llm-async-codex 0.1.0__tar.gz

llm_async_codex-0.1.0/PKG-INFO

@@ -0,0 +1,15 @@
+Metadata-Version: 2.4
+Name: llm-async-codex
+Version: 0.1.0
+Summary: ChatGPT Codex subscription provider for llm-async
+Author: Johanderson Mogollon
+Author-email: johander1822@gmail.com
+Requires-Python: >=3.10,<4.0
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Dist: aiosonic (>=1.0.6)
+Requires-Dist: llm-async (>=0.5.2)

llm_async_codex-0.1.0/pyproject.toml

@@ -0,0 +1,35 @@
+[project]
+name = "llm-async-codex"
+version = "0.1.0"
+description = "ChatGPT Codex subscription provider for llm-async"
+authors = [
+    {name = "Johanderson Mogollon",email = "johander1822@gmail.com"}
+]
+requires-python = ">=3.10,<4.0"
+dependencies = [
+    "llm-async (>=0.5.2)",
+    "aiosonic (>=1.0.6)"
+]
+
+[dependency-groups]
+dev = [
+    "pytest (>=7.0)",
+    "ruff (>=0.8)"
+]
+
+
+[tool.poetry]
+packages = [{ include = "llm_async_codex", from = "src" }]
+
+[tool.poetry.scripts]
+llm-async-codex = "llm_async_codex.cli:main"
+
+[tool.ruff]
+target-version = "py310"
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+
+[build-system]
+requires = ["poetry-core>=2.0.0,<3.0.0"]
+build-backend = "poetry.core.masonry.api"

llm_async_codex-0.1.0/src/llm_async_codex/__init__.py

@@ -0,0 +1,34 @@
+"""ChatGPT Codex subscription support for llm_async."""
+
+from .auth import (
+    CodexAuthError,
+    CodexCredentials,
+    default_auth_path,
+    load_credentials,
+    save_credentials,
+)
+from .oauth import (
+    CodexLoginError,
+    login,
+    login_with_browser,
+    login_with_device_code,
+    refresh_access_token,
+    refresh_credentials,
+)
+from .provider import CODEX_BASE_URL, CodexProvider
+
+__all__ = [
+    "CODEX_BASE_URL",
+    "CodexAuthError",
+    "CodexCredentials",
+    "CodexLoginError",
+    "CodexProvider",
+    "default_auth_path",
+    "load_credentials",
+    "login",
+    "login_with_browser",
+    "login_with_device_code",
+    "refresh_access_token",
+    "refresh_credentials",
+    "save_credentials",
+]

