axexec 1.1.3 → 1.1.5

package/dist/credentials/get-credential-environment.js

@@ -19,8 +19,6 @@ function getCredentialEnvironment(credentials) {
     // axauth uses "accessToken", but also check legacy "oauthToken" and "token" keys
     const oauthToken = resolveStringField(credentials.data, "accessToken", "oauthToken") ??
         resolveStringField(credentials.data, "token", "token");
-    // Extract Google OAuth access_token (snake_case, used by Gemini)
-    const googleAccessToken = resolveStringField(credentials.data, "access_token", "accessToken");
     switch (credentials.agent) {
         case "claude": {
             if (credentials.type === "api-key" && apiKey) {
@@ -41,12 +39,13 @@ function getCredentialEnvironment(credentials) {
             if (credentials.type === "api-key" && apiKey) {
                 environment["GEMINI_API_KEY"] = apiKey;
             }
-            else if (credentials.type === "oauth-credentials" &&
-                googleAccessToken) {
-                // For non-interactive mode, Gemini needs pre-obtained access token
-                // via GOOGLE_GENAI_USE_GCA + GOOGLE_CLOUD_ACCESS_TOKEN
+            else if (credentials.type === "oauth-credentials") {
+                // Set GOOGLE_GENAI_USE_GCA to enable oauth-personal auth type.
+                // This tells Gemini to check for cached OAuth credentials (oauth_creds.json).
+                // DO NOT set GOOGLE_CLOUD_ACCESS_TOKEN - that bypasses the file and
+                // prevents token refresh. Credentials are written to oauth_creds.json
+                // by installGeminiCredentials().
                 environment["GOOGLE_GENAI_USE_GCA"] = "true";
-                environment["GOOGLE_CLOUD_ACCESS_TOKEN"] = googleAccessToken;
             }
             break;
         }

package/dist/credentials/write-agent-credentials.d.ts

@@ -23,11 +23,11 @@ declare function installClaudeCredentials(configDirectory: string, credentials:
  * Installs Codex credentials to a config directory.
  *
  * File: auth.json
- * Format: { OPENAI_API_KEY: "..." } or { tokens: { ... }, last_refresh: "..." }
+ * Format: { OPENAI_API_KEY: "..." } or { OPENAI_API_KEY: null, tokens: { id_token, access_token, refresh_token, account_id }, last_refresh: "..." }
  *
  * Handles:
  * - api-key: Written as { OPENAI_API_KEY: "..." }
- * - oauth-credentials: Written as { tokens: { ... }, last_refresh: "..." }
+ * - oauth-credentials: Written directly (expected to already have correct structure)
  */
 declare function installCodexCredentials(configDirectory: string, credentials: Credentials, warn?: WarningWriter): void;
 /**

package/dist/credentials/write-agent-credentials.js

@@ -40,11 +40,11 @@ function installClaudeCredentials(configDirectory, credentials) {
  * Installs Codex credentials to a config directory.
  *
  * File: auth.json
- * Format: { OPENAI_API_KEY: "..." } or { tokens: { ... }, last_refresh: "..." }
+ * Format: { OPENAI_API_KEY: "..." } or { OPENAI_API_KEY: null, tokens: { id_token, access_token, refresh_token, account_id }, last_refresh: "..." }
  *
  * Handles:
  * - api-key: Written as { OPENAI_API_KEY: "..." }
- * - oauth-credentials: Written as { tokens: { ... }, last_refresh: "..." }
+ * - oauth-credentials: Written directly (expected to already have correct structure)
  */
 function installCodexCredentials(configDirectory, credentials, warn = defaultWarningWriter) {
     const authPath = path.join(configDirectory, "auth.json");
@@ -59,10 +59,12 @@ function installCodexCredentials(configDirectory, credentials, warn = defaultWar
             break;
         }
         case "oauth-credentials": {
-            saveJsonFile(authPath, {
-                tokens: credentials.data,
-                last_refresh: new Date().toISOString(),
-            });
+            // Codex expects { OPENAI_API_KEY, tokens: { id_token, access_token, refresh_token, account_id }, last_refresh }
+            // The vault stores credentials in this exact format, so write directly.
+            // Remove internal _source field if present.
+            const data = { ...credentials.data };
+            delete data["_source"];
+            saveJsonFile(authPath, data);
             break;
         }
         case "oauth-token": {

package/package.json

@@ -2,7 +2,7 @@
   "name": "axexec",
   "author": "Łukasz Jerciński",
   "license": "MIT",
-  "version": "1.1.3",
+  "version": "1.1.5",
   "description": "Unified CLI runner for AI coding agents with normalized event streaming",
   "repository": {
     "type": "git",