codex-multi-auth 0.1.0 → 0.1.2

package/scripts/audit-dev-allowlist.js

@@ -1,128 +1,128 @@
-#!/usr/bin/env node
-
-import { spawnSync } from "node:child_process";
-
-const ALLOWED_HIGH_OR_CRITICAL_PACKAGES = new Set([
-	"eslint",
-	"ajv",
-	"@eslint-community/eslint-utils",
-	"@typescript-eslint/eslint-plugin",
-	"@typescript-eslint/parser",
-	"@typescript-eslint/type-utils",
-	"@typescript-eslint/typescript-estree",
-	"@typescript-eslint/utils",
-	"minimatch",
-]);
-
-function summarizeVia(via) {
-	if (!Array.isArray(via)) return [];
-	return via
-		.map((item) => {
-			if (typeof item === "string") return item;
-			if (!item || typeof item !== "object") return "unknown";
-			const name = typeof item.name === "string" ? item.name : "unknown";
-			const range = typeof item.range === "string" ? item.range : "";
-			return range ? `${name}:${range}` : name;
-		})
-		.slice(0, 5);
-}
-
-const isWindows = process.platform === "win32";
-const command = isWindows ? process.env.ComSpec || "cmd.exe" : "npm";
-const commandArgs = isWindows
-	? ["/d", "/s", "/c", "npm audit --json"]
-	: ["audit", "--json"];
-const audit = spawnSync(command, commandArgs, {
-	encoding: "utf8",
-	stdio: ["ignore", "pipe", "pipe"],
-	env: {
-		...process.env,
-		// npm run -s can suppress child npm JSON output; force a readable level.
-		npm_config_loglevel:
-			process.env.npm_config_loglevel === "silent"
-				? "notice"
-				: process.env.npm_config_loglevel || "notice",
-	},
-});
-
-const stdout = (audit.stdout ?? "").trim();
-const stderr = (audit.stderr ?? "").trim();
-const combined = [stdout, stderr].filter(Boolean).join("\n");
-
-if (!combined) {
-	if ((audit.status ?? 1) === 0) {
-		console.log("No vulnerabilities found in npm audit output.");
-		process.exit(0);
-	}
-	console.error("Failed to read npm audit output.");
-	process.exit(1);
-}
-
-// npm can emit human-readable success text (no JSON) on some versions/configs.
-if (!combined.includes("{") && /found 0 vulnerabilities/i.test(combined)) {
-	console.log("No vulnerabilities found in npm audit output.");
-	process.exit(0);
-}
-
-let auditJson;
-try {
-	const jsonCandidate =
-		(stdout.startsWith("{") ? stdout : "") ||
-		(stderr.startsWith("{") ? stderr : "") ||
-		combined.slice(combined.indexOf("{"));
-	auditJson = JSON.parse(jsonCandidate.replace(/^\uFEFF/, ""));
-} catch (error) {
-	console.error("Failed to parse npm audit JSON output.");
-	if (stderr) {
-		console.error(stderr);
-	}
-	console.error(error instanceof Error ? error.message : String(error));
-	process.exit(1);
-}
-
-const vulnerabilities =
-	auditJson && typeof auditJson === "object" && auditJson.vulnerabilities && typeof auditJson.vulnerabilities === "object"
-		? auditJson.vulnerabilities
-		: {};
-
-const unexpected = [];
-const allowlisted = [];
-
-for (const [name, details] of Object.entries(vulnerabilities)) {
-	if (!details || typeof details !== "object") continue;
-	const severity = typeof details.severity === "string" ? details.severity : "unknown";
-	if (severity !== "high" && severity !== "critical") continue;
-
-	const entry = {
-		name,
-		severity,
-		via: summarizeVia(details.via),
-		fixAvailable: details.fixAvailable ?? false,
-	};
-
-	if (ALLOWED_HIGH_OR_CRITICAL_PACKAGES.has(name)) {
-		allowlisted.push(entry);
-		continue;
-	}
-	unexpected.push(entry);
-}
-
-if (unexpected.length > 0) {
-	console.error("Unexpected high/critical vulnerabilities detected in dev dependency audit:");
-	for (const entry of unexpected) {
-		console.error(
-			`- ${entry.name} (${entry.severity}) via ${entry.via.join(", ") || "unknown"} fixAvailable=${String(entry.fixAvailable)}`,
-		);
-	}
-	process.exit(1);
-}
-
-if (allowlisted.length > 0) {
-	console.warn("Allowlisted high/critical dev vulnerabilities detected:");
-	for (const entry of allowlisted) {
-		console.warn(
-			`- ${entry.name} (${entry.severity}) via ${entry.via.join(", ") || "unknown"} fixAvailable=${String(entry.fixAvailable)}`,
-		);
-	}
