From f67564a8aeccd4b0011069ae71803356f04add1f Mon Sep 17 00:00:00 2001 From: Alessandro <155005371+3clyp50@users.noreply.github.com> Date: Tue, 28 Apr 2026 15:11:37 +0200 Subject: [PATCH] Add Codex/ChatGPT account OAuth provider Create a generic OAuth Connections plugin with Codex/ChatGPT Account as the first provider, using OpenAI's device-code flow to persist Codex-compatible account tokens. Expose a loopback OpenAI-compatible wrapper for models, responses, and chat completions, and point LiteLLM at the container-local Agent Zero origin. Add a dummy API-key extension and focused tests so the account-backed provider appears configured without requiring a user-entered key. docs: add Codex plan OAuth callout Highlight that Agent Zero can use an existing OpenAI Codex plan through the new OAuth flow. Add the account-backed LLM plans image and surface the section from the README navigation, while pointing toward future Gemini CLI and Claude Code integrations. Handle Codex account SSE chat chunks Teach the Codex/ChatGPT account bridge to extract text from OpenAI-style SSE chat completion deltas and fall back to a normal output_text response when upstream only streams chunks. Strip user-supplied stream kwargs before LiteLLM calls so Agent Zero owns streaming mode and custom parameters cannot pass stream twice. Add targeted tests for streamed delta extraction and reconstructed responses. update README.md with LLM plans mention --- README.md | 13 +- docs/res/oauth_llm_plans-ok.png | Bin 0 -> 54324 bytes models.py | 16 +- plugins/_oauth/README.md | 12 + plugins/_oauth/api/models.py | 13 + plugins/_oauth/api/poll_device_login.py | 35 + plugins/_oauth/api/start_device_login.py | 36 + plugins/_oauth/api/start_login.py | 54 ++ plugins/_oauth/api/status.py | 22 + plugins/_oauth/conf/model_providers.yaml | 9 + plugins/_oauth/default_config.yaml | 33 + .../end/_20_codex_account_dummy_key.py | 28 + .../startup_migration/_20_oauth_routes.py | 9 + plugins/_oauth/helpers/__init__.py | 1 + plugins/_oauth/helpers/codex.py | 859 ++++++++++++++++++ plugins/_oauth/helpers/config.py | 112 +++ plugins/_oauth/helpers/route_bootstrap.py | 26 + plugins/_oauth/helpers/routes.py | 372 ++++++++ plugins/_oauth/helpers/state.py | 118 +++ plugins/_oauth/plugin.yaml | 9 + plugins/_oauth/webui/config.html | 391 ++++++++ plugins/_oauth/webui/oauth-config-store.js | 192 ++++ tests/test_oauth_codex.py | 156 ++++ 23 files changed, 2511 insertions(+), 5 deletions(-) create mode 100644 docs/res/oauth_llm_plans-ok.png create mode 100644 plugins/_oauth/README.md create mode 100644 plugins/_oauth/api/models.py create mode 100644 plugins/_oauth/api/poll_device_login.py create mode 100644 plugins/_oauth/api/start_device_login.py create mode 100644 plugins/_oauth/api/start_login.py create mode 100644 plugins/_oauth/api/status.py create mode 100644 plugins/_oauth/conf/model_providers.yaml create mode 100644 plugins/_oauth/default_config.yaml create mode 100644 plugins/_oauth/extensions/python/_functions/models/get_api_key/end/_20_codex_account_dummy_key.py create mode 100644 plugins/_oauth/extensions/python/startup_migration/_20_oauth_routes.py create mode 100644 plugins/_oauth/helpers/__init__.py create mode 100644 plugins/_oauth/helpers/codex.py create mode 100644 plugins/_oauth/helpers/config.py create mode 100644 plugins/_oauth/helpers/route_bootstrap.py create mode 100644 plugins/_oauth/helpers/routes.py create mode 100644 plugins/_oauth/helpers/state.py create mode 100644 plugins/_oauth/plugin.yaml create mode 100644 plugins/_oauth/webui/config.html create mode 100644 plugins/_oauth/webui/oauth-config-store.js create mode 100644 tests/test_oauth_codex.py diff --git a/README.md b/README.md index de98e1f10..d113ad396 100644 --- a/README.md +++ b/README.md @@ -14,7 +14,8 @@ Agent Zero is a dynamic, organic agentic framework for running AI agents that ca [Introduction](#what-agent-zero-is) | [Space Agent](#agent-zero-and-space-agent) | -[Quick Start](#quick-start) | +[Quick Start](#how-to-install) | +[LLM Plans](#use-your-openai-codex-plan) | [CLI Connector](#a0-cli-connector-use-agent-zero-on-your-host-machine) | [Features](#what-makes-agent-zero-different) | [Examples](#try-these-first) | @@ -98,6 +99,16 @@ For web and mobile development, Annotate mode lets you click page elements or re The Browser also supports Chrome extensions installed from the Chrome Web Store directly inside the Agent Zero browser environment, so workflows can use the same kind of browser capabilities real users depend on. +## Use Your OpenAI Codex Plan + +Agent Zero can now connect to your OpenAI Codex plan through the new OAuth flow. Sign in with your account, pick the Codex-backed provider, and let Agent Zero use the plan you already have. + +OAuth LLM plans in Agent Zero +
+ +Click "Connect", enter the device code in the OpenAI page. Choose your model after checking the list, and you're all set. + +This is the first step toward account-backed LLM plans in Agent Zero. More integrations are coming, including Gemini CLI, Claude Code based on extra-usage, and more. # A0 CLI Connector: Use Agent Zero on Your Host Machine diff --git a/docs/res/oauth_llm_plans-ok.png b/docs/res/oauth_llm_plans-ok.png new file mode 100644 index 0000000000000000000000000000000000000000..1a621665f073d96f7b820e5cc0de12c2cacae5d4 GIT binary patch literal 54324 zcmeFYWmHsO_%@6RN=qXxB_O3DT}ns^NQ0Ep-3)`24uXV&)X*U*Ez<1}4oH_Y3@tr$ z!?Q7d&--8Rm-oZF*7M~#3uQU(bI#uTuIsw)J;BdZarMW)e; zzZx|4wh!`*Pi;J_$!tr_%!p`I+?vib^&7f~jEahkT;43fn)Bm`Xe3)7nKtc3}HG*;$ zhSh?;7xy_tAVLIwc{-|6^OwOMbh}nyU z^@p+cQRC8Uc~@tTZixu{b{nm%<%vhaYji!MKasima21OR(PP}k)fG5_`w3@T>Y8^? zX!(D)#y{$|sMPMI<+62{GTT|?+@H)cZQjrsw%&L`;Pt(K7vGkAz-TrcSICq_N$B18 zty`^is&7#NnAr5ZzE82j&$DSyZ14N%i1;HlmHJY$k$LW#9Q{J{qmyc(o?-%xI&1E- zPuD|q3GJ>$Dhi}mC1gcGLl9e-^yJBjSN^W1D_O?na*K>>D2iPel zE3en;h7CSfp>XKAT5WOyJ_-JtX*6c>$Oc(9q;o68vCm8cqVS!DKQw1k5lgj8Ks`68 zl7g~+6(a_|XTf5&sPK1s- zz3+bT@j@;0Dul*_NKCfTZ^9weNLD0_# zrKCG%(KQ~Ibv&b$qnYPS<()p@5SW^UA%}Pnrz~3 z5rUV3jo=RoGo)U!)nxrbdL09!EC|?p=-P2U#6o5;tn^2TF#nAZ(f2LdHw67H^=|m) zw5L`L_|B7=RfcwsEHLobn#M0%5bknDzTfiUq=PLnU(WaiW_UyEg z6FWgQ)6q!0uyTX2D0&n@Eh|4QgvvP7NI=8H1gYUa!RGqH58uuNA4-S}f!e zxf~jo(K@D`8U1vI1DU-MH%T`n=98mUJKI>$YEJV}^D7-|Y<#-jzA~EYATw6GxkGk! za`y24k#dZFZRzT5;U{M2ZI4fDpD+-YiDH9vp_6)4$MbT7Dd-7@hSAF&c?(UMgBa{tTh$TeK2lhXTiD% zDRcYO@+%}n@#piW(;QiqR&Y&a_nt^w#(CJ%S;ztz_lPp?eoz=}NyvlpGb*?;&-bN{ z>g7D_(2X9XsqI_D)x7KkwhPqiD!iNfct6sJDaBla^6Obf920be38m_2e|@}$*!gY7 zZ?GJ8R!I&WCg_@DTt(C;%@c)(_MBM|NC_~(4c^q1QYaxA-%1+j3RB}H_)qX)hy?}BZL z05=AP%#DVck=9@p&J}@d<8`*iC6dwow50%M`yhS#VgY|L;sja5j$XE9yO6#eu2P+6fcUoL zysbkAoYHG=?Qg9^9+FJ>k}ea-%4as*{OcaSa8lBfTR1)ORXK=rGc(n`ly7QrgSvki^vg{CZ#d@i@kh1&VXxQsV>CBYuep<~O3E*eT(U z(9o?6PH3wnJgrjnn626@yJ)xj=^mr_5Lz)myKuea-A0JtfdK~IqA9$tCeuxCr?O>Xa9Uc&l-iYxXW1&a#2QO=r^Ia|?2IG+XuvGT@Fy+} zUhmnel}Df5=%ms9tU4S0G|!EWMFpAkmijiLCdqfQxVS~cWu(3x9CBfs*38#19zn5} zZf`?vxzCQ9C@~2zd*p6I>kb=mQYdT@e4wyiM{-t+_NRGY9Z$ziNk0%NoQzSK-ojE< z!#A;Hb|HaS7F3YA*tGDDX;rn5!Q1RV_9wm&)MFDLq6nZ8YjyL%!A*IAg@JL~22&(R zCiDgg{$C6GQ;P9_p4TBQBlTcqP)hYtx_hQyH@0~C5Z6c{rb{G;fWvdQsI31EV!(jp zYFLht;YY-t>f?!+nT0@gZYF{#&=dS6EMRlcIzKL{ed29@f`)pPFr1o_3 zV*hqg0}W+UFJX^)8XxmRt)1b+Hb-FY!`goSp26HoWBQ?YwwS!_x|8y06;sDKn`KHC zv8CQcokdLz2kH$5WntyBGHB?5Dbbz>|1`UJ1iLRgmgQC91k3YZ%)ZL9Axn$(WPTlc zm3Lm=sS<6j|5mJZD@^uqo#~e?8@?Q)$lD8D|F>8E1eSMdDx#D%ch@nuJEovN*RcJ9 z?%mj0_|FBm12g!!>HQoXgXruP>Y+JF+3$Kz0mf(f#u-i#$Iw2StydvEuve**A@)0# zxvn86oPA2mkg7?(k_1tLocgx}n_e72XLI`}vA;+co&9=;RiI%~ZrD2|*Ml+tnG??_ z@?~N7sp3*w*_-T9vF5L?1d5&AKQ z&8aw-2t*ox!NbJBAfmN$eEjGU+8Yxfv&~|ZUb14s7nUyk6akpCK+m0OA9BU@?k@!& zavMMO)Wor9EMW4~p%z8bh5gwmHQpY+l41@zu{#>;Y22ujdjud~bi(S=OR{J*BS>a}ez=g``=R468Zyxx*J2IO6GMP`+wRFwDA&NEO zaOBx*)ZZjO&5I~auH~C_i8r(L5Eu^k@9()-5gkFfvV zLWw99_E%KlUO%#_Vk|wpQ21{0p43O1bzHm4rBKVRBWF(+adlX$Zk#T4u9PiEi@~~W zpkvq2E#)dXVtqHQQIO`{OLcbqVl+G9+T#8>V*l8`0o4g zKK^SRL-d+T>MUvgZmvM`80#{BPu;JF2#dTpS>^TFss@8_!CF&V$3j21DH@Ix{oa%5 zY0vJFsS~#P;-={ftgS5n{KJx0fdXRhz9Vz8rJ_N+TA9m&cZ zy$oazXTjvVIeR8mwA^=sRZ1d zDg{QEI2UYJJn{K6SliqhCL;hNm7AaomA;Q^lD5M77M}?z#llAm7@rs z@#GM<()CH_dxbY%;f0Jndm(s^6F%p8q#jAU*+cb8?o?nA&*v5PTzskvvsy z0Sfz_l9@W{q(;_qg#&2UUi<7vjQfwD!vKp?)9oj5@*0dkRJ5h>tqVF6yiMKH-L`ikIZ)X-g`O`Pf45F zi$}QS(6LU}G~+y+wpFtC8Wn&Guy8{o%+lP0l_ba5vdVOzy_ah^ah<2VOhDoO1y70> zf|L8(!rtPhzruMK%D;i&L8oDW@%L`DhmsF1Y3<$n$9#N6fp=i$vO6V3PTjcIea@kd z$%l;RMv2}g<4-(=b($f_$4=-T0%S1_X5;ofd}!xfY6kII>0;hPJNS+y_+h>Se;pK#h(X zE*rak&dyT5kbjZT!e@Ucv187mfJeeZMS4DO$Ky7+F$@__wM!d1VfVU4B3!ER7bK2{ z2g)QI^fpwGW6}GRye_TBkJp-13w@d(f=Xp`F>fEbn{dbpb=YJj7M8BtbmfJyO}z?= zHTV4KjM;k% z#cgO^ON&OzUNafyHV$}%ahEfPE#L}J8L@m|Ko&l)l9fWQN#Lr?9`#cyhPSO(=p19$ zBuF}QLPNS1nAtA>?qn13$=p5SN`B^@{(YTlbtU>)Ggc1);yS{(ewXB3_{1>j>=AUC znO2E1UeUcpNr~rRkLV&JZ3+iHtiN;>^I?376f;)3w-v-G67 zBOYi-Vm%`xG~}r1;5IbG&XiT<;k#;Ig0Q2RDJ<3bA0)zpEj`lMDZ&#S^hCm(v$E)k z{kFg>uampC_IipUr<`p)iW=Ai?O+hb`?RXv8@Ku#nQlYrFB#SiZm7j5r+~N*COp7o z(>h723$gNqJuqwb!(GBJw##K5a9K=7C<(LSGRe`j&o&>~a9}TPN?XyQAAUNs+r&8R zBuZ;2bduw0PQ9T7$(&AQGg$<0=8=4ob;EnNjOpPq{yCByPD_0;LeAEXm?D3a^>T+3 zT!XY$V^~Yu#rUd7LU3c(*Mm(WZXgTPpE70QfrEow49(1_$8DQG#DJ);Vh59Q>1C5!bRs>3bH%9>unY5o%cSg zBjY=LYxMK_n@K8GmuzPhoZw_@;cPNVGf1-@LIheDCX{cmE2A!Lxiy6>oc$qOA>^%g zf4HmA$>#b^LhgzMHG#y$s!1$1C=-Nj9hzj@+r331jjr>)X+ntv0?%)9dxH&n2gw;D z%B{G}@yqS*SV1MO1!F>&nr3+^xmb6g{(f#BrI_#VLIqa`J~uH}E7GD*E1%`QW@MB& zqF)?>!9-Pa4DXv$NFPbM81v@35z3UMOE}Ec@s&&GzTuamC;13>_{)3Zm4)?mOivi0 zbzH~@m}SNs6_b^Al2c`UO0_{{vz*+A`){Gs*Wel6Izfqv`k47GC3GD&Bm9(*Crh6_ z)hNWmh85N@MQclU#alNC@Ts@DI|w7}52{rE!o!=IX#5Tc1Zf?EFDw7niQ1#1D>~}F z#0;4j@1BQ#QS5zE2Av#sHa}}bX@P$%;Ufn}S4FZ2ao%PReul?geBqihgdgO`7a*&3 z9=^UDsRmEE9r&NH6dL-7(eonSd<`1&oYrwUK`KdePgRE4l_MkaXV}rJs0x{_!`Tz$ zz5ZtfMds@dj2(n+EUOE!lPZmz>~h!ERGir2!o8S;Q{+WAAw=YF=l)i9hBB0_1f1uq zACQB~oyjy#%ylq%TO_io^(s#}tLkAQHawH|DI~BZ^WGP7yXz`nOdR+G=i86i@B2my z5yA9=&3K?P28M%SOPST$4oFN31nKAweIi%oFs~%(a@^yC+9cA~q;JCY2TC~yUDE7= ztlLJt2PX)9Sa_IxtIVB~M4X=bM}-^YFX$GTxYt+h>8g~o5{U^5=QZcPp1gIN9!s@% ztJ9tzxj~|imRVB?HB3Z}z+dIEVfI|APTt0tJrh^hffr?W2lRb~)e51hoF@<7qB)rx zNIRt|0=%|&I?D6?&4a^^c8FD1_gnTUBRDlrW!&94Mq}D2#oS{iF@hxTk-TYKpS4ez z_!jCnm9RtX7{O9R*>SFtc?Z(gN<7N8NZUC_;F@N>V|A{tshQaVG8|#N&>Z_Uh`MF9 z<*Xsv;KN<57O$t+M)I#OWgTNQ{(uKuxs=gWC8#av*~A9syUZl>N`fnX`YpUF!Eef6 zoI4asi!szbuWq&Po|R_ZTGZ^6ro0Bzc@g$g7mZUVTaYN zEZKBn$l;Pg6a%kskbEBmR0uqkarR+(5#KWWKBf}E!