ai-sdk-provider-codex-cli 2.1.0 → 2.1.2

package/dist/index.d.ts

@@ -900,7 +900,21 @@ declare class ExecLanguageModel implements LanguageModelV4 {
     private mergeSettings;
     private getItemType;
     private buildArgs;
+    /**
+     * Apply MCP server settings as `-c` config overrides.
+     *
+     * Returns environment variables that must be set on the spawned codex
+     * process. Inline HTTP `bearerToken` secrets are routed through the child
+     * environment (via `bearer_token_env_var`) instead of argv, because command
+     * lines are readable by any local process (`ps`, /proc/<pid>/cmdline).
+     */
     private applyMcpSettings;
+    /**
+     * Pick a child-env variable name to carry an inline MCP bearer token,
+     * avoiding collisions between server names that normalize identically
+     * (e.g. 'foo-bar' and 'foo_bar').
+     */
+    private allocateBearerTokenEnvVar;
     private addConfigOverride;
     /**
      * Serialize a config override value into a CLI-safe string.

package/dist/index.js

@@ -1443,7 +1443,7 @@ var ExecLanguageModel = class {
     if (settings.webSearch) {
       args.push("-c", "tools.web_search=true");
     }
-    this.applyMcpSettings(args, settings);
+    const mcpSecretEnv = this.applyMcpSettings(args, settings);
     if (settings.color) {
       args.push("--color", settings.color);
     }
@@ -1491,6 +1491,7 @@ var ExecLanguageModel = class {
     const env = {
       ...process.env,
       ...settings.env || {},
+      ...mcpSecretEnv,
       RUST_LOG: process.env.RUST_LOG || "error"
     };
     let lastMessagePath = settings.outputLastMessageFile;
@@ -1516,11 +1517,20 @@ var ExecLanguageModel = class {
       tempImagePaths: tempImagePaths.length > 0 ? tempImagePaths : void 0
     };
   }
+  /**
+   * Apply MCP server settings as `-c` config overrides.
+   *
+   * Returns environment variables that must be set on the spawned codex
+   * process. Inline HTTP `bearerToken` secrets are routed through the child
+   * environment (via `bearer_token_env_var`) instead of argv, because command
+   * lines are readable by any local process (`ps`, /proc/<pid>/cmdline).
+   */
   applyMcpSettings(args, settings) {
     if (settings.rmcpClient) {
       this.addConfigOverride(args, "features.rmcp_client", true);
     }
-    if (!settings.mcpServers) return;
+    if (!settings.mcpServers) return void 0;
+    const secretEnv = {};
     for (const [rawName, server] of Object.entries(settings.mcpServers)) {
       const name = assertValidMcpServerName(rawName);
       const prefix = `mcp_servers.${name}`;
@@ -1546,15 +1556,43 @@ var ExecLanguageModel = class {
         if (server.cwd) this.addConfigOverride(args, `${prefix}.cwd`, server.cwd);
       } else {
         this.addConfigOverride(args, `${prefix}.url`, server.url);
-        if (server.bearerTokenEnvVar)
+        const hasExplicitAuthorizationHeader = Object.keys(server.httpHeaders ?? {}).some(
+          (key) => key.toLowerCase() === "authorization"
+        );
+        if (server.bearerTokenEnvVar) {
           this.addConfigOverride(args, `${prefix}.bearer_token_env_var`, server.bearerTokenEnvVar);
-        const httpHeaders = mcpHttpHeadersWithBearerToken(server);
-        if (httpHeaders !== void 0)
-          this.addConfigOverride(args, `${prefix}.http_headers`, httpHeaders);
+          if (server.bearerToken !== void 0) {
+            this.logger.warn(
+              `[codex-cli] MCP server '${name}': both bearerToken and bearerTokenEnvVar are set; using bearerTokenEnvVar and ignoring the inline token.`
+            );
+          }
+        } else if (server.bearerToken !== void 0 && !hasExplicitAuthorizationHeader) {
+          const envVarName = this.allocateBearerTokenEnvVar(name, secretEnv);
+          secretEnv[envVarName] = server.bearerToken;
+          this.addConfigOverride(args, `${prefix}.bearer_token_env_var`, envVarName);
+        }
+        if (server.httpHeaders !== void 0)
+          this.addConfigOverride(args, `${prefix}.http_headers`, server.httpHeaders);
         if (server.envHttpHeaders !== void 0)
           this.addConfigOverride(args, `${prefix}.env_http_headers`, server.envHttpHeaders);
       }
     }
+    return Object.keys(secretEnv).length > 0 ? secretEnv : void 0;
+  }
+  /**
+   * Pick a child-env variable name to carry an inline MCP bearer token,
+   * avoiding collisions between server names that normalize identically
+   * (e.g. 'foo-bar' and 'foo_bar').
