Lines 1-43javascript
2import{createInterface as Ic}from"node:readline/promises";import{spawnSync as We}from"node:child_process";import{stdin as Ro,stdout as Do}from"node:process";var jn="1.0.1";var Te=(e,t)=>{let n=e==null||e===""?NaN:Number(e);return Number.isFinite(n)?n:t},Xo=["read-only","workspace-write","danger-full-access"],qn=["cli","proxy"];function Ut(e,t,n,r){if(!t)return r;if(!n.includes(t))throw new Error(`${e} must be one of: ${n.join(" | ")} (got "${t}")`);return t}function Oe(e=process.env){return{version:jn,host:e.HOST??"127.0.0.1",port:Te(e.PORT,8787),apiKey:e.AGENT_PROXY_API_KEY??"",messagesBacken ...
3`)}var Z={info:(e,t)=>jt(process.stdout,"info",e,t),warn:(e,t)=>jt(process.stderr,"warn",e,t),error:(e,t)=>jt(process.stderr,"error",e,t)};var it=class{constructor(t,n){this.max=t;this.queueLimit=n}active=0;waiters=[];async enter(){if(this.active>=this.max){if(this.waiters.length>=this.queueLimit)throw Lt("server at capacity, retry shortly");await new Promise(t=>this.waiters.push(t))}this.active++}leave(){this.active--,this.waiters.shift()?.()}get stats(){return{active:this.active,queued:this.waiters.length}}};var Kn=6e4,at=class{constructor(t,n){this.requestsPerMinute=t;this.cooldownMs=n}hits ...
HighChild Process
Package source references child process execution.
dist/cli.jsView on unpkg · L1 5`)}function de(){let e={text:"",thinking:"",usage:Xn(),stop:"stop"};return{sink:{meta(n){n.id&&(e.id=n.id),n.model&&(e.model=n.model)},text(n){e.text
6`}let d=pt(n.maxConcurrency,!!n.claudeToken),i=await d.acquire();try{await ut({bin:n.claudeBin,args:o,prompt:s,cwd:i.workDir,env:{...process.env,HOME:i.home,CLAUDE_CONFIG_DIR:i.configDir,CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC:"1",...n.claudeToken?{CLAUDE_CODE_OAUTH_TOKEN:n.claudeToken}:{}},timeoutMs:n.timeoutMs,signal:r,authHint:us,onLine:l=>{let c=l;if(c.type==="stream_event"&&c.event){let u=c.event;if(u.type==="message_start"&&u.message){t.meta({id:u.message.id,model:u.message.model});let y=u.message.usage??{};t.usage({inputTokens:y.input_tokens,cacheReadTokens:y.cache_read_input_tokens,ca ...
HighRuntime Package Install
Package source invokes a package manager install command at runtime.
dist/cli.jsView on unpkg · L4 8`:"")+ct(e),s=["exec","--json","--skip-git-repo-check","--ignore-user-config","--ephemeral","-C",o,"--sandbox",n.codexSandbox];n.codexReasoning&&s.push("-c",`model_reasoning_effort="${n.codexReasoning}"`),n.codexModel
9data: ${JSON.stringify({type:c,...u})}
11`),d=async()=>{n.started()||await s("message_start",{message:{id:r.result.id??V("msg"),type:"message",role:"assistant",model:r.result.model??t.model,content:[],stop_reason:null,stop_sequence:null,usage:{input_tokens:r.result.usage.inputTokens,output_tokens:0,cache_read_input_tokens:r.result.usage.cacheReadTokens,cache_creation_input_tokens:r.result.usage.cacheWriteTokens}}})},i=async()=>{a!==null&&(await s("content_block_stop",{index:o}),a=null)},l=async(c,u)=>{await d(),a!==c&&(await i(),o++,await s("content_block_start",{index:o,content_block:c==="thinking"?{type:"thinking",thinking:""}:{typ ...
