optio-codex 0.3.0__tar.gz → 0.4.1__tar.gz

{optio_codex-0.3.0 → optio_codex-0.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: optio-codex
-Version: 0.3.0
+Version: 0.4.1
 Summary: Run OpenAI Codex as an optio task; local subprocess; ttyd-served TUI iframe.
 Author-email: Kristof Csillag <kristof.csillag@deai-labs.com>
 License-Expression: Apache-2.0
@@ -20,9 +20,9 @@ Classifier: Topic :: Software Development :: Code Generators
 Classifier: Framework :: AsyncIO
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
-Requires-Dist: optio-core<0.4,>=0.3
-Requires-Dist: optio-host<0.3,>=0.2
-Requires-Dist: optio-agents<0.6,>=0.5
+Requires-Dist: optio-core<0.5,>=0.4
+Requires-Dist: optio-host<0.4,>=0.3
+Requires-Dist: optio-agents<0.7,>=0.6
 Requires-Dist: asyncssh>=2.14
 Requires-Dist: aiohttp>=3.9
 Provides-Extra: dev

{optio_codex-0.3.0 → optio_codex-0.4.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "optio-codex"
-version = "0.3.0"
+version = "0.4.1"
 description = "Run OpenAI Codex as an optio task; local subprocess; ttyd-served TUI iframe."
 readme = "README.md"
 license = "Apache-2.0"
@@ -26,9 +26,9 @@ classifiers = [
     "Framework :: AsyncIO",
 ]
 dependencies = [
-    "optio-core>=0.3,<0.4",
-    "optio-host>=0.2,<0.3",
-    "optio-agents>=0.5,<0.6",
+    "optio-core>=0.4,<0.5",
+    "optio-host>=0.3,<0.4",
+    "optio-agents>=0.6,<0.7",
     "asyncssh>=2.14",
     "aiohttp>=3.9",
 ]

{optio_codex-0.3.0 → optio_codex-0.4.1}/src/optio_codex/__init__.py

@@ -9,6 +9,7 @@ from optio_host import (
     SSHConfig,
 )
 
+from optio_codex.account import analyze_account
 from optio_codex.info import AGENT_INFO
 from optio_codex.seed_manifest import (
     CODEX_CRED_MANIFEST,
@@ -40,6 +41,7 @@ _logging.getLogger("asyncssh").setLevel(_logging.WARNING)
 
 __all__ = [
     "AGENT_INFO",
+    "analyze_account",
     "create_codex_task",
     "run_codex_session",
     "AllowedDir",