+   */
+  allocateBearerTokenEnvVar(serverName, secretEnv) {
+    const base = `CODEX_MCP_${serverName.toUpperCase().replace(/-/g, "_")}_BEARER_TOKEN`;
+    let candidate = base;
+    let suffix = 2;
+    while (candidate in secretEnv) {
+      candidate = `${base}_${suffix}`;
+      suffix += 1;
+    }
+    return candidate;
   }
   addConfigOverride(args, key, value) {
     assertValidConfigOverrideKey(key);
@@ -4827,6 +4865,7 @@ var AppServerRpcClient = class extends EventEmitter {
   activeRequestContextsByTurn = /* @__PURE__ */ new Map();
   completedTurnIds = /* @__PURE__ */ new Set();
   lastStderr = "";
+  lastCrashHadStderr = false;
   idleTimer;
   serverCapabilities;
   expectedExitSignal;
@@ -5033,6 +5072,7 @@ var AppServerRpcClient = class extends EventEmitter {
     const base = resolveCodexPath2(this.settings.codexPath);
     const args = [...base.args, "app-server", "--listen", "stdio://"];
     this.lastStderr = "";
+    this.lastCrashHadStderr = false;
     this.expectedExitSignal = void 0;
     this.child = spawn(base.cmd, args, {
       stdio: ["pipe", "pipe", "pipe"],
@@ -5043,18 +5083,23 @@ var AppServerRpcClient = class extends EventEmitter {
       },
       cwd: this.settings.cwd
     });
-    this.child.stderr.setEncoding("utf8");
-    this.child.stderr.on("data", (chunk) => {
-      this.lastStderr += String(chunk);
-      if (this.lastStderr.length > 4e3) {
-        this.lastStderr = this.lastStderr.slice(-4e3);
+    const child = this.child;
+    let stderrBuf = "";
+    child.stderr.setEncoding("utf8");
+    child.stderr.on("data", (chunk) => {
+      stderrBuf = (stderrBuf + String(chunk)).slice(-4e3);
+      if (this.child === child) {
+        this.lastStderr = stderrBuf;
       }
     });
-    this.child.on("error", (error) => {
+    child.on("error", (error) => {
       this.logger.error(`[codex-app-server] process error: ${String(error)}`);
-      this.handleCrash(error);
+      const base2 = String(error);
+      const message = this.withStderrTail(base2, stderrBuf);
+      this.lastCrashHadStderr = message !== base2;
+      this.handleCrash(new Error(message));
     });
-    this.child.on("exit", (code, signal) => {
+    child.on("exit", (code, signal) => {
       const message = `codex app-server exited (code=${String(code)}, signal=${String(signal)})`;
       const expected = this.state === "closed" || signal !== null && signal === this.expectedExitSignal;
       this.expectedExitSignal = void 0;
@@ -5062,11 +5107,29 @@ var AppServerRpcClient = class extends EventEmitter {
         this.logger.info(`[codex-app-server] ${message}`);
         return;
       }
-      this.logger.warn(`[codex-app-server] ${message}`);
-      this.handleCrash(new Error(message));
+      const crashedPending = this.markCrashed();
+      if (!crashedPending) return;
+      let settled = false;
+      const finish = () => {
+        if (settled) return;
+        settled = true;
+        child.off("close", finish);
+        clearTimeout(timer);
+        const base2 = `codex app-server exited (code=${String(code)}, signal=${String(signal)})`;
+        const crashMessage = this.withStderrTail(base2, stderrBuf);
+        if (this.child === void 0) {
+          this.lastStderr = stderrBuf;
+          this.lastCrashHadStderr = crashMessage !== base2;
+        }
+        this.logger.warn(`[codex-app-server] ${crashMessage}`);
+        this.rejectCrashedPending(crashedPending, new Error(crashMessage));
+      };
+      child.once("close", finish);
+      const timer = setTimeout(finish, 120);
+      timer.unref?.();
     });
     this.stdoutReader = readline.createInterface({
-      input: this.child.stdout,
+      input: child.stdout,
       crlfDelay: Infinity
     });
     this.stdoutReader.on("line", (line) => this.handleLine(line));
@@ -5088,12 +5151,22 @@ var AppServerRpcClient = class extends EventEmitter {
         this.settings.connectionTimeoutMs ?? this.requestTimeoutMs
       );
     } catch (error) {
-      const message = String(error?.message ?? error);
-      if (message.includes("ENOENT") || message.includes("unknown subcommand")) {
+      const raw = String(error?.message ?? error);
+      if (raw.includes("unknown subcommand") || this.lastStderr.includes("unknown subcommand")) {
+        throw new Error(
+          this.withStderrTail(
+            "codex app-server requires codex CLI >= 0.144.0. Run 'codex --version' to check."
