|
1
|
+ |
defmodule OpenAgents.SCV.CodexLogin do
|
|
2
|
+ |
@moduledoc "Runs one bounded operator-initiated Codex device-login ceremony."
|
|
3
|
+ |
|
|
4
|
+ |
use GenServer, restart: :temporary
|
|
5
|
+ |
|
|
6
|
+ |
alias OpenAgents.SCV.CodexAccounts
|
|
7
|
+ |
alias OpenAgents.SCV.CodexAppServer
|
|
8
|
+ |
alias OpenAgents.SCV.CodexCredentialStore
|
|
9
|
+ |
|
|
10
|
+ |
@required_model "gpt-5.6-luna"
|
|
11
|
+ |
@maximum_auth_bytes 65_536
|
|
12
|
+ |
|
|
13
|
+ |
def child_spec(options) do
|
|
14
|
+ |
attempt = Keyword.fetch!(options, :attempt)
|
|
15
|
+ |
|
|
16
|
+ |
%{
|
|
17
|
+ |
id: {__MODULE__, attempt.id},
|
|
18
|
+ |
start: {__MODULE__, :start_link, [options]},
|
|
19
|
+ |
restart: :temporary
|
|
20
|
+ |
}
|
|
21
|
+ |
end
|
|
22
|
+ |
|
|
23
|
+ |
def start_link(options) do
|
|
24
|
+ |
attempt = Keyword.fetch!(options, :attempt)
|
|
25
|
+ |
name = {:via, Registry, {OpenAgents.SCV.CodexLoginRegistry, attempt.id}}
|
|
26
|
+ |
GenServer.start_link(__MODULE__, options, name: name)
|
|
27
|
+ |
end
|
|
28
|
+ |
|
|
29
|
+ |
@spec begin(pid()) :: {:ok, map()} | {:error, atom()}
|
|
30
|
+ |
def begin(server), do: GenServer.call(server, :begin, 30_000)
|
|
31
|
+ |
|
|
32
|
+ |
@spec snapshot(pid()) :: {:ok, map()} | {:error, atom()}
|
|
33
|
+ |
def snapshot(server), do: GenServer.call(server, :snapshot)
|
|
34
|
+ |
|
|
35
|
+ |
@spec cancel(pid()) :: :ok | {:error, atom()}
|
|
36
|
+ |
def cancel(server), do: GenServer.call(server, :cancel, 15_000)
|
|
37
|
+ |
|
|
38
|
+ |
@impl true
|
|
39
|
+ |
def init(options) do
|
|
40
|
+ |
account = Keyword.fetch!(options, :account)
|
|
41
|
+ |
attempt = Keyword.fetch!(options, :attempt)
|
|
42
|
+ |
root = temporary_home(attempt.id)
|
|
43
|
+ |
|
|
44
|
+ |
with :ok <- File.mkdir_p(root),
|
|
45
|
+ |
:ok <- File.chmod(root, 0o700),
|
|
46
|
+ |
:ok <- write_config(root) do
|
|
47
|
+ |
{:ok,
|
|
48
|
+ |
%{
|
|
49
|
+ |
account: account,
|
|
50
|
+ |
app_server: nil,
|
|
51
|
+ |
attempt: attempt,
|
|
52
|
+ |
ceremony: nil,
|
|
53
|
+ |
codex_home: root,
|
|
54
|
+ |
expiry_timer: nil,
|
|
55
|
+ |
login_id: nil
|
|
56
|
+ |
}}
|
|
57
|
+ |
else
|
|
58
|
+ |
_error -> {:stop, :login_home_failed}
|
|
59
|
+ |
end
|
|
60
|
+ |
end
|
|
61
|
+ |
|
|
62
|
+ |
@impl true
|
|
63
|
+ |
def handle_call(:begin, _from, %{app_server: nil} = state) do
|
|
64
|
+ |
case begin_login(state) do
|
|
65
|
+ |
{:ok, updated} ->
|
|
66
|
+ |
{:reply, {:ok, updated.ceremony}, updated}
|
|
67
|
+ |
|
|
68
|
+ |
{:error, code, updated} ->
|
|
69
|
+ |
CodexAccounts.mark_failed(updated.account, updated.attempt, code)
|
|
70
|
+ |
{:stop, :normal, {:error, code}, updated}
|
|
71
|
+ |
end
|
|
72
|
+ |
end
|
|
73
|
+ |
|
|
74
|
+ |
def handle_call(:begin, _from, state), do: {:reply, snapshot_response(state), state}
|
|
75
|
+ |
def handle_call(:snapshot, _from, state), do: {:reply, snapshot_response(state), state}