optio_codex-0.4.1/src/optio_codex/account.py

@@ -0,0 +1,312 @@
+"""Best-effort Codex (OpenAI/ChatGPT) account summary for seeded logins.
+
+The per-engine ``analyze_account`` seam every wrapper implements: live OAuth
+credentials in, a vendor-agnostic ``optio_agents.account.AccountInfo`` out.
+Fail-soft: any error (missing field, HTTP/parse error, malformed token) yields
+``EMPTY`` -- account analysis is informational (it feeds the ``on_seed_saved``
+2nd arg + a ``metadata.accounts`` stamp), never load-bearing, so a failure here
+must not disturb seed capture, verify, or launch.
+
+Divergence from claudecode: codex ``creds`` is the whole ``auth.json`` **tokens
+dict** (``{id_token, access_token, account_id}``), not a bare access token.
+Rationale --
+
+  * **Identity is OFFLINE.** ``tokens.id_token`` is a JWT whose middle segment
+    b64url-decodes to the identity claims (``name``, ``email``,
+    ``chatgpt_plan_type``, ``chatgpt_account_id``). No network is needed for
+    ``name``/``email``/``plan``/``account_id``; this is also the fail-soft
+    identity fallback when the live usage GET fails.
+  * **account_id** = ``tokens.account_id`` (the ChatGPT account uuid), needed
+    both for the ``ChatGPT-Account-Id`` request header and for
+    ``AccountInfo.account_id``. NB the ``usage.account_id`` field is the *user*
+    id string, not the uuid -- do NOT use it.
+  * **Usage windows** come from a read-only, non-billable
+    ``GET https://chatgpt.com/backend-api/wham/usage`` (the same endpoint the
+    codex TUI polls). chatgpt.com serves a Cloudflare challenge to a blank UA,
+    so a real ``codex_cli_rs/<ver>`` User-Agent is REQUIRED.
+
+See ``docs/2026-07-09-codex-account-research.md`` for the captured payloads and
+the full field mapping.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import base64
+import binascii
+import json
+import logging
+import urllib.request
+from datetime import datetime, timedelta, timezone
+from urllib.error import HTTPError, URLError
+
+from optio_agents.account import EMPTY, AccountInfo, UsageWindow
+
+_LOG = logging.getLogger(__name__)
+
+# The ChatGPT backend (NOT api.openai.com). Read-only, non-billable.
+_USAGE_URL = "https://chatgpt.com/backend-api/wham/usage"
+# Identity endpoint for the creds-form-agnostic helper: the source of name/email
+# when there is no id_token to decode (opencode's openai-oauth stores only an
+# access token). Read-only.
+_ME_URL = "https://chatgpt.com/backend-api/me"
+# A real UA is REQUIRED -- chatgpt.com serves a Cloudflare HTML challenge to a
+# blank/curl User-Agent. Any real codex_cli_rs version string works.
+_USER_AGENT = "codex_cli_rs/0.142.5"
+_HTTP_TIMEOUT_S = 15
+
+# id_token claim namespace carrying the ChatGPT identity block.
+_AUTH_CLAIM = "https://api.openai.com/auth"
+
+# Live-workdir credentials (isolated HOME) -- the same file codex itself writes,
+# still on disk at capture time (pre-cleanup). Mirrors verify._AUTH_RELPATH.
+_AUTH_RELPATH = "home/.codex/auth.json"
+
+# Prettify the well-known plan tokens; unknown tokens pass through title-cased.
+# Only ``free`` is confirmed against a live seed; paid spellings are from codex
+# source (chatgpt_plan_type) and want a paid-seed confirmation.
+_PLAN_NAMES = {
+    "free": "Free",
+    "plus": "ChatGPT Plus",
+    "pro": "ChatGPT Pro",
+    "team": "ChatGPT Team",
+    "business": "ChatGPT Business",
+    "enterprise": "ChatGPT Enterprise",
+    "edu": "ChatGPT Edu",
+}
+
+
+# --- synchronous HTTP (run in an executor; no host, no codex) ----------------
+
+
+def _usage_sync(access_token: str, account_id: str) -> "dict | None":
+    """GET the wham/usage window source. Fail-soft -> None on any error."""
+    req = urllib.request.Request(
+        _USAGE_URL,
+        headers={
+            "Authorization": f"Bearer {access_token}",
+            "ChatGPT-Account-Id": account_id,
+            "User-Agent": _USER_AGENT,
+            "Accept": "application/json",
+        },
+        method="GET",
+    )
+    try:
+        with urllib.request.urlopen(req, timeout=_HTTP_TIMEOUT_S) as resp:
+            return json.loads(resp.read().decode("utf-8"))
+    except (HTTPError, URLError, OSError, ValueError):
+        return None
+
+
+async def _fetch_usage(access_token: str, account_id: str) -> "dict | None":
+    """Async wrapper around the sync wham/usage fetcher (executor)."""
+    return await asyncio.get_event_loop().run_in_executor(
+        None, _usage_sync, access_token, account_id
+    )
+
+
