Lines 1-43javascript
2import{createInterface as Qc}from"node:readline/promises";import{spawnSync as Ge}from"node:child_process";import{stdin as Lo,stdout as jo}from"node:process";var Fn="1.0.1";var Te=(e,t)=>{let n=e==null||e===""?NaN:Number(e);return Number.isFinite(n)?n:t},Qo=["read-only","workspace-write","danger-full-access"],Hn=["cli","proxy"];function jt(e,t,n,r){if(!t)return r;if(!n.includes(t))throw new Error(`${e} must be one of: ${n.join(" | ")} (got "${t}")`);return t}function Ae(e=process.env){return{version:Fn,host:e.HOST??"127.0.0.1",port:Te(e.PORT,8787),apiKey:e.AGENT_PROXY_API_KEY??"",messagesBacken ...
3`)}var Z={info:(e,t)=>Ft(process.stdout,"info",e,t),warn:(e,t)=>Ft(process.stderr,"warn",e,t),error:(e,t)=>Ft(process.stderr,"error",e,t)};var lt=class{constructor(t,n){this.max=t;this.queueLimit=n}active=0;waiters=[];async enter(){if(this.active>=this.max){if(this.waiters.length>=this.queueLimit)throw qt("server at capacity, retry shortly");await new Promise(t=>this.waiters.push(t))}this.active++}leave(){this.active--,this.waiters.shift()?.()}get stats(){return{active:this.active,queued:this.waiters.length}}};var Yn=6e4,dt=class{constructor(t,n){this.requestsPerMinute=t;this.cooldownMs=n}hits ...
HighChild Process
Package source references child process execution.
dist/cli.jsView on unpkg · L1 5`)}function ue(){let e={text:"",thinking:"",usage:Jn(),stop:"stop"};return{sink:{meta(n){n.id&&(e.id=n.id),n.model&&(e.model=n.model)},text(n){e.text
6`}let d=ft(n.maxConcurrency,!!n.claudeToken),i=await d.acquire();try{await ht({bin:n.claudeBin,args:o,prompt:s,cwd:i.workDir,env:{...process.env,HOME:i.home,CLAUDE_CONFIG_DIR:i.configDir,CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC:"1",...n.claudeToken?{CLAUDE_CODE_OAUTH_TOKEN:n.claudeToken}:{}},timeoutMs:n.timeoutMs,signal:r,authHint:gs,onLine:l=>{let a=l;if(a.type==="stream_event"&&a.event){let u=a.event;if(u.type==="message_start"&&u.message){t.meta({id:u.message.id,model:u.message.model});let y=u.message.usage??{};t.usage({inputTokens:y.input_tokens,cacheReadTokens:y.cache_read_input_tokens,ca ...
HighRuntime Package Install
Package source invokes a package manager install command at runtime.
dist/cli.jsView on unpkg · L4 8`:"")+ut(e),s=["exec","--json","--skip-git-repo-check","--ignore-user-config","--ephemeral","-C",o,"--sandbox",n.codexSandbox];n.codexReasoning&&s.push("-c",`model_reasoning_effort="${n.codexReasoning}"`),n.codexModel
9data: ${JSON.stringify({type:a,...u})}
11`),d=async()=>{n.started()||await s("message_start",{message:{id:r.result.id??V("msg"),type:"message",role:"assistant",model:r.result.model??t.model,content:[],stop_reason:null,stop_sequence:null,usage:{input_tokens:r.result.usage.inputTokens,output_tokens:0,cache_read_input_tokens:r.result.usage.cacheReadTokens,cache_creation_input_tokens:r.result.usage.cacheWriteTokens}}})},i=async()=>{c!==null&&(await s("content_block_stop",{index:o}),c=null)},l=async(a,u)=>{await d(),c!==a&&(await i(),o++,await s("content_block_start",{index:o,content_block:a==="thinking"?{type:"thinking",thinking:""}:{typ ...
