@open-matrix/codex-agent (0.1.9)
Installation
@open-matrix:registry=npm install @open-matrix/codex-agent@0.1.9"@open-matrix/codex-agent": "0.1.9"About this package
Codex agent
Owner: codex-agent / fleet operations. A Matrix peer wrapping the vendored Codex SDK.
Machine-local auth health
self-check.run includes codex-auth-refreshable in the canonical development-readiness
checklist. credential.test uses the same checker and returns {ok:true,live,detail,codexAuth};
live is the credential verdict, while the outer ok means the operation answered.
status.get returns status.codexAuth; session.status returns codexAuth, including
when the requested session does not exist. The Fleet manager retains this object in
lastStatus, alongside the environment-scoped availability it verifies.
The metadata is {ok,lastRefresh,ageHours,mode,state,authFile,checkedAt,detail}.
No token, account email, auth-file content, or CLI stdout/stderr crosses the bus.
lastRefresh is normalized UTC; ageHours is rounded down (the guard compares exact
age); missing dates are null. state is ok, stale, or dead. checkedAt:null means
no explicit refresh has been proved for this login; a recent file alone is not proof.
API-key mode has no refresh lineage and is exempt from age refusal, explicitly without
a validity claim. External-token/keyring-only logins are outside this file-owned check.
The no-inference call is the vendored codex app-server --stdio with
-c 'cli_auth_credentials_store="file"', initialized over JSON lines, then:
{"id":2,"method":"account/read","params":{"refreshToken":true}}
The checker requires both a ChatGPT account response and an advanced last_refresh.
At 0.153.4 a transient refresh failure can return cached account data, so the response
alone is insufficient. No thread/turn/model call is issued; the utility is terminated
after its reply. Concurrent checks share one process; the existing 10-second
credential-test bound applies. See the OpenAI auth API
and pinned account processor.
Status polling reads metadata without rotating credentials. Configure positive
codexAuthMaxAgeHours in deployed runtime config or config.set (default 72), or set
CODEX_AGENT_AUTH_MAX_AGE_HOURS when starting the agent; deployed config wins.
session.start, session.resume, and session.run refuse stale/dead auth before
creating an SDK thread. Existing running sessions are not interrupted by age polling.
A recognized refresh failure marks status stale immediately and persists in the
existing self-check state file. A new local login timestamp or a successful explicit
refresh clears it. Failure text names the file and the exact cure:
codex login on this machine; do not copy another machine's auth.json
The September 9 fleet incident invalidated mac/ninja copies of one old refresh lineage together. Copying auth.json is the disease: refresh-token rotation/revocation can invalidate the other copies. Each machine or coding unit needs its own managed login home. The check detects stale/failed credentials; it cannot predict revocation of a currently valid lineage or prove that nobody copied a file.
This source change is not a peer rollout. Existing deployments need the new agent and canonical checklist through their delivery owner. Older custom checklists still receive the status/refusal guard; add the canonical item for explicit refresh proof.
Dependencies
Dependencies
| ID | Version |
|---|---|
| @openai/codex-sdk | ^0.153.4 |
Development Dependencies
| ID | Version |
|---|---|
| @open-matrix/core | 0.1.31 |
| @types/node | ^25.0.10 |
| esbuild | ^0.25.0 |
| typescript | 5.9.3 |
Peer Dependencies
| ID | Version |
|---|---|
| @open-matrix/core | 0.1.31 |