*ug*h;QGtegra zrxj~!w~)l2%_^os9S~eHdITTu$ikeJ#}*G1uJdkzuw-0#(Y$r#LCO0&hFUwhoPt-0 zIXD?FbEg*rUIH(ReTHcuW)JOSXOY6L83$g&+UwnQC6GCMm1;H*`5( zWyPA~S_YY*8(YOD(m`zjs1=yIoeOuVRxM8JN>a4deS>vO(TNS*Exw-{HFI|5@_Y`% z)ac6L^&)uaT9qr8K2FE=79Q7*Mo5LJu6fW4J^M{vdgl)A1+EeE?rEnEZUPe;|JS9{ zWF@2{>+&NV68DFZMS=ZuM9YWHH-LsSy>4y)ePS))Oc{?=NgxA++X?nuwN$r8-bG*r_W`=LWPqw(jkYx@&cl5xmznW>xKv5 z>@Mzcc;uV4l=ep=b9riif^>FLs*P0@%an@VDzmNzlhr91%br_o6x@~^asNZEMtO z+cr#s)C|L0Y%Iz{5>304$T}Urs2-SFuhJu|E-7eq|0rD)VcBL#9Z15hs)i&XI182c z5ps7jfP|u`Y}uup#)Y%c;V}6n9*^D0pYh>U{G(KKei!5AA+&ycT!{lB+C$usm`d8) z!eMEh)mxQ=4<-)m@d=yvZS-+k^Qi96L0H!6t9yAu-&?FpwR9-TUuq8ysQY*si7}#0!}3Y_F2RIyC06EY5-LDYI)wq%*#>JmlpW>z`G z@D7|=2Pa(scguxPE~j=Ox=B*x)Q8=`eVF4)YXI8=!$Rb5(SbtPVNKQ=u%iB zZ`BSfwK^h$7b^AqCxSQ z<>b&pS#d~GrVkmEwR5pdf{JsbEmhCN!i+!ULVea|YrD9Agjv$ZqI>q!RLO~F)zF&W z%MzwTH*WYajxQ``pm2UFW*RgOD%BBQ5>KkwCv^{K4=m*I=yRwc*JvUdA#a$p+_5em zjT6Avc2yJM1A4kV`HWZWt%-CYOhpNJmCP^y=6^3rvDTI6v)Cz**M(p?*hvRt>0Rvv zj>f1y2 zy4#qlAMTiVgt1cpAZNI)5S@sIv6U>fZmnWM0I+w;DHwU^;~fziHaV(g)EADs<`y;w z4aD7{>-qBIqd?~&I}{#^gUMTVshau_i?yEDvJxXSs_diWkOM}Q{V?RFW@l@w0b1q< zSew|)oX>j_PRlPH2xBBEEiUK2&gY}(pC&<@`~C1{t$~?avyQ>%B!TpU#o~*hD6Hq{ z;~md7W=R--m1?s1@hV#-;ik+sWIUYjq!g>g?jr`hx`Z8_mW{HZiZw1Wjp2_NupENe zTh+mDy^6X2)cn(5cqyKRvx8#Q?qVGTm9#{74!JM*ULLVNdjw;%^hmN1f-@Nvy~t-7 z*_AKL?C(l9*PH!N%*j%q`W(Hs##5D|f6tPaEzlsifi#ew3}#6=3#G&PDU<2I^ayEz8Xl2@&nAn@2_jZ!?W35dW4*j+l;=n-R#lS z;o#{xjU#$1k12QS)iXcy=92cv@5O2nhCu=o>px}X&@CMyl!%>!QxDeD({Q+_2uN!% z6IN(a_-TG~zdqLqVXIBP^oX1;6ORfcD17!dl<{|$6ALlmYt}J#P+&EFM@fP7$jXDt zsiJKnJwBGZ_#qN6aGKMp$bO5dQ>&b-k9VRbpJJ0c`h^~RROEWd`~Aa2RMi_79yVQR zS2p`#LvMtLO#C58qnB%|o}xx%=PU`2}y$YK2YV6m2ib?JHT;4?a$^!lkz) z&#}iZv!8L(P3nV9vbT{$Y}}?_S0TPd>jH^D1;3s^f-p%4QM<@+sRo zhb6H2(q2<{zJ@b>P4)`!$vy3BLORKzrt(f%??@}XzG>w%8R9ZTIR2b>Aw`xf;kub^ z22DQMqU%9NNV&R+u}|K36~1Bb607L+WR4*TKvgZvCtq&L3pWXggT}vwF;;` zYHAV5+wnW^i;ZYMAC7w>JFHQ|+9$R3v(w0<#76yezi2G4rwlt}h$4cr0@XoCLJ&&t zi7UUvjHvx72#J?HpM?m0{x`R?zOdoFTRLa0Hu2C1&UjjW3Ngs!b`=c+(|L)gWy2h1 z>ab2pA`VVWNgCdAg?Qa*EB|B^7QJ9ype1w%YEewO+$anAYT9ZLflhu_fITLX={#Nv z4Zf}RnfeGS#OEVM(J%)k6QlQuu#ilk3{69gwz^HwFfo6tq7Z96b5aX!tD=Na-o31* zYD8lEEh_tDU3%;zc2rVpOimR#U$~=gA(iHr_m%FboPQz_>z)erKxkxk6V#H_XAb>H ztoioXxu%8@dfTdriyR2{@kF>OyhmQaC{b_Z+}o1}68GP-1fqfq)PtKi{^=QyV3yeP zwkg7&%ooFEiW(Y7h{dXj>tp~Kp*$<5nZ!+rh1^X7^}OqZis@Z7&Ek0S%NTP)`g}6w z&RUU%l}*ZX$kf)?o6QwNF3RzZSwW;-8EYNT=S-@^GCw{HkrVemYAXqM-L0>B?H34b zeExT@89t*pv>}$*5B_6@T7F~k;Ve$YFwt#MszMfyIPf&3z>dv@g#Cp<@Y`gMg_#^SK~1v}N+$BsX# zJ))`>R&`Bbk||YNq)BGF15Lt)u-3GmoRe|rI5Y{T&6!v5iw=~A(w65POF6NrdJ`M; z&@I+ewrG2e8f_iRdt^6|CeP8Fi<6G+OswOl?6x7CZ@z_4ZsAl9{gc{bQTNwW3_A2g zHv{Liv1Kjn4%1C2c_b>oH%8JOyv{%2JZ1?3!q+$dH8!wQsJpr+xSA(xKExK6bJ=#_ zY^m3bPt+N|xjdG@F{y;Nuo+uB>!A`jz$Sd;3W(06LE6-l zk2ft-tLiJYovHDq(X^N3NC}VLZ|ZyZRwpsOt+0GjF09MP4y#9N(WUiB{xakTj&An_ zg_?23=9swRxUO}d_93ak>9UWvXOOeOZw_Xd{?0HA7Mqfi5*azW!sYBmnU2)B7q%wP zN?$BuJs$p`PmG}nLMx2Rw!Mpmc@qO8U3H{}w9DWy94a$ZZe*VEJU+F#qs3j8w?gOBC%?RF}%t571b-z8%) zc5PvPo>s^yEiLU^j>zT7J8-?v%+9v3ut;zme2WskiYN_pgwCYYJS%+8FVchlMfYbA z;xRQmDyr1HgCgLB#uOK`2lTO+8ay8x7O7=?udpBY&b$3*;I{-)6``5p#&dN$w=ma% zI}F%Hv_J?wHAccfyZ!Pa!a4*vV7jdR28Rm z*T5)xIoNQ4UMZ=n*j8HvbE!pFh`XVp^>~H7g~j6j`Zy)`bF$T%-_ODD(9Bh56&3Y5 zJKhUKN2y92p=X-)D;)^R+^|zvEb<4Ah1wQp~(ood=7Z#JB4Y|SA{zYPv*)*N=k@~ZMz&xMKVq5=tM z*q2z9;AM`}MlQ|2C;f;^UR9Mr#La5-t2u-3;S9Ha#pf9_pK!@@p${Ld+2c}E84R$* za8oAlUi!p#%G0gGewbXh^oAMX#mQzP*a!Vu$a;^&$$N>0t?x7klOC!0N#*j`Q(*m` zOUWM8R~yfdS2>I8B2&L;1x(1 z#^s^c32AlnwYhPr1nfqVgk8Of#VXA#EY7!(47s_vAPs0fJX`O}xFJgAP_vw^DtQ(i zrELIC4uI>C!9b~H4~S*Qv9jfvcMRFYbHLutzzzf0komTV$CL!X$An14DjU6u4!NNq zJ7lcBp*Y@M-q{^c9cb!|=QH+PATLB+PLa~U>9Mb`um5#|{k74ZPQIQA-;?#S{eC50 z!!oPB>ZKG>v$l`Nd#jGq4L(1jIXtF3**wP%x8^RbCOGX~suaruQo!EIP%YTcRG)o4 zMcIA#QS;cLLVXWlq#nr&F~bm>!aSYg29s7?*7W2L)cj-hUV>-lV+u2V=SP+`Ti}XqtLwOs7mXch{XoQ?+Tj)d~__yvoqN#$cKM$$!K5`i| zo%Y@#82T{ewA7tUmP%IQvhZVPv5Q6wir#FzD3Vz`mV1B8`KO*Gov_RNxMQREa%NPw z#L1dgzIM6I&|Oi{#1MzRbXgS@LgD#gV?X6_*~0hv8NW9eV?OP^CD=8;lXXGroW5J` z=ch*x1wy5&8vv8Iipd*>Q;3RaH}G07SDbJ7Q913a&k3D>!J@gl1@}s+j(&^eL863tW?8J)N_t3N|#~LaLgH zb;lQW@~1#R%~0RoETwqyaQD90j<-zt)MrYD8-Qwe1`VBzNxknlyHsMci;0eR_({m> zzM6OR%ds-a@-`gKeh{1*DbV8!;DnlKgEZoGIP-3F&Xc$CblWssJR3gM;B%su@dOkE zt9%(kg=#t>CluJ~uFlR=;N}W=xdktq134mWy|!js!Ni4Y6L%*)rjsRnM1q;9sI>y? zodS5gLY_K2xzCNY>3>rKx?Vm!<-Mbvch_fas$P^;uNJ~BZ0YMO5o{iHN4W;Fo)?Wx zzf5b*O~uTe3Vdt+&5fJ%neZ%7iiY0&u`EeuX6A&~X1!&qPX$T!(CTtdDurKGD&;AO z7?Sq#n2Ni1E$t~uT~kxjO!GU*trk*{6;jer{8qgv#0`c_^P0~oe&?RsJo_&=<`9WnopJo389CF!b zl>wUe{h12%Ses3FyetYD47{}WUVH;7@&{%(ZvFn4ZSI5Un7h#3tpwX5#x2{SJaR1c zha#ACB5p5kZvL*`uU|h~+5kxr{VOA!f{g5R)9=D|qRQEAaqBkJg_aV=X5s?<$gN*`2Zhm5hl8 z4<1$jXpKR0?5rRWC;3ASM7p2Z2pnCB3Ow;Ant5<`xJ#vVFC;q6` z`&;bL$_bZH5w`4rok(&;-?NHp==XV#W7L=$&2@5A z=qdm{s>t*%lO=m|{`JvU(S6@&>w)Zu#N67@LCt6ADbFRkj@W|UB8UFWc2I1n1?=Rh z)FtM<+?3T%r1T1n8;#5^{=f?yc{Du~^#&xtV&{gJT^r`sK6A#f0DZ5DL-I>izuEkQdylBu(lz@>IlF9y$htB*C-SiCgh$8eRq z0c&A{9=pH#GVP<$Ak(B3-oY}jwE79aj(1E2?5={`%jN#8!ECPQWo<)he^QA9W2};r z(s-j^qj1tlrK53LmNa@^-Wx$$CfX4PDur>cmRp}JWnUAho&b|c|9EKrgX~yd@n@~a zW}IfbT-$Nmw7h}e;mi%z2Oe^T?I2^d8wvlhLYUwwxfuT)P-+zJA(*ie1njA~L3o#` zrb=A9j{jm4P74C$Bcrs5IxE9ynY9L}w63nMUSI)fkNrPMzf(t@9_;`$a%(m3PfXnc zu=5(s^1UM^i7P@$Mdci%b9~7M4PfJd>wM2sl-LGUm)iGk{g*FaKteM1J996{`{S%8 z*qEw>*eUlL4COnq!rR*0m&eLib8}J>Qc}(jru`g8zPtqaOVnfIy_SzR3paP6>r!`D z0)Iz$_Y_#_#o6>l#8{zT>7Ac@f09?p6&TwM%${4*JS_NsA?!EjtC*@`n3Q79wHj5h zoSIn$wq(qIfY(YMeZF~d-t)rT2s2zZ5X8to^gT-kpem7=p?3$-y750Cul5?8Wo;}6 z{ZM%(JR_j-YQp*VUYlFsn7gwW zcFLQ#C&OPPh#|x9XEG!zg#X@`9;k;V;}i#veT`a< zyaoR^v;|Z267U0dQha$D^zsTa2HEWqcp!eqzq?Jqo`8Ml34TfSAJTt~YLAG6S^nhP z(u4?qhE;lO8u{7a{CUKePf`K6S8!5f@`SF!ET5WJr&(e03JMOVKL1O@?Ap4!D@esU zupZxrIxD2X4uJJeG?f0_{hHw7bV(ANns|hMpUXx0-`=QU{tHlR4Z=3PgGD*g8nKWHQa#Y*#kE}EW~{QpUqn6CgvM$R#d^WO$0J;G9D zdRd2o;Jfqo->h8!%<6v+qWx_UQ>lNRasS4jr4aqw&dxWe_ACGIN4Vh-DEv1;OgV%p zu<`ZV(3-dZCfS7X$1;rnCVB67c;zVlN74Yn1|@izMCz}3v9JAJ=l_{Us6YO17BHA4 z;rum3sN{d^6a6zW&6(fOE;~E>N%gZo9&rl`3kv|K_b#9Q4*5h<2Oy}3$U;YK4(AHs zmmqofaZvsl9Wy^aUshHIgoC=ey2)A(N(zc6IR<}1A`gviWMOe9dEn^i2=K2EDd#`; zpmPBSjelTnb8`RlUBeL z0AOJM_4QB8l&NtE=C@ul}9Dbwoa>Z2(z1bpOeLGc25(oZ{j>0NnkLQHHhq zfL4do3X@oI{CQqm1RSoNr5H2qcOl-Z{&#{+x1kru!;R@qs(gP&_4j^01jGTa4ExUx z-TmjIVUN&Kcwn;sM1a@KM0LGa5d&HOv<(#Y@4k=Qe^DiL^>?4c@c%vn1LOb4y~vw0 zK&$8L$mgo_2#YccGk=hvpc7G#_WJB}at>4WGW{#A5vhQKa#+A=-Dz=+zK^oSSZilI zZ6@ts(NXQVuAN)wKqJ@@V7q+O}#+{P=MS%w8adyzQ{A!NY~&S zKj*CWrqaO)-QK?0d1imHW*mN6!JJm}r-Fkv^JR0?Fb|;n9}k5X^H-P6^?&Zi^&pNK zH&2{A&sXdl2LJeU3+PJ!_8CPxgi`m@o{b@~)sR4m#p=yct!hW^yCO~_NU`5febn}M z9$HuNjGlxhT>Kh-kfjLU6sB~TuJmd-mBtf1PI0~J+DfjI-eKHC}&zKZ(0p61w;GK1d}EW>|mM_m-?K#7E!4-EQ7A5VCgSwvZCBbJoSj&tL9! zun}wY%DVp5UY=GyJ^0`fphWJ-N{G3dRlZKEupgI!2o9NpA+ z7%rMj;I}Qa&2=zEh5>|@Z9bU|QmYf{(F&U`c5)4^{Wt({1cDP^pj#&WvXSD*5b?c1 zjpBymyiji7KSZ~HRJHIUCc}v9C;650N6CkP&f?+XX1anC%9q})1;a5481Lrr8(MBK zV^x_NT<|hBMu{`5$XfKI*e{FSZMdZpjkWoMvzYe22`2aa;-Y|c|J%W~A@~zLw9JZt z>tZKh$tC6uDB?sxM+qPX0j`P<@Y!o2*jkbI(RN7@7CN=APRttV|M!hdI7ZcBAI|$K zvktsjM#Npt&sB9^b;RniDC14ytaqt9Ul&+9)Kb2*YGwRzFUMyKX z^b}ABE{OsKP%7mrva2Tg+3`{;92Ctio=v*AxQMu~xE(KNP18+y?{oouRsA7MuD%tJ zLlr#pAJNvMUl;g?4Wi)i?@StJIz;0r?V$P@sBV3ZGH=?`ef2DF*En z_}X;GfC>s6iGW4`D1l2E;S$H&9lWE@{ZZhu_pJN5JvG>urA) zP;r0cuiyT`354BY_z2+OB-|vjdFn<+^!Bab{h-_7`>U7n`3VqKjogQ{;3uj3*VYN_ zC!f5(^-1DfCrgq1fykb-=npgyrqmw7Jm%Yo*A0__#^eHu_UQJPm(51d87zA}AUY|5 zvOD6kK2|~WOEcr2~;&8 zVe~y|>+0(2?zZT7j-Yv9*2Y~qVbbtp_BhKu7>UXhZaVj4mFF*l&GMD_q({v60!GxHg^Df{LzX8gcogg^#e z9n8&;8AA}#i4+)kuF-4m`6{t)yBTCW`A`Iu^8JY2O^~~KEsA{Ve~2GU@Of^V1#=JK zrm$+VlPlwmeK?y7m!#k^7|B+q(Q21hmXrN8m>Xp-u|@#Dl#6X_@?K1maUz&K8)ic| ztt=zYz6t^H`qfUCVEJ!IL}YOnIPT}U7iltqRe_rsSpQWxY$KQI2U0_F7`1X5M+n}LNjZF%x}%aL z+9r>`rQ* ze_JNwev2PQvA(Ls?z$Imp`)KiUI&mU0Z7b1h&GD>f}Yu%=%fdq0>J)2zrDVq*y3ny zZ)9WyLY$JtL$Ee}KdNk%gZjOn`ZvXQKTg1HuvAZ;O*94IEzg^E zXbR?iN?;KcJxOxyW~A%_y25xRuUB$A&`XA@Lmr?ds|X7DgOFJ3zH=6kG=5PD`+mo7rKy%jeQ0(X&8;5!{~$1TF51rC9)uKEWie2@ltx` z(W=8UvZ&R#J30Jw`WR|9yyJSaQ;#j8cPL+u3v3(_wH$h7Fjsn|6&{Zo%GYt6s`E^$ zSy)&ALFlHHCUdvZlz{i{PhLmYI7)Omhsng@;aa(*MY8sUA)5cM&GkR zPbu|mz~U~BmQrI4TyU!6nYf^1u?23+{pP?GSMop|&*wb_6;AL50d?jttni8h&>aLN z$}D*B%4bR67uPQ-^vgS2-$TA(VDcgW)m3k;MQPD{D|{E`Po9&Fkj4|(fZAotNYygj zOyh&oDx7U$^b14^?olZBIooYl~`W2o&iN< z3RJh}&&S5fZS~T$(bu26=rDT?64RFgnkX~(p_X9M@e1y9fj8m@pMmBL6jfHz#Wj&X zkwaBoG7CgC0It#`l6kI{U!?jTbL=^gv|i!;XCZGqBO8}J>q?d^mJ>r}Ra$PYvB3r9 ztZ$J0?}Qzx7ZMB68X}Oj&k}ap&z|+xdF~YIS4K9vZy21``T?=!0;rl~XUS14vYM2x6EMli=F3YU)LzkBj*xA^)H?o?srl;VB| z+}f2M)S|r&jpm!lps*zGcOv|6~r+jVo~PWB|Wfi^ChH`VB@LQ z7|y7Bpkb5|x4ziR4N=L3hLcj6;GAU07yvp$f}U24u29fmF?zL}1v;E1A3dSmiAnN=U5@QS^Y(D947j*)?K`VxA3AD(~UeCYbLIVZe zXC*g>J!-VnvecO4nWDqsWdJ0FOj6#h&zkK)O}h4ocjA<c}tZ-3w ze~9LRuzLpgG0OiYd&03d-KAtjax=Ij9r4QmC&lz3>{V8xV?+Ea_7&HIwb4=#bN5ZZ zpB~PIE6&>@L0x&4GYSxf|Bah9h1G9BUMPKYL0v5w8u^j8Ge0hhK{}Z(w*%6K0hxHr~4BG9`V7d%d zuAWj3T9n?F*sbd{#F>zqy40>tZ=3mo!TxX&kQH;4w#hh@K&x=KJ;+amk$G*4Kv;V_zKG=>)3Ga2)%W8EDa8bt?qq^ z@=2ASftYjXa!_RHjeZjSxHF0Ti$QMlhihj}BTJ>aUgX(nRjYWZ=M&`jyn7vCGedRP z<_b=K21d6kcZ~Ge;$(hFqKm94>$JI1kCUP7xm+`3Z|OG;sQdXUL-vp$t?aaG2#I3Z z;Jg%HWGd03g0zuww5mxrLW6A^YwHyq{mfcH}gKs$Xy!_EBZTb(;$cF56q z5GPzf$X7s|KGScOo=Vjzqag0D^5~_u#ag|pl^FHFo>wWpu%ARtLjz63Ag{RUVPUZE z6VZYWFxg*Kl2vIyDzty0Jb!`F z-~0e97~jfM$X+OZ;NC|9?W(D!pHz*EHZ|o|-iXX^#J$||`WzS%s z#i@)k@1X=0*EeS(-^XroJN4trr%N$AOAb_??&*8sqc1u$Qs74W{p4%*i3;5NstA5N zJmyV|!m=BW+7?p}0!vq8RnM(ihow$ZjuW3e149PL4kI(O?kx3n%R5djpD52q8Zb;( z@OpW}Qg3v<~XR00MqZ%Oh%vnv)KGw;x}6OKk4%m)Ofvb9syT^)IjQ z`+5MngJ4J*?if4Z)x_eq=FE>T<_QLjP1{^wp7_*vd7v%z+BL%m+LmS4@(u?tpsX|v zGt0vkH4c4E&k5qd2F3Ay3MmPRi(+jJx~8I5FmWNV_)fnO4Z0Dtx?W%U&xz&~ui!g4m*dKVm2LVYQY z5VFA8Y9Y7a%?jsxk#IltSJeUOf(==FN*O019O$fV&r`z0<2|aAAYhdtZP$QEd()