+def _me_sync(access_token: str, account_id: "str | None") -> "dict | None":
+    """GET /backend-api/me for the ChatGPT identity (name/email). Fail-soft ->
+    None on any error. ``ChatGPT-Account-Id`` is sent when known (mirrors the
+    wham/usage call)."""
+    headers = {
+        "Authorization": f"Bearer {access_token}",
+        "User-Agent": _USER_AGENT,
+        "Accept": "application/json",
+    }
+    if isinstance(account_id, str) and account_id:
+        headers["ChatGPT-Account-Id"] = account_id
+    req = urllib.request.Request(_ME_URL, headers=headers, method="GET")
+    try:
+        with urllib.request.urlopen(req, timeout=_HTTP_TIMEOUT_S) as resp:
+            return json.loads(resp.read().decode("utf-8"))
+    except (HTTPError, URLError, OSError, ValueError):
+        return None
+
+
+async def _fetch_me(access_token: str, account_id: "str | None") -> "dict | None":
+    """Async wrapper around the sync /backend-api/me fetcher (executor)."""
+    return await asyncio.get_event_loop().run_in_executor(
+        None, _me_sync, access_token, account_id
+    )
+
+
+# --- offline id_token decode -------------------------------------------------
+
+
+def _decode_id_token(id_token) -> dict:
+    """Decode the JWT id_token's claims OFFLINE (b64url the middle segment; no
+    signature check, no network). Returns ``{}`` on any malformation -- never
+    raises -- so a bad id_token degrades to the usage-only identity path."""
+    if not isinstance(id_token, str) or id_token.count(".") < 2:
+        return {}
+    payload = id_token.split(".")[1]
+    payload += "=" * (-len(payload) % 4)  # restore b64url padding
+    try:
+        claims = json.loads(base64.urlsafe_b64decode(payload).decode("utf-8"))
+    except (binascii.Error, ValueError, UnicodeDecodeError):
+        return {}
+    return claims if isinstance(claims, dict) else {}
+
+
+# --- normalized AccountInfo mapping -----------------------------------------
+
+
+def _format_plan(plan_type) -> "str | None":
+    """``chatgpt_plan_type`` -> display name. ``free`` -> ``"Free"``; unknown
+    tokens title-case with ``_`` -> space. None when absent."""
+    if not isinstance(plan_type, str) or not plan_type.strip():
+        return None
+    key = plan_type.strip().lower()
+    return _PLAN_NAMES.get(key, plan_type.replace("_", " ").title())
+
+
+def _reset_at(window: dict) -> "datetime | None":
+    """Absolute reset time. Prefer ``reset_at`` (unix epoch seconds); fall back
+    to ``now + reset_after_seconds`` (relative). None if neither is present."""
+    ra = window.get("reset_at")
+    if isinstance(ra, (int, float)):
+        try:
+            return datetime.fromtimestamp(ra, tz=timezone.utc)
+        except (ValueError, OSError, OverflowError):
+            pass
+    ras = window.get("reset_after_seconds")
+    if isinstance(ras, (int, float)):
+        return datetime.now(timezone.utc) + timedelta(seconds=ras)
+    return None
+
+
+def _window_from(label: str, window, *, model: "str | None" = None) -> "UsageWindow | None":
+    """One vendor window dict -> UsageWindow. None when the dict is null/absent
+    or carries no ``used_percent``."""
+    if not isinstance(window, dict):
+        return None
+    pct = window.get("used_percent")
+    if not isinstance(pct, (int, float)):
+        return None
+    return UsageWindow(
+        label=label, pct=float(pct), resets_at=_reset_at(window), model=model
+    )
+
+
+def _windows_from_usage(usage: dict) -> list[UsageWindow]:
+    """Build windows from ``usage.rate_limit``. Global windows (primary /
+    secondary / code_review) carry ``model=None``; ``additional_rate_limits[]``
+    are per-model (``model`` set from the entry). Null windows are skipped."""
+    rl = usage.get("rate_limit")
+    if not isinstance(rl, dict):
+        return []
+    out: list[UsageWindow] = []
+    for label, key in (("primary", "primary_window"), ("secondary", "secondary_window")):
+        w = _window_from(label, rl.get(key))
+        if w is not None:
+            out.append(w)
+    crl = _window_from("code_review", rl.get("code_review_rate_limit"))
+    if crl is not None:
+        out.append(crl)
+    additional = rl.get("additional_rate_limits")
+    if isinstance(additional, list):
+        for entry in additional:
+            if not isinstance(entry, dict):
+                continue
+            label = entry.get("name") or entry.get("id") or entry.get("label") or "additional"
+            model = entry.get("model") or entry.get("model_id") or entry.get("name")