llm_async_codex-0.1.0/src/llm_async_codex/auth.py

@@ -0,0 +1,76 @@
+"""Load credentials from an existing Codex CLI login."""
+
+from __future__ import annotations
+
+import json
+import os
+from collections.abc import Mapping
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+
+
+class CodexAuthError(ValueError):
+    """Raised when Codex credentials cannot be loaded."""
+
+
+@dataclass(frozen=True, slots=True)
+class CodexCredentials:
+    """ChatGPT OAuth credentials used by the Codex Responses endpoint."""
+
+    access_token: str
+    refresh_token: str | None = None
+    account_id: str | None = None
+    expires_at: float | None = None
+
+
+def default_auth_path() -> Path:
+    """Return the auth file used by the Codex CLI."""
+    return Path(os.environ.get("CODEX_HOME", "~/.codex")).expanduser() / "auth.json"
+
+
+def load_credentials(path: Path | None = None) -> CodexCredentials:
+    """Load credentials from a Codex CLI auth file."""
+    auth_path = path or default_auth_path()
+    try:
+        value: Any = json.loads(auth_path.read_text(encoding="utf-8"))
+    except OSError as error:
+        raise CodexAuthError(f"cannot read Codex auth file: {auth_path}") from error
+    except json.JSONDecodeError as error:
+        raise CodexAuthError(f"invalid JSON in Codex auth file: {auth_path}") from error
+
+    if not isinstance(value, Mapping) or not isinstance(value.get("tokens"), Mapping):
+        raise CodexAuthError("Codex auth file has no tokens object")
+
+    tokens = value["tokens"]
+    access_token = tokens.get("access_token")
+    if not isinstance(access_token, str) or not access_token:
+        raise CodexAuthError("Codex auth file has no access token")
+
+    refresh_token = _string_or_none(tokens.get("refresh_token"))
+    account_id = _string_or_none(tokens.get("account_id")) or _string_or_none(
+        value.get("account_id")
+    )
+    expires_at = tokens.get("expires_at")
+    if not isinstance(expires_at, (int, float)):
+        expires_at = None
+    return CodexCredentials(access_token, refresh_token, account_id, expires_at)
+
+
+def _string_or_none(value: object) -> str | None:
+    return value if isinstance(value, str) and value else None
+
+
+def save_credentials(credentials: CodexCredentials, path: Path | None = None) -> Path:
+    """Write credentials to a Codex-CLI-compatible auth file. Returns the path written."""
+    auth_path = path or default_auth_path()
+    auth_path.parent.mkdir(parents=True, exist_ok=True)
+    tokens: dict[str, Any] = {"access_token": credentials.access_token}
+    if credentials.refresh_token:
+        tokens["refresh_token"] = credentials.refresh_token
+    if credentials.account_id:
+        tokens["account_id"] = credentials.account_id
+    if credentials.expires_at is not None:
+        tokens["expires_at"] = credentials.expires_at
+    auth_path.write_text(json.dumps({"tokens": tokens}, indent=2), encoding="utf-8")
+    return auth_path

llm_async_codex-0.1.0/src/llm_async_codex/cli.py

@@ -0,0 +1,60 @@
+"""Command-line entry point for llm-async-codex."""
+
+from __future__ import annotations
+
+import argparse
+import asyncio
+from pathlib import Path
+
+from .oauth import CodexLoginError, login
+
+
+def _build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(prog="llm-async-codex")
+    subparsers = parser.add_subparsers(dest="command", required=True)
+
+    login_parser = subparsers.add_parser("login", help="Log in to ChatGPT Codex")
+    login_parser.add_argument(
+        "--device-code",
+        action="store_true",
+        help="Use the device-code flow instead of opening a browser",
+    )
+    login_parser.add_argument(
+        "--auth-file",
+        type=Path,
+        default=None,
+        help="Where to write credentials (default: $CODEX_HOME/auth.json or ~/.codex/auth.json)",
+    )
+    login_parser.add_argument(
+        "--verbose",
+        "-v",
+        action="store_true",
+        help="Show detailed progress (HTTP statuses, full URLs, poll attempts)",
+    )
+    return parser
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = _build_parser().parse_args(argv)
+
+    if args.command == "login":
+        try:
+            credentials = asyncio.run(
+                login(
+                    device_code=args.device_code,
+                    auth_path=args.auth_file,
+                    verbose=args.verbose,
+                )
+            )
+        except CodexLoginError as error:
+            print(f"Login failed: {error}")
+            return 1
+        masked = f"{credentials.access_token[:8]}..."
+        print(f"Logged in (access token {masked}).")
+        return 0
+
+    return 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