|
|
76
|
+ |
|
|
77
|
+ |
def handle_call(:cancel, _from, %{login_id: login_id, app_server: client} = state)
|
|
78
|
+ |
when is_binary(login_id) and is_pid(client) do
|
|
79
|
+ |
_result =
|
|
80
|
+ |
CodexAppServer.request(client, "account/login/cancel", %{"loginId" => login_id})
|
|
81
|
+ |
|
|
82
|
+ |
CodexAccounts.mark_cancelled(state.account, state.attempt)
|
|
83
|
+ |
{:stop, :normal, :ok, state}
|
|
84
|
+ |
end
|
|
85
|
+ |
|
|
86
|
+ |
def handle_call(:cancel, _from, state) do
|
|
87
|
+ |
CodexAccounts.mark_cancelled(state.account, state.attempt)
|
|
88
|
+ |
{:stop, :normal, :ok, state}
|
|
89
|
+ |
end
|
|
90
|
+ |
|
|
91
|
+ |
@impl true
|
|
92
|
+ |
def handle_info(
|
|
93
|
+ |
{:codex_app_server, client,
|
|
94
|
+ |
{:notification,
|
|
95
|
+ |
%{
|
|
96
|
+ |
"method" => "account/login/completed",
|
|
97
|
+ |
"params" => %{"loginId" => login_id, "success" => true}
|
|
98
|
+ |
}}},
|
|
99
|
+ |
%{app_server: client, login_id: login_id} = state
|
|
100
|
+ |
) do
|
|
101
|
+ |
case complete_login(state) do
|
|
102
|
+ |
{:ok, updated} ->
|
|
103
|
+ |
{:stop, :normal, updated}
|
|
104
|
+ |
|
|
105
|
+ |
{:error, code, updated} ->
|
|
106
|
+ |
CodexAccounts.mark_failed(updated.account, updated.attempt, code)
|
|
107
|
+ |
{:stop, :normal, updated}
|
|
108
|
+ |
end
|
|
109
|
+ |
end
|
|
110
|
+ |
|
|
111
|
+ |
def handle_info(
|
|
112
|
+ |
{:codex_app_server, client,
|
|
113
|
+ |
{:notification,
|
|
114
|
+ |
%{
|
|
115
|
+ |
"method" => "account/login/completed",
|
|
116
|
+ |
"params" => %{"loginId" => login_id, "success" => false} = params
|
|
117
|
+ |
}}},
|
|
118
|
+ |
%{app_server: client, login_id: login_id} = state
|
|
119
|
+ |
) do
|
|
120
|
+ |
code = if is_binary(params["error"]), do: params["error"], else: "login_failed"
|
|
121
|
+ |
CodexAccounts.mark_failed(state.account, state.attempt, code)
|
|
122
|
+ |
{:stop, :normal, state}
|
|
123
|
+ |
end
|
|
124
|
+ |
|
|
125
|
+ |
def handle_info(:expire, state) do
|
|
126
|
+ |
if is_pid(state.app_server) and is_binary(state.login_id) do
|
|
127
|
+ |
_result =
|
|
128
|
+ |
CodexAppServer.request(
|
|
129
|
+ |
state.app_server,
|
|
130
|
+ |
"account/login/cancel",
|
|
131
|
+ |
%{"loginId" => state.login_id}
|
|
132
|
+ |
)
|
|
133
|
+ |
end
|
|
134
|
+ |
|
|
135
|
+ |
CodexAccounts.mark_failed(state.account, state.attempt, "login_expired")
|
|
136
|
+ |
{:stop, :normal, state}
|
|
137
|
+ |
end
|
|
138
|
+ |
|
|
139
|
+ |
def handle_info({:codex_app_server, client, {:exited, _status}}, %{app_server: client} = state) do
|
|
140
|
+ |
CodexAccounts.mark_failed(state.account, state.attempt, "app_server_exited")
|
|
141
|
+ |
{:stop, :normal, state}
|
|
142
|
+ |
end
|
|
143
|
+ |
|
|
144
|
+ |
def handle_info(
|
|
145
|
+ |
{:codex_app_server, client, {:protocol_error, reason}},
|
|
146
|
+ |