+            w = _window_from(str(label), entry, model=model)
+            if w is not None:
+                out.append(w)
+    return out
+
+
+def _info_from(claims: dict, usage: "dict | None", account_id: "str | None") -> AccountInfo:
+    auth = claims.get(_AUTH_CLAIM)
+    if not isinstance(auth, dict):
+        auth = {}
+    u = usage or {}
+    plan = _format_plan(u.get("plan_type")) or _format_plan(auth.get("chatgpt_plan_type"))
+    return AccountInfo(
+        name=claims.get("name") or None,
+        email=u.get("email") or claims.get("email") or None,
+        plan=plan,
+        # The account uuid: creds.account_id (== id_token chatgpt_account_id).
+        # NOT usage.account_id (that field is the user-id string).
+        account_id=account_id or auth.get("chatgpt_account_id") or None,
+        windows=tuple(_windows_from_usage(u)),
+        raw={"usage": usage, "id_token": claims},
+    )
+
+
+def _info_from_me(me: "dict | None", usage: "dict | None", account_id: "str | None") -> AccountInfo:
+    """Map the ``/backend-api/me`` identity + ``wham/usage`` windows into an
+    AccountInfo. Identity (name/email) comes from ``me`` (there is no id_token to
+    decode); the plan comes from the live usage payload."""
+    m = me or {}
+    u = usage or {}
+    return AccountInfo(
+        name=m.get("name") or None,
+        email=m.get("email") or u.get("email") or None,
+        plan=_format_plan(u.get("plan_type")),
+        account_id=account_id or None,
+        windows=tuple(_windows_from_usage(u)),
+        raw={"me": me, "usage": usage},
+    )
+
+
+async def account_from_openai(access_token: str, account_id: "str | None") -> AccountInfo:
+    """Reusable, creds-form-agnostic OpenAI/ChatGPT account map: a bare access
+    token (+ optional ChatGPT account uuid) in, a normalized ``AccountInfo`` out.
+    Identity is fetched from ``GET /backend-api/me`` (NOT an id_token — opencode's
+    openai-oauth stores only the access token); usage windows come from the
+    read-only wham/usage GET (needs the account uuid for the required header).
+    Never raises -> ``EMPTY`` on any failure."""
+    try:
+        if not isinstance(access_token, str) or not access_token:
+            return EMPTY
+        me = await _fetch_me(access_token, account_id)
+        usage = None
+        if isinstance(account_id, str) and account_id:
+            usage = await _fetch_usage(access_token, account_id)
+        return _info_from_me(
+            me if isinstance(me, dict) else None,
+            usage if isinstance(usage, dict) else None,
+            account_id,
+        )
+    except Exception:  # noqa: BLE001 -- fail-soft, never disturbs the caller
+        return EMPTY
+
+
+async def analyze_account(creds) -> AccountInfo:
+    """Best-effort codex ``AccountInfo`` from the live ``auth.json`` tokens dict
+    (``{id_token, access_token, account_id}``). Identity is decoded offline from
+    the id_token; usage windows come from a read-only wham/usage GET. Never
+    raises -> ``EMPTY`` on any failure."""
+    try:
+        if not isinstance(creds, dict):
+            return EMPTY
+        claims = _decode_id_token(creds.get("id_token"))
+        access = creds.get("access_token")
+        account_id = creds.get("account_id")
+        usage = None
+        if isinstance(access, str) and access and isinstance(account_id, str) and account_id:
+            usage = await _fetch_usage(access, account_id)
+        return _info_from(claims, usage if isinstance(usage, dict) else None, account_id)
+    except Exception:  # noqa: BLE001 -- fail-soft, never disturbs the caller
+        return EMPTY
+
+
+async def resolve_capture_account(host) -> AccountInfo:
+    """Live-host capture variant: read the isolated HOME's ``auth.json`` tokens,
+    then ``analyze_account``. Fail-soft -> ``EMPTY`` on any failure (no auth
+    file, no tokens, analysis error).
+
+    No token refresh: the operator just authed, so the token is fresh; an
+    expired/invalid token simply yields ``EMPTY`` (analysis fail-soft)."""
+    path = f"{host.workdir.rstrip('/')}/{_AUTH_RELPATH}"
+    try:
+        raw = await host.fetch_bytes_from_host(path)
+        data = json.loads(raw.decode("utf-8"))
+        tokens = data.get("tokens")
+    except Exception:  # noqa: BLE001 -- missing/unreadable/malformed auth -> EMPTY
+        return EMPTY
+    if not isinstance(tokens, dict):
+        return EMPTY
+    return await analyze_account(tokens)