a^4Ncy2sW4WrZ0zxd5E z0k;>!doq-XSYP1@`v{I+jY*zfSApRR>~b+N7YO1Y?kc1#{gJ5CwtL*t2#PIt2i~%? zdke7G^9E+fIY5tcUYGRC5{imTs0_1X4M-_d#$UjJ-DK4!JSyG0&Lg+gPTsmd zogFP{U&4~t`R&VO6#%^XH|~G%$6oe)qY7&1IMWVZGO%pFOI3votG9 z-KqpSYV-ZVmz$r(tN40Mp0Cm-bU!cMSL8FWuGD}&bhd+iFL$50t-tX7?Fl=#9rcUO z-%rAU9s*s!*%6-$htAoaxWq{D=r`iR!iNzSKpplX{pfwvEY?W}bM!Q$Uht_s{Y3op z_%B75jSrU3b!hV<2}N|rI7Z5TpSu0Rtlre4qXy`#_onrBhsU%}t+y7N6*UYFz}A9F zsK~l%8e2^g1kRlLR|g%`P{jxCmW%lj^aboI`VG2I`f{}CeZoI*dDO_by^{WqHSp%S zU*UE<`e2TaV{`Ylsv4zaR#~q7TfUW?nf^YSGI02s>9<_%9sX52MuxLheCaaY?)>F( z(zsSSkZoD8_bOmv6^O&W-S>y;yQq0Mx&g^`Zuv~TQpM=Ci)JFNui*acyk)b)JuKH9 zTD#G~ar zzSz?>8k9^6%e~3ygYvb~ra%0qifZaNUJ44>d~|T#)2|Q8+LLb(0gd4>5?f>I=4%Gj z-MP9<w?eLVAOmKh@JG(#E*#C z_2-f54*obvE<6G{y~n!l^eHUx_&b;-b@F>FoVzYupcV5)kvb*c0m_7yOMdFc?dN)X z_h!f)-3#)>iF*;na`AqI${Fy``MJ5@Nss8kxcmS~TbM8v*2%9PW^^h5B~fjlZy&v$ z1_c7*3ToE-J8cx(K`Wj!m}ytBK$=bII`_vw#M z0VPRWwi8RHafyMNhs5^JYU>wSRQBa&*hUS?1@0R(P%7XSPok1}!qPmrQ6QPM;2mz;Fo$-hNWN|;4`76cucloemaTbXr#OB*df>c8h;h^A%?lG< z9}@H>6+cyU6=oH%jyAC!Jn^l)bSB-ifl5C~JnO;H={I*rieN;_(wD0JjLLAKY!eEg zs|sHBhy-|0V-A&8!G-cfj2HZ`N?q8zMZv3l)H-sF{qfkU=&w8pIyyev{Yb-z(H{Zh zcMyfF@ALtbYjd^hx$Kt|4&o6LM-+!LzE)O0j&Se-2DkxO#%|;PLJ)B9)lLE0E~VT| z;=8^c>o%=ZQzigy{CA>4Z*rr`%Bjl*@JdZxdl0bT*{WCt@#YwGRfsD`c?}^j z0ES)URauGG=9w)CzV*v=pfLC!-$cdd=e+HwS3}|Su9wX;{nIJljyVRGR0{|$oUjFN zAM{gSA2brVd0fd+MYaot3aD%Bdp`iWOW5vPof#>RwBthJ$Zr7fL&bohc9SMHqSQ?* zfJC?hefpdW;9*VnK8?(-vXr~n`Vb5m)}R;!IJoAgh#R|>#|5{22PKRwLdC(X$%9(G z=fm?IGiH=(dKPA88m`xZ=5)PFfzfYS-66o_35)gliRtME zRH&n#07$`(bsC4*6q8037jeX{d1u}+`wW>Gr|bI4fe8SEUiivzWLAI~;Kt66U0a_+ zOFTK`8B@y&UXkF#U#6lei@&bp4JyT!Kv7qwfGE@o^zcIA9qsju#(IqBVmK%?Xt9C) z?65F9AuN(JC})pcmAI|6ZLWA%=hQdH_ZhuoPcc^U$~M>iV6y8LM`-4)OiEDRT?}!@ z=0go+i`63hVyK_L;bMNiII}X3^5_l1Y(cs=b!!_ae&YG+m4nLL6b^%KAgO*`N%cq+ zjb!yO@FQTR;6xXA;CWa-ZQxV|Dr|#;I>t?B_SyN;jT4;6i2sOZpeOHh|Q$eThjv`rX$l9f`E8CB~abl=(EvY5^ zbEm$2&AVqT?3~l`l8F4bG-X=d2)A(0K6B%%MFB!(C^MH)5$g7f5cI9b-SgY@OB3iuH!4R=KDE>d#Np(`flRWcN zKRza&aa`UfOhxU>`zoOSoAv^4lKvp_RiU3VaPlJRcs+FIsVf*QhV=H54MwWVbLR(w~Vc!m zd29dSWShqg+7~(R92-!I@~GClB#SzKb5D|HPORgV(RAiIKu$KB6B}sG;DO?29T=3a zTOc*SbguCfVAl3QkU!8#i%#nhJpI=n^o_zHCxQwA_H;{DOG`Y|*Vg+A6LRkyslN~B zK1w-1NIH9eZ9(~oH>h|(Jk0`v?Ym*&1?d7rHxcRI(@7#UEd~digK5N~myDcZz1%Cd z>SKQq_V$!K@vp}YUS8>cp1j;rHu+j{-B|0v`HNiJHw~3usn6L*$WlXfD&G`fQHNj? zUllj_#`Dp7KrAJi&8Zx_g8ZO4_{?A{4NjX*+x+C!Rsk*$z$~#fYoi!O}zZ z`^;^&0qx5wC5WhZtgR13jv?Z-d&r}3`d)YdU8><2m-jE!I3}6LnZ|o$lJ(r)>u5qb zS8-`zUN^W38H1Ogtp$Aq z5JqKi@5F?f4D=ZNPMsg;mfDdpbd=#5eUc=>HEDG=Q^AkK_s#Z|#9v}Qd%d98pqK6b z4_!4M1nVEfo_Q_zF;GeozMC6ptU$Qr4>w+e{sKLBr1tYr#Z|xNvD6@LT!Zg&Z7t#2 z1GZ^6t#g(<*6jnB2#4a9NfbX?o92;lr%}azUz~Lj1wVbDHeg$%@EyyTU?L?T?h)=x zmykDa-hePWjaq1n`7N_OkuI;mwVogTGSL+-V348g53->`F;S02`ML@Ai^bOKKB$Rx zKG6pI!ao2vdzh4;PtWZwX{Mi0<)Hu${Ok+%X!LO(VMY*AX4$gepgW7?MR(ByOq5_U zYcQJ?QQ$-h`Dr|NNKSG;T`pxAdEB$(+KzQENE!5Zn}N9RcytIA1OU6YEDxUk=FTXQ zpj7FCO^n_sNNkA=H3-*N@le3g+r7p99)zJ9H=sVP(QH+#dAu=VL*g2aBcRPi`0r=M zHxN&TTBwRZZ{rRK-(qHk*dJtbort#A7nBktO{!H%a6l)=Z*aN`@Xxf#V3=l*kbkZ6 z2D6tyn}LtI^5;GeehQ^wOL#-bnu#Gk@l}s#kP|b|!6F4^_=fB1??(Z!!s+#Q8U5w$ zAZMz{z0fUYXqz!eB0uQO^pq6AYPD;Lu~1-9l~2jY*tM0c=PkUi*(P)I^C0wpH1nQG-oXwwxilDn}9bu4vX z09TdWey$Wxzp;GN$qbP2?rhR&@ZH>KrmLHEo?GHC!e? zyLOGEFAr})_#Y$02o+C!V#4>>Z~aFqZ%sO69H9%keR|>e@mN+?c;6!Ue+Z_-Q0+a_ zhp&la&(+e|yLWGQy%(8!&g<;#>|n~l<9}Hy)Tns`zb(t%_E6|raO1ek#QI_H0dAu) zKA|=o3ZzHmr-+l91m0x`{L9AjFjzZL@kb+d)mB55FA%Z)7kld#9^4f)mdV@OYDT+1n_kz+-C1+&+qu-b>2E=oXYLT-9To8EKf5Z1x85PQw>Y6A z`$($X_2io0c0)AYxlwaHIR_pnLV$Fbb~C2`9y z=2~BKe2yoJ9b;pD&m*?DqvTN6px~r$XR}D}Z|_wI(;r9F#;QLq)3XZy&%yV9*3HPc zt^W2_41=M}AWTSqIf++kXAAm)f=lLS2>t*|`@bxfG8>d{C#aIz2qhU-O>`Ha&b3xm zRn5%%wI5dTXu{HBWORpC35XduIF_l(X%dq7)Ss!6-uuxcHA7*CD9i`plmnZZZ7NAM2yBXZ zZrgKa70F-F61Qd++$>^U>87Qn<>KO!oe})&Z~5BVrK{0>j5ZU(XME(YPw>$NSHIxh zq>)&1rauk4G3w$JvGbC9;8~wt_m|(=uUXvhyRS1fT5|v8WES#+ON=#=s=n*rhFJz! zw+Uzc--g+c)&J$WwcE|2+|xJ}w!olFc(498(%L-~$9P3b-rxel;7RdUUjS{~u>0$B z%^%y2uO)x6;a@xKtn|ZQLu`(d|HsFjC}JHi$hCwII}=XHf4ta2erU8feBSfsuxP&O z4syeP+kSVmA3~?X~TK7_+bqxKW2bd4D~) zz}`1`)9>%a14vFtFoE}Z?)_6ZxaA7}m@vCf`@ZTs`*&q(MX+nEX5w$X!OXB9OP z#>?P52>Km$}!c7_#P}Uy7OCPDg8%%h&ljSj^>^<+d+pjm6B9DlKu&_Rf=cKBaBPhwEJ(fsI9j_2Ek7R_rr1CuT`1q24F=S@R2O-XU`XQnW$A{NnSvmXj` z6+coYuFdW_92r)XZcCVWfc{v58IU{roS?1S5=rm^UxuoM%4kQ>V(Gpwn?mB!52HeX zB*|I;U>t~jexN8Ube**tWm$%RW>n*mxKG004l``nVCPTy&(9J4o};aopx*K_GLF1^ zcN?Arw{|pE+Bbwy<>@EOi@yYagYpC=>D-szgHi{or8_f0dx5$e8EJ~{>}*$Z;t@mN z#Q82tnK`(I&g#8d~A`Pp!#qA?|d@55J)XJaZfTA#~0RTrkB6=1B z(TJIns&eKuyE$Om&Ye4n9|GY4+&b|3HOJQ;^jm`qAE@?PLld!1CgL^9#wa!^*sM;0 ze**c+=dR>Gm%A)YnObxF!(Kf->Lc>5FKNrrc>N4w4SpnF;nlI%<-%1;Aq*q07LPD+ za5(48ty#0?+L1$V=a`iT)aoy3zP?HrOL6}9rC1>TzzJyWcLy*#? z4!g;U_Z5SqQ^?&BcMl(GZfd&Y-p_hhKa`p!ZmrFOpe0xzQsz;Zv2NK=A8hkZKC@^GD($1TF0C1?YS&7J=+TzI}q9;>feKm6a7N+Rh;QydwJZ z*beBMV^uSn13lm+`EaWq9Sw~sw;TONrNrWm>Xcp5pp{p9N!2N1}e~d{jLO2M<21I;9phkUA<@VYHEc~qG9_}B?J9k2k z3z!>i#qJLb40I@iNt~Rf?dlFTCNOG6Mp2vH zZVpTPEq`|AHZu-~S9zXwkDAW&vybTLyf|%ro%tmtC1F`@if?at|JU)}QO~3*-vz1% z(m8;DBp=@}j#FrZsCNvZ%cJrFvIv|Tjl6$RO|0Z^^;t z?{EqCXD@{?*i(VXxNcFFeS)sd9o>b%B=w&mw+DUd+xEzu$Rku#=W-=1%NwPSV=Mtm z5O5LwsIyo&IqxBqq@<*v{S>zXGvY8qEtn#3t&st`h=!xIihO34Ruuo7R}x{K%1}B< z&9qpJq8Ca>#8TAacnf+cHyfnzeg9V3h9cM<&DN-@m*zjPQPA5iKo_rtyp65Hx^n6R z^&C$~w69WRaCnJy9nv~7X^60Zu53;JSq3%l6s!y6x00w-$b2_V3+Q65`Ol3KgbeHs zUbzir$G}5C_-M*9sR`bW|AnJ{2HSb{>ecU>W1DB0)+x0xmMgA9QChb~-SnTh) zn`>9lBCc;JaAv31b3E#~v1hnpo1h*nA}kd^f=OGhg$uv2A z4Z5*G$28ELors8tfQ=G6sA>eJs4qQ;2r*?e?&>aNEVQ(=P_hyW3O?ZBgnT~&_?tq| z(GgGBI60%ZDT-)?q?MJw<0(SvW*f?;;)2VSG7ae>qHPSM=EDSer=9#Ejxl~u-y=cP zeVg9l^&HR6vt}9Hu`okb9I6k-_Bb?#D}WhT^{V=uOw3S=^siO)7YbpZNNgO zFDaW74k#A3@h@5;ZcvlrJsz@wEw=-{0c`!{N zqHFI@ftQWaLqV5wDfAw(gzBiHJ*crRjLJEu?OKPyVfnC4DKo223g_uuxpC|IYR&$u zqdL(EUvG8{%Jl_34cuL(^(f?o%pT(j%^(X+uv&o~A=muEWs(eY49{_qAh9lCcD6OncK zQ+wa~Q5VR5TysQR=UnRXI<*jSX62%DB0}16fiZoav}IbK_8O<9cBNLVxLlRHw!kjt zP?*s$O)`&rYO$ZfP^`+tAu&nRu`u2ks`vr9E3XPo#J2A1W0(&vn3l=0K4@$>!J2r? z$oXw#WMqEY?u;$sx*HG!e-fb%I|yyqckGTJecGaMMI1j^8_=`7&&k??>t6`5g9}Cz z>SXD{tM${3RO^E`r|hzHOe>+86R)Qon-rATbAC9_+Lz+RckP^k?5_gu=A^c*2kZ_+ zg^3uk=h!n{>1&U2cl><4=)_5vJ91KfT04x4)k8ZtSd`=9;trj#j{C4)-$diWTjG${ zovsDC2vbCKD2b~FYP)eTv@-P0AJlvJ;|ZsfmjwhNT!5It&(9BB{3_2E*bQvl?Bm!2 z1psRwUR-O|Kq^K`cJ)7mlo!LRBI&5SrRL=1e(RoChU~za+FBOYw*uN?ew|x%)O-%s zcWv^EV#v81&nj|x{UdJY&^^v)E4IoN$f-_yf2`B8zD{ZOG^OHs=a=g}&o2yf^k{zB zr|PVdGSoPcztONZuiHeTh2ll`9n+lJ+>HISH7A(97E7w^+BG;n#`l7YH9rEuk_VFm zaHe0D9Hf6e37`Su8upBx&YihaR-s}4+~L@Tlw0QYLGY4JdA8o;&+~Q1ahv?(OZpFrd55&`bN;)=TnfKWJW30YjE* zkS^@kjXUtu_-WV)O_SHshZR0*<#FBKp_(1@ktJ0(fL8zdOy}0?S}x)7`}bKfeX*$y zOO4uV#4P!V_2fd@>vpZGycvvTuUfO6U6CI-EE!~TJR*Px5=@$qfibOf*reh_*Z8Wb=M z1a7<^v{WwP>Vg@IY7v(aWKzp_n46o24s!%OJgYRY{n}@JnUkVg(noxQsqCZ=a;RR; zR46*eyj9q5;_>uev#KovDZ`>udu6&r)`lB%#j8E;zO(P(<%CKr~lt-1qT zANTI}IF{3|-$9jH+2FKreKRwc&ZpY!UfrLZtbxm)i;6C)Wo#)=6cC{Qys*%$0f$y3 z(`L7_zhYclI&;@aQNp=zS#@mVCR+1B%s!|_)0)8rc9{`KGxc9L?hH5q_ZeVw6Y$rg zM8bF!^bMLL(VHY)*x1+zq@Wz|c^s(as>+!MOC=AHSO&2*0Ez6+?C>6KfzhdHqu~K# zCnqP6*d+(+9zfGHbB3)AV%z2Yei*&P(19}pB@Pgs?Su6A5C)|fUR4ryeDgvPj5#34 z&ePu)LBBIPi28*nf8f(Lrpa(!Ytk$?&z{2Pzd8KGk^BOxNeaWb$<#v)v$;*25~=|% zavrk569zi>q6}QOGzAH>7?$YfNT)w!#ak6YETirG@dr z$wL*J^C-l+_sZCfm%Vyrang8HQD|LARPYCOq9mI5y2;P;CIG^r5hx;-IMpN89v(9= z`6h|&qwXrKT+Da_G2d;hE!8L=XC!NfFz_c}qk?+GoXNyIxj|Ns*j` z(S+Cq)-65Craq3>xt$NU9Wqm0Uo4Fc)b+H2Wh}7YiNCW`_VRJ(WKI|1Q{#I-VWw<$ zrr+$y+qZ9><-ctdpE?ZY8&9I#)Bg{K#MA!%{X4vqQxg+QXgtMkeiWbS*{;a{=(8uE zMYU&E+*=(|1*{hJjhKPN&du%ic%&@|HpmBJ`>sEnMuMw2P6 z7k>fs2zw9fuN|?Q&J#8|KDu z4XopD-PMfS?pTX zhI!xfokA)}yXytlMlp*92fgsAiynXfo|P-A9R@kUjv^Wz zF3zXOnO+R1GAf_knYYcXa6^9A`{YG~lZpO2SVj$%uRk@Oyp?TmCuXGNv-XDEf03IIPBO-kCjC@D_lM^|;gUX&@U`Y@AhgQTqqg^b+>w2;%NY$d z;n$gf*$X{9SWmL^eRXGkq8B?gB}HU#bEG2TE9*+F`yA>RqPJoGa@?#OEt&+*iMWv} z&^TEBFLSAhMt8!A}`gZyF?3h6l{nab+>+4Ts z^I3TE=9B5)`jT1{7Phs?;Qg~haRN>6WkbiP=Du06Bwt}Z_U`k{eG7wq{e@4iQ@n7x z$?Vaw^`l?d9i3vaeS%G~>r=etoKGYE#Ttm$vkk zJ;LOix9UWn%O>S=A|@6o6-y1Je%yX%n=Zhwi`=Ju;!=AHrNoqqZi%F^Dc^agdr{}D zpNs0Yu0X9V*NO(HuFE(K`gL_CmRK48Y`<&AvC^(6GyLJhhnX4rW_?}V*2nfXHa2#? zGBPrj%N}HZSQDZ!?cmaJ%GIs=9A*$Y5ZRmASSJt_y*X^@C6aEF>{Zdiy@q|y_a}uo ziut*m@=n5=8VfVj)N)@I6o$#?$or*T`gl<)e^dG>{X35R{3mM+@OHs$pJ3-^xqDRI zYaZ7ObDUIe3b9MAu2zs^+4O>Ig#+kJ>@87ib zh7G@8{<6_c1M1g0raQxqR*gD zYA(g(z5#_{%ab3eS}IoOh0UwBI#gtQbUmykHN=tFYQ!-goLsc&aGyx%uxMqb{k!W@ z<3$uw1C0)T`|%o20d?si$uAWZTb)CD%9Hc&Wp%T9bn`U^i2UaDvx%KK2@w&vvC6k?U1fr2!Hm{A8 z*q~e=tXx07wme9mV`Iq2eOuxNFNwCCxy&yr+S;&>DdEz;wT#-g)6>UV##pw`iIN*i ze)F$CVlqPR z*}~n_hV|Q8nZ=XR)7>7(QMI!C>sAPEB|-FGYxqkk0t@x)xqjyJL+Ycar)Tqcu=zKw z;-Ro($2tlMAjPNou35v*=YLB`ETSeF{U!0gHKc?!5p_*$5DB{O7?CPeLE=oPlD_}= zG4SRMyyAzt?)?5(_CayDlnIsgOqXU(k1s(8`6JY@HQQ7 z+(KNMz{Y2-zN=0C+?pOqLmB_<+*xL-_>n>A*F^-Zb@s&Y3^g@1x;p;gKT2BoAFZn8 zIJ6VuqW)5|7x?mkA7gLf8*PIyhcPhq}7DuZp~n+b&dMNuKJtiRMrB8vU5kNzJTHN+8g`!8AXe`vGNcIfG28yhvQybS++J}CZ5-&coG zS{{Qd5p#jcYrf;a!Q8)&2}2#++B45}9LAhcW=_rk)R6!}ujdlnpFk&tV>dJseG?J) zm3}R9tHhs+E#FZexJcq(K@Cct7G9SsIrHIz??k7tl$6x$JCGeq=+G)+>n}g756A`A zh%xGm=q<;rA*09zEqWT5-8!%YR{E~ZM&h31K7erk72T%HNE&D^q~>GIKXEDpZvOS+Wu{L4*3?wFk+cEMd*c z8F`goTzm@7aKcfFdn3%>xFU4FwOvyg8W^y-@emrNkq(5RGV8q<1BcI~5E>*QRINX8 z@+5xfBW6WF7>Zp&NdlcK#H2yF>?=y@WsD<8IS5Ab2ANiPT4q0}Y$24q1wDEKY> zO8BiBTiXnQH>T))m3#kM*Wg}&PNKabIyP1clmz0Dj!p~M`t++;^Jt>YNtmufU%?sn z6+?i~ff6d}Z^s!^d3imFf) zugdhyOl%}*0_duCWP_B7jn`51oPlr*5giOu<}Ob~k#VSAw!op9On-LOUAjM){8iF# z80v&4;lwCp(|Z5*Bq9X(gnQskQC31wC&oF!C`%~E5H^@)C1?4+VzYS48Iu~rhca#J z>+6Y0IG|NAlV?Zu0W5elvnXo2)!Wr?6cn5y%EM zV$f>#oY@3xLG(R%s)(ccM$S)gEZSrNUCP;ExEb_{^+NiUK7;XBg=@rKquKe~??|4# z=C2*VvtBsNJsr7_|~CnF9&1Num?I| z5%R8KcR&#;rG21;p-EVZEcZAWb>oQO#mHa?v7F54U}#1TekW*90^`Yu7<#Pu-G|Yz z@fCd+A})}OD^W5&5|UY8d*I%QB2`roZNzE(XNkA?kqRM-amO4z@)n3X+q0<+{&TcW zphNGOCj~LN2)Ys2PuUvB!(c-p6&dR4dYwGE6Jy9>pq}efJy^Z$9<$e?%@b%(!Y$%z+h~H5hW&4`~f`VCzom>1ol_LsKN)p%9vHGw0 zkTd)VoHODBYyt9hqagpqmpjj{UIRYhES1|bME&aO>W8%aC&3z=uhUhh4erIN&AN*m z!kL6zFoWStI4HATAdZachldaG-`?U^$bW*4htmIiA9MqHn?AHqZDlR~`t|Dym^+9o zpf$tZZ-~}Y+hkmw&Hp=^#T^L$Td1yqAK0b>6N}{CtuU+{yIcRV7z-EImggZ}^~n(E zdkc*Pt6yU8fh!MytG_vx7rxsCnCd}_FeZP8u>s5u%{7!|x;i?ZK0Y|?K6uJalWsT; z>SYk1@B&$n4it1>pjxhHTb914n3a`uxSdT8P~fS-Zhh^P=@PBJ=&4ScvrpNfb8I$!_TV-g3b{upKy>Hq)2_WzOW@i%ZZ z)Yrc~Vf8CcQFesgzI_~HLZF1Z-9zc{E1B)2w2c?g8^xtW+8{*5)IyMu#+u>+ZynB4CP{Qhit6d=K&Lx)g8 zBqg}7|9>EoLGAxC5V=C}qNk?^-m2HH6`NnCBqb%KrKJJzeG>iw0z0QH%zHi0LwXA;vT?<|gM|wwEy*`F^Q#gUdkzZ2bZX z2adau2et-q7twDllAu$s^k7Cu1z9QtyHQ8L zRZNiSNs61ul?Z;cty!xy`9^d6a(jH=h_vHV;!40<{6>P?>mQ}|zjz_V&%gTUG`Dq; ze_XnMK)~b2j|CK;nq<=bkBc}zb`cviAnZ?(U>+Rq*fKPvqNJn*9{=b|C;sW_X<%m1 z5lKfG@3}`0dp;}MFeNVA3dKG^u=rIZohGMmZ3orH$jIn@$fl13 zm*m&4TASi05|%yw#}6m{T0E7%7H@+x;I6rOZ%PWgbxDgJ$~{vPlaY~;HgN~3|M9!^ z3B*nNtp2+=lLDot6ZZK`?8PfrxMU+?{z{t=#o2}a ziEZ1=&DSl2e@EHB6C9tL=(F#{{tE;Z`Ild_2IEKHBf(->P})L~#S#z*_@hTWhoFkq zOM$`dgfS6)FMG=1v3db~`EhdcKHBA+Sw))q`}=!