%{app_server: client} = state
|
|
147
|
+ |
) do
|
|
148
|
+ |
CodexAccounts.mark_failed(state.account, state.attempt, reason)
|
|
149
|
+ |
{:stop, :normal, state}
|
|
150
|
+ |
end
|
|
151
|
+ |
|
|
152
|
+ |
def handle_info({:codex_app_server, _client, _message}, state), do: {:noreply, state}
|
|
153
|
+ |
def handle_info(_message, state), do: {:noreply, state}
|
|
154
|
+ |
|
|
155
|
+ |
@impl true
|
|
156
|
+ |
def terminate(_reason, state) do
|
|
157
|
+ |
if is_reference(state.expiry_timer), do: Process.cancel_timer(state.expiry_timer)
|
|
158
|
+ |
if is_pid(state.app_server), do: CodexAppServer.stop(state.app_server)
|
|
159
|
+ |
File.rm_rf(state.codex_home)
|
|
160
|
+ |
:ok
|
|
161
|
+ |
end
|
|
162
|
+ |
|
|
163
|
+ |
defp begin_login(state) do
|
|
164
|
+ |
config = config()
|
|
165
|
+ |
executable = Keyword.fetch!(config, :executable)
|
|
166
|
+ |
client_options = Keyword.get(config, :client_options, [])
|
|
167
|
+ |
|
|
168
|
+ |
with {:ok, client} <-
|
|
169
|
+ |
CodexAppServer.start_link(
|
|
170
|
+ |
[owner: self(), executable: executable, codex_home: state.codex_home] ++
|
|
171
|
+ |
client_options
|
|
172
|
+ |
),
|
|
173
|
+ |
{:ok, _initialization} <- initialize(client),
|
|
174
|
+ |
:ok <- CodexAppServer.notify(client, "initialized"),
|
|
175
|
+ |
{:ok,
|
|
176
|
+ |
%{
|
|
177
|
+ |
"type" => "chatgptDeviceCode",
|
|
178
|
+ |
"loginId" => login_id,
|
|
179
|
+ |
"verificationUrl" => verification_url,
|
|
180
|
+ |
"userCode" => user_code
|
|
181
|
+ |
}} <-
|
|
182
|
+ |
CodexAppServer.request(client, "account/login/start", %{
|
|
183
|
+ |
"type" => "chatgptDeviceCode"
|
|
184
|
+ |
}),
|
|
185
|
+ |
:ok <- validate_login_response(login_id, verification_url, user_code),
|
|
186
|
+ |
{:ok, attempt} <-
|
|
187
|
+ |
CodexAccounts.mark_waiting(
|
|
188
|
+ |
state.attempt,
|
|
189
|
+ |
login_id,
|
|
190
|
+ |
verification_url,
|
|
191
|
+ |
user_code
|
|
192
|
+ |
) do
|
|
193
|
+ |
expires_in_ms = max(DateTime.diff(attempt.expires_at, DateTime.utc_now(), :millisecond), 1)
|
|
194
|
+ |
timer = Process.send_after(self(), :expire, expires_in_ms)
|
|
195
|
+ |
|
|
196
|
+ |
ceremony = %{
|
|
197
|
+ |
account_id: state.account.id,
|
|
198
|
+ |
attempt_id: attempt.id,
|
|
199
|
+ |
expires_at: attempt.expires_at,
|
|
200
|
+ |
user_code: user_code,
|
|
201
|
+ |
verification_url: verification_url
|
|
202
|
+ |
}
|
|
203
|
+ |
|
|
204
|
+ |
{:ok,
|
|
205
|
+ |
%{
|
|
206
|
+ |
state
|
|
207
|
+ |
| app_server: client,
|
|
208
|
+ |
attempt: attempt,
|
|
209
|
+ |
ceremony: ceremony,
|
|
210
|
+ |
expiry_timer: timer,
|
|
211
|
+ |
login_id: login_id
|
|
212
|
+ |
}}
|
|
213
|
+ |
else
|
|
214
|
+ |
{:error, reason} -> {:error, error_code(reason), state}
|
|
215
|
+ |
_invalid -> {:error, :login_protocol_invalid, state}
|
|
216
|
+ |
end
|
|
217
|
+ |
end
|
|
218
|
+ |
|
|
219
|
+ |
defp initialize(client) do