llm_async_codex-0.1.0/src/llm_async_codex/oauth.py

@@ -0,0 +1,334 @@
+"""ChatGPT Codex login: browser OAuth (PKCE) and device-code flows."""
+
+from __future__ import annotations
+
+import asyncio
+import base64
+import hashlib
+import json
+import logging
+import secrets
+import time
+import webbrowser
+from collections.abc import Mapping
+from http.server import BaseHTTPRequestHandler, HTTPServer
+from pathlib import Path
+from typing import Any
+from urllib.parse import parse_qs, urlencode, urlparse
+
+import aiosonic
+
+from .auth import CodexCredentials, save_credentials
+
+logger = logging.getLogger("llm_async_codex.oauth")
+
+CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann"
+ISSUER = "https://auth.openai.com"
+OAUTH_PORT = 1455
+REDIRECT_URI = f"http://localhost:{OAUTH_PORT}/auth/callback"
+ORIGINATOR = "llm-async-codex"
+CALLBACK_TIMEOUT_SECONDS = 300
+DEVICE_POLL_SAFETY_MARGIN_SECONDS = 3
+TOKEN_REFRESH_SAFETY_MARGIN_SECONDS = 60
+
+
+class CodexLoginError(RuntimeError):
+    """Raised when the login flow fails."""
+
+
+def _configure_logging(verbose: bool) -> None:
+    """Ensure login progress is visible by default, with more detail if verbose."""
+    if not logging.getLogger().handlers:
+        logging.basicConfig(format="%(message)s", level=logging.INFO)
+    logger.setLevel(logging.DEBUG if verbose else logging.INFO)
+
+
+def _b64url(data: bytes) -> str:
+    return base64.urlsafe_b64encode(data).rstrip(b"=").decode()
+
+
+def _generate_pkce() -> tuple[str, str]:
+    """Return (code_verifier, code_challenge) for an OAuth PKCE exchange."""
+    verifier = _b64url(secrets.token_bytes(32))
+    challenge = _b64url(hashlib.sha256(verifier.encode()).digest())
+    return verifier, challenge
+
+
+def _build_authorize_url(state: str, code_challenge: str) -> str:
+    params = {
+        "response_type": "code",
+        "client_id": CLIENT_ID,
+        "redirect_uri": REDIRECT_URI,
+        "scope": "openid profile email offline_access",
+        "code_challenge": code_challenge,
+        "code_challenge_method": "S256",
+        "id_token_add_organizations": "true",
+        "codex_cli_simplified_flow": "true",
+        "state": state,
+        "originator": ORIGINATOR,
+    }
+    return f"{ISSUER}/oauth/authorize?{urlencode(params)}"
+
+
+def parse_jwt_claims(token: str) -> dict[str, Any] | None:
+    """Decode (without verifying) the claims payload of a JWT."""
+    parts = token.split(".")
+    if len(parts) != 3:
+        return None
+    padding = "=" * (-len(parts[1]) % 4)
+    try:
+        return json.loads(base64.urlsafe_b64decode(parts[1] + padding))
+    except (ValueError, json.JSONDecodeError):
+        return None
+
+
+def _compute_expires_at(tokens: Mapping[str, Any]) -> float | None:
+    expires_in = tokens.get("expires_in")
+    if not isinstance(expires_in, (int, float)):
+        return None
+    return time.time() + expires_in
+
+
+def extract_account_id(tokens: Mapping[str, Any]) -> str | None:
+    """Extract the ChatGPT account id from a token response's claims."""
+    for token_key in ("id_token", "access_token"):
+        token = tokens.get(token_key)
+        if not isinstance(token, str):
+            continue
+        claims = parse_jwt_claims(token)
+        if not claims:
+            continue
+        account_id = (
+            claims.get("chatgpt_account_id")
+            or claims.get("https://api.openai.com/auth", {}).get("chatgpt_account_id")
+            or (claims.get("organizations") or [{}])[0].get("id")
+        )
+        if account_id:
+            return account_id
+    return None
+
+
+async def _exchange_code_for_tokens(
+    client: aiosonic.HTTPClient,
+    *,
+    code: str,
+    redirect_uri: str,
+    code_verifier: str,
+) -> dict[str, Any]:
+    response = await client.post(
+        f"{ISSUER}/oauth/token",
+        data={
+            "grant_type": "authorization_code",
+            "code": code,
+            "redirect_uri": redirect_uri,
+            "client_id": CLIENT_ID,
+            "code_verifier": code_verifier,
+        },
+    )