(So|Y9JZ=|D3KHjTv!Ec^DThD|lNn0QCQmVu|qs3mH zJ^R|!ur!trf)u%D2)tljiK+SOczMb^be8KhtyrM5J|iVXJ4FIz>Z*j6w$_t=3coxFDv88ONmZKGxjD#>hAaWR6@6HhGjmXV_q8yT=0w_CR=m zh^{F?0f9J6doocv&PBkrLl+k#Ze>7*#N#7%FoYh)Yfg$pK0<-51*Hp};o_}vD72?A zw;^uiii>mQRstj8=_oxIsPR9J&49rI!Kp-7GUg%T;$}uh%Hh_-Gk^({_ZVLoSTU|V@{-KyFR5hlSePggv9ZYh7wJWgLN>gG)3NUjGs$qM! zM|O5V*B0y&4LXkxil0|krX?5*Se;2>SAVvBu5TwK73#u^!W85vqaV-2EdkqXU$j+TuO?7UGh7Zk_%b0l( z$IG`}Gfe?QDICo^DHy8puCZJN9c$xY(Ry{(hziD5qy7D4M!Gsp__i%(g{x9Eyw5)& zMp+cnYEXIy2hmXR9?{a)zEa1qx)qD6dN1r`7Qar7y@SL0A%S!1*NOHGcPHPi}K1pX>xSZ3UdOrMo`Mc@xMwdLvzYm=n>@hp!p;xTm9PCC7#yH_Y<+wn+NR$IT5Nnn ze~O}Cqom=Xru*4m)$c|+78dMo9JZXy%puD;Htgp_a^Xs5xal^fem2SWt~bTUPRQME z`xogG*92-4y6xwQ^MmX=1GYAnqwrEY0&CHX!dmGA^t`)ZL)O|VAJ`wfO>Oj$sD;$y z4=5TvAJ#`n^GL5PWqRAPO1pto^$QA#@N=AujKRVkA6}hrH{s41KB5qR3dN_$dZhr; zu<8^irSge!hOe94v`=1^9u1@A2$l%F8JQD+15_G2e0I%xrexKtG8db21GmV_e6^oC zA#%`6oRX_C?7}NJrj8Y!L2B~kepub4*Thq}ub5SyRh~(! z8_n{W$CzW*jxV9v+pa+2%!=|?8g_9XL$^eP7p_yOQAAj&B5^4NZ5@=;qv>po%?hG|60o&Fhl)L1Gh#+h1#UL0iiSf+d`*oP#tnr6a z_eb1oK`#04b-bZ3 zN$*9y8ro<*`x{YQoX=DX?DVsCcdrv}Y;Kmas-W!ea58tAR(G?!LH3S3N3+GxlSW&} zm;|1=X>)bywz9fm!oPCkwU>spSm~+@WQ^X(4{mNWXYC^mm#8^@3ZJ_au^e?X@@8!6 z$m}}XkoD){#cd-)`@yy!qE~{nlvautl(mI$G~ANOusho>=4L7`PMu?wcd%$X^Ll*d->Hm`0P1>3V}ZIm7~%6}C^E9Pa$EXz}b^dv`Sd^{0` zc>nKbblnEnblnI-ixHiT4@+f%jHkM5& z04fn|Wl#}l-F>SIZ|8bDME*2!*sfW`DD!O5E}1S?G+!v@N=^2bu*vcya^jUmB7WI^ z5l?rM#a|IHP8us}nL(v5EO~a6swlSNRcWboBHs~nmpHSmr7#1T`)TKezQ8Q+M3!$y zNixB!O}0`ovNJG{URrzTnre;yD*kCABO-Qha(Pe*nSKRQeta4Yhc&nr!?IINTl_|@ zgR+PnRR1XMs9aO!&`j5DB<9z?X0*$GN#rmFRsP1L#F*08kHo*PGY^tI2l-_sW zvlXpQPm$(oAVPy?%E<%3tM^gm50h}JFm6|y9io0EV=UXq9urO-gz=QWN}GQJxAeaF zdmN`6-=kyY8@w_|S$wB8c+OT>w8h4smqc!t!vwD|GupcwE5!{~O>ic#pESmnQ=5)? zquHVp98U>ovoB~9dFDg-Yjl%iFI?EV{8$t2KAq^I1+Od4(Q&hU9Nq!5r>Nk)R@*N` z&11qX^xnP+jvVTthxR&7N#d5}hy*7Ubzh-Mo5ZEMk|pqA?|#?2U2jcA1V^iRj< zbzW{g3KIxKD@0z#l{>QNn=CTbu4(qhM3$DH?e~yo(2W>r*j*@NYHi%l{L}+jrn4}` z*|fgvjlQD%*$s65ay3fcaHKJ;{c_tgo08)mo6EYZTP(|ksI?0sg>&fGjp5Hmi58Mc zov_6Zg+}Pyz7ks-<0*`EMJHAUOy0DE<2x_D{G7Gu!?CzIArQ~%CCq@D_3Ei3O?hZ$ zMn$7v6MXbp%z3ho@bM_DPHKQu{5JOuqvoVcnQ=#M)<$cFrnR@MtLUz*x=*W>Z>P_3 zYuN5k&PkG_b1HiqwtLuG^ji3ix2x865=|U7ue20ye3>5LQm3J9t~>3%fkrB#)wHj0gP_)- z+u7*=nK|}YvPY!JzB^k!8$SB4QU{`a?1lRA$(v2uDRIO^&NB44+cN?-3yCXga(=m#XqeNEskY;CPl+SOjq|s$$9Ea-%y$9rXz0J&+ z$ApB1MW1;2`lpyD{GT`zU6RyEvy-<1_d@;C~2~$qa<|adc1mIM0SHtKiktywt5KVRhgrwCkd-||HMS_xu~#1 zx;diN+jh|1qs%!4^QX?jcJQ@chyB*lZwh-J!joCtq+NrA^k8M#^+G2?RAikQ7}}jV zGkz8M678F5JuZBOhX|Ejj^e8w(11dea`b0=Fp;A@9Cfv3ahZ>sX<5&RoF6+6iCe)1 zEy!AAN(XBCVk_}3FlMI3Ee{m5sr&ks){L%~w&>=yHVw*MPho%GLHW=O1BKzeDzzO% zF)%eXzEwfa>f-vF#}e(YsXfEEQbK3RUtwh!( zQI<8XME{`F)})ossZE>suU!^y@DxMuyCXRwR|t%rPL=8k2*l4~e>!NSF%rd`y{mwo zCK>C zs`G&9%eNZt=s--xe=0gS9jlg^ z`AP{RoOI5|p#EA-uU>addqw}3aead|F_7!<+X~aQUWn1#ONH#yd3)V!QqK? zeSD5@yPx9d3_W35T?xcjqS`j`UJjR^%3=96ns46woZ(+tN8&- z_ur(g$~|Jv+rX45Qz+NHRd$UrsWg&sFoO$6(_RkTwIiP%r1^5E(0|pNXb@rO7YXc7 z*zRFVyJ|Mct;6iy$cPcI#U3=oMO}?QSJC6?=0_KUvda!_LG_zlG4t7xMX9&IkoU7< zrD!FB{U)9YvK+Obm1nzm?_MQu53#ItU6%1U`Ru*-=z?rawm=uvbsTpF#i_GVwJh)H zIb_Lm=z7jBa{P$bYTC6Al__k)H!$5rA=6Hqb?7;nv{k12;{FpeASI$aI?T4~b-x1@ zkR9Fl?P1xKOtO#q3#`Y$IhL`B{MN)ll(W0AKeLFww*oWVCyd`^l%0Kto~x#xKKi_N zPjuVNdJ-sLS~xeQSF?d;i9yy|$PtD=Z$?)D6CREp&=R4vXU-d`O2D^!bY-9L*NAPk zxmByvtu5}p+r1x6z=C7br8#J%Pl^1@QIp>Iq>{n<;jYag3bg+aBK+@UxW4bJD^XTZ zSVSL?PCSG?V$v15G4ZyGZJ5zhHRoXZrNT26_hr9`T(hTT@#t581+5tF)ac-&dyYf8 z3>D%^TUeZRFu;o*h;7vQO~~E+6ZhjZ+s^(~&n0fW@scjYQf)(&$1Du&El2nUp_R5t z)ZZ?bXk;yYM8!|H=5I>S@H(zZGW*AfTEGZ!=n(Fw$$oa1}vHS^>ZLgob>7U<`9 zD1_))kVZO;cIZl!wCNi!;qMoGxsY&rt>-bjQ@k%RbsiK9NFQw~>;q!@(k7U|$?E}~ zQY0pCH7-}ixivTZ7ny0;;-@j#+`P^{^TnmDvho+w;psA+*&CNVUr9;V%gt49Th62X zQC-_5`cYgS@wdy6p?;BfD#7dG=p##1^$8EeHmiu}=;*~G%DEd@|G(9&%e)KUaxWP`#$H~=Un%>-q-tmUC-vK{s-{;D7h>=wdplU@Z33XDrE>#{WNIWEB!j;tiyYza7-Bzt!QhLPXtdS9zt~KGPDp_O_-`_h0t^Gx zeeQqPKv-JZ_>i(S4V;30KZEH%o{=DIId(k{07U?C%$)>;yo^85m!p9w(<1?*p=J+M znA6}BmqltJ{~s;nm@}+`0jLPDc(qm#p04}19uN}A0|fxGE{x&aIZ==(ji3O+s)I~_ z3??adTxM_wU1VNY)$KL`1)64=-`%AAk8Y9x)}F4eF2HF3u^bWttE>C^Q3{ZVf-uDS zS4jbVfXQS9*mwU>yGXaCIej{OGzjRNL1=RvkPScx`3=YB^2h-1apO$sHzNr^3L7hv zjkQh91emtW-#oGb?a8kd*$$3leQPa*f&E)SOumHkB54FKjC?g}ot1g7p<(r^t zD9}P&cF4o3{jC@M#r*u_GSE}+9~=Pw&>9Gxyz;*c2#>1D^m1#^SJs~jI5cQ^pq_uH zq>w%}&qB$P=dLOr1x9xKIGV&DlGZ|3fH2%YDJh<_zov$RNEOT9SCMEL{-5))ES)%B zsQ!QZl`I6%B{{!py$neL%i&+dz$}oCrbeDZha`IbU+loU6qrCO9dz8k^s#^7KbX0zCrRI55as}u-LvlU5Xeol0Nikp)oaIDpkk9|k7jSTMq0++I;BR*(SO*| zqYS1H{5sm!KOo6_hX*_Lu7@)o4o{6|-dY+u?L_^D{dr_Uzr5cB2nz_30-v|WoGuL@ zK{X&(Dp0i;n{*ZBwpR=23EkjSxV)kU&h=Hjf=nJB5TRdj+@E_E^U{)hEl@VL4iv{n z=mmO*`$}|cv5D|f1GJZ?y3e^-gIMDJ0fG&t>N;RZNe(C<0U;FERQ^4BD_QVS?giH5 zXK8pRNS?a`%5W6P1m2C-W#XQVHo}ZW`o%|Aw);dL%q}xuj7^10&Q3k*43FoLzpQh! zzE_;M={?|FoEGiwsqW$N%I{pz)J&$Bco-`=#<)$}PQlKQpBi2d>WqN(^ZX1bmII{i zDELU_S581!xehXgpMHA0uvbl63qSL7%^4A^4Xx7`lwwLk5Ty$_tBhal;5Qm#QyE_` zSC;dZc8PSyKt>yCE)_jJ+EL&SSQuf0A;8%MBrWl3r#CrZyYGP2Z$e%0;KSXd_4}>t z!;f{Q80pIsCuS71m1>KedZUXn6<)|>!*DSmQY&1>xVk5 z_tm(?srm5wgwMh-BA139m-^|gEf|;J=!gm!LzgxN-f{@t*k2L=@@x{pmqPzH7tM+W zVBUs+BlojZ`PDfPdIgxZKzN4}VLvR>S6&@zM;ZeXK9(u|SmH6}nE;SRtlzKoVyS~} zYDdQzlp73Z&Jv*98hR(t2i3G!6jaa#xBqo>*PkC2g4Q7Fz_e6+JdBha4R9fLsU&nW zTrf4QoJoBb-zZtAa|XNOPuzS_YVv1&(!Bf4b^OApixYSnVt;~~odTl-Hs8&ovw`zp z6c`}0vdaSc0``_1EH7ZH9y{Vtl>t7ZMiw^ZX$W^V;VC#$fXyuM`iS~vb`xCzeqn*@ zpzFM5U+rZgbFc-#oczb76EzHSw_L4`L}dT`FO^()ZRux~;I;I-^oo1*rwSM@3{$D{nH!A6vZOzt)+uF9+T>FP7OpUsy;sAV+1IT(}i zUk+x31E zmQ06cKMaMNJMMDdNtZ|N;QAtz%1WcEJLd0o#Je|VWDHeJOhutx0;)?M6hiXGI<teRo*T`I!dh@!Dt*)M}B>8b)5Lq$c{{GAxA`^>OLcQo=W8o1QePsm&7aLU}$J75+*YkhjHb zrezY7ljC!J>`(qj*Nr)$_O}(~k=yu(l!m{e6YyrI#~7LTE*M#TnP?W9MT`XRR=M4M zoCXg)v2#j6{?nt`gzD22@n=WMo%CxoG~Vl&Ay;OLs0irFk&k_aOx$iakAk%5(xL1u9z1j47 zw|=E;HI*tntNwJ5nD(Ps@BS<*ae1VcPe`YS+Q*-se;<=jpBxZ?xM&VJSTm^34o$0E z#;#$F?>VL%3lB8lxL6k)*qwko#k!fVTT6KDdCL|l7kkc{h=c{t?``Bw8c-Oa-rG9) z@EVpUA5@IMMh89TcQU$P)H2B>IX=prLCypR;5&VpTI3nhBPE2_A8{ih4z4Iz5(Nq# z!^e(OSM90p>91P87~OT5YDu#=ZqKwh$1d+NS1Hm6p!}ZS(~zW4U0nQA$AUO*gWskh`>8XX9Ov40tdwJnoUZe3 z>FA_7JI7GLw^)=?(=%V{;1BjQOe4QWIz}bm4o)!e8wr`gB)Q%htjoRru-aK-d_yx_mFzC*Ju^Y1wlEI0a5`oaB2_n&vYIGhaRY{l z4tZN&*L$k8FE?Q1A+cEE5;r+U0+y+g;g7^Ym!Eb zVz!1Y*ij=Mr$4`-6~uwK@xfuJ;xnDraKi$>ToBZ6W0X5Qlus%My)|5;)g-J)OWmKs zWLjhVBh-553P&x2i{U241j2G`Z+Tmz&ysa5+kJl_C36y=nowlSxjdYAu#I1O>xK5> z>)$8NocR_f#XCQ@k1}$Omf_fP6AY?9(Bbbca$e}xIvX6d_PA#&Tr`F~hIPwGKkrb>J>RMb`;yKo zS~-u@kUZc4ojNjwS4Y~|(Hb@N>&wqVtC>Pxoc5Q_Mvp8WZ@oAyFZ$(nIxK7boxD?1 zUO;5c3 ziXw-Z80TRMc3-JS-?sgo>T>it%W!`1{9MlJMFlU}zFf^3h~<51=^#gZn5wPaf+>#h zrZ5sQwYseizhOH%N-;5CZ=d%{#q9xccL%1086D5D%6Q`H#*jam`N3+plOuiO_5yWg z6x7#Bvq4IuYktAsyDR#I(Yj`)InOQzHO9u^BRH08HGYm}d~-KwBJ;|C{j!1%wZ$t? zlkddQmn|05p#YUmE<#nEwRgWm}lJn zQyV&g%vbJtN}~-d(B}h#XcE>mYw^1;RNuC*Ch}X#W@gsCPK{sqwG!*U-@6dAVoM1h z>0}8A9%jk((6HZ7xjz|vRu~!yZ z(PG#|y}ULWL}kERZK|X^)hlBegpYUYLh4fw?h7njzM9KjBU_Vqt(Y0&wdPap8mDnu zfE5M(6&koo;j_6v3+Xht70#s9R%E=kEFm?Hzp>(ASa=itO@s&9{^tW(p0PxSjEHEh zc2Oj*&UpDEoc$z=!E&ju)y^D~7;KWT_CS1YPYA)EKchjuI&QyAsDOIze7DjW*mf3$ z>U>uWnMKvuN4*UQA$mO?ImyY6YpK3)hEVpJ4t+2ynA&`8d6>~q4G}UsHTuyouk03k zxjimbyl}zOtsBGi4fzx4uuxf(_i8mLdGm*&(JZo)YV4`lo>FbF{tx9~3SrOLaX%G_ zQcF(4`p*ifl|0*Gad{EZeZ+yqeuHw)Xin$rY&MN|7Z3NxA{7ZWRr3~aKc}aJ^Qp+E zepH{6x`Ak2L)n!C25!Pti78yQ6taA3E+bc8$%z3Ox87MOc;!E0-vWJH@_{-NpTXp}$W zfs+}rs=l8)>xcC)`v+)N zra%|ZIzutc{=iaiB?Q}4;WTiOAUk<1OB46NT3hpRx7A7?)@Z-7gyBbd049~9qW?*{ zf0SL0-&XsrAa;4A-;EnwZf`~J2ZiVDoH=tNZ7|Q{+X?NRez*+B%Kh?yX3_AB4hyub z`=Q6g`whpWHdc;?z4gkw#P%Td8J${RT!sNmB7byZRH-0Om}B&CQ1+uz#`^~1Pr6#Z z`tni=aCR^qKi5;|U)#!UUYG37#aD8di|DAFu|kCUHd1Bkw4h$EVp^jH6ul5|l&@C| z5j-rDk9=ki(~&jvG~{*shhI5qQIDQAjMXa$cB8C@R~L!H!9BT;29!=8C*t||b#b1j zsNteV2d>x7+^oSTS2+%E-#C@J>0tc$4XiY;IsJi*^-OH#$u2_19LJ&O2K>BTSpAal zmvrXw!e*jtcOcY?F!!O2we%V_JKCj|oY1iD-T)&g z1coEXXed;Cgo3$V4ZOd*zN#mBPD4sLlpA z_}KOJISrgMkEG~hG06R;xJuAGT%3(qIUNZlZk!scms^!|8bL45jxl=>8j}@X@e59pVkh)~w6`$JKeFFAn*0 z(OXdNL!6}u;$_U5nrgL5aLsy~3p&SdJo^#CZ#KL&ycMp#Rbn9S(Tq!r5`Is}2|uph zH9z%cQ+29tlKnvxk-JNtM`yK~x~gD0WkBO@q^9)8Ekf~@hY4Op9vHd_kR65DK*Hru z21Xm2RC3HpTN%fVYFSU9#b?WsLVMk-1M-cToFjm&jgbcmB;sNKt_}O`vwHn==|6|& zqjXj^f08(s12PkrF336icU}P&TW_VTqq8}6SGvsP>}(Rr9RcJb5Q$6AeXWe}W+`*~ z)-&~`gQ?O!a8%At+=aLj<5WS z1xxId3;wKf{|8l*lY|0`->mL#rb%QwsBBJTIIE#8_%O$Gh+Zn`q_1md!0sg{v&7%% zq-gtG*pXD?xzA?^sX!*l#ngt&QRVf~N;gu(k+@n;mCQ3MgR{^4|b1|y=4f5{sF*WQIJY{FQ73Oz$F_R8i0867=>_@bTRhnM*)HW z;BG{C%z(TXAfu;q;T6(NfwEc+(2W5r9K-|oY^t#`BSc~T)QFHB#a^SscdzVss{kB!Q&3fb{gTR=vKxsyJ-%z7V6}=W2QC;HM->=iAL-6#}Z$2v{i4X)5}v{>Idt{S3TbQp5Ke zI{}fQL2t-QRI=xKQ(JG+vxINl3EB3Z6GUyZ9}drgG!KjL)z`e39kwnC*D#sQLYK== zRzo>^UJf z$5#cjYnlm}KIrpW+AGj@Gue!Ix|CQUW-mztFY%R9lVP*+T7!9m>|(`_(<|s{nO;^6 z2*~Zq8J3KGU2ij)(i@M|!-?NMy4T)_gcyJ4(pI(i`6!u`Wa4TE?B(|#MP4%~bt!y8 z?%bh}7EO`OfFG(h8ZwZcUhrYmhop{;wN8d5bB)BEHb6bLpQ$=Rd*i>QrCKjI!VB&v zpO-U0JkSfAwXtgG#xQakj(pY3x!-oqknqc<>tTao$AMSU#YLFwVa{6>v(O*6I|w0!?XY7iuX`>4h-5OP(6P!wNx*D1fc)>iloEaa-n1cWBtBeFHOemI$F-FFTT(}~p+*kX8Nu`Zil0Fvh{fGwwM%b=q|1U8PS8z!m^l*&835!1oE>mj*N~6 zNd~W{i+tb1*mRm2?8b%9l${`azS;FUPJU@n@x@!6K};C!$eX?*@nNioCacLpwWejg zHoD>*HT=zVbXVCOT(21Mpj#guSFhBAOTBD8PJjj2f5PS$hTW=IC3bmX#+I(~d=LB{ zeam3WT2h4k#bximYS|yxXq$>sYb%J}E=q45@jazAMdUm|cIi~ka%Gw=hHdww!{z;_ zg&AkagMr z;r%6%mhAJ3%O~2mFO2_8-CNbB?}CdG!;}VmKzIZ)7dRd zxo>fCtKzT*}& z;+Xjr=k<&>GP2`?i~|z9@t03T?i&m#_Wg?X*{KW_>yJGMl?UT>qeC9Lh~a0>%Q@xE zoO@W))pmd5QAbY@o5pB6h1urQ3(_dDu6W{}kU=Ib7D=7j#8U4fO!lPn3D#%SrBA&6 z$s2szrsR^=$eL<*Jw+NHwB@|48&!xs7mmgPUfj>TT)mW0y#F#$F3x$i4o2;!WIW*! zz8BoeI2~iY;XnOicv7C3_1a7M(9GI;udypOc8c6~m(De=k$t|6z_L{>7Fnn2bejRG%@tb-SQwaML*h0h^>G0NjVU~?^btM2@=?f2LJCZ<(2KB^cl#TlrM+YFj_LGOh~ zRgL@kyI%`FiA!(Q(PHmnB=nGD^0%eg$;hobx@Fi9ETb%)rXq0+-y?1X1PD#9oo~W_ zlS8wb{qS=DmH+Aua29h3TOUezq0JarhY{ys)No$;E9`XmEgU_qoQ{I^-ocLNW3sJ> zk1Lre$x4+FCF`rKU^OcHiE6zk<*&aMY|&plPP+$Pra#+uirjViqG??>pOP64*)&S{x~w;$_}kvqp~m>bZ2eQ#?@9~=#enuaFa&oH=W`v#Subj z!%FN~3(5+!`mw{-M6Q<}tmtpDjW=83rQH=I7kvG$J(S<`wiQ~*mwDx+Di^U#$xgOA z&w$Jx9lBuP+#@6iO>_Sl>7d``jbsUtvKA+vy9Dju1_xQjv&gvTll*j7@PNP75xHj; z@%0K{*`l>PAa*vYI1T!k=6vL4Y`z~KRa!NL$=Zvn_*X4^bK<8ej2ZVB7JWD3W zeEer6YP*GACp7VzS)7%@I4cc{qRd$bIaN?4XNr{qvE40)u29uIS66Y-O@EhgNVl=z zH(+9Hf;(~HmNG6JEtQ@4DRIAsXEzdjGVwjem9wlwL87D$JVz2{U-4-io(DcJg4TK6@8rYtN%u-1nsdW)Gb^mceF zfyRBcVM!)`c%Ho|y0iY|kF*Lxl)vn*IL7Kz9K0@d>xJ!cvbzr2jlIVTjZ%l7@4eR= z?@KK|Tn?GL^7eSh4$r7Z^>eI*tSNK1U$Qg|izxtJAu3+2$pWC5|X z?1ZgAex-($?#HCE4|UrCX{furxV(LC>$!Wp$qN1h0knq)8Ig|(U6y(;pH@wYOW0zb zNA{n6LH3aC1UZ7)8_30NwJwGj1(vvV-@+Z+b3~8$^Q~M(^WU%_G|wnAGqgtx?50lo zkz=|_o_U;Vwv@jFHOnQ=@jcoY7;>>Pa==_&)vE62+PiFs`+^VdUx^Zl%0mih<3^9kAm$Vrtmx}XOmj2o@6v!