-	console.warn("No unexpected high/critical vulnerabilities found.");
-}
+#!/usr/bin/env node
+
+import { spawnSync } from "node:child_process";
+
+const ALLOWED_HIGH_OR_CRITICAL_PACKAGES = new Set([
+	"eslint",
+	"ajv",
+	"@eslint-community/eslint-utils",
+	"@typescript-eslint/eslint-plugin",
+	"@typescript-eslint/parser",
+	"@typescript-eslint/type-utils",
+	"@typescript-eslint/typescript-estree",
+	"@typescript-eslint/utils",
+	"minimatch",
+]);
+
+function summarizeVia(via) {
+	if (!Array.isArray(via)) return [];
+	return via
+		.map((item) => {
+			if (typeof item === "string") return item;
+			if (!item || typeof item !== "object") return "unknown";
+			const name = typeof item.name === "string" ? item.name : "unknown";
+			const range = typeof item.range === "string" ? item.range : "";
+			return range ? `${name}:${range}` : name;
+		})
+		.slice(0, 5);
+}
+
+const isWindows = process.platform === "win32";
+const command = isWindows ? process.env.ComSpec || "cmd.exe" : "npm";
+const commandArgs = isWindows
+	? ["/d", "/s", "/c", "npm audit --json"]
+	: ["audit", "--json"];
+const audit = spawnSync(command, commandArgs, {
+	encoding: "utf8",
+	stdio: ["ignore", "pipe", "pipe"],
+	env: {
+		...process.env,
+		// npm run -s can suppress child npm JSON output; force a readable level.
+		npm_config_loglevel:
+			process.env.npm_config_loglevel === "silent"
+				? "notice"
+				: process.env.npm_config_loglevel || "notice",
+	},
+});
+
+const stdout = (audit.stdout ?? "").trim();
+const stderr = (audit.stderr ?? "").trim();
+const combined = [stdout, stderr].filter(Boolean).join("\n");
+
+if (!combined) {
+	if ((audit.status ?? 1) === 0) {
+		console.log("No vulnerabilities found in npm audit output.");
+		process.exit(0);
+	}
+	console.error("Failed to read npm audit output.");
+	process.exit(1);
+}
+
+// npm can emit human-readable success text (no JSON) on some versions/configs.
+if (!combined.includes("{") && /found 0 vulnerabilities/i.test(combined)) {
+	console.log("No vulnerabilities found in npm audit output.");
+	process.exit(0);
+}
+
+let auditJson;
+try {
+	const jsonCandidate =
+		(stdout.startsWith("{") ? stdout : "") ||
+		(stderr.startsWith("{") ? stderr : "") ||
+		combined.slice(combined.indexOf("{"));
+	auditJson = JSON.parse(jsonCandidate.replace(/^\uFEFF/, ""));
+} catch (error) {
+	console.error("Failed to parse npm audit JSON output.");
+	if (stderr) {
+		console.error(stderr);
+	}
+	console.error(error instanceof Error ? error.message : String(error));
+	process.exit(1);
+}
+
+const vulnerabilities =
+	auditJson && typeof auditJson === "object" && auditJson.vulnerabilities && typeof auditJson.vulnerabilities === "object"
+		? auditJson.vulnerabilities
+		: {};
+
+const unexpected = [];
+const allowlisted = [];
+
+for (const [name, details] of Object.entries(vulnerabilities)) {
+	if (!details || typeof details !== "object") continue;
+	const severity = typeof details.severity === "string" ? details.severity : "unknown";
+	if (severity !== "high" && severity !== "critical") continue;
+
+	const entry = {
+		name,
+		severity,
+		via: summarizeVia(details.via),
+		fixAvailable: details.fixAvailable ?? false,
+	};
+
+	if (ALLOWED_HIGH_OR_CRITICAL_PACKAGES.has(name)) {
+		allowlisted.push(entry);
+		continue;
+	}
+	unexpected.push(entry);
+}
+
+if (unexpected.length > 0) {
+	console.error("Unexpected high/critical vulnerabilities detected in dev dependency audit:");
+	for (const entry of unexpected) {
+		console.error(
+			`- ${entry.name} (${entry.severity}) via ${entry.via.join(", ") || "unknown"} fixAvailable=${String(entry.fixAvailable)}`,
+		);
+	}
+	process.exit(1);
+}
+
+if (allowlisted.length > 0) {
+	console.warn("Allowlisted high/critical dev vulnerabilities detected:");
+	for (const entry of allowlisted) {
+		console.warn(
+			`- ${entry.name} (${entry.severity}) via ${entry.via.join(", ") || "unknown"} fixAvailable=${String(entry.fixAvailable)}`,
+		);
+	}
+	console.warn("No unexpected high/critical vulnerabilities found.");