+    logger.debug("Token exchange response: %s", response.status_code)
+    if response.status_code != 200:
+        raise CodexLoginError(f"token exchange failed: {response.status_code}")
+    return json.loads(await response.text())
+
+
+class _CallbackResult:
+    code: str | None = None
+    state: str | None = None
+    error: str | None = None
+
+
+def _make_callback_handler(result: _CallbackResult) -> type[BaseHTTPRequestHandler]:
+    class Handler(BaseHTTPRequestHandler):
+        def do_GET(self) -> None:
+            parsed = urlparse(self.path)
+            if parsed.path != "/auth/callback":
+                self.send_response(404)
+                self.end_headers()
+                return
+
+            query = parse_qs(parsed.query)
+            result.code = query.get("code", [None])[0]
+            result.state = query.get("state", [None])[0]
+            result.error = query.get("error", [None])[0]
+
+            self.send_response(200)
+            self.send_header("Content-Type", "text/html; charset=utf-8")
+            self.end_headers()
+            message = (
+                "Login failed, you can close this window."
+                if result.error
+                else "Login successful, you can close this window."
+            )
+            self.wfile.write(f"<html><body>{message}</body></html>".encode())
+
+        def log_message(self, format: str, *args: Any) -> None:
+            return
+
+    return Handler
+
+
+async def login_with_browser(
+    auth_path: Path | None = None, *, verbose: bool = False
+) -> CodexCredentials:
+    """Log in via the browser-based OAuth flow, opening a localhost listener."""
+    _configure_logging(verbose)
+    code_verifier, code_challenge = _generate_pkce()
+    state = secrets.token_urlsafe(24)
+
+    result = _CallbackResult()
+    server = HTTPServer(("localhost", OAUTH_PORT), _make_callback_handler(result))
+    server.timeout = CALLBACK_TIMEOUT_SECONDS
+
+    authorize_url = _build_authorize_url(state, code_challenge)
+    authorize_endpoint = urlparse(authorize_url)
+    logger.debug(
+        "Authorize endpoint: %s://%s%s",
+        authorize_endpoint.scheme,
+        authorize_endpoint.netloc,
+        authorize_endpoint.path,
+    )
+    logger.info("Listening on %s ...", REDIRECT_URI)
+    if webbrowser.open(authorize_url):
+        logger.info("Opened browser for ChatGPT login. Complete the login there.")
+    else:
+        logger.info(
+            "Could not open a browser automatically. Open this URL to log in:\n%s",
+            authorize_url,
+        )
+
+    loop = asyncio.get_running_loop()
+    try:
+        await loop.run_in_executor(None, server.handle_request)
+    finally:
+        server.server_close()
+
+    if result.code is None:
+        raise CodexLoginError(result.error or "OAuth callback timed out")
+    if result.state != state:
+        raise CodexLoginError("invalid OAuth state - potential CSRF")
+
+    logger.info("Received callback, exchanging code for tokens ...")
+    async with aiosonic.HTTPClient() as client:
+        tokens = await _exchange_code_for_tokens(
+            client,
+            code=result.code,
+            redirect_uri=REDIRECT_URI,
+            code_verifier=code_verifier,
+        )
+
+    credentials = CodexCredentials(
+        access_token=tokens["access_token"],
+        refresh_token=tokens.get("refresh_token"),
+        account_id=extract_account_id(tokens),
+        expires_at=_compute_expires_at(tokens),
+    )
+    resolved_path = save_credentials(credentials, auth_path)
+    logger.info("Saved credentials to %s", resolved_path)
+    return credentials
+
+
+async def login_with_device_code(
+    auth_path: Path | None = None, *, verbose: bool = False
+) -> CodexCredentials:
+    """Log in via OpenAI's device-code flow (no local server required)."""
+    _configure_logging(verbose)
+    async with aiosonic.HTTPClient() as client:
+        usercode_response = await client.post(
+            f"{ISSUER}/api/accounts/deviceauth/usercode",
+            json={"client_id": CLIENT_ID},