+6-aJ!m zC(*1lyr(m*%aNT;OdXQMRQ|AM9hPIYwyYgxsgXcL1%CeJ-XCdUR7_lqxI^}VzA`zl ze`hFkMtO;@NPMV|0^xKW&z)8-8~8C58{OR<64 zXQ_88?7wOA153vqxtzcW9Z`6HW9l`lMw!+~dBcHS$SjMdr8>@kxm0S6;TG=Iyo+8z z?#D8pmCCX~u#Job5-d!%+_s)QX})sJv7&(~03~@m$=hW~S6JWZaS_LaowZS*Q_{rY zN+C~ErMS8FnC$gOZi;zg$(+#o1JM?bo`IU-T(^xczyzMM#thOoe}0~$zvNMLyIg~2 z%uw;cUiHhbE@0H^81yzpT7$a>BIT0+b-p^$oHFQ_i1fWaD;;tWtSJ#zvo} zKTkbFp4d~@Y8sZro&1!&J96&4ZS%1X!h}kk)b-KftA_8=LV4#Ie+EEG`{V~( zKkUSV*QE(5Aw4mNmoIXX?Hn_sy|dey0ikf|L@7o=de{L~2-7)c%c7GUWax??{7lF$ zC-i4Sx8#=^u5j#7O|%wupHjW|H@Rz_F)Vw%`!54EmfT_rIXRf*CVhnA6I4Mc-v!nd zM-5lsW}WIFrw^T|!@sb>&%x13_`Tnwom-vV3x`ofZ-x8weaP!aH=WUof~azYSqRo- ze#7Lz`(O}?8fEVL@lGtj%)9;`xsIlDM~H<~qrt12{_ody=;XMn^B?JvBbbPXhlbQo zB00M&OM}Ra$#Z7!H}X-`dlUtENGx$WXPrCl)Bj{vyYy!}5pxUjC?zn#qrS z^H8=(XkkEeHNCG~5PQ9yMP|b&rjM~MjIhoh8d4U33M!I+QMUinyT;C$ob3A@4~E-k zzmz!yoO65jqvHz1BT>PPM^|BGpnC{&uQa2XV0yH40M1f z#v) zFOc=^0R^)3j^s(+@ye4~sJ9f0^+WHZ$_7C_r>B>ohW;^FdBr|%NPNO~|6|;Gd#q0E zt~UqtQt=}?u7#VAXmng@Jx%Kv=}*}kJ2A-AkkKly9%7hZ>O{X`FUsG_rX0IY2~QXk z1|N|#45*@U{pl}pd26F(5=CX*v+t^QO;4kdG9TkS7?(`#mm|eh-4jbp$=vnqWZ5A* zw`h?!Y32BXo?~5_NXCl0c%iG}W7!CSb*W8l&VVE+pB>!*?axkv;0PmQ;)AS^gMSMJ@WFNK~! zEnocWv*UxZX`~e8m_C@^eU^}F<)5@ZqyB!VPwwHeYo%tOu@PwOa{{&TyK&JpQvOe4 zwGdw!Lw9CSDdO6d<637x$PJR8WS`5yh;%aFAXOgnwSthtn(qpK>7+$!JOPU+fMPY$ zNS5@kC&xm3slbbnKdRhzot0de_V-hNS3BxBaWu_Wprp2B72s6y&vVH>JO6oyN!Ule zzyE*y&$2SdefWLzPv`Y89hzSGZ45^}QpJ&)VQF6Mqq?QYSG~b=@y_VFpe<6-x+iH9 zFUmkMB$E9wpjh4Z0hJ@k$XwNo=Ay6}r@(kJxuMkvW73cA)|+!oXjvA}QAIVJt7Q@C zN9^|VzpjV)ih?B>{0uwVpiUaW=cKGJpDD-Me!mUkSqt5SA7T@0a8mp0;iYPFS5B!M z4aq!&dqpH$eQSnx6-uxaSyfD&6J#YegNngqpPBVM=#K_)mI~p{4 zdQn;V#P7MW4*Q}kcWT)_}`gRiH;w5Y)RFrLsBIa&Xj`oQ)CqS0|0^yv9z$q(;a zADkrC+&p^l(-0{~U$*m3_``2MAxIX8QBIA*0lDFvpdrt3Q1nkgY~R>`ctKX z-;1WMfW+W4$%3ifko;m>QBxHq?xtN52gmE~IVG}?k!3w&<1F?wYJMr(ZpFg?)|{P) zP&vAKhuXr$y6ysl-SV&H6}9HImj#U|j`@Kf$*OGn!3&LMcd{Lujo*=mqjfmhD7mr! z#n>q2mK#;Vx-?88q?(>Ivp0dWvH9|$JpacGrzrz*vmGqkw@Flf*T?vw$@|u)0^A0C z!6+4)Q+9lNle?|=GplGTR~*LTMp|F79^C@i3m3xuvYq15hIZR6;U&&g#a1JV){3RB zh989#bTjW8_Sof`=iEUpG-DPn!uIACfeaHm8=O8UvgUWzjre?$^SANZpAXq_v$b=P zc;BEdhW{yMxigl!s)xcA2CP2t8BztVIezfwcqt+=^0H*L7yQD4 z|A{Z(*>is69WB`Xnvk7_)s?d9PuT+uy*ka%^2o#Vgn@+D7M>B&`X*DXOldJck)Pp^u)GA`7TFuI@M_-T4b`MozL6%D5j8!O>WjQG^lODynDE=7v)e-&la2UEA83+@PyO1@*&f zJSJ1oY~C?2$)@oXTr~21_1oD4{Sp;6f~3}J`VU~HQ04bJRWHkQq1RUFM9EJCaW8In{FOUp&Ywr(_SYNrL0laWF7mW-VW z6NNWKG==e{(q6W{;p$)CP8IKbXl|?h^{8O_;i(zE9)HNZq!;{B203#(2ih#0_!ph5 WgRCQTA^!!>U${d6 literal 0 HcmV?d00001 diff --git a/models.py b/models.py index 80600e855..8518f0d1e 100644 --- a/models.py +++ b/models.py @@ -396,8 +396,9 @@ class LiteLLMChatWrapper(SimpleChatModel): apply_rate_limiter_sync(self.a0_model_conf, str(msgs)) # Call the model + call_kwargs = _without_stream_kwarg({**self.kwargs, **kwargs}) resp = completion( - model=self.model_name, messages=msgs, stop=stop, **{**self.kwargs, **kwargs} + model=self.model_name, messages=msgs, stop=stop, **call_kwargs ) # Parse output @@ -420,13 +421,14 @@ class LiteLLMChatWrapper(SimpleChatModel): apply_rate_limiter_sync(self.a0_model_conf, str(msgs)) result = ChatGenerationResult() + call_kwargs = _without_stream_kwarg({**self.kwargs, **kwargs}) for chunk in completion( model=self.model_name, messages=msgs, stream=True, stop=stop, - **{**self.kwargs, **kwargs}, + **call_kwargs, ): # parse chunk parsed = _parse_chunk(chunk) # chunk parsing @@ -451,13 +453,14 @@ class LiteLLMChatWrapper(SimpleChatModel): await apply_rate_limiter(self.a0_model_conf, str(msgs)) result = ChatGenerationResult() + call_kwargs = _without_stream_kwarg({**self.kwargs, **kwargs}) response = await acompletion( model=self.model_name, messages=msgs, stream=True, stop=stop, - **{**self.kwargs, **kwargs}, + **call_kwargs, ) async for chunk in response: # type: ignore # parse chunk @@ -504,7 +507,7 @@ class LiteLLMChatWrapper(SimpleChatModel): ) # Prepare call kwargs and retry config (strip A0-only params before calling LiteLLM) - call_kwargs: dict[str, Any] = {**self.kwargs, **kwargs} + call_kwargs: dict[str, Any] = _without_stream_kwarg({**self.kwargs, **kwargs}) max_retries: int = int(call_kwargs.pop("a0_retry_attempts", 2)) retry_delay_s: float = float(call_kwargs.pop("a0_retry_delay_seconds", 1.5)) stream = reasoning_callback is not None or response_callback is not None or tokens_callback is not None @@ -760,6 +763,11 @@ def _parse_chunk(chunk: Any) -> ChatChunk: return ChatChunk(reasoning_delta=reasoning_delta, response_delta=response_delta) +def _without_stream_kwarg(kwargs: dict[str, Any]) -> dict[str, Any]: + kwargs.pop("stream", None) + return kwargs + + def _adjust_call_args(provider_name: str, model_name: str, kwargs: dict): diff --git a/plugins/_oauth/README.md b/plugins/_oauth/README.md new file mode 100644 index 000000000..7f0f46ab9 --- /dev/null +++ b/plugins/_oauth/README.md @@ -0,0 +1,12 @@ +# OAuth Connections + +Generic local OAuth bridge for Agent Zero. + +The first provider is `Codex/ChatGPT Account`: + +- signs in with OpenAI's Codex device-code flow +- writes Codex-compatible `auth.json` credentials +- refreshes local tokens when needed +- exposes a loopback OpenAI-compatible wrapper at `/oauth/codex/v1` + +Tokens in `auth.json` are password-equivalent credentials. Keep this plugin on trusted local machines only. diff --git a/plugins/_oauth/api/models.py b/plugins/_oauth/api/models.py new file mode 100644 index 000000000..02ccfadab --- /dev/null +++ b/plugins/_oauth/api/models.py @@ -0,0 +1,13 @@ +from __future__ import annotations + +from helpers.api import ApiHandler, Request +from plugins._oauth.helpers import codex + + +class Models(ApiHandler): + async def process(self, input: dict, request: Request) -> dict: + try: + models = codex.fetch_models() + return {"ok": True, "models": models} + except Exception as exc: + return {"ok": False, "error": str(exc), "models": []} diff --git a/plugins/_oauth/api/poll_device_login.py b/plugins/_oauth/api/poll_device_login.py new file mode 100644 index 000000000..6f971b496 --- /dev/null +++ b/plugins/_oauth/api/poll_device_login.py @@ -0,0 +1,35 @@ +from __future__ import annotations + +from helpers.api import ApiHandler, Request +from plugins._oauth.helpers import codex +from plugins._oauth.helpers.state import get_device_attempt, pop_device_attempt + + +class PollDeviceLogin(ApiHandler): + async def process(self, input: dict, request: Request) -> dict: + attempt_id = str(input.get("attempt_id") or "").strip() + if not attempt_id: + return {"ok": False, "error": "Missing device authorization attempt."} + + attempt = get_device_attempt(attempt_id) + if attempt is None: + return {"ok": False, "expired": True, "error": "Device authorization expired."} + + try: + result = codex.poll_device_authorization( + attempt.device_auth_id, + attempt.user_code, + ) + except Exception as exc: + return {"ok": False, "error": str(exc)} + + if result.get("completed"): + pop_device_attempt(attempt_id) + return {"ok": True, "completed": True, "account_id": result.get("account_id", "")} + + return { + "ok": True, + "completed": False, + "interval": attempt.interval, + "expires_at": attempt.expires_at, + } diff --git a/plugins/_oauth/api/start_device_login.py b/plugins/_oauth/api/start_device_login.py new file mode 100644 index 000000000..1720f552c --- /dev/null +++ b/plugins/_oauth/api/start_device_login.py @@ -0,0 +1,36 @@ +from __future__ import annotations + +import secrets + +from helpers.api import ApiHandler, Request +from plugins._oauth.helpers import codex +from plugins._oauth.helpers.config import codex_config +from plugins._oauth.helpers.state import put_device_attempt + + +class StartDeviceLogin(ApiHandler): + async def process(self, input: dict, request: Request) -> dict: + cfg = codex_config() + if not cfg["enabled"]: + return {"ok": False, "error": "Codex/ChatGPT account connection is disabled."} + + try: + device = codex.request_device_code() + attempt_id = secrets.token_urlsafe(24) + attempt = put_device_attempt( + attempt_id, + device["device_auth_id"], + device["user_code"], + device["interval"], + device["expires_at"], + ) + return { + "ok": True, + "attempt_id": attempt.attempt_id, + "verification_url": device["verification_url"], + "user_code": attempt.user_code, + "interval": attempt.interval, + "expires_at": attempt.expires_at, + } + except Exception as exc: + return {"ok": False, "error": str(exc)} diff --git a/plugins/_oauth/api/start_login.py b/plugins/_oauth/api/start_login.py new file mode 100644 index 000000000..a2f7ad4b8 --- /dev/null +++ b/plugins/_oauth/api/start_login.py @@ -0,0 +1,54 @@ +from __future__ import annotations + +import webbrowser + +from helpers.api import ApiHandler, Request +from plugins._oauth.helpers import codex +from plugins._oauth.helpers.config import codex_config +from plugins._oauth.helpers.state import put_attempt + + +class StartLogin(ApiHandler): + async def process(self, input: dict, request: Request) -> dict: + cfg = codex_config() + if not cfg["enabled"]: + return {"ok": False, "error": "Codex/ChatGPT account connection is disabled."