13`),messages:o,stream:t.stream===!0,maxTokens:typeof t.max_tokens=="number"?t.max_tokens:void 0},includeUsage:c?.include_usage===!0}}function ir(e){return{prompt_tokens:e.usage.inputTokens,completion_tokens:e.usage.outputTokens,total_tokens:e.usage.inputTokens
15`)},i=l=>{let a=s?l:{role:"assistant",...l};return s=!0,d({index:0,delta:a,logprobs:null,finish_reason:null})};return{sink:{meta(){},text(l){return c.sink.text(l),i({content:l})},thinking(l){return c.sink.thinking(l),i({reasoning_content:l})},usage(l){c.sink.usage(l)},stop(l){c.sink.stop(l)}},started:n.started,async finalize(){await d({index:0,delta:{},logprobs:null,finish_reason:Kt(c.result.stop)}),t.includeUsage&&await d(null,ir(c.result)),await n.send(`data: [DONE]
17`)},async error(l){await n.send(`data: ${JSON.stringify(l.body("openai"))}
19`)}}}var ar=Be({style:"openai",parse:Ts,req:e=>e.req,renderJson:As,stream:Cs});function $s(e){let t=me(e),n=Ue(t),r=t.input;if(r==null||typeof r!="string"&&!Array.isArray(r))throw oe("`input` must be a string or an array");let o=[];typeof t.instructions=="string"&&o.push(t.instructions);let c=[];if(typeof r=="string")c.push({role:"user",text:r});else for(let s of r){if(typeof s=="string"){c.push({role:"user",text:s});continue}let d=re(s.content);if(s.role==="system"||s.role==="developer"){d&&o.push(d);continue}let i=s.role!=="assistant"?de(s.content):[];c.push({role:s.role==="assistant"?"assis ...
21`),messages:c,stream:t.stream===!0,maxTokens:typeof t.max_output_tokens=="number"?t.max_output_tokens:void 0}}function cr(e){return{input_tokens:e.usage.inputTokens,output_tokens:e.usage.outputTokens,total_tokens:e.usage.inputTokens+e.usage.outputTokens,input_tokens_details:{cached_tokens:e.usage.cacheReadTokens},output_tokens_details:{reasoning_tokens:0}}}function lr(e,
22data: ${JSON.stringify({type:w,sequence_number:d++,...C})}
24`),u=(w,C={})=>({id:o,object:"response",created_at:c,status:w,model:t.model,error:null,...C}),y=async()=>{n.started()||await a("response.created",{response:u("in_progress",{output:[]})})},x=async()=>{l==="reasoning"?(await a("response.reasoning_summary_text.done",{item_id:s.rs,output_index:i,summary_index:0,text:r.result.thinking}),await a("response.output_item.done",{output_index:i,item:{type:"reasoning",id:s.rs,summary:[{type:"summary_text",text:r.result.thinking}]}})):l==="text"&&(await a("response.output_text.done",{item_id:s.msg,output_index:i,content_index:0,text:r.result.text}),await a( ...
25 Note Auth flows open a browser. No browser on this box?
HighSandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/cli.jsView on unpkg · L1 26 Authenticate on a machine that has one, then bring the credential here.
28 claude run \`claude setup-token\` there \u2192 paste the printed token into
29 .env as CLAUDE_CODE_OAUTH_TOKEN (or via this CLI's own config command).
31 codex run \`codex login\` there \u2192 copy ~/.codex/auth.json here via scp,
32 then paste its path below. It carries a refresh token \u2014 stays valid.
34 ${"\u2500".repeat(50)}
36`,zs=e=>e.startsWith("~")?nn(wr(),e.slice(1)):e,xt=()=>process.env.CODEX_HOME||nn(wr(),".codex"),se
37
HighCommand Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/cli.jsView on unpkg · L20 HighSame File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/cli.jsView on unpkg · L23 38`))>=0;){let i=r.slice(0,d).split(`
39`).filter(a=>a.startsWith("data:")).map(a=>a.slice(5).trim()).join("");if(r=r.slice(d+2),!i||i==="[DONE]")continue;let l;try{l=JSON.parse(i)}catch{continue}l.type==="response.completed"?o=l.response:(l.type==="response.failed"||l.type==="error")&&(c=l.response?.error?.message??l.message??"codex upstream error")}}if(!o&&c){e.writeHead(502,{"content-type":"application/json",...ie}),e.end(JSON.stringify({error:{message:c,type:"api_error"}}));return}e.writeHead(200,{"content-type":"application/json",...ie}),e.end(JSON.stringify(o??{}))}var cn=async({body:e,res:t,cfg:n,signal:r})=>{let o=await Et(e ...
41`)),Array.isArray(e.tools)&&(r.tools=e.tools.map(c=>({type:"function",name:c.function?.name,description:c.function?.description,parameters:c.function?.parameters,strict:!1})).filter(c=>c.name)),e.tool_choice!=null&&(r.tool_choice=pi(e.tool_choice));let o=e.max_completion_tokens
43`))>=0;){let c=n.slice(0,o).split(`
Long lines were clipped for display.