eve
Version:
Filesystem-first framework for durable backend AI agents that run anywhere.
1 lines • 5.72 kB
JavaScript
import{z}from"#compiled/zod/index.js";import{join}from"node:path";import{readFile,writeFile}from"node:fs/promises";import{isObject}from"#shared/guards.js";import{toErrorMessage}from"#shared/errors.js";import{decodeJwt}from"#compiled/jose/index.js";import{homedir}from"node:os";const codexAuthTokensSchema=z.object({access_token:z.string().nullable().optional(),account_id:z.string().nullable().optional(),id_token:z.string().nullable().optional(),refresh_token:z.string().nullable().optional()}).passthrough(),codexAuthFileSchema=z.object({OPENAI_API_KEY:z.string().nullable().optional(),auth_mode:z.string().nullable().optional(),last_refresh:z.string().nullable().optional(),tokens:codexAuthTokensSchema.nullable().optional()}).passthrough();async function readCodexAuth(e={}){let r=e.codexHome??resolveDefaultCodexHome(),i=join(r,`auth.json`),o;try{o=await readFile(i,`utf8`)}catch(e){return e instanceof Error&&`code`in e&&e.code===`ENOENT`?{state:{kind:`missing`,authPath:i,codexHome:r}}:{state:{kind:`invalid`,authPath:i,codexHome:r,reason:toErrorMessage(e)}}}return parseCodexAuth(o,{authPath:i,codexHome:r})}async function readCodexAuthCredentials(e={}){let t=await readCodexAuth(e);if(t.credentials!==void 0)return t.credentials;throw assertCodexAuthStateAuthenticated(t.state),Error(`Codex login state at ${t.state.authPath} did not include usable credentials.`)}function parseCodexAuth(e,t){let n=parseCodexAuthFile(e);if(n.kind===`invalid`)return{state:{kind:`invalid`,authPath:t.authPath,codexHome:t.codexHome,reason:n.reason}};let r=selectCodexCredentials(n.value);return r.kind===`none`?{state:{kind:`missing`,authPath:t.authPath,codexHome:t.codexHome}}:r.kind===`api-key`?{state:{kind:`authenticated`,authMode:`api-key`,authPath:t.authPath,codexHome:t.codexHome},credentials:{kind:`api-key`,apiKey:r.apiKey,authPath:t.authPath,codexHome:t.codexHome}}:{state:{kind:`authenticated`,authMode:`chatgpt`,authPath:t.authPath,codexHome:t.codexHome,...r.accountId!==void 0&&{accountId:r.accountId},...r.lastRefresh!==void 0&&{lastRefresh:r.lastRefresh}},credentials:{kind:`chatgpt`,authPath:t.authPath,codexHome:t.codexHome,...r.accessToken!==void 0&&{accessToken:r.accessToken},...r.accountId!==void 0&&{accountId:r.accountId},...r.idToken!==void 0&&{idToken:r.idToken},...r.lastRefresh!==void 0&&{lastRefresh:r.lastRefresh},...r.refreshToken!==void 0&&{refreshToken:r.refreshToken}}}}function selectCodexCredentials(e){let t=readNonEmptyString(e.OPENAI_API_KEY),n=e.tokens??void 0,r=readNonEmptyString(n?.access_token),i=readNonEmptyString(n?.refresh_token),a=r!==void 0||i!==void 0,o=e.auth_mode===`api-key`&&t!==void 0;if(a&&!o){let t=readNonEmptyString(n?.account_id)??extractCodexAccountIdFromToken(readNonEmptyString(n?.id_token))??extractCodexAccountIdFromToken(r),a=readNonEmptyString(n?.id_token),o=readNonEmptyString(e.last_refresh);return{kind:`chatgpt`,...r!==void 0&&{accessToken:r},...t!==void 0&&{accountId:t},...a!==void 0&&{idToken:a},...o!==void 0&&{lastRefresh:o},...i!==void 0&&{refreshToken:i}}}return t===void 0?{kind:`none`}:{kind:`api-key`,apiKey:t}}function parseCodexAuthFile(e){let t;try{t=JSON.parse(e)}catch(e){return{kind:`invalid`,reason:toErrorMessage(e)}}let n=codexAuthFileSchema.safeParse(t);return n.success?{kind:`parsed`,value:n.data}:{kind:`invalid`,reason:`auth.json must match the Codex auth schema.`}}async function writeCodexAuthCredentials(e){let t=await readFile(e.credentials.authPath,`utf8`),a=JSON.parse(t);if(!isObject(a))throw Error(`Codex login state at ${e.credentials.authPath} must contain a JSON object.`);let o=isObject(a.tokens)?a.tokens:{},s=e.tokens.accountId??e.credentials.accountId??extractCodexAccountIdFromToken(e.tokens.idToken)??extractCodexAccountIdFromToken(e.tokens.accessToken),c=e.tokens.idToken??e.credentials.idToken,l=(e.now??(()=>new Date))().toISOString(),u={...a,auth_mode:`chatgpt`,tokens:{...o,access_token:e.tokens.accessToken,refresh_token:e.tokens.refreshToken,...s!==void 0&&{account_id:s},...c!==void 0&&{id_token:c}},last_refresh:l};return await writeFile(e.credentials.authPath,`${JSON.stringify(u,null,2)}\n`,`utf8`),{kind:`chatgpt`,accessToken:e.tokens.accessToken,authPath:e.credentials.authPath,codexHome:e.credentials.codexHome,lastRefresh:l,refreshToken:e.tokens.refreshToken,...s!==void 0&&{accountId:s},...c!==void 0&&{idToken:c}}}function assertCodexAuthStateAuthenticated(e){if(e.kind!==`authenticated`)throw e.kind===`missing`?Error(`Codex login state was not found at ${e.authPath}. Run \`codex login\` before using experimental_chatgpt.`):Error(`Codex login state at ${e.authPath} could not be read: ${e.reason}. Run \`codex login\` again before using experimental_chatgpt.`)}function resolveDefaultCodexHome(){return process.env.CODEX_HOME?.trim()||join(homedir(),`.codex`)}function readNonEmptyString(e){return typeof e==`string`&&e.trim()!==``?e:void 0}function readCodexJwtExpirationMs(e){let t=parseCodexJwtClaims(e);if(!(t===void 0||typeof t.exp!=`number`))return t.exp*1e3}function isFreshCodexAccessToken(e,t){if(e===void 0)return!1;let n=readCodexJwtExpirationMs(e);return n===void 0||n-6e4>t}function extractCodexAccountIdFromToken(e){let t=parseCodexJwtClaims(e);if(t===void 0)return;let n=t[`https://api.openai.com/auth`],r=t.organizations;return readNonEmptyString(t.chatgpt_account_id)??readNonEmptyString(isObject(n)?n.chatgpt_account_id:void 0)??readNonEmptyString(Array.isArray(r)&&isObject(r[0])?r[0].id:void 0)}function parseCodexJwtClaims(e){if(e!==void 0)try{return decodeJwt(e)}catch{return}}export{assertCodexAuthStateAuthenticated,extractCodexAccountIdFromToken,isFreshCodexAccessToken,parseCodexAuth,readCodexAuth,readCodexAuthCredentials,readCodexJwtExpirationMs,writeCodexAuthCredentials};