+            headers={"Content-Type": "application/json"},
+        )
+        logger.debug("Device usercode response: %s", usercode_response.status_code)
+        if usercode_response.status_code != 200:
+            raise CodexLoginError("failed to start device authorization")
+        device_data = json.loads(await usercode_response.text())
+        device_auth_id = device_data["device_auth_id"]
+        user_code = device_data["user_code"]
+        interval = max(int(device_data.get("interval") or 5), 1)
+
+        logger.info("Enter code: %s", user_code)
+        logger.info("Then visit: %s/codex/device", ISSUER)
+
+        attempt = 0
+        while True:
+            attempt += 1
+            await asyncio.sleep(interval + DEVICE_POLL_SAFETY_MARGIN_SECONDS)
+            poll_response = await client.post(
+                f"{ISSUER}/api/accounts/deviceauth/token",
+                json={"device_auth_id": device_auth_id, "user_code": user_code},
+                headers={"Content-Type": "application/json"},
+            )
+            logger.debug(
+                "Poll attempt %d: status %s", attempt, poll_response.status_code
+            )
+            if poll_response.status_code == 200:
+                break
+            if poll_response.status_code not in (403, 404):
+                raise CodexLoginError(
+                    f"device authorization failed: {poll_response.status_code}"
+                )
+            logger.info("Still waiting for confirmation ...")
+
+        poll_data = json.loads(await poll_response.text())
+        logger.info("Confirmed, exchanging code for tokens ...")
+        tokens = await _exchange_code_for_tokens(
+            client,
+            code=poll_data["authorization_code"],
+            redirect_uri=f"{ISSUER}/deviceauth/callback",
+            code_verifier=poll_data["code_verifier"],
+        )
+
+    credentials = CodexCredentials(
+        access_token=tokens["access_token"],
+        refresh_token=tokens.get("refresh_token"),
+        account_id=extract_account_id(tokens),
+        expires_at=_compute_expires_at(tokens),
+    )
+    resolved_path = save_credentials(credentials, auth_path)
+    logger.info("Saved credentials to %s", resolved_path)
+    return credentials
+
+
+async def refresh_access_token(refresh_token: str) -> dict[str, Any]:
+    """Exchange a refresh token for a new access token."""
+    async with aiosonic.HTTPClient() as client:
+        response = await client.post(
+            f"{ISSUER}/oauth/token",
+            data={
+                "grant_type": "refresh_token",
+                "refresh_token": refresh_token,
+                "client_id": CLIENT_ID,
+            },
+        )
+        logger.debug("Token refresh response: %s", response.status_code)
+        if response.status_code != 200:
+            raise CodexLoginError(f"token refresh failed: {response.status_code}")
+        return json.loads(await response.text())
+
+
+async def refresh_credentials(
+    credentials: CodexCredentials, auth_path: Path | None = None
+) -> CodexCredentials:
+    """Refresh an access token and persist the result."""
+    if not credentials.refresh_token:
+        raise CodexLoginError("no refresh token available")
+
+    tokens = await refresh_access_token(credentials.refresh_token)
+    refreshed = CodexCredentials(
+        access_token=tokens["access_token"],
+        refresh_token=tokens.get("refresh_token") or credentials.refresh_token,
+        account_id=extract_account_id(tokens) or credentials.account_id,
+        expires_at=_compute_expires_at(tokens),
+    )
+    resolved_path = save_credentials(refreshed, auth_path)
+    logger.debug("Refreshed credentials saved to %s", resolved_path)
+    return refreshed
+
+
+async def login(
+    *, device_code: bool = False, auth_path: Path | None = None, verbose: bool = False
+) -> CodexCredentials:
+    """Log in to ChatGPT Codex, via browser by default or device code."""
+    if device_code:
+        return await login_with_device_code(auth_path, verbose=verbose)
+    return await login_with_browser(auth_path, verbose=verbose)