|
|
220
|
+ |
CodexAppServer.request(client, "initialize", %{
|
|
221
|
+ |
"clientInfo" => %{
|
|
222
|
+ |
"name" => "openagents_scv",
|
|
223
|
+ |
"title" => "OpenAgents SCV",
|
|
224
|
+ |
"version" => Application.get_env(:openagents, :build_revision, "image")
|
|
225
|
+ |
},
|
|
226
|
+ |
"capabilities" => %{"experimentalApi" => false}
|
|
227
|
+ |
})
|
|
228
|
+ |
end
|
|
229
|
+ |
|
|
230
|
+ |
defp complete_login(state) do
|
|
231
|
+ |
with {:ok, account_response} <-
|
|
232
|
+ |
CodexAppServer.request(state.app_server, "account/read", %{"refreshToken" => false}),
|
|
233
|
+ |
{:ok, account_metadata} <- account_metadata(account_response),
|
|
234
|
+ |
{:ok, model_response} <-
|
|
235
|
+ |
CodexAppServer.request(state.app_server, "model/list", %{
|
|
236
|
+ |
"includeHidden" => true,
|
|
237
|
+ |
"limit" => 100
|
|
238
|
+ |
}),
|
|
239
|
+ |
{:ok, model_metadata} <- model_metadata(model_response),
|
|
240
|
+ |
{:ok, _rate_limits} <-
|
|
241
|
+ |
CodexAppServer.request(state.app_server, "account/rateLimits/read", %{}),
|
|
242
|
+ |
{:ok, auth_json} <- read_auth_json(state.codex_home),
|
|
243
|
+ |
{:ok, version} <- CodexCredentialStore.put(state.account, auth_json),
|
|
244
|
+ |
{:ok, account} <-
|
|
245
|
+ |
CodexAccounts.mark_ready(state.account, state.attempt, %{
|
|
246
|
+ |
credential_version: version,
|
|
247
|
+ |
account_email: account_metadata.email,
|
|
248
|
+ |
plan_type: account_metadata.plan_type,
|
|
249
|
+ |
available_models: model_metadata.models,
|
|
250
|
+ |
reasoning_efforts: model_metadata.reasoning_efforts,
|
|
251
|
+ |
last_verified_at: DateTime.utc_now()
|
|
252
|
+ |
}) do
|
|
253
|
+ |
{:ok, %{state | account: account}}
|
|
254
|
+ |
else
|
|
255
|
+ |
{:error, reason} -> {:error, error_code(reason), state}
|
|
256
|
+ |
_invalid -> {:error, :login_completion_invalid, state}
|
|
257
|
+ |
end
|
|
258
|
+ |
end
|
|
259
|
+ |
|
|
260
|
+ |
defp account_metadata(%{
|
|
261
|
+ |
"account" => %{"type" => "chatgpt", "planType" => plan_type} = account
|
|
262
|
+ |
})
|
|
263
|
+ |
when is_binary(plan_type) do
|
|
264
|
+ |
email = if is_binary(account["email"]), do: account["email"], else: nil
|
|
265
|
+ |
{:ok, %{email: email, plan_type: plan_type}}
|
|
266
|
+ |
end
|
|
267
|
+ |
|
|
268
|
+ |
defp account_metadata(_response), do: {:error, :chatgpt_account_required}
|
|
269
|
+ |
|
|
270
|
+ |
defp model_metadata(%{"data" => models}) when is_list(models) do
|
|
271
|
+ |
admitted =
|
|
272
|
+ |
Enum.filter(models, fn model ->
|
|
273
|
+ |
model["id"] == @required_model or model["model"] == @required_model
|
|
274
|
+ |
end)
|
|
275
|
+ |
|
|
276
|
+ |
if admitted == [] do
|
|
277
|
+ |
{:error, :required_model_unavailable}
|
|
278
|
+ |
else
|
|
279
|
+ |
model_ids =
|
|
280
|
+ |
models
|
|
281
|
+ |
|> Enum.map(&(&1["id"] || &1["model"]))
|
|
282
|
+ |
|> Enum.filter(&is_binary/1)