+}

package/scripts/bench-format/{opencode.mjs → codex-host.mjs}

@@ -1,205 +1,206 @@
-import { spawnSync } from "node:child_process";
-import { dirname, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-
-const scriptDir = dirname(fileURLToPath(import.meta.url));
-const repoRoot = resolve(scriptDir, "..", "..");
-
-export function getRepoRoot() {
-  return repoRoot;
-}
-
-export function resolveOpencodeExecutable() {
-  const envOverride = process.env.OPENCODE_BIN;
-  if (envOverride && envOverride.trim().length > 0) {
-    const command = envOverride.trim();
-    return { command, shell: /\.cmd$/i.test(command) };
-  }
-
-  if (process.platform !== "win32") {
-    return { command: "opencode", shell: false };
-  }
-
-  const whereResult = spawnSync("where", ["opencode"], {
-    encoding: "utf8",
-    windowsHide: true,
-  });
-  const candidates = `${whereResult.stdout ?? ""}\n${whereResult.stderr ?? ""}`
-    .split(/\r?\n/)
-    .map((line) => line.trim())
-    .filter(Boolean);
-
-  if (candidates.length === 0) {
-    return { command: "opencode", shell: false };
-  }
-
-  const exactExe = candidates.find((candidate) => /npm\\opencode\.exe$/i.test(candidate));
-  if (exactExe) {
-    return { command: exactExe, shell: false };
-  }
-
-  const exactCmd = candidates.find((candidate) => /npm\\opencode\.cmd$/i.test(candidate));
-  if (exactCmd) {
-    return { command: exactCmd, shell: true };
-  }
-
-  const anyCmd = candidates.find((candidate) => /\.cmd$/i.test(candidate));
-  if (anyCmd) {
-    return { command: anyCmd, shell: true };
-  }
-
-  return { command: candidates[0], shell: false };
-}
-
-export function parseNdjson(text) {
-  const events = [];
-  for (const line of text.split(/\r?\n/)) {
-    const trimmed = line.trim();
-    if (!trimmed) {
-      continue;
-    }
-    try {
-      events.push(JSON.parse(trimmed));
-    } catch {
-      // Ignore non-JSON lines emitted by wrappers (bun install, warnings, etc.).
-    }
-  }
-  return events;
-}
-
-export function getToolEvents(events) {
-  return events
-    .filter((event) => event?.type === "tool_use" && event?.part?.type === "tool")
-    .map((event) => ({
-      tool: event.part.tool,
-      input: event.part.state?.input ?? {},
-      output: event.part.state?.output,
-      status: event.part.state?.status,
-      start: event.part.state?.time?.start,
-      end: event.part.state?.time?.end,
-      durationMs:
-        typeof event.part.state?.time?.start === "number" &&
-        typeof event.part.state?.time?.end === "number"
-          ? event.part.state.time.end - event.part.state.time.start
-          : null,
-    }));
-}
-
-export function getSessionDuration(events) {
-  const starts = events
-    .filter((event) => event?.type === "step_start" && typeof event.timestamp === "number")
-    .map((event) => event.timestamp);
-  const finishes = events
-    .filter((event) => event?.type === "step_finish" && typeof event.timestamp === "number")
-    .map((event) => event.timestamp);
-  if (starts.length === 0 || finishes.length === 0) {
-    return null;
-  }
-  return Math.max(...finishes) - Math.min(...starts);
-}
-
-export function getTokenTotals(events) {
-  const stepFinishes = events.filter((event) => event?.type === "step_finish" && event?.part?.tokens);
-  if (stepFinishes.length === 0) {
-    return null;
-  }
-  const total = {
-    total: 0,
-    input: 0,
-    output: 0,
-    reasoning: 0,
-    cacheRead: 0,
-    cacheWrite: 0,
-  };
-  for (const event of stepFinishes) {
-    const tokens = event.part.tokens ?? {};
-    const input = Number(tokens.input ?? 0);
-    const output = Number(tokens.output ?? 0);
-    const reasoning = Number(tokens.reasoning ?? 0);
-    const explicitTotal = Number(tokens.total ?? NaN);
-    total.total += Number.isFinite(explicitTotal) ? explicitTotal : input + output + reasoning;
-    total.input += input;
-    total.output += output;
-    total.reasoning += reasoning;