13`),messages:o,stream:t.stream===!0,maxTokens:typeof t.max_tokens=="number"?t.max_tokens:void 0},includeUsage:a?.include_usage===!0}}function or(e){return{prompt_tokens:e.usage.inputTokens,completion_tokens:e.usage.outputTokens,total_tokens:e.usage.inputTokens
15`)},i=l=>{let c=s?l:{role:"assistant",...l};return s=!0,d({index:0,delta:c,logprobs:null,finish_reason:null})};return{sink:{meta(){},text(l){return a.sink.text(l),i({content:l})},thinking(l){return a.sink.thinking(l),i({reasoning_content:l})},usage(l){a.sink.usage(l)},stop(l){a.sink.stop(l)}},started:n.started,async finalize(){await d({index:0,delta:{},logprobs:null,finish_reason:Wt(a.result.stop)}),t.includeUsage&&await d(null,or(a.result)),await n.send(`data: [DONE]
17`)},async error(l){await n.send(`data: ${JSON.stringify(l.body("openai"))}
19`)}}}var sr=Ue({style:"openai",parse:bs,req:e=>e.req,renderJson:vs,stream:Ss});function Es(e){let t=pe(e),n=Be(t),r=t.input;if(r==null||typeof r!="string"&&!Array.isArray(r))throw oe("`input` must be a string or an array");let o=[];typeof t.instructions=="string"&&o.push(t.instructions);let a=[];if(typeof r=="string")a.push({role:"user",text:r});else for(let s of r){if(typeof s=="string"){a.push({role:"user",text:s});continue}let d=re(s.content);if(s.role==="system"||s.role==="developer"){d&&o.push(d);continue}let i=s.role!=="assistant"?le(s.content):[];a.push({role:s.role==="assistant"?"assis ...
21`),messages:a,stream:t.stream===!0,maxTokens:typeof t.max_output_tokens=="number"?t.max_output_tokens:void 0}}function ir(e){return{input_tokens:e.usage.inputTokens,output_tokens:e.usage.outputTokens,total_tokens:e.usage.inputTokens+e.usage.outputTokens,input_tokens_details:{cached_tokens:e.usage.cacheReadTokens},output_tokens_details:{reasoning_tokens:0}}}function ar(e,
22data: ${JSON.stringify({type:w,sequence_number:d++,...C})}
24`),u=(w,C={})=>({id:o,object:"response",created_at:a,status:w,model:t.model,error:null,...C}),y=async()=>{n.started()||await c("response.created",{response:u("in_progress",{output:[]})})},x=async()=>{l==="reasoning"?(await c("response.reasoning_summary_text.done",{item_id:s.rs,output_index:i,summary_index:0,text:r.result.thinking}),await c("response.output_item.done",{output_index:i,item:{type:"reasoning",id:s.rs,summary:[{type:"summary_text",text:r.result.thinking}]}})):l==="text"&&(await c("response.output_text.done",{item_id:s.msg,output_index:i,content_index:0,text:r.result.text}),await c( ...
25 Note Auth flows open a browser. No browser on this box?
HighSandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/cli.jsView on unpkg · L1 26 Authenticate on a machine that has one, then bring the credential here.
28 claude run \`claude setup-token\` there \u2192 paste the printed token into
29 .env as CLAUDE_CODE_OAUTH_TOKEN (or via this CLI's own config command).
31 codex run \`codex login\` there \u2192 copy ~/.codex/auth.json here via scp,
32 then paste its path below. It carries a refresh token \u2014 stays valid.
34 ${"\u2500".repeat(50)}
36`,Gs=e=>e.startsWith("~")?en(_r(),e.slice(1)):e,_t=()=>process.env.CODEX_HOME||en(_r(),".codex"),se
37
HighCommand Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/cli.jsView on unpkg · L20 HighSame File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/cli.jsView on unpkg · L23 38`)),Array.isArray(e.tools)&&(r.tools=e.tools.map(a=>({type:"function",name:a.function?.name,description:a.function?.description,parameters:a.function?.parameters,strict:!1})).filter(a=>a.name)),e.tool_choice!=null&&(r.tool_choice=ni(e.tool_choice));let o=e.max_completion_tokens??e.max_tokens;return typeof o=="number"&&(r.max_output_tokens=o),r}async function*oi(e){let t=new TextDecoder,n="";for await(let r of e.body){n+=t.decode(r,{stream:!0});let o;for(;(o=n.indexOf(`
40`))>=0;){let a=n.slice(0,o).split(`
41`).filter(s=>s.startsWith("data:")).map(s=>s.slice(5).trim()).join("");if(n=n.slice(o+2),!(!a||a==="[DONE]"))try{yield JSON.parse(a)}catch{}}}}async function Or(e,t){let n="stop",r=null,o=-1,a=new Map;for await(let s of oi(e))switch(s.type){case"response.output_text.delta":s.delta&&await t.text(s.delta);break;case"response.reasoning_summary_text.delta":s.delta&&await t.reasoning(s.delta);break;case"response.output_item.added":s.item?.type==="function_call"&&(o++,a.set(s.output_index??o,o),n="tool_calls",await t.toolStart(o,s.item.call_id??s.item.id??V("call"),s.item.name??""));break;case"respo ...
43`),l=c=>{let u=d?c:{role:"assistant",...c};return d=!0,i({index:0,delta:u,logprobs:null,finish_reason:null})};try{let{
Long lines were clipped for display.