} + + redirect_uri = _redirect_uri(request, cfg["callback_path"]) + pkce = codex.generate_pkce() + state = codex.generate_state() + attempt = put_attempt(state, pkce.verifier, redirect_uri) + auth_url = codex.build_authorize_url(redirect_uri, state, pkce) + + if cfg["open_browser_from_server"]: + try: + webbrowser.open(auth_url) + except Exception: + pass + + return { + "ok": True, + "auth_url": auth_url, + "redirect_uri": redirect_uri, + "expires_at": attempt.expires_at, + } + + +def _redirect_uri(request: Request, callback_path: str) -> str: + origin = (request.headers.get("Origin") or "").rstrip("/") + if not _is_local_origin(origin): + origin = request.url_root.rstrip("/") + return f"{origin}{callback_path}" + + +def _is_local_origin(origin: str) -> bool: + if not origin: + return False + return ( + origin.startswith("http://localhost:") + or origin == "http://localhost" + or origin.startswith("http://127.0.0.1:") + or origin == "http://127.0.0.1" + or origin.startswith("http://[::1]:") + or origin == "http://[::1]" + ) diff --git a/plugins/_oauth/api/status.py b/plugins/_oauth/api/status.py new file mode 100644 index 000000000..dff490a31 --- /dev/null +++ b/plugins/_oauth/api/status.py @@ -0,0 +1,22 @@ +from __future__ import annotations + +from helpers.api import ApiHandler, Request +from plugins._oauth.helpers import codex +from plugins._oauth.helpers.config import codex_config +from plugins._oauth.helpers.route_bootstrap import is_installed + + +class Status(ApiHandler): + async def process(self, input: dict, request: Request) -> dict: + cfg = codex_config() + return { + "ok": True, + "routes_installed": is_installed(), + "codex": { + **codex.status(), + "enabled": cfg["enabled"], + "proxy_base_path": cfg["proxy_base_path"], + "callback_path": cfg["callback_path"], + "v1_base_path": f'{cfg["proxy_base_path"]}/v1', + }, + } diff --git a/plugins/_oauth/conf/model_providers.yaml b/plugins/_oauth/conf/model_providers.yaml new file mode 100644 index 000000000..a68c6f05a --- /dev/null +++ b/plugins/_oauth/conf/model_providers.yaml @@ -0,0 +1,9 @@ +chat: + codex_oauth: + name: Codex/ChatGPT Account + litellm_provider: openai + models_list: + endpoint_url: "/models" + kwargs: + api_base: "http://127.0.0.1/oauth/codex/v1" + api_key: "oauth" diff --git a/plugins/_oauth/default_config.yaml b/plugins/_oauth/default_config.yaml new file mode 100644 index 000000000..66a88481d --- /dev/null +++ b/plugins/_oauth/default_config.yaml @@ -0,0 +1,33 @@ +# Generic OAuth connection settings. Only Codex is implemented for now. +codex: + enabled: true + + # Empty means auto-discover CODEX_HOME/auth.json, ~/.codex/auth.json, + # CHATGPT_LOCAL_HOME/auth.json, then ~/.chatgpt-local/auth.json. + auth_file_path: "" + + issuer: "https://auth.openai.com" + token_url: "https://auth.openai.com/oauth/token" + client_id: "app_EMoamEEZ73f0CkXaXp7hrann" + scopes: + - openid + - profile + - email + - offline_access + - api.connectors.read + - api.connectors.invoke + + open_browser_from_server: false + forced_workspace_id: "" + + upstream_base_url: "https://chatgpt.com/backend-api/codex" + codex_version: "" + models: [] + request_timeout_seconds: 120 + + # The OpenAI-compatible wrapper is mounted at /oauth/codex/v1. + # It is loopback-only by default and does not emit CORS headers. + proxy_base_path: "/oauth/codex" + callback_path: "/auth/callback" + require_proxy_token: false + proxy_token: "" diff --git a/plugins/_oauth/extensions/python/_functions/models/get_api_key/end/_20_codex_account_dummy_key.py b/plugins/_oauth/extensions/python/_functions/models/get_api_key/end/_20_codex_account_dummy_key.py new file mode 100644 index 000000000..cdd0fe397 --- /dev/null +++ b/plugins/_oauth/extensions/python/_functions/models/get_api_key/end/_20_codex_account_dummy_key.py @@ -0,0 +1,28 @@ +from __future__ import annotations + +from helpers.extension import Extension + + +DUMMY_API_KEY = "oauth" +PROVIDERS = {"codex_oauth"} + + +class CodexAccountDummyKey(Extension): + def execute(self, data: dict | None = None, **kwargs): + if not isinstance(data, dict): + return + + args = data.get("args") + call_kwargs = data.get("kwargs") + service = "" + if isinstance(args, tuple) and args: + service = str(args[0] or "") + elif isinstance(call_kwargs, dict): + service = str(call_kwargs.get("service") or "") + + if service.lower() not in PROVIDERS: + return + + result = str(data.get("result") or "").strip() + if not result or result == "None": + data["result"] = DUMMY_API_KEY diff --git a/plugins/_oauth/extensions/python/startup_migration/_20_oauth_routes.py b/plugins/_oauth/extensions/python/startup_migration/_20_oauth_routes.py new file mode 100644 index 000000000..9165f5ad9 --- /dev/null +++ b/plugins/_oauth/extensions/python/startup_migration/_20_oauth_routes.py @@ -0,0 +1,9 @@ +from __future__ import annotations + +from helpers.extension import Extension +from plugins._oauth.helpers.route_bootstrap import install_route_hooks + + +class OAuthRoutesStartup(Extension): + def execute(self, **kwargs): + install_route_hooks() diff --git a/plugins/_oauth/helpers/__init__.py b/plugins/_oauth/helpers/__init__.py new file mode 100644 index 000000000..b525f257f --- /dev/null +++ b/plugins/_oauth/helpers/__init__.py @@ -0,0 +1 @@ +"""OAuth Connections plugin helpers.""" diff --git a/plugins/_oauth/helpers/codex.py b/plugins/_oauth/helpers/codex.py new file mode 100644 index 000000000..967b61f8c --- /dev/null +++ b/plugins/_oauth/helpers/codex.py @@ -0,0 +1,859 @@ +from __future__ import annotations + +import base64 +import hashlib +import json +import os +import secrets +import subprocess +import time +from dataclasses import dataclass +from datetime import datetime, timedelta, timezone +from pathlib import Path +from typing import Any, Iterable +from urllib.parse import parse_qs, urlencode, urljoin, urlparse + +import requests + +from helpers import files +from plugins._oauth.helpers.config import codex_config + + +AUTH_FILENAME = "auth.json" +ACCESS_EXPIRY_MARGIN = timedelta(minutes=5) +REFRESH_INTERVAL = timedelta(minutes=55) +FALLBACK_CODEX_VERSION = "0.124.0" +OAUTH_ERROR_KEYS = {"error", "error_description"} +DEVICE_CODE_TIMEOUT_SECONDS = 15 * 60 + + +@dataclass(frozen=True) +class PkcePair: + verifier: str + challenge: str + + +@dataclass(frozen=True) +class EffectiveAuth: + access_token: str + account_id: str + id_token: str = "" + refresh_token: str = "" + source_path: str = "" + last_refresh: str = "" + + +def generate_pkce() -> PkcePair: + verifier = _base64url(secrets.token_bytes(64)) + challenge = _base64url(hashlib.sha256(verifier.encode("utf-8")).digest()) + return PkcePair(verifier=verifier, challenge=challenge) + + +def generate_state() -> str: + return _base64url(secrets.token_bytes(32)) + + +def build_authorize_url(redirect_uri: str, state: str, pkce: PkcePair) -> str: + cfg = codex_config() + query = { + "response_type": "code", + "client_id": cfg["client_id"], + "redirect_uri": redirect_uri, + "scope": " ".join(cfg["scopes"]), + "code_challenge": pkce.challenge, + "code_challenge_method": "S256", + "id_token_add_organizations": "true", + "codex_cli_simplified_flow": "true", + "state": state, + "originator": "codex_cli_rs", + } + if cfg["forced_workspace_id"]: + query["allowed_workspace_id"] = cfg["forced_workspace_id"] + + return f'{cfg["issuer"]}/oauth/authorize?{urlencode(query)}' + + +def exchange_code_for_tokens( + code: str, + redirect_uri: str, + verifier: str, +) -> dict[str, str]: + cfg = codex_config() + response = requests.post( + cfg["token_url"], + headers={"Content-Type": "application/x-www-form-urlencoded"}, + data={ + "grant_type": "authorization_code", + "code": code, + "redirect_uri": redirect_uri, + "client_id": cfg["client_id"], + "code_verifier": verifier, + }, + timeout=30, + ) + if not response.ok: + raise RuntimeError(_token_error_message(response)) + + payload = response.json() + if not isinstance(payload, dict): + raise RuntimeError("OAuth token endpoint returned a malformed response.") + + tokens = { + "id_token": str(payload.get("id_token") or ""), + "access_token": str(payload.get("access_token") or ""), + "refresh_token": str(payload.get("refresh_token") or ""), + } + missing = [key for key, value in tokens.items() if not value] + if missing: + raise RuntimeError(f"OAuth token response is missing: {', '.join(missing)}") + + return tokens + + +def obtain_api_key(id_token: str) -> str: + cfg = codex_config() + response = requests.post( + cfg["token_url"], + headers={"Content-Type": "application/x-www-form-urlencoded"}, + data={ + "grant_type": "urn:ietf:params:oauth:grant-type:token-exchange", + "client_id": cfg["client_id"], + "requested_token": "openai-api-key", + "subject_token": id_token, + "subject_token_type": "urn:ietf:params:oauth:token-type:id_token", + }, + timeout=30, + ) + if not response.ok: + raise RuntimeError(f"API-key token exchange failed with status {response.status_code}.") + payload = response.json() + if not isinstance(payload, dict) or not payload.get("access_token"): + raise RuntimeError("API-key token exchange returned a malformed response.") + return str(payload["access_token"]) + + +def complete_login(code: str, redirect_uri: str, verifier: str) -> EffectiveAuth: + tokens = exchange_code_for_tokens(code, redirect_uri, verifier) + return persist_exchanged_tokens(tokens) + + +def persist_exchanged_tokens(tokens: dict[str, str]) -> EffectiveAuth: + id_token = tokens["id_token"] + account_id = derive_account_id(id_token) + if not account_id: + raise RuntimeError("OAuth ID token did not include a ChatGPT account id.") + + cfg = codex_config() + if cfg["forced_workspace_id"] and account_id != cfg["forced_workspace_id"]: + raise RuntimeError( + f'Login is restricted to workspace id {cfg["forced_workspace_id"]}.' + ) + + try: + api_key = obtain_api_key(id_token) + except Exception: + api_key = "" + + auth_data = { + "auth_mode": "chatgpt", + "OPENAI_API_KEY": api_key or None, + "tokens": { + "id_token": id_token, + "access_token": tokens["access_token"], + "refresh_token": tokens["refresh_token"], + "account_id": account_id, + }, + "last_refresh": utc_now_iso(), + } + path = resolve_auth_write_path() + write_auth_file(path, auth_data) + return load_auth(ensure_fresh=False) + + +def request_device_code() -> dict[str, Any]: + cfg = codex_config() + base_url = cfg["issuer"].rstrip("/") + response = requests.post( + f"{base_url}/api/accounts/deviceauth/usercode", + headers={"Content-Type": "application/json"}, + json={"client_id": cfg["client_id"]}, + timeout=30, + ) + if not response.ok: + raise RuntimeError(_token_error_message(response)) + + payload = response.json() + if not isinstance(payload, dict): + raise RuntimeError("Device authorization returned a malformed response.") + + device_auth_id = _string(payload.get("device_auth_id")) + user_code = _string(payload.get("user_code") or payload.get("usercode")) + if not device_auth_id or not user_code: + raise RuntimeError("Device authorization response did not include a code.") + + interval = _safe_int(payload.get("interval"), 5) + expires_at = _device_expires_at(payload.get("expires_at")) + return { + "device_auth_id": device_auth_id, + "user_code": user_code, + "interval": interval, + "expires_at": expires_at, + "verification_url": f"{base_url}/codex/device", + } + + +def