-    total.cacheRead += Number(tokens.cache?.read ?? 0);
-    total.cacheWrite += Number(tokens.cache?.write ?? 0);
-  }
-  return total;
-}
-
-export function getTextOutput(events) {
-  return events
-    .filter((event) => event?.type === "text" && typeof event?.part?.text === "string")
-    .map((event) => event.part.text)
-    .join("\n");
-}
-
-export function getEventError(events) {
-  const errorEvent = events.find((event) => event?.type === "error");
-  if (!errorEvent) {
-    return null;
-  }
-  return {
-    name: errorEvent.error?.name ?? "UnknownError",
-    message: errorEvent.error?.data?.message ?? errorEvent.error?.message ?? "Unknown error",
-  };
-}
-
-export function runOpencodeJson({
-  executable,
-  prompt,
-  model,
-  variant,
-  agent,
-  cwd,
-  homeDir,
-  timeoutMs,
-  extraEnv,
-}) {
-  const startWall = Date.now();
-  const args = ["run", "--format", "json", "--agent", agent, "--model", model];
-  if (variant) {
-    args.push("--variant", variant);
-  }
-  args.push(prompt);
-
-  const child = spawnSync(executable.command, args, {
-    cwd: cwd ?? repoRoot,
-    encoding: "utf8",
-    windowsHide: true,
-    shell: executable.shell,
-    timeout: timeoutMs,
-    maxBuffer: 30 * 1024 * 1024,
-    env: {
-      ...process.env,
-      ...(homeDir ? { HOME: homeDir, USERPROFILE: homeDir } : {}),
-      ...extraEnv,
-    },
-  });
-
-  const wallMs = Date.now() - startWall;
-  const stdout = child.stdout ?? "";
-  const stderr = child.stderr ?? "";
-  const events = parseNdjson(stdout);
-  const eventError = getEventError(events);
-  const timedOut =
-    child.error?.code === "ETIMEDOUT" ||
-    child.signal === "SIGTERM" ||
-    /timed out/i.test(String(child.error?.message ?? ""));
-  if (child.error && !timedOut) {
-    throw child.error;
-  }
-  const modelNotFound = /Model not found|ProviderModelNotFoundError/i.test(`${stdout}\n${stderr}`) || /Model not found/i.test(eventError?.message ?? "");
-
-  return {
-    status: child.status ?? 1,
-    signal: child.signal ?? null,
-    stdout,
-    stderr,
-    wallMs,
-    events,
-    eventError,
-    timedOut,
-    modelNotFound,
-  };
-}
+import { spawnSync } from "node:child_process";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const scriptDir = dirname(fileURLToPath(import.meta.url));
+const repoRoot = resolve(scriptDir, "..", "..");
+
+export function getRepoRoot() {
+  return repoRoot;
+}
+
+export function resolveCodexExecutable() {
+  const envOverride = process.env.CODEX_BIN;
+  if (envOverride && envOverride.trim().length > 0) {
+    const command = envOverride.trim();
+    return { command, shell: /\.cmd$/i.test(command) };
+  }
+
+  if (process.platform !== "win32") {
+    return { command: "codex", shell: false };
+  }
+
+  const whereResult = spawnSync("where", ["Codex"], {
+    encoding: "utf8",
+    windowsHide: true,
+  });
+  const candidates = `${whereResult.stdout ?? ""}`
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter((line) => /^[A-Za-z]:\\.+\.(exe|cmd)$/i.test(line));
+
+  if (candidates.length === 0) {
+    return { command: "codex", shell: false };
+  }
+
+  const exactExe = candidates.find((candidate) => /npm\\Codex\.exe$/i.test(candidate));
+  if (exactExe) {
+    return { command: exactExe, shell: false };
+  }
+
+  const exactCmd = candidates.find((candidate) => /npm\\Codex\.cmd$/i.test(candidate));
+  if (exactCmd) {
+    return { command: exactCmd, shell: true };
+  }
+
+  const anyCmd = candidates.find((candidate) => /\.cmd$/i.test(candidate));
+  if (anyCmd) {
+    return { command: anyCmd, shell: true };
+  }
+
+  return { command: candidates[0], shell: false };
+}
+
+export function parseNdjson(text) {
+  const events = [];
+  for (const line of text.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed) {
+      continue;
+    }
+    try {
+      events.push(JSON.parse(trimmed));
+    } catch {
+      // Ignore non-JSON lines emitted by wrappers (bun install, warnings, etc.).