{optio_codex-0.3.0 → optio_codex-0.4.1}/src/optio_codex/conversation.py

@@ -101,6 +101,7 @@ from optio_agents.conversation import (
     PermissionRequest,
 )
 from optio_codex import models as codex_models
+from optio_codex import rollout as codex_rollout
 from optio_codex.info import AGENT_INFO
 
 _LOG = logging.getLogger(__name__)
@@ -259,6 +260,17 @@ class CodexConversation:
         # backfill into on_event after the listener subscribes. thread/start has
         # no prior turns → [].
         self._resume_turns = thread.get("turns") or []
+        if self._resume_thread_id is not None:
+            # Diagnostic: how much history thread/resume actually returned. codex
+            # compacts context on long conversations, so a resume may hand back
+            # TRUNCATED turns — this INFO line lets the next resume confirm
+            # whether that happened (the rollout on disk stays the full-history
+            # source of truth for the fresh-attach replay).
+            total_items = sum(len(t.get("items") or []) for t in self._resume_turns)
+            _LOG.info(
+                "codex thread/resume: %d turns, %d items for thread %s",
+                len(self._resume_turns), total_items, self.thread_id,
+            )
 
     async def replay_history(self) -> int:
         """Backfill on_event with the RESUMED thread's prior turns.
@@ -286,15 +298,19 @@ class CodexConversation:
         for turn in self._resume_turns:
             turn_id = turn.get("id")
             for item in turn.get("items") or []:
-                await self._emit_event({"method": "item/completed", "params": {
-                    "threadId": self.thread_id, "turnId": turn_id, "item": item}})
+                # Build the wire envelope through the SAME helper the rollout
+                # history path uses (optio_codex.rollout) so the two
+                # reconstructions cannot drift.
+                await self._emit_event(
+                    codex_rollout.item_completed_event(self.thread_id, turn_id, item)
+                )
                 count += 1
             # Close this historic turn's bubble and open the next's — a live
             # multi-turn stream ends every turn with turn/completed, so replay
             # must too (else the reducer coalesces all turns into one bubble).
-            await self._emit_event({"method": "turn/completed", "params": {
-                "threadId": self.thread_id,
-                "turn": {"id": turn_id, "status": "completed"}}})
+            await self._emit_event(
+                codex_rollout.turn_completed_event(self.thread_id, turn_id)
+            )
             count += 1
         return count
 

{optio_codex-0.3.0 → optio_codex-0.4.1}/src/optio_codex/conversation_listener.py

@@ -36,6 +36,8 @@ from aiohttp import web
 
 from optio_agents.conversation import ConversationClosed, PermissionDecision
 
+from optio_codex import rollout as _rollout
+
 _LOG = logging.getLogger(__name__)
 
 BUFFER_MAXLEN = 1000
@@ -48,16 +50,42 @@ SHUTDOWN_TIMEOUT_S = 2.0
 _STOP = object()
 
 
+def _event_turn_id(event: dict) -> str | None:
+    """The codex turn id an event belongs to, or None (synthetic/handshake
+    events carry no turn). Used to dedup live-buffer events against the rollout
+    history on a fresh attach — the rollout records the SAME turn ids the live
+    wire uses (verified: response_item.internal_chat_message_metadata_passthrough
+    .turn_id == the app-server turn id)."""
+    params = event.get("params")
+    if not isinstance(params, dict):
+        return None
+    turn = params.get("turn")
+    if isinstance(turn, dict) and turn.get("id"):
+        return turn["id"]          # turn/started, turn/completed
+    return params.get("turnId")    # item/*, requestApproval, deltas
+
+
 class ConversationListener:
     def __init__(
         self, conversation, *, password: str,
         download_reader: "Callable[[str], Awaitable[tuple[bytes, str]]] | None" = None,
         max_download_bytes: int = 10_000_000,
+        host=None,
+        codex_home: str | None = None,
     ) -> None:
         self._conversation = conversation
         self._password = password
         self._download_reader = download_reader
         self._max_download_bytes = max_download_bytes
+        # The Host (local or SSH worker) the codex session runs on — rollout
+        # discovery + reads route through it (host.glob / fetch_bytes_from_host),
+        # never a bare local open(), so full-history replay works for remote
+        # workers too. None ⇒ no rollout replay (buffer-only, as before).
+        self._host = host
+        # CODEX_HOME (=<workdir>/home/.codex) — the on-disk rollout store that is
+        # the AUTHORITATIVE full history a fresh viewer attach replays before the
+        # in-flight live tail. None ⇒ no rollout replay (buffer-only, as before).
+        self._codex_home = codex_home
         self._buffer: deque[tuple[int, dict]] = deque(maxlen=BUFFER_MAXLEN)
         self._seq = 0
         self._subscribers: set[asyncio.Queue] = set()
@@ -99,6 +127,32 @@ class ConversationListener:
         })
         return decision
 