|
|
283
|
+ |
|> Enum.uniq()
|
|
284
|
+ |
|
|
285
|
+ |
reasoning_efforts =
|
|
286
|
+ |
admitted
|
|
287
|
+ |
|> Enum.flat_map(&Map.get(&1, "supportedReasoningEfforts", []))
|
|
288
|
+ |
|> Enum.map(fn option -> option["reasoningEffort"] end)
|
|
289
|
+ |
|> Enum.filter(&(&1 in ["none", "low"]))
|
|
290
|
+ |
|> Enum.uniq()
|
|
291
|
+ |
|
|
292
|
+ |
if reasoning_efforts == [] do
|
|
293
|
+ |
{:error, :required_reasoning_effort_unavailable}
|
|
294
|
+ |
else
|
|
295
|
+ |
{:ok, %{models: model_ids, reasoning_efforts: reasoning_efforts}}
|
|
296
|
+ |
end
|
|
297
|
+ |
end
|
|
298
|
+ |
end
|
|
299
|
+ |
|
|
300
|
+ |
defp model_metadata(_response), do: {:error, :model_catalog_invalid}
|
|
301
|
+ |
|
|
302
|
+ |
defp read_auth_json(codex_home) do
|
|
303
|
+ |
path = Path.join(codex_home, "auth.json")
|
|
304
|
+ |
|
|
305
|
+ |
with {:ok, contents} when byte_size(contents) in 2..@maximum_auth_bytes <- File.read(path),
|
|
306
|
+ |
{:ok, decoded} when is_map(decoded) <- Jason.decode(contents) do
|
|
307
|
+ |
{:ok, contents}
|
|
308
|
+ |
else
|
|
309
|
+ |
_invalid -> {:error, :auth_cache_invalid}
|
|
310
|
+ |
end
|
|
311
|
+ |
end
|
|
312
|
+ |
|
|
313
|
+ |
defp validate_login_response(login_id, verification_url, user_code)
|
|
314
|
+ |
when is_binary(login_id) and byte_size(login_id) in 1..128 and is_binary(user_code) and
|
|
315
|
+ |
byte_size(user_code) in 1..64 do
|
|
316
|
+ |
case URI.new(verification_url) do
|
|
317
|
+ |
{:ok, %URI{scheme: "https", host: "auth.openai.com", path: "/codex/device"}} -> :ok
|
|
318
|
+ |
_invalid -> {:error, :verification_url_invalid}
|
|
319
|
+ |
end
|
|
320
|
+ |
end
|
|
321
|
+ |
|
|
322
|
+ |
defp validate_login_response(_login_id, _verification_url, _user_code),
|
|
323
|
+ |
do: {:error, :login_protocol_invalid}
|
|
324
|
+ |
|
|
325
|
+ |
defp snapshot_response(%{ceremony: ceremony}) when is_map(ceremony), do: {:ok, ceremony}
|
|
326
|
+ |
defp snapshot_response(_state), do: {:error, :login_not_ready}
|
|
327
|
+ |
|
|
328
|
+ |
defp write_config(codex_home) do
|
|
329
|
+ |
path = Path.join(codex_home, "config.toml")
|
|
330
|
+ |
contents = "cli_auth_credentials_store = \"file\"\n"
|
|
331
|
+ |
|
|
332
|
+ |
with :ok <- File.write(path, contents, [:binary, :exclusive]),
|
|
333
|
+ |
:ok <- File.chmod(path, 0o600) do
|
|
334
|
+ |
:ok
|
|
335
|
+ |
end
|
|
336
|
+ |
end
|
|
337
|
+ |
|
|
338
|
+ |
defp temporary_home(attempt_id) do
|
|
339
|
+ |
root = Keyword.get(config(), :temporary_root, System.tmp_dir!())
|
|
340
|
+ |
Path.join(root, "openagents-scv-codex-login-#{attempt_id}")
|
|
341
|
+ |
end
|
|
342
|
+ |
|
|
343
|
+ |
defp error_code(reason) when is_atom(reason), do: reason
|
|
344
|
+ |
defp error_code(_reason), do: :login_failed
|
|
345
|
+ |
|
|
346
|
+ |
defp config, do: Application.fetch_env!(:openagents, :scv_codex)
|
|
347
|
+ |
end
|