codex-multi-auth 2.1.8 → 2.1.10

package/scripts/audit-dev-allowlist.js

@@ -1,220 +0,0 @@
-import { spawnSync } from "node:child_process";
-import { pathToFileURL } from "node:url";
-
-const ALLOWED_HIGH_OR_CRITICAL_ADVISORIES = new Map([
-	// Example:
-	// ["1113465", { package: "minimatch", expiresOn: "2026-06-30" }],
-]);
-
-export function summarizeVia(via) {
-	if (!Array.isArray(via)) return [];
-	return via
-		.map((item) => {
-			if (typeof item === "string") return item;
-			if (!item || typeof item !== "object") return "unknown";
-			const name = typeof item.name === "string" ? item.name : "unknown";
-			const range = typeof item.range === "string" ? item.range : "";
-			return range ? `${name}:${range}` : name;
-		})
-		.slice(0, 5);
-}
-
-export function extractAdvisoryIds(via) {
-	if (!Array.isArray(via)) return [];
-	const advisoryIds = [];
-	for (const item of via) {
-		if (!item || typeof item !== "object") {
-			continue;
-		}
-		const source = "source" in item ? item.source : undefined;
-		if (typeof source === "number" || typeof source === "string") {
-			advisoryIds.push(String(source));
-		}
-	}
-	return advisoryIds;
-}
-
-export function isAdvisoryAllowed(packageName, advisoryId, now = Date.now()) {
-	const rule = ALLOWED_HIGH_OR_CRITICAL_ADVISORIES.get(advisoryId);
-	if (!rule || typeof rule !== "object") {
-		return false;
-	}
-	if (typeof rule.package === "string" && rule.package !== packageName) {
-		return false;
-	}
-	if (typeof rule.expiresOn === "string") {
-		const expiresAt = Date.parse(rule.expiresOn);
-		if (!Number.isFinite(expiresAt) || now > expiresAt) {
-			return false;
-		}
-	}
-	return true;
-}
-
-export function getAuditCommand(platform = process.platform, env = process.env) {
-	const isWindows = platform === "win32";
-	return {
-		command: isWindows ? env.ComSpec || "cmd.exe" : "npm",
-		commandArgs: isWindows
-			? ["/d", "/s", "/c", "npm audit --json"]
-			: ["audit", "--json"],
-	};
-}
-
-function resolveVulnerabilities(auditJson) {
-	if (
-		auditJson &&
-		typeof auditJson === "object" &&
-		auditJson.vulnerabilities &&
-		typeof auditJson.vulnerabilities === "object"
-	) {
-		return auditJson.vulnerabilities;
-	}
-	return {};
-}
-
-export function partitionHighCriticalVulnerabilities(
-	vulnerabilities,
-	advisoryAllowed = isAdvisoryAllowed,
-) {
-	const unexpected = [];
-	const allowlisted = [];
-	for (const [name, details] of Object.entries(vulnerabilities)) {
-		if (!details || typeof details !== "object") continue;
-		const severity = typeof details.severity === "string" ? details.severity : "unknown";
-		if (severity !== "high" && severity !== "critical") continue;
-		const entry = {
-			name,
-			severity,
-			via: summarizeVia(details.via),
-			advisoryIds: extractAdvisoryIds(details.via),
-			fixAvailable: details.fixAvailable ?? false,
-		};
-		const hasAdvisories = entry.advisoryIds.length > 0;
-		const allAdvisoriesAllowlisted =
-			hasAdvisories &&
-			entry.advisoryIds.every((advisoryId) => advisoryAllowed(name, advisoryId));
-		if (allAdvisoriesAllowlisted) {
-			allowlisted.push(entry);
-			continue;
-		}
-		unexpected.push(entry);
-	}
-	return { unexpected, allowlisted };
-}
-
-function parseAuditOutput(audit) {
-	const stdout = (audit.stdout ?? "").trim();
-	const stderr = (audit.stderr ?? "").trim();
-	const combined = [stdout, stderr].filter(Boolean).join("\n");
-	if (!combined) {
-		return {
-			type: "empty",
-			ok: (audit.status ?? 1) === 0,
-			stderr,
-		};
-	}
-	if (!combined.includes("{") && /found 0 vulnerabilities/i.test(combined)) {
-		return { type: "none" };
-	}
-	try {
-		const jsonCandidate =
-			(stdout.startsWith("{") ? stdout : "") ||
-			(stderr.startsWith("{") ? stderr : "") ||
-			combined.slice(combined.indexOf("{"));
-		return {
-			type: "json",
-			json: JSON.parse(jsonCandidate.replace(/^\uFEFF/, "")),
-		};
-	} catch (error) {
-		return {
-			type: "parse_error",
-			stderr,
-			message: error instanceof Error ? error.message : String(error),
-		};
-	}
-}
-
-export function runAuditDevAllowlist(options = {}) {
-	const {
-		platform = process.platform,
-		env = process.env,
-		spawn = spawnSync,
-		log = console.log,
-		warn = console.warn,
-		error = console.error,
-		now = Date.now,
-	} = options;
-
-	const { command, commandArgs } = getAuditCommand(platform, env);
-	const audit = spawn(command, commandArgs, {
-		encoding: "utf8",
-		stdio: ["ignore", "pipe", "pipe"],
-		env: {
-			...env,
-			// npm run -s can suppress child npm JSON output; force a readable level.
-			npm_config_loglevel:
-				env.npm_config_loglevel === "silent"
-					? "notice"
-					: env.npm_config_loglevel || "notice",
-		},
-	});
-
-	const parsed = parseAuditOutput(audit);
-	if (parsed.type === "empty") {
-		if (parsed.ok) {
-			log("No vulnerabilities found in npm audit output.");
-			return 0;
-		}
-		error("Failed to read npm audit output.");
-		return 1;
-	}
-	if (parsed.type === "none") {
-		log("No vulnerabilities found in npm audit output.");
-		return 0;
-	}
-	if (parsed.type === "parse_error") {
-		error("Failed to parse npm audit JSON output.");
-		if (parsed.stderr) {
-			error(parsed.stderr);
-		}
-		error(parsed.message);
-		return 1;
-	}
-
-	const vulnerabilities = resolveVulnerabilities(parsed.json);
-	const { unexpected, allowlisted } = partitionHighCriticalVulnerabilities(
-		vulnerabilities,
-		(packageName, advisoryId) => isAdvisoryAllowed(packageName, advisoryId, now()),
-	);
-
-	if (unexpected.length > 0) {
-		error("Unexpected high/critical vulnerabilities detected in dev dependency audit:");
-		for (const entry of unexpected) {
-			error(
-				`- ${entry.name} (${entry.severity}) advisories=${entry.advisoryIds.join(", ") || "none"} via ${entry.via.join(", ") || "unknown"} fixAvailable=${String(entry.fixAvailable)}`,
-			);
-		}
-		return 1;
-	}
-
-	if (allowlisted.length > 0) {
-		warn("Allowlisted high/critical dev vulnerabilities detected:");
-		for (const entry of allowlisted) {
-			warn(
-				`- ${entry.name} (${entry.severity}) advisories=${entry.advisoryIds.join(", ") || "none"} via ${entry.via.join(", ") || "unknown"} fixAvailable=${String(entry.fixAvailable)}`,
-			);
-		}
-		warn("No unexpected high/critical vulnerabilities found.");
-	}
-
-	return 0;
-}
-
-const isEntryPoint =
-	typeof process.argv[1] === "string" &&
-	import.meta.url === pathToFileURL(process.argv[1]).href;
-
-if (isEntryPoint) {
-	process.exit(runAuditDevAllowlist());
-}

package/scripts/bench-format/codex-host.mjs

@@ -1,275 +0,0 @@
-import { spawnSync } from "node:child_process";
-import { existsSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-
-const scriptDir = dirname(fileURLToPath(import.meta.url));
-const repoRoot = resolve(scriptDir, "..", "..");
-
-export function getRepoRoot() {
-  return repoRoot;
-}
-
-function resolveWindowsNpmShim(command) {
-  if (!/\.(cmd|bat)$/i.test(command)) {
-    return { command, shell: false };
-  }
-
-  const codexScript = join(dirname(command), "node_modules", "codex-multi-auth", "scripts", "codex.js");
-  if (existsSync(codexScript)) {
-    return {
-      command: process.execPath,
-      shell: false,
-      argsPrefix: [codexScript],
-      shimCommand: command,
-    };
-  }
-
-  return { command, shell: true };
-}
-
-export function resolveCodexExecutable() {
-  const envOverride = process.env.CODEX_BIN;
-  if (envOverride && envOverride.trim().length > 0) {
-    const command = envOverride.trim();
-    return process.platform === "win32" ? resolveWindowsNpmShim(command) : { command, shell: false };
-  }
-
-  if (process.platform !== "win32") {
-    return { command: "codex", shell: false };
-  }
-
-  const whereResult = spawnSync("where", ["Codex"], {
-    encoding: "utf8",
-    windowsHide: true,
-  });
-  const candidates = `${whereResult.stdout ?? ""}`
-    .split(/\r?\n/)
-    .map((line) => line.trim())
-    .filter((line) => /^[A-Za-z]:\\.+\.(exe|cmd)$/i.test(line));
-
-  if (candidates.length === 0) {
-    return { command: "codex", shell: false };
-  }
-
-  const exactExe = candidates.find((candidate) => /npm\\Codex\.exe$/i.test(candidate));
-  if (exactExe) {
-    return { command: exactExe, shell: false };
-  }
-
-  const exactCmd = candidates.find((candidate) => /npm\\Codex\.cmd$/i.test(candidate));
-  if (exactCmd) {
-    return resolveWindowsNpmShim(exactCmd);
-  }
-
-  const anyCmd = candidates.find((candidate) => /\.cmd$/i.test(candidate));
-  if (anyCmd) {
-    return resolveWindowsNpmShim(anyCmd);
-  }
-
-  return { command: candidates[0], shell: false };
-}
-
-export function parseNdjson(text) {
-  const events = [];
-  for (const line of text.split(/\r?\n/)) {
-    const trimmed = line.trim();
-    if (!trimmed) {
-      continue;
-    }
-    try {
-      events.push(JSON.parse(trimmed));
-    } catch {
-      // Ignore non-JSON lines emitted by wrappers (bun install, warnings, etc.).
-    }
-  }
-  return events;
-}
-
-export function getToolEvents(events) {
-  const legacyToolEvents = events
-    .filter((event) => event?.type === "tool_use" && event?.part?.type === "tool")
-    .map((event) => ({
-      tool: event.part.tool,
-      input: event.part.state?.input ?? {},
-      output: event.part.state?.output,
-      status: event.part.state?.status,
-      start: event.part.state?.time?.start,
-      end: event.part.state?.time?.end,
-      durationMs:
-        typeof event.part.state?.time?.start === "number" &&
-        typeof event.part.state?.time?.end === "number"
-          ? event.part.state.time.end - event.part.state.time.start
-          : null,
-    }));
-  const execToolEvents = events
-    .filter((event) => event?.type === "item.completed" && event?.item?.type === "command_execution")
-    .map((event) => ({
-      tool: "command_execution",
-      input: { command: event.item.command },
-      output: event.item.aggregated_output,
-      status: event.item.status,
-      start: null,
-      end: null,
-      durationMs: null,
-    }));
-  return [...legacyToolEvents, ...execToolEvents];
-}
-
-export function getSessionDuration(events) {
-  const starts = events
-    .filter((event) => event?.type === "step_start" && typeof event.timestamp === "number")
-    .map((event) => event.timestamp);
-  const finishes = events
-    .filter((event) => event?.type === "step_finish" && typeof event.timestamp === "number")
-    .map((event) => event.timestamp);
-  if (starts.length === 0 || finishes.length === 0) {
-    return null;
-  }
-  return Math.max(...finishes) - Math.min(...starts);
-}
-
-export function getTokenTotals(events) {
-  const stepFinishes = events.filter((event) => event?.type === "step_finish" && event?.part?.tokens);
-  const turnCompletions = events.filter((event) => event?.type === "turn.completed" && event?.usage);
-  if (stepFinishes.length === 0 && turnCompletions.length === 0) {
-    return null;
-  }
-  const total = {
-    total: 0,
-    input: 0,
-    output: 0,
-    reasoning: 0,
-    cacheRead: 0,
-    cacheWrite: 0,
-  };
-  for (const event of stepFinishes) {
-    const tokens = event.part.tokens ?? {};
-    const input = Number(tokens.input ?? 0);
-    const output = Number(tokens.output ?? 0);
-    const reasoning = Number(tokens.reasoning ?? 0);
-    const explicitTotal = Number(tokens.total ?? NaN);
-    total.total += Number.isFinite(explicitTotal) ? explicitTotal : input + output + reasoning;
-    total.input += input;
-    total.output += output;
-    total.reasoning += reasoning;
-    total.cacheRead += Number(tokens.cache?.read ?? 0);
-    total.cacheWrite += Number(tokens.cache?.write ?? 0);