poll_device_authorization(device_auth_id: str, user_code: str) -> dict[str, Any]: + cfg = codex_config() + base_url = cfg["issuer"].rstrip("/") + response = requests.post( + f"{base_url}/api/accounts/deviceauth/token", + headers={"Content-Type": "application/json"}, + json={"device_auth_id": device_auth_id, "user_code": user_code}, + timeout=30, + ) + + if response.status_code in {403, 404}: + return {"completed": False} + if not response.ok: + raise RuntimeError(_token_error_message(response)) + + payload = response.json() + if not isinstance(payload, dict): + raise RuntimeError("Device authorization token response was malformed.") + authorization_code = _string(payload.get("authorization_code")) + verifier = _string(payload.get("code_verifier")) + if not authorization_code or not verifier: + raise RuntimeError("Device authorization response was missing token exchange data.") + + tokens = exchange_code_for_tokens( + authorization_code, + f"{base_url}/deviceauth/callback", + verifier, + ) + auth = persist_exchanged_tokens(tokens) + return {"completed": True, "account_id": auth.account_id} + + +def load_auth(*, ensure_fresh: bool = True) -> EffectiveAuth: + path, data = read_auth_file() + tokens = data.get("tokens") if isinstance(data, dict) else {} + tokens = tokens if isinstance(tokens, dict) else {} + + access_token = _string(tokens.get("access_token")) + id_token = _string(tokens.get("id_token")) + refresh_token = _string(tokens.get("refresh_token")) + account_id = _string(tokens.get("account_id")) or derive_account_id(id_token) + last_refresh = _string(data.get("last_refresh")) if isinstance(data, dict) else "" + + if ensure_fresh and refresh_token and should_refresh(access_token, last_refresh): + refreshed = refresh_tokens(refresh_token) + access_token = refreshed.get("access_token") or access_token + id_token = refreshed.get("id_token") or id_token + refresh_token = refreshed.get("refresh_token") or refresh_token + account_id = derive_account_id(id_token) or account_id + last_refresh = utc_now_iso() + data["tokens"] = { + "id_token": id_token, + "access_token": access_token, + "refresh_token": refresh_token, + "account_id": account_id, + } + data["last_refresh"] = last_refresh + write_auth_file(path, data) + + if not access_token: + raise RuntimeError("Codex/ChatGPT account access token not found. Connect the account first.") + if not account_id: + raise RuntimeError("Codex/ChatGPT account id not found. Connect the account again.") + + return EffectiveAuth( + access_token=access_token, + account_id=account_id, + id_token=id_token, + refresh_token=refresh_token, + source_path=str(path), + last_refresh=last_refresh, + ) + + +def status() -> dict[str, Any]: + candidates = resolve_auth_file_candidates() + existing = [str(path) for path in candidates if path.is_file()] + result: dict[str, Any] = { + "connected": False, + "auth_file_path": str(resolve_auth_write_path()), + "discovered_auth_files": existing, + } + try: + auth = load_auth(ensure_fresh=False) + except Exception as exc: + result["message"] = str(exc) + return result + + id_claims = parse_jwt_claims(auth.id_token) + access_claims = parse_jwt_claims(auth.access_token) + auth_claims = _auth_claims(id_claims) + result.update( + { + "connected": True, + "auth_file_path": auth.source_path, + "account_id": auth.account_id, + "email": id_claims.get("email") + or _record(id_claims.get("https://api.openai.com/profile")).get("email"), + "plan_type": auth_claims.get("chatgpt_plan_type"), + "user_id": auth_claims.get("chatgpt_user_id") or auth_claims.get("user_id"), + "access_expires_at": _jwt_expiration_iso(access_claims), + "last_refresh": auth.last_refresh, + } + ) + return result + + +def refresh_tokens(refresh_token: str) -> dict[str, str]: + cfg = codex_config() + response = requests.post( + cfg["token_url"], + headers={"Content-Type": "application/json"}, + json={ + "client_id": cfg["client_id"], + "grant_type": "refresh_token", + "refresh_token": refresh_token, + }, + timeout=30, + ) + if not response.ok: + raise RuntimeError(_token_error_message(response)) + + payload = response.json() + if not isinstance(payload, dict): + raise RuntimeError("OAuth refresh endpoint returned a malformed response.") + + return { + "id_token": _string(payload.get("id_token")), + "access_token": _string(payload.get("access_token")), + "refresh_token": _string(payload.get("refresh_token")) or refresh_token, + } + + +def should_refresh(access_token: str, last_refresh: str) -> bool: + if not access_token: + return True + + claims = parse_jwt_claims(access_token) + exp = claims.get("exp") + if isinstance(exp, (int, float)): + expires_at = datetime.fromtimestamp(float(exp), tz=timezone.utc) + if expires_at <= datetime.now(timezone.utc) + ACCESS_EXPIRY_MARGIN: + return True + + refreshed_at = parse_iso(last_refresh) + if refreshed_at is not None: + return refreshed_at <= datetime.now(timezone.utc) - REFRESH_INTERVAL + return False + + +def request_codex( + path: str, + *, + method: str = "GET", + headers: dict[str, str] | None = None, + body: bytes | str | None = None, + stream: bool = False, + params: dict[str, str] | None = None, +) -> requests.Response: + cfg = codex_config() + auth = load_auth() + target = build_upstream_url(path, cfg["upstream_base_url"]) + request_headers = sanitize_forward_headers(headers or {}) + request_headers.update( + { + "Authorization": f"Bearer {auth.access_token}", + "chatgpt-account-id": auth.account_id, + "OpenAI-Beta": "responses=experimental", + } + ) + + return requests.request( + method, + target, + headers=request_headers, + data=body, + params=params, + timeout=max(5, cfg["request_timeout_seconds"]), + stream=stream, + ) + + +def fetch_models() -> list[str]: + cfg = codex_config() + configured = cfg["models"] + if configured: + return configured + + response = request_codex( + "/models", + params={"client_version": resolve_codex_version()}, + ) + if not response.ok: + raise RuntimeError(upstream_error_message(response, "Failed to load Codex models.")) + + payload = response.json() + raw_models = payload.get("models") if isinstance(payload, dict) else None + if not isinstance(raw_models, list): + raise RuntimeError("Codex returned a malformed models response.") + + models: list[str] = [] + seen: set[str] = set() + for item in raw_models: + slug = item.get("slug") if isinstance(item, dict) else None + if isinstance(slug, str) and slug and slug not in seen: + seen.add(slug) + models.append(slug) + if not models: + raise RuntimeError("Codex returned an empty models list.") + return models + + +def prepare_responses_body(body: dict[str, Any], *, force_stream: bool) -> dict[str, Any]: + normalized = dict(body) + normalized.setdefault("instructions", "") + normalized.setdefault("store", False) + if force_stream: + normalized["stream"] = True + normalized.pop("max_output_tokens", None) + return normalized + + +def collect_completed_response(response: requests.Response) -> dict[str, Any]: + latest_response: dict[str, Any] | None = None + latest_error: Any = None + text_pieces: list[str] = [] + latest_usage: dict[str, Any] | None = None + for event in iter_sse_events(response): + data = event.get("data") + if not data: + continue + try: + parsed = json.loads(data) + except json.JSONDecodeError: + continue + if not isinstance(parsed, dict): + continue + if event.get("event") == "error": + latest_error = parsed + continue + text_pieces.extend(extract_sse_text_deltas(parsed, event.get("event", ""))) + usage = parsed.get("usage") + if isinstance(usage, dict): + latest_usage = usage + candidate = parsed.get("response") + if isinstance(candidate, dict): + latest_response = candidate + + if latest_response is not None: + return latest_response + if text_pieces: + result: dict[str, Any] = {"output_text": "".join(text_pieces)} + if latest_usage: + result["usage"] = latest_usage + return result + suffix = f" Last error: {json.dumps(latest_error)}" if latest_error else "" + raise RuntimeError(f"No completed response found in Codex SSE stream.{suffix}") + + +def iter_sse_events(response: requests.Response) -> Iterable[dict[str, str]]: + buffer = "" + for chunk in response.iter_content(chunk_size=8192, decode_unicode=True): + if not chunk: + continue + buffer += chunk + while "\n\n" in buffer or "\r\n\r\n" in buffer: + sep = "\r\n\r\n" if "\r\n\r\n" in buffer else "\n\n" + block, buffer = buffer.split(sep, 1) + event = parse_sse_block(block) + if event: + yield event + event = parse_sse_block(buffer) + if event: + yield event + + +def parse_sse_block(block: str) -> dict[str, str]: + event: dict[str, str] = {} + data_lines: list[str] = [] + for line in block.splitlines(): + if line.startswith("event:"): + event["event"] = line[6:].strip() + elif line.startswith("data:"): + data_lines.append(line[5:].lstrip()) + if data_lines: + event["data"] = "\n".join(data_lines) + return event + + +def extract_sse_text_deltas(payload: dict[str, Any], event_type: str = "") -> list[str]: + pieces: list[str] = [] + + choices = payload.get("choices") + if isinstance(choices, list): + for choice in choices: + if not isinstance(choice, dict): + continue + delta = choice.get("delta") + if isinstance(delta, dict): + _append_text_value(pieces, delta.get("content")) + elif isinstance(delta, str): + pieces.append(delta) + + message = choice.get("message") + if isinstance(message, dict): + _append_text_value(pieces, message.get("content")) + + delta = payload.get("delta") + if isinstance(delta, str): + pieces.append(delta) + elif isinstance(delta, dict): + _append_text_value(pieces, delta.get("content")) + _append_text_value(pieces, delta.get("text")) + + if (payload.get("type") or event_type) in { + "response.output_text.delta", + "response.text.delta", + }: + _append_text_value(pieces, payload.get("text")) + + return [piece for piece in pieces if piece] + + +def _append_text_value(pieces: list[str], value: Any) -> None: + if isinstance(value, str): + pieces.append(value) + return + if isinstance(value, list): + for item in value: + if isinstance(item, str): + pieces.append(item) + elif