+    }
+  }
+  return events;
+}
+
+export function getToolEvents(events) {
+  return events
+    .filter((event) => event?.type === "tool_use" && event?.part?.type === "tool")
+    .map((event) => ({
+      tool: event.part.tool,
+      input: event.part.state?.input ?? {},
+      output: event.part.state?.output,
+      status: event.part.state?.status,
+      start: event.part.state?.time?.start,
+      end: event.part.state?.time?.end,
+      durationMs:
+        typeof event.part.state?.time?.start === "number" &&
+        typeof event.part.state?.time?.end === "number"
+          ? event.part.state.time.end - event.part.state.time.start
+          : null,
+    }));
+}
+
+export function getSessionDuration(events) {
+  const starts = events
+    .filter((event) => event?.type === "step_start" && typeof event.timestamp === "number")
+    .map((event) => event.timestamp);
+  const finishes = events
+    .filter((event) => event?.type === "step_finish" && typeof event.timestamp === "number")
+    .map((event) => event.timestamp);
+  if (starts.length === 0 || finishes.length === 0) {
+    return null;
+  }
+  return Math.max(...finishes) - Math.min(...starts);
+}
+
+export function getTokenTotals(events) {
+  const stepFinishes = events.filter((event) => event?.type === "step_finish" && event?.part?.tokens);
+  if (stepFinishes.length === 0) {
+    return null;
+  }
+  const total = {
+    total: 0,
+    input: 0,
+    output: 0,
+    reasoning: 0,
+    cacheRead: 0,
+    cacheWrite: 0,
+  };
+  for (const event of stepFinishes) {
+    const tokens = event.part.tokens ?? {};
+    const input = Number(tokens.input ?? 0);
+    const output = Number(tokens.output ?? 0);
+    const reasoning = Number(tokens.reasoning ?? 0);
+    const explicitTotal = Number(tokens.total ?? NaN);
+    total.total += Number.isFinite(explicitTotal) ? explicitTotal : input + output + reasoning;
+    total.input += input;
+    total.output += output;
+    total.reasoning += reasoning;
+    total.cacheRead += Number(tokens.cache?.read ?? 0);
+    total.cacheWrite += Number(tokens.cache?.write ?? 0);
+  }
+  return total;
+}
+
+export function getTextOutput(events) {
+  return events
+    .filter((event) => event?.type === "text" && typeof event?.part?.text === "string")
+    .map((event) => event.part.text)
+    .join("\n");
+}
+
+export function getEventError(events) {
+  const errorEvent = events.find((event) => event?.type === "error");
+  if (!errorEvent) {
+    return null;
+  }
+  return {
+    name: errorEvent.error?.name ?? "UnknownError",
+    message: errorEvent.error?.data?.message ?? errorEvent.error?.message ?? "Unknown error",
+  };
+}
+
+export function runCodexJson({
+  executable,
+  prompt,
+  model,
+  variant,
+  agent,
+  cwd,
+  homeDir,
+  timeoutMs,
+  extraEnv,
+}) {
+  const startWall = Date.now();
+  const args = ["run", "--format", "json", "--agent", agent, "--model", model];
+  if (variant) {
+    args.push("--variant", variant);
+  }
+  args.push(prompt);
+
+  const child = spawnSync(executable.command, args, {
+    cwd: cwd ?? repoRoot,
+    encoding: "utf8",
+    windowsHide: true,
+    shell: executable.shell,
+    timeout: timeoutMs,
+    maxBuffer: 30 * 1024 * 1024,
+    env: {
+      ...process.env,
+      ...(homeDir ? { HOME: homeDir, USERPROFILE: homeDir } : {}),
+      ...extraEnv,
+    },
+  });
+
+  const wallMs = Date.now() - startWall;
+  const stdout = child.stdout ?? "";
+  const stderr = child.stderr ?? "";
+  const events = parseNdjson(stdout);
+  const eventError = getEventError(events);
+  const timedOut =
+    child.error?.code === "ETIMEDOUT" ||
+    child.signal === "SIGTERM" ||
+    /timed out/i.test(String(child.error?.message ?? ""));
+  if (child.error && !timedOut) {
+    throw child.error;
+  }
+  const modelNotFound = /Model not found|ProviderModelNotFoundError/i.test(`${stdout}\n${stderr}`) || /Model not found/i.test(eventError?.message ?? "");
+
+  return {
+    status: child.status ?? 1,
+    signal: child.signal ?? null,
+    stdout,
+    stderr,
+    wallMs,
+    events,
+    eventError,
+    timedOut,
+    modelNotFound,
+  };
+}
+