagePart as R, type MessageCompletedEvent as S, type MessageInjectedEvent as T, type MessageStartedEvent as U, type NormalizedAgentEvent as V, type NormalizedAgentEventBase as W, type NormalizedAgentEventType as X, type OpenCodeAgentOptions as Y, type OpenCodePluginConfig as Z, type OpenCodePluginEvent as _, type AgentApprovalMode as a, type OpenCodeProviderOptions as a0, type OpenRouterPlugin as a1, type PermissionRequestedEvent as a2, type PermissionResolvedEvent as a3, type RawAgentEvent as a4, type ReasoningDeltaEvent as a5, type RepoSkillConfig as a6, type RunCancelledEvent as a7, type RunCompletedEvent as a8, type RunErrorEvent as a9, type RunStartedEvent as aa, type SetupLayout as ab, type TextDeltaEvent as ac, type TextPart as ad, type ToolCallCompletedEvent as ae, type ToolCallDeltaEvent as af, type ToolCallStartedEvent as ag, type UserContent as ah, type UserContentPart as ai, createNormalizedEvent as aj, normalizeRawAgentEvent as ak, toAISDKEvent as al, toAISDKStream as am, type AgentAttachRequest as b, type AgentCommandConfig as c, type AgentCostData as d, type AgentExecutionRequest as e, type AgentLocalMcpConfig as f, type AgentMcpConfig as g, type AgentOptions as h, type AgentOptionsBase as i, type AgentOptionsMap as j, type AgentPermissionDecision as k, type AgentPermissionKind as l, type AgentPermissionResponse as m, type AgentProviderAdapter as n, type AgentProviderName as o, type AgentReasoningEffort as p, type AgentRemoteMcpConfig as q, type AgentResult as r, type AgentRun as s, type AgentRunConfig as t, type AgentRunSink as u, type AgentSetupRequest as v, type AgentSkillConfig as w, type AgentSubAgentConfig as x, type AttachedRun as y, type ClaudeCodeHookConfig as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentbox-sdk",
-  "version": "0.1.323",
+  "version": "0.1.500",
   "description": "Swappable coding agents and sandbox providers for Bun and TypeScript.",
   "license": "MIT",
   "repository": {