+          )
+        );
+      }
+      if (raw.includes("ENOENT") || this.lastStderr.includes("ENOENT")) {
         throw new Error(
-          "codex app-server requires codex CLI >= 0.144.0. Run 'codex --version' to check."
+          this.withStderrTail(
+            "codex app-server failed to start: codex executable not found (ENOENT). Check that the codex CLI is installed and its native binary is intact \u2014 a corrupted @openai/codex npm install can cause this. Run 'codex --version' to verify."
+          )
         );
       }
+      const message = this.lastCrashHadStderr ? raw : this.withStderrTail(raw);
       throw createAPICallError({
         message: `Failed to initialize codex app-server: ${message}`,
         stderr: this.lastStderr,
@@ -5155,8 +5228,8 @@ var AppServerRpcClient = class extends EventEmitter {
     }
     this.writeQueue = Promise.resolve();
   }
-  handleCrash(error) {
-    if (this.state === "closed") return;
+  markCrashed() {
+    if (this.state === "closed" || this.state === "error") return void 0;
     this.state = "error";
     this.clearIdleTimer();
     this.stdoutReader?.close();
@@ -5166,11 +5239,9 @@ var AppServerRpcClient = class extends EventEmitter {
       this.child.kill("SIGTERM");
       this.child = void 0;
     }
-    for (const [id, pending] of this.pending.entries()) {
-      clearTimeout(pending.timer);
-      pending.reject(
-        new Error(`Request ${String(id)} failed after app-server crash: ${String(error)}`)
-      );
+    const pending = new Map(this.pending);
+    for (const [, entry] of pending) {
+      clearTimeout(entry.timer);
     }
     this.pending.clear();
     this.threadLocks.clear();
@@ -5180,6 +5251,41 @@ var AppServerRpcClient = class extends EventEmitter {
     this.completedTurnIds.clear();
     this.serverCapabilities = void 0;
     this.writeQueue = Promise.resolve();
+    return pending;
+  }
+  rejectCrashedPending(pending, error) {
+    for (const [id, entry] of pending) {
+      entry.reject(
+        new Error(`Request ${String(id)} failed after app-server crash: ${String(error)}`)
+      );
+    }
+  }
+  handleCrash(error) {
+    const pending = this.markCrashed();
+    if (!pending) return;
+    this.rejectCrashedPending(pending, error);
+  }
+  stderrExcerpt(raw) {
+    if (!raw) return "";
+    const escape = String.fromCharCode(27);
+    const ansiEscapeSequence = new RegExp(
+      `${escape}(?:\\[[0-?]*[ -/]*[@-~]|\\][^\\u0007]*(?:\\u0007|${escape}\\\\))`,
+      "g"
+    );
+    const withoutAnsi = raw.replace(ansiEscapeSequence, "");
+    const withoutControls = Array.from(withoutAnsi).filter((character) => {
+      const code = character.charCodeAt(0);
+      return character === "\n" || code >= 32 && (code < 127 || code > 159);
+    }).join("");
+    const excerpt = withoutControls.split(/\r?\n/).map((line) => line.trim()).filter(Boolean).slice(-5).join("; ");
+    if (excerpt.length > 600) {
+      return `\u2026${excerpt.slice(-600)}`;
+    }
+    return excerpt;
+  }
+  withStderrTail(message, raw = this.lastStderr) {
+    const excerpt = this.stderrExcerpt(raw);
+    return excerpt ? `${message} | stderr (tail): ${excerpt}` : message;
   }
   handleLine(line) {
     const trimmed = line.trim();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-sdk-provider-codex-cli",
-  "version": "2.1.0",
+  "version": "2.1.2",
   "description": "AI SDK v7 provider for OpenAI Codex CLI (use ChatGPT Plus/Pro subscription)",
   "keywords": [
     "ai-sdk",