isinstance(item, dict): + _append_text_value(pieces, item.get("text")) + _append_text_value(pieces, item.get("content")) + + +def chat_messages_to_response_body(body: dict[str, Any]) -> dict[str, Any]: + messages = body.get("messages") + if not isinstance(messages, list): + raise RuntimeError("`messages` must be an array.") + if body.get("tools"): + raise RuntimeError("Codex/ChatGPT account wrapper does not yet support tool calls.") + + instructions: list[str] = [] + response_input: list[dict[str, Any]] = [] + for message in messages: + if not isinstance(message, dict): + continue + role = str(message.get("role") or "user") + content = message.get("content", "") + text = normalize_message_content(content) + if role in {"system", "developer"}: + if text: + instructions.append(text) + continue + response_input.append({"role": role, "content": text}) + + response_body: dict[str, Any] = { + "model": body.get("model") or "gpt-5.2", + "input": response_input, + "instructions": "\n\n".join(instructions), + "store": False, + } + if body.get("temperature") is not None: + response_body["temperature"] = body["temperature"] + if body.get("top_p") is not None: + response_body["top_p"] = body["top_p"] + if body.get("reasoning_effort") is not None: + response_body["reasoning"] = {"effort": body["reasoning_effort"]} + return response_body + + +def normalize_message_content(content: Any) -> str: + if isinstance(content, str): + return content + if isinstance(content, list): + parts: list[str] = [] + for item in content: + if isinstance(item, dict): + text = item.get("text") + if isinstance(text, str): + parts.append(text) + elif isinstance(item, str): + parts.append(item) + return "\n".join(parts) + if content is None: + return "" + return str(content) + + +def response_text(response: dict[str, Any]) -> str: + value = response.get("output_text") + if isinstance(value, str): + return value + + pieces: list[str] = [] + output = response.get("output") + if isinstance(output, list): + for item in output: + if not isinstance(item, dict): + continue + content = item.get("content") + if isinstance(content, list): + for block in content: + if isinstance(block, dict): + text = block.get("text") + if isinstance(text, str): + pieces.append(text) + return "".join(pieces) + + +def build_upstream_url(path: str, base_url: str) -> str: + if path.startswith("http://") or path.startswith("https://"): + parsed = urlparse(path) + path = parsed.path + if parsed.query: + path = f"{path}?{parsed.query}" + if path == "/v1": + path = "/" + elif path.startswith("/v1/"): + path = path[3:] + return urljoin(base_url.rstrip("/") + "/", path.lstrip("/")) + + +def sanitize_forward_headers(headers: dict[str, str]) -> dict[str, str]: + blocked = { + "authorization", + "chatgpt-account-id", + "host", + "openai-beta", + "content-length", + "connection", + } + return { + key: value + for key, value in headers.items() + if key.lower() not in blocked and value is not None + } + + +def response_headers(response: requests.Response) -> dict[str, str]: + blocked = { + "connection", + "content-encoding", + "content-length", + "transfer-encoding", + } + return { + key: value + for key, value in response.headers.items() + if key.lower() not in blocked + } + + +def upstream_error_message(response: requests.Response, fallback: str) -> str: + text = response.text + if not text: + return fallback + try: + payload = json.loads(text) + except json.JSONDecodeError: + return text + if isinstance(payload, dict): + detail = payload.get("detail") + if isinstance(detail, str): + return detail + error = payload.get("error") + if isinstance(error, dict) and isinstance(error.get("message"), str): + return error["message"] + if isinstance(error, str): + return error + return text + + +def resolve_codex_version() -> str: + configured = codex_config()["codex_version"] + if configured: + return configured + try: + result = subprocess.run( + ["codex", "--version"], + check=False, + capture_output=True, + text=True, + timeout=2, + ) + version = _extract_semver(result.stdout) or _extract_semver(result.stderr) + if version: + return version + except Exception: + pass + return FALLBACK_CODEX_VERSION + + +def resolve_auth_file_candidates() -> list[Path]: + cfg = codex_config() + explicit = cfg["auth_file_path"] + if explicit: + return [Path(explicit).expanduser()] + + candidates: list[Path] = [] + for env_name in ("CHATGPT_LOCAL_HOME", "CODEX_HOME"): + env_home = os.getenv(env_name) + if env_home: + candidates.append(Path(env_home).expanduser() / AUTH_FILENAME) + + home = Path.home() + candidates.extend( + [ + home / ".codex" / AUTH_FILENAME, + home / ".chatgpt-local" / AUTH_FILENAME, + Path(files.get_abs_path("usr", "plugins", "_oauth", "codex", AUTH_FILENAME)), + ] + ) + return _unique_paths(candidates) + + +def resolve_auth_write_path() -> Path: + for candidate in resolve_auth_file_candidates(): + if candidate.is_file(): + return candidate + return resolve_auth_file_candidates()[-1] + + +def read_auth_file() -> tuple[Path, dict[str, Any]]: + candidates = resolve_auth_file_candidates() + for candidate in candidates: + try: + with candidate.open("r", encoding="utf-8") as handle: + payload = json.load(handle) + if isinstance(payload, dict): + return candidate, payload + except FileNotFoundError: + continue + except Exception: + continue + return resolve_auth_write_path(), {} + + +def write_auth_file(path: Path, data: dict[str, Any]) -> None: + path.parent.mkdir(parents=True, exist_ok=True) + path.write_text(json.dumps(data, indent=2) + "\n", encoding="utf-8") + try: + path.chmod(0o600) + except OSError: + pass + + +def parse_jwt_claims(token: str) -> dict[str, Any]: + if not token or token.count(".") != 2: + return {} + try: + payload = token.split(".")[1] + padding = "=" * ((4 - len(payload) % 4) % 4) + decoded = base64.urlsafe_b64decode((payload + padding).encode("ascii")) + value = json.loads(decoded) + return value if isinstance(value, dict) else {} + except Exception: + return {} + + +def derive_account_id(id_token: str) -> str: + return _string(_auth_claims(parse_jwt_claims(id_token)).get("chatgpt_account_id")) + + +def parse_iso(value: str) -> datetime | None: + if not value: + return None + normalized = value.replace("Z", "+00:00") + try: + parsed = datetime.fromisoformat(normalized) + except ValueError: + return None + if parsed.tzinfo is None: + parsed = parsed.replace(tzinfo=timezone.utc) + return parsed.astimezone(timezone.utc) + + +def utc_now_iso() -> str: + return datetime.now(timezone.utc).isoformat().replace("+00:00", "Z") + + +def _auth_claims(claims: dict[str, Any]) -> dict[str, Any]: + return _record(claims.get("https://api.openai.com/auth")) + + +def _record(value: Any) -> dict[str, Any]: + return value if isinstance(value, dict) else {} + + +def _string(value: Any) -> str: + return value if isinstance(value, str) else "" + + +def _jwt_expiration_iso(claims: dict[str, Any]) -> str: + exp = claims.get("exp") + if not isinstance(exp, (int, float)): + return "" + return datetime.fromtimestamp(float(exp), tz=timezone.utc).isoformat() + + +def _base64url(data: bytes) -> str: + return base64.urlsafe_b64encode(data).decode("ascii").rstrip("=") + + +def _token_error_message(response: requests.Response) -> str: + try: + payload = response.json() + except Exception: + payload = None + if isinstance(payload, dict): + for key in OAUTH_ERROR_KEYS: + value = payload.get(key) + if isinstance(value, str) and value: + return value + error = payload.get("error") + if isinstance(error, dict) and isinstance(error.get("message"), str): + return error["message"] + if isinstance(error, str): + return error + return f"OAuth token endpoint returned status {response.status_code}: {response.text}" + + +def _extract_semver(value: str) -> str: + import re + + match = re.search(r"\b\d+\.\d+\.\d+\b", value or "") + return match.group(0) if match else "" + + +def _safe_int(value: Any, default: int) -> int: + try: + return int(value) + except (TypeError, ValueError): + return default + + +def _device_expires_at(value: Any) -> float: + if isinstance(value, str): + parsed = parse_iso(value) + if parsed is not None: + return parsed.timestamp() + return time.time() + DEVICE_CODE_TIMEOUT_SECONDS + + +def _unique_paths(paths: list[Path]) -> list[Path]: + result: list[Path] = [] + seen: set[str] = set() + for path in paths: + key = str(path) + if key in seen: + continue + seen.add(key) + result.append(path) + return result diff --git a/plugins/_oauth/helpers/config.py b/plugins/_oauth/helpers/config.py new file mode 100644 index 000000000..34347f9f5 --- /dev/null +++ b/plugins/_oauth/helpers/config.py @@ -0,0 +1,112 @@ +from __future__ import annotations + +from typing import Any + +from helpers import plugins + + +PLUGIN_NAME = "_oauth" + +DEFAULT_CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann" +DEFAULT_CODEX_ISSUER = "https://auth.openai.com" +DEFAULT_CODEX_TOKEN_URL = "https://auth.openai.com/oauth/token" +DEFAULT_CODEX_BASE_URL = "https://chatgpt.com/backend-api/codex" +DEFAULT_CODEX_SCOPES = [ + "openid", + "profile", + "email", + "offline_access", + "api.connectors.read", + "api.connectors.invoke", +] + + +def oauth_config() -> dict[str, Any]: + value = plugins.get_plugin_config(PLUGIN_NAME) or {} + return value if isinstance(value, dict) else {} + + +def codex_config(config: dict[str, Any] | None = None) -> dict[str, Any]: + source = config if isinstance(config, dict) else oauth_config() + raw = source.get("codex", {}) if isinstance(source, dict) else {} + raw = raw if isinstance(raw, dict) else {} + + return { + "enabled": _as_bool(raw.get("enabled"), True), + "auth_file_path": _as_str(raw.get("auth_file_path")), + "issuer": _trim_url(raw.get("issuer"), DEFAULT_CODEX_ISSUER), + "token_url": _as_str(raw.get("token_url")) or DEFAULT_CODEX_TOKEN_URL, + "client_id": _as_str(raw.get("client_id")) or DEFAULT_CODEX_CLIENT_ID, + "scopes": _as_str_list(raw.get("scopes")) or DEFAULT_CODEX_SCOPES, + "open_browser_from_server": _as_bool(raw.get("open_browser_from_server"), False), + "forced_workspace_id": _as_str(raw.get("forced_workspace_id")), + "upstream_base_url": _trim_url(raