abstract-gpt 0.1.0__tar.gz

abstract_gpt-0.1.0/PKG-INFO

@@ -0,0 +1,97 @@
+Metadata-Version: 2.4
+Name: abstract-gpt
+Version: 0.1.0
+Summary: Codex login and session management for the abstract toolserver
+Author: jrputkey
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+Provides-Extra: mcp
+Requires-Dist: abstract-claude>=0.1.30; extra == "mcp"
+
+# abstract-gpt
+
+Codex login and session management, usable as a CLI and as the optional `/gpt/*`
+category in `abstract_toolserver`. Requires Python 3.11+, Linux (for HTTP login
+locking), and an installed Codex CLI.
+
+```bash
+pip install -e /srv/pyit/dev/abstract_gpt
+abstract-gpt oauth-status
+abstract-gpt login                    # device URL + code; approve in your browser
+abstract-gpt launch --                # new interactive conversation
+abstract-gpt exec -- "Explain this repository"  # ephemeral noninteractive session
+```
+
+`login --browser` uses normal browser login. `login --with-api-key` reads a key
+from stdin via Codex itself. API key usage has separate API billing. No key is
+required for the ChatGPT subscription login flow.
+
+## Toolserver
+
+Install in the toolserver's Python environment, then add alongside its Claude merge:
+
+```python
+_merge_optional_toolset("abstract_gpt.toolset:get_toolset")
+```
+
+Restart the service to register these routes. They use the toolserver's existing
+authentication and execute as its OS user (`vm_mgr` on this host):
+
+| Route | Purpose |
+| --- | --- |
+| `/gpt/state` | Wrapper configuration and local login status |
+| `/gpt/oauth_status` | Local credential availability; not a live entitlement probe |
+| `/gpt/oauth_solution` | Login instructions |
+| `/gpt/login_start` | Start device login, or return an existing attempt |
+| `/gpt/login_poll` | Poll state, verification URL and one-time code |
+| `/gpt/save_template` | Save config.toml privately |
+| `/gpt/restore` | Restore config only when missing |
+| `/gpt/set_model` | Set `default_model`; null clears wrapper default |
+
+Use POST for mutations. Device login runs in a detached subprocess with a
+15-minute timeout; a file lock prevents duplicate flows across gunicorn workers.
+Poll until `authenticated`, `failed`, `expired`, or `interrupted`. After service
+restart, an interrupted attempt can be started again. Failed login output remains in the private `AG_ROOT/login-output.txt` for local
+diagnostics, and is cleared at the next attempt. Raw login output and stored
+credentials are never returned by the HTTP tools. The device code is sensitive:
+use the existing authenticated toolserver connection.
+
+## Storage and sessions
+
+- `CODEX_HOME`: existing Codex home, default `~/.codex`. Login and launch use the
+  same store so Codex manages token refresh. No credentials are copied between users.
+- `AG_ROOT`: wrapper storage, default `~/.local/share/abstract_gpt`, private mode 0700.
+- `AG_CODEX_BIN`: optional executable path. Otherwise `~/.local/bin/codex`, then PATH. The user-local binary takes priority
+  to avoid selecting a Snap launcher inside a restricted systemd service.
+- `abstract-gpt init`, `state`, `save-template`, `restore`, `set-model MODEL`,
+  `login-start`, `login-poll`, and `oauth-solution` mirror their actions.
+- `launch` starts a new conversation by default; explicit Codex resume flags still
+  work. `exec` adds `--ephemeral`. Neither deletes existing sessions or changes
+  sandbox/approval settings. Explicit model flags override the wrapper default.
+- A config template can contain user-configured secrets; it stays private and is
+  never returned through the API. It does not include auth.json or transcripts.
+
+This package does not emulate Claude's durable token export, destructive reset,
+or automatic quota fallback. Codex owns its cached authentication and renewal.
+A service login applies to that service account; other OS users log in separately.
+
+## Toolserver tools inside Codex
+
+Optional `pip install 'abstract-gpt[mcp]'` reuses the existing protocol-neutral
+`abstract_claude.mcp` bridge:
+
+```bash
+codex mcp add toolserver -- abstract-gpt mcp
+```
+
+The bridge honors `TOOLSERVER_URL` and the existing Hugpy operator credentials.
+
+## Validation
+
+```bash
+PYTHONPATH=src python -m unittest discover -s tests -v
+```
+
+Tests use a fake Codex executable; they never consume model credits or change real
+credentials. Authentication behavior follows the
+[official Codex documentation](https://developers.openai.com/codex/auth/).

abstract_gpt-0.1.0/README.md

@@ -0,0 +1,87 @@
+# abstract-gpt
+
+Codex login and session management, usable as a CLI and as the optional `/gpt/*`
+category in `abstract_toolserver`. Requires Python 3.11+, Linux (for HTTP login
+locking), and an installed Codex CLI.
+
+```bash
+pip install -e /srv/pyit/dev/abstract_gpt
+abstract-gpt oauth-status
+abstract-gpt login                    # device URL + code; approve in your browser
+abstract-gpt launch --                # new interactive conversation
+abstract-gpt exec -- "Explain this repository"  # ephemeral noninteractive session
+```
+
+`login --browser` uses normal browser login. `login --with-api-key` reads a key
+from stdin via Codex itself. API key usage has separate API billing. No key is
+required for the ChatGPT subscription login flow.
+
+## Toolserver
+
+Install in the toolserver's Python environment, then add alongside its Claude merge:
+
+```python
+_merge_optional_toolset("abstract_gpt.toolset:get_toolset")
+```
+
+Restart the service to register these routes. They use the toolserver's existing
+authentication and execute as its OS user (`vm_mgr` on this host):
+
+| Route | Purpose |
+| --- | --- |
+| `/gpt/state` | Wrapper configuration and local login status |
+| `/gpt/oauth_status` | Local credential availability; not a live entitlement probe |
+| `/gpt/oauth_solution` | Login instructions |
+| `/gpt/login_start` | Start device login, or return an existing attempt |
+| `/gpt/login_poll` | Poll state, verification URL and one-time code |
+| `/gpt/save_template` | Save config.toml privately |
+| `/gpt/restore` | Restore config only when missing |
+| `/gpt/set_model` | Set `default_model`; null clears wrapper default |
+
+Use POST for mutations. Device login runs in a detached subprocess with a
+15-minute timeout; a file lock prevents duplicate flows across gunicorn workers.
+Poll until `authenticated`, `failed`, `expired`, or `interrupted`. After service
+restart, an interrupted attempt can be started again. Failed login output remains in the private `AG_ROOT/login-output.txt` for local
+diagnostics, and is cleared at the next attempt. Raw login output and stored
+credentials are never returned by the HTTP tools. The device code is sensitive:
+use the existing authenticated toolserver connection.
+
+## Storage and sessions
+
+- `CODEX_HOME`: existing Codex home, default `~/.codex`. Login and launch use the
+  same store so Codex manages token refresh. No credentials are copied between users.
+- `AG_ROOT`: wrapper storage, default `~/.local/share/abstract_gpt`, private mode 0700.
+- `AG_CODEX_BIN`: optional executable path. Otherwise `~/.local/bin/codex`, then PATH. The user-local binary takes priority
+  to avoid selecting a Snap launcher inside a restricted systemd service.
+- `abstract-gpt init`, `state`, `save-template`, `restore`, `set-model MODEL`,
+  `login-start`, `login-poll`, and `oauth-solution` mirror their actions.
+- `launch` starts a new conversation by default; explicit Codex resume flags still
+  work. `exec` adds `--ephemeral`. Neither deletes existing sessions or changes
+  sandbox/approval settings. Explicit model flags override the wrapper default.
+- A config template can contain user-configured secrets; it stays private and is
+  never returned through the API. It does not include auth.json or transcripts.
+
+This package does not emulate Claude's durable token export, destructive reset,
+or automatic quota fallback. Codex owns its cached authentication and renewal.
+A service login applies to that service account; other OS users log in separately.
+
+## Toolserver tools inside Codex
+
+Optional `pip install 'abstract-gpt[mcp]'` reuses the existing protocol-neutral
+`abstract_claude.mcp` bridge:
+
+```bash
+codex mcp add toolserver -- abstract-gpt mcp
+```
+
+The bridge honors `TOOLSERVER_URL` and the existing Hugpy operator credentials.
+
+## Validation
+
+```bash
+PYTHONPATH=src python -m unittest discover -s tests -v
+```
+
+Tests use a fake Codex executable; they never consume model credits or change real
+credentials. Authentication behavior follows the
+[official Codex documentation](https://developers.openai.com/codex/auth/).

abstract_gpt-0.1.0/pyproject.toml

@@ -0,0 +1,19 @@
+[build-system]
+requires = ["setuptools>=68", "wheel"]
+build-backend = "setuptools.build_meta"
+[project]
+name = "abstract-gpt"
+version = "0.1.0"
+description = "Codex login and session management for the abstract toolserver"
+readme = "README.md"
+requires-python = ">=3.11"
+authors = [{name = "jrputkey"}]
+dependencies = []
+[project.optional-dependencies]
+mcp = ["abstract-claude>=0.1.30"]
+[project.scripts]
+abstract-gpt = "abstract_gpt.cli:main"
+[tool.setuptools.packages.find]
+where = ["src"]
+[tool.pypit]
+github_push = false

abstract_gpt-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

abstract_gpt-0.1.0/src/abstract_gpt/__init__.py

@@ -0,0 +1,2 @@
+"""Codex authentication and launch integration."""
+__version__ = "0.1.0"

abstract_gpt-0.1.0/src/abstract_gpt/__main__.py

@@ -0,0 +1,2 @@
+from .cli import main
+raise SystemExit(main())

abstract_gpt-0.1.0/src/abstract_gpt/actions.py

@@ -0,0 +1,197 @@
+"""JSON actions; credentials remain in Codex's own store."""
+import fcntl
+import json
+import os
+from pathlib import Path
+import re
+import shutil
+import subprocess
+import sys
+import tempfile
+import time
+import threading
+
+
+def root():
+    return Path(os.environ.get("AG_ROOT", "~/.local/share/abstract_gpt")).expanduser()
+
+
+def codex_home():
+    return Path(os.environ.get("CODEX_HOME", "~/.codex")).expanduser()
+
+
+def binary():
+    candidate = Path.home() / ".local/bin/codex"
+    found = os.environ.get("AG_CODEX_BIN")
+    if not found and candidate.is_file():
+        found = str(candidate)
+    if not found:
+        found = shutil.which("codex")
+    if not found:
+        raise FileNotFoundError("Install Codex CLI or set AG_CODEX_BIN")
+    return found
+
+
+def private_dir(path):
+    path.mkdir(parents=True, exist_ok=True, mode=0o700)
+    path.chmod(0o700)
+
+
+def write(path, text):
+    private_dir(path.parent)
+    fd, tmp = tempfile.mkstemp(dir=path.parent)
+    try:
+        with os.fdopen(fd, "w") as stream:
+            stream.write(text)
+        os.replace(tmp, path)
+    finally:
+        if os.path.exists(tmp):
+            os.unlink(tmp)
+
+
+def read_json(path):
+    try:
+        return json.loads(path.read_text())
+    except FileNotFoundError:
+        return {}
+
+
+def env():
+    result = os.environ.copy()
+    result["CODEX_HOME"] = str(codex_home())
+    return result
+
+
+def auth_status():
+    """Check local login status without returning credentials or account data."""
+    try:
+        result = subprocess.run([binary(), "login", "status"], env=env(),
+                                capture_output=True, text=True, timeout=20, cwd=Path.home())
+        return {"ok": True, "authenticated": result.returncode == 0,
+                "codex_home": str(codex_home())}
+    except (OSError, subprocess.TimeoutExpired) as exc:
+        return {"ok": False, "authenticated": False, "error": str(exc)}
+
+
+def build_state():
+    """Show wrapper configuration and local authentication status, never tokens."""
+    return {"root": str(root()), "auth": auth_status(),
+            "config": read_json(root() / "config.json")}
+
+
+def init_root():
+    """Create private wrapper storage; leave existing Codex state intact."""
+    private_dir(root())
+    if not (root() / "config.json").exists():
+        write(root() / "config.json", '{}\n')
+    return {"ok": True, "root": str(root())}
+
+
+def set_model(default_model=None):
+    """Set the wrapper launch default; null clears it. Explicit CLI flags win."""
+    if default_model is not None and (not isinstance(default_model, str) or not default_model.strip()):
+        raise ValueError("default_model must be a nonempty string or null")
+    cfg = read_json(root() / "config.json")
+    cfg["default_model"] = default_model
+    write(root() / "config.json", json.dumps(cfg, indent=2) + "\n")
+    return {"ok": True, "default_model": default_model}
+
+
+def save_template():
+    """Save config.toml only, privately; auth and transcripts are never copied."""
+    source = codex_home() / "config.toml"
+    if not source.is_file():
+        return {"ok": False, "error": "No Codex config.toml to save"}
+    write(root() / "template/config.toml", source.read_text())
+    return {"ok": True}
+
+
+def restore():
+    """Restore saved config only when no live config exists."""
+    target = codex_home() / "config.toml"
+    source = root() / "template/config.toml"
+    if target.exists():
+        return {"ok": True, "changed": False}
+    if not source.exists():
+        return {"ok": False, "error": "No saved template"}
+    private_dir(target.parent)
+    try:
+        fd = os.open(target, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+    except FileExistsError:
+        return {"ok": True, "changed": False}
+    with os.fdopen(fd, "w") as stream:
+        stream.write(source.read_text())
+    return {"ok": True, "changed": True}
+
+
+def auth_solution():
+    """Describe supported login paths for this service's own OS account."""
+    return {"status": auth_status(), "steps": [
+        "POST /gpt/login_start, then poll /gpt/login_poll for the URL and one-time code.",
+        "Approve in your browser. Enable device login in ChatGPT security settings first.",
+        "Alternatively run abstract-gpt login --browser as the service OS user.",
+        "For API billing: pipe a key to abstract-gpt login --with-api-key."],
+        "documentation": "https://developers.openai.com/codex/auth/"}
+
+
+def login_start():
+    """Start device login, or return the current attempt shared across workers."""
+    init_root()
+    lock = open(root() / "login.lock", "a+")
+    try:
+        try:
+            fcntl.flock(lock, fcntl.LOCK_EX | fcntl.LOCK_NB)
+        except BlockingIOError:
+            return login_poll()
+        status = auth_status()
+        if not status["ok"]:
+            return status
+        if status["authenticated"]:
+            return {"ok": True, "state": "authenticated"}
+        write(root() / "login-output.txt", "")
+        write(root() / "login.json", json.dumps({"state": "pending", "started": time.time()}))
+        worker = subprocess.Popen([sys.executable, "-m", "abstract_gpt.login_worker", str(lock.fileno())],
+                         env=env(), pass_fds=(lock.fileno(),), start_new_session=True,
+                         stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL,
+                         stderr=subprocess.DEVNULL)
+        threading.Thread(target=worker.wait, daemon=True).start()
+        return {"ok": True, "state": "pending", "poll": "/gpt/login_poll"}
+    finally:
+        lock.close()
+
+
+def login_poll():
+    """Return only device URL/code and completion state, never raw CLI output."""
+    state = read_json(root() / "login.json") or {"state": "idle"}
+    if state["state"] == "pending":
+        with open(root() / "login.lock", "a+") as lock:
+            try:
+                fcntl.flock(lock, fcntl.LOCK_EX | fcntl.LOCK_NB)
+                state["state"] = "interrupted"
+            except BlockingIOError:
+                pass
+    if state["state"] == "pending":
+        try:
+            with open(root() / "login-output.txt") as stream:
+                output = stream.read(16384)
+        except FileNotFoundError:
+            output = ""
+        output = re.sub(r"\x1b\[[0-?]*[ -/]*[@-~]", "", output)
+        url = re.search(r"https://(?:auth\.openai\.com|chatgpt\.com)/[\w/.-]*device[\w/.-]*", output)
+        code = re.search(r"\b[A-Z0-9]{4,6}-[A-Z0-9]{4,6}\b", output)
+        if url and code:
+            state.update(verification_url=url.group(), user_code=code.group())
+    return {"ok": state["state"] not in ("failed", "expired", "interrupted"), **state}
+
+
+def launch(args, execute=False):
+    """New conversation, same refreshable credential store; exec is ephemeral."""
+    cfg = read_json(root() / "config.json")
+    command = [binary()]
+    if execute:
+        command += ["exec", "--ephemeral"]
+    if cfg.get("default_model") and not any(
+        a in ("-m", "--model") or a.startswith(("--model=", "-m")) for a in args
+    ):
+        command += ["--model", cfg["default_model"]]
+    return subprocess.call(command + args, env=env())

abstract_gpt-0.1.0/src/abstract_gpt/cli.py

@@ -0,0 +1,49 @@
+"""Command-line entry point."""
+import argparse
+import json
+import subprocess
+import sys
+from pathlib import Path
+from . import actions
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Codex login and session manager")
+    sub = parser.add_subparsers(dest="command", required=True)
+    for name in ("init", "state", "oauth-status", "oauth-solution", "login-start",
+                 "login-poll", "save-template", "restore", "mcp"):
+        sub.add_parser(name)
+    login = sub.add_parser("login")
+    methods = login.add_mutually_exclusive_group()
+    methods.add_argument("--browser", action="store_true")
+    methods.add_argument("--with-api-key", action="store_true")
+    sub.add_parser("set-model").add_argument("model", nargs="?")
+    for name in ("launch", "exec"):
+        sub.add_parser(name).add_argument("args", nargs=argparse.REMAINDER)
+    opts = parser.parse_args()
+    try:
+        if opts.command in ("launch", "exec"):
+            args = opts.args[1:] if opts.args[:1] == ["--"] else opts.args
+            return actions.launch(args, execute=opts.command == "exec")
+        if opts.command == "login":
+            flags = ["--with-api-key"] if opts.with_api_key else ([] if opts.browser else ["--device-auth"])
+            return subprocess.call([actions.binary(), "login"] + flags, env=actions.env(), cwd=Path.home())
+        if opts.command == "mcp":
+            try:
+                from abstract_claude.mcp import serve_mcp as bridge
+            except ImportError:
+                parser.error("Install abstract-gpt[mcp] to use the toolserver MCP bridge")
+            return bridge() or 0
+        if opts.command == "set-model":
+            result = actions.set_model(opts.model)
+        else:
+            names = {"init": "init_root", "state": "build_state", "oauth-status": "auth_status",
+                     "oauth-solution": "auth_solution"}
+            result = getattr(actions, names.get(opts.command, opts.command.replace("-", "_")))()
+        print(json.dumps(result, indent=2))
+        return 0 if result.get("ok", True) else 1
+    except KeyboardInterrupt:
+        return 130
+    except (OSError, ValueError, subprocess.SubprocessError) as exc:
+        print(json.dumps({"ok": False, "error": str(exc)}), file=sys.stderr)
+        return 1

abstract_gpt-0.1.0/src/abstract_gpt/login_worker.py

@@ -0,0 +1,35 @@
+"""Detached login worker; parent passes a held flock descriptor."""
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+from . import actions
+
+
+def main():
+    lock_fd = int(sys.argv[1])
+    state = {"state": "failed", "message": "Run abstract-gpt login in a terminal for diagnostics."}
+    try:
+        with open(actions.root() / "login-output.txt", "w") as output:
+            process = subprocess.Popen([actions.binary(), "login", "--device-auth"],
+                                       env=actions.env(), stdin=subprocess.DEVNULL,
+                                       stdout=output, stderr=subprocess.STDOUT, cwd=Path.home())
+            try:
+                code = process.wait(timeout=900)
+            except subprocess.TimeoutExpired:
+                process.kill()
+                process.wait()
+                state = {"state": "expired"}
+            else:
+                if code == 0:
+                    state = {"state": "authenticated"}
+    finally:
+        actions.write(actions.root() / "login.json", json.dumps(state))
+        if state["state"] == "authenticated":
+            (actions.root() / "login-output.txt").unlink(missing_ok=True)
+        os.close(lock_fd)
+
+
+if __name__ == "__main__":
+    main()

abstract_gpt-0.1.0/src/abstract_gpt/toolset.py

@@ -0,0 +1,18 @@
+"""Optional abstract_toolserver /gpt/* category."""
+from . import actions
+
+
+def get_toolset():
+    return {"gpt": {
+        "state": actions.build_state,
+        "oauth_status": actions.auth_status,
+        "oauth_solution": actions.auth_solution,
+        "login_start": actions.login_start,
+        "login_poll": actions.login_poll,
+        "save_template": actions.save_template,
+        "restore": actions.restore,
+        "set_model": actions.set_model,
+    }}
+
+
+TOOLSET = get_toolset()

abstract_gpt-0.1.0/src/abstract_gpt.egg-info/PKG-INFO

@@ -0,0 +1,97 @@
+Metadata-Version: 2.4
+Name: abstract-gpt
+Version: 0.1.0
+Summary: Codex login and session management for the abstract toolserver
+Author: jrputkey
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+Provides-Extra: mcp
+Requires-Dist: abstract-claude>=0.1.30; extra == "mcp"
+
+# abstract-gpt
+
+Codex login and session management, usable as a CLI and as the optional `/gpt/*`
+category in `abstract_toolserver`. Requires Python 3.11+, Linux (for HTTP login
+locking), and an installed Codex CLI.
+
+```bash
+pip install -e /srv/pyit/dev/abstract_gpt
+abstract-gpt oauth-status
+abstract-gpt login                    # device URL + code; approve in your browser
+abstract-gpt launch --                # new interactive conversation
+abstract-gpt exec -- "Explain this repository"  # ephemeral noninteractive session
+```
+
+`login --browser` uses normal browser login. `login --with-api-key` reads a key
+from stdin via Codex itself. API key usage has separate API billing. No key is
+required for the ChatGPT subscription login flow.
+
+## Toolserver
+
+Install in the toolserver's Python environment, then add alongside its Claude merge:
+
+```python
+_merge_optional_toolset("abstract_gpt.toolset:get_toolset")
+```
+
+Restart the service to register these routes. They use the toolserver's existing
+authentication and execute as its OS user (`vm_mgr` on this host):
+
+| Route | Purpose |
+| --- | --- |
+| `/gpt/state` | Wrapper configuration and local login status |
+| `/gpt/oauth_status` | Local credential availability; not a live entitlement probe |
+| `/gpt/oauth_solution` | Login instructions |
+| `/gpt/login_start` | Start device login, or return an existing attempt |
+| `/gpt/login_poll` | Poll state, verification URL and one-time code |
+| `/gpt/save_template` | Save config.toml privately |
+| `/gpt/restore` | Restore config only when missing |
+| `/gpt/set_model` | Set `default_model`; null clears wrapper default |
+
+Use POST for mutations. Device login runs in a detached subprocess with a
+15-minute timeout; a file lock prevents duplicate flows across gunicorn workers.
+Poll until `authenticated`, `failed`, `expired`, or `interrupted`. After service
+restart, an interrupted attempt can be started again. Failed login output remains in the private `AG_ROOT/login-output.txt` for local
+diagnostics, and is cleared at the next attempt. Raw login output and stored
+credentials are never returned by the HTTP tools. The device code is sensitive:
+use the existing authenticated toolserver connection.
+
+## Storage and sessions
+
+- `CODEX_HOME`: existing Codex home, default `~/.codex`. Login and launch use the
+  same store so Codex manages token refresh. No credentials are copied between users.
+- `AG_ROOT`: wrapper storage, default `~/.local/share/abstract_gpt`, private mode 0700.
+- `AG_CODEX_BIN`: optional executable path. Otherwise `~/.local/bin/codex`, then PATH. The user-local binary takes priority
+  to avoid selecting a Snap launcher inside a restricted systemd service.
+- `abstract-gpt init`, `state`, `save-template`, `restore`, `set-model MODEL`,
+  `login-start`, `login-poll`, and `oauth-solution` mirror their actions.
+- `launch` starts a new conversation by default; explicit Codex resume flags still
+  work. `exec` adds `--ephemeral`. Neither deletes existing sessions or changes
+  sandbox/approval settings. Explicit model flags override the wrapper default.
+- A config template can contain user-configured secrets; it stays private and is
+  never returned through the API. It does not include auth.json or transcripts.
+
+This package does not emulate Claude's durable token export, destructive reset,
+or automatic quota fallback. Codex owns its cached authentication and renewal.
+A service login applies to that service account; other OS users log in separately.
+
+## Toolserver tools inside Codex
+
+Optional `pip install 'abstract-gpt[mcp]'` reuses the existing protocol-neutral
+`abstract_claude.mcp` bridge:
+
+```bash
+codex mcp add toolserver -- abstract-gpt mcp
+```
+
+The bridge honors `TOOLSERVER_URL` and the existing Hugpy operator credentials.
+
+## Validation
+
+```bash
+PYTHONPATH=src python -m unittest discover -s tests -v
+```
+
+Tests use a fake Codex executable; they never consume model credits or change real
+credentials. Authentication behavior follows the
+[official Codex documentation](https://developers.openai.com/codex/auth/).

abstract_gpt-0.1.0/src/abstract_gpt.egg-info/SOURCES.txt

@@ -0,0 +1,15 @@
+README.md
+pyproject.toml
+src/abstract_gpt/__init__.py
+src/abstract_gpt/__main__.py
+src/abstract_gpt/actions.py
+src/abstract_gpt/cli.py
+src/abstract_gpt/login_worker.py
+src/abstract_gpt/toolset.py
+src/abstract_gpt.egg-info/PKG-INFO
+src/abstract_gpt.egg-info/SOURCES.txt
+src/abstract_gpt.egg-info/dependency_links.txt
+src/abstract_gpt.egg-info/entry_points.txt
+src/abstract_gpt.egg-info/requires.txt
+src/abstract_gpt.egg-info/top_level.txt
+tests/test_actions.py

abstract_gpt-0.1.0/src/abstract_gpt.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

abstract_gpt-0.1.0/src/abstract_gpt.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+abstract-gpt = abstract_gpt.cli:main

abstract_gpt-0.1.0/src/abstract_gpt.egg-info/requires.txt

@@ -0,0 +1,3 @@
+
+[mcp]
+abstract-claude>=0.1.30

abstract_gpt-0.1.0/src/abstract_gpt.egg-info/top_level.txt

@@ -0,0 +1 @@
+abstract_gpt

abstract_gpt-0.1.0/tests/test_actions.py

@@ -0,0 +1,95 @@
+import json
+import os
+from pathlib import Path
+import stat
+import tempfile
+import time
+import unittest
+from unittest.mock import patch
+from abstract_gpt import actions
+
+
+class ActionsTest(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        self.base = Path(self.tmp.name)
+        self.fake = self.base / 'codex'
+        self.fake.write_text('''#!/usr/bin/env python3
+import os, pathlib, sys, time
+home = pathlib.Path(os.environ['CODEX_HOME'])
+if sys.argv[1:] == ['login', 'status']:
+    print('secret-status-output')
+    sys.exit(0 if (home / 'authenticated').exists() else 1)
+print('https://auth.openai.com/codex/device', flush=True)
+print('ABCD-12345', flush=True)
+print('secret-refresh-token', flush=True)
+time.sleep(0.4)
+home.mkdir(exist_ok=True)
+(home / 'authenticated').touch()
+''')
+        self.fake.chmod(0o700)
+        self.env = patch.dict(os.environ, {'AG_ROOT': str(self.base / 'data'),
+            'CODEX_HOME': str(self.base / 'home'), 'AG_CODEX_BIN': str(self.fake)})
+        self.env.start()
+
+    def tearDown(self):
+        self.env.stop()
+        self.tmp.cleanup()
+
+    def test_device_login_shared_worker_and_redaction(self):
+        self.assertEqual(actions.login_start()['state'], 'pending')
+        self.assertEqual(actions.login_start()['state'], 'pending')
+        seen_code = False
+        for _ in range(100):
+            result = actions.login_poll()
+            self.assertNotIn('secret', json.dumps(result))
+            seen_code |= result.get('user_code') == 'ABCD-12345'
+            if result['state'] != 'pending':
+                break
+            time.sleep(0.03)
+        self.assertTrue(seen_code)
+        self.assertEqual(result['state'], 'authenticated')
+        self.assertTrue(actions.auth_status()['authenticated'])
+        self.assertFalse((actions.root() / 'login-output.txt').exists())
+        self.assertEqual(stat.S_IMODE(actions.root().stat().st_mode), 0o700)
+
+    def test_user_binary_preferred_over_snap(self):
+        local = self.base / '.local/bin/codex'
+        local.parent.mkdir(parents=True)
+        local.touch()
+        with patch.dict(os.environ, {'AG_CODEX_BIN': ''}), \
+             patch('pathlib.Path.home', return_value=self.base), \
+             patch('shutil.which', return_value='/snap/bin/codex'):
+            self.assertEqual(actions.binary(), str(local))
+
+    def test_dead_worker(self):
+        actions.init_root()
+        actions.write(actions.root() / 'login.json', '{"state":"pending"}')
+        self.assertEqual(actions.login_poll()['state'], 'interrupted')
+
+    def test_template_preserves_auth_and_live_config(self):
+        home = actions.codex_home()
+        home.mkdir()
+        (home / 'auth.json').write_text('secret')
+        (home / 'config.toml').write_text('model = "example"\n')
+        actions.save_template()
+        self.assertFalse((actions.root() / 'template/auth.json').exists())
+        (home / 'config.toml').write_text('model = "changed"\n')
+        self.assertFalse(actions.restore()['changed'])
+        (home / 'config.toml').unlink()
+        self.assertTrue(actions.restore()['changed'])
+        self.assertEqual((home / 'auth.json').read_text(), 'secret')
+
+    def test_launch_flags_and_status_redaction(self):
+        actions.set_model('configured')
+        with patch('subprocess.call', return_value=7) as call:
+            self.assertEqual(actions.launch(['--model', 'explicit', 'hello'], True), 7)
+            self.assertEqual(call.call_args.args[0],
+                [str(self.fake), 'exec', '--ephemeral', '--model', 'explicit', 'hello'])
+            actions.launch(['hello'])
+            self.assertEqual(call.call_args.args[0], [str(self.fake), '--model', 'configured', 'hello'])
+        self.assertNotIn('secret', json.dumps(actions.auth_status()))
+
+
+if __name__ == '__main__':
+    unittest.main()