+    # -- rollout history -----------------------------------------------------
+
+    async def _load_history(self) -> "tuple[list[dict], set[str]]":
+        """Reconstruct the FULL conversation from the on-disk rollout, and the
+        set of turn ids it covers (the dedup key for the live buffer).
+
+        Discovery + read route through the HOST abstraction (host.glob +
+        fetch_bytes_from_host) so it works for a remote SSH worker, not just a
+        local workdir. Fail-soft by contract: any error (no host/codex_home, no
+        rollout, an unreadable/malformed file) yields ``([], set())`` so a fresh
+        attach silently falls back to buffer-only replay — NEVER raises into the
+        SSE handler."""
+        if not self._codex_home or self._host is None:
+            return [], set()
+        try:
+            path = await _rollout.resolve_latest_rollout(self._host, self._codex_home)
+            if path is None:
+                return [], set()
+            data = await self._host.fetch_bytes_from_host(path)
+            events = _rollout.parse_rollout_events(data.decode("utf-8", "replace"))
+        except Exception:  # noqa: BLE001 — attach must never fail on the rollout
+            _LOG.exception("rollout history reconstruction failed; buffer only")
+            return [], set()
+        turn_ids = {t for e in events if (t := _event_turn_id(e)) is not None}
+        return events, turn_ids
+
     # -- HTTP handlers -------------------------------------------------------
 
     def _authorized(self, request: web.Request) -> bool:
@@ -137,10 +191,38 @@ class ConversationListener:
         self._subscribers.add(queue)
         try:
             sent_through = last_id
-            for seq, event in list(self._buffer):
-                if seq > sent_through:
-                    await send_item(seq, event)
-                    sent_through = seq
+            if last_id == 0:
+                # FRESH attach: replay the FULL history from the on-disk rollout
+                # (authoritative — the bounded buffer deque has evicted early
+                # turns on a long session), THEN the in-flight turn from the live
+                # buffer, deduped against the rollout by turnId.
+                #
+                # SSE-id scheme: history events get ids -N..-1 (a reserved range
+                # strictly below every live seq, which start at 1). They are
+                # per-attach ephemeral — NOT stored in self._buffer and they do
+                # NOT advance self._seq, so live Last-Event-ID resumption is
+                # untouched. A client that saw only history and reconnects sends
+                # a negative Last-Event-ID; ``raw_last.isdigit()`` is False for
+                # it, so last_id falls back to 0 and the full history replays
+                # again (idempotent). A client that reached the live tail sends a
+                # positive id, taking the reconnect branch below (no rollout).
+                history, hist_turn_ids = await self._load_history()
+                hid = -len(history)
+                for event in history:
+                    await send_item(hid, event)
+                    hid += 1
+                for seq, event in list(self._buffer):
+                    # Skip buffered events for turns the rollout already covers;
+                    # keep the in-flight turn (and any turn not yet flushed to
+                    # the rollout) plus synthetic events (no turnId).
+                    if _event_turn_id(event) not in hist_turn_ids:
+                        await send_item(seq, event)
+                    sent_through = seq  # buffer is seq-ordered; advance past all
+            else:
+                for seq, event in list(self._buffer):
+                    if seq > sent_through:
+                        await send_item(seq, event)
+                        sent_through = seq
             while True:
                 try:
                     item = await asyncio.wait_for(