-  }
-  for (const event of turnCompletions) {
-    const usage = event.usage ?? {};
-    const input = Number(usage.input_tokens ?? 0);
-    const output = Number(usage.output_tokens ?? 0);
-    const reasoning = Number(usage.reasoning_output_tokens ?? 0);
-    total.total += input + output;
-    total.input += input;
-    total.output += output;
-    total.reasoning += reasoning;
-    total.cacheRead += Number(usage.cached_input_tokens ?? 0);
-  }
-  return total;
-}
-
-export function getTextOutput(events) {
-  const legacyText = events
-    .filter((event) => event?.type === "text" && typeof event?.part?.text === "string")
-    .map((event) => event.part.text)
-    .join("\n");
-  const execText = events
-    .filter((event) => event?.type === "item.completed" && event?.item?.type === "agent_message" && typeof event.item.text === "string")
-    .map((event) => event.item.text)
-    .join("\n");
-  return [legacyText, execText].filter(Boolean).join("\n");
-}
-
-export function getEventError(events) {
-  const lastCompletedIndex = events.findLastIndex((event) => event?.type === "turn.completed");
-  const failureIndex = events.findLastIndex(
-    (event, index) => index > lastCompletedIndex && (event?.type === "error" || event?.type === "turn.failed"),
-  );
-  if (failureIndex < 0) {
-    return null;
-  }
-  const errorEvent = events[failureIndex];
-  return {
-    name: errorEvent.error?.name ?? errorEvent.type ?? "UnknownError",
-    message: errorEvent.error?.data?.message ?? errorEvent.error?.message ?? errorEvent.message ?? "Unknown error",
-  };
-}
-
-export function runCodexJson({
-  executable,
-  prompt,
-  model,
-  variant,
-  agent,
-  cwd,
-  homeDir,
-  timeoutMs,
-  extraEnv,
-}) {
-  const startWall = Date.now();
-  const args = [
-    "exec",
-    "--json",
-    "--model",
-    model,
-    "--skip-git-repo-check",
-    "--sandbox",
-    "danger-full-access",
-    "-c",
-    "approval_policy='never'",
-  ];
-  if (variant) {
-    args.push("-c", `model_reasoning_effort='${variant}'`);
-  }
-  void agent;
-  args.push(prompt);
-  const childArgs = [...(executable.argsPrefix ?? []), ...args];
-
-  const child = spawnSync(executable.command, childArgs, {
-    cwd: cwd ?? repoRoot,
-    encoding: "utf8",
-    windowsHide: true,
-    shell: executable.shell,
-    stdio: ["ignore", "pipe", "pipe"],
-    timeout: timeoutMs,
-    maxBuffer: 30 * 1024 * 1024,
-    env: {
-      ...process.env,
-      ...(homeDir ? { HOME: homeDir, USERPROFILE: homeDir } : {}),
-      ...extraEnv,
-    },
-  });
-
-  const wallMs = Date.now() - startWall;
-  const stdout = child.stdout ?? "";
-  const stderr = child.stderr ?? "";
-  const events = parseNdjson(stdout);
-  const eventError = getEventError(events);
-  const timedOut =
-    child.error?.code === "ETIMEDOUT" ||
-    child.signal === "SIGTERM" ||
-    /timed out/i.test(String(child.error?.message ?? ""));
-  if (child.error && !timedOut) {
-    throw child.error;
-  }
-  const failed = (child.status ?? 1) !== 0 || eventError !== null;
-  const modelNotFound =
-    failed &&
-    (/Model not found|ProviderModelNotFoundError|model is not supported|not supported when using Codex/i.test(`${stdout}\n${stderr}`) ||
-      /Model not found|model is not supported|not supported when using Codex/i.test(eventError?.message ?? ""));
-
-  return {
-    status: child.status ?? 1,
-    signal: child.signal ?? null,
-    stdout,
-    stderr,
-    wallMs,
-    events,
-    eventError,
-    timedOut,
-    modelNotFound,
-  };
-}
-