llm_async_codex-0.1.0/src/llm_async_codex/provider.py

@@ -0,0 +1,106 @@
+"""ChatGPT subscription provider for Codex Responses."""
+
+from __future__ import annotations
+
+import asyncio
+import time
+from pathlib import Path
+from typing import Any
+
+from llm_async.models import Response
+from llm_async.providers.openai_responses import OpenAIResponsesProvider
+
+from .auth import CodexCredentials, default_auth_path, load_credentials
+from .oauth import TOKEN_REFRESH_SAFETY_MARGIN_SECONDS, refresh_credentials
+
+CODEX_BASE_URL = "https://chatgpt.com/backend-api/codex"
+
+
+class CodexProvider(OpenAIResponsesProvider):
+    """Send Responses API requests through a ChatGPT Codex subscription."""
+
+    def __init__(
+        self,
+        credentials: CodexCredentials,
+        *,
+        base_url: str = CODEX_BASE_URL,
+        http2: bool = False,
+        auth_path: Path | None = None,
+    ) -> None:
+        self.credentials = credentials
+        self.auth_path = auth_path
+        self._refresh_lock = asyncio.Lock()
+        super().__init__(api_key=credentials.access_token, base_url=base_url, http2=http2)
+
+    @classmethod
+    def from_codex_home(cls, path: Path | None = None) -> CodexProvider:
+        """Create a provider from an existing Codex CLI login."""
+        return cls(load_credentials(path), auth_path=path or default_auth_path())
+
+    async def _ensure_fresh_credentials(self) -> None:
+        credentials = self.credentials
+        if not credentials.refresh_token or credentials.expires_at is None:
+            return
+        if time.time() < credentials.expires_at - TOKEN_REFRESH_SAFETY_MARGIN_SECONDS:
+            return
+
+        async with self._refresh_lock:
+            credentials = self.credentials
+            if (
+                not credentials.refresh_token
+                or credentials.expires_at is None
+                or time.time() < credentials.expires_at - TOKEN_REFRESH_SAFETY_MARGIN_SECONDS
+            ):
+                return
+            self.credentials = await refresh_credentials(credentials, self.auth_path)
+            self.api_key = self.credentials.access_token
+
+    async def _single_complete(self, *args: Any, **kwargs: Any) -> Response:
+        stream = args[2] if len(args) > 2 else kwargs.get("stream", False)
+        if not stream:
+            raise ValueError("Codex subscriptions require stream=True")
+        kwargs.setdefault("store", False)
+        await self._ensure_fresh_credentials()
+        return await super()._single_complete(*args, **kwargs)
+
+    def _messages_to_input(
+        self, messages: list[dict[str, Any]]
+    ) -> list[dict[str, Any]]:
+        """Convert text messages to the list-only Codex Responses input format."""
+        input_items = super()._messages_to_input(messages)
+        if isinstance(input_items, str):
+            return [
+                {
+                    "role": "user",
+                    "content": [{"type": "input_text", "text": input_items}],
+                }
+            ]
+
+        normalized: list[dict[str, Any]] = []
+        for item in input_items:
+            if item.get("role") == "user" and isinstance(item.get("content"), str):
+                normalized.append(
+                    {
+                        **item,
+                        "content": [{"type": "input_text", "text": item["content"]}],
+                    }
+                )
+            elif item.get("role") == "assistant" and isinstance(
+                item.get("content"), str
+            ):
+                normalized.append(
+                    {
+                        **item,
+                        "content": [{"type": "output_text", "text": item["content"]}],
+                    }
+                )
+            else:
+                normalized.append(item)
+        return normalized
+
+    def _default_headers(self) -> dict[str, str]:
+        headers = super()._default_headers()
+        headers["originator"] = "llm-async-codex"
+        if self.credentials.account_id:
+            headers["ChatGPT-Account-Id"] = self.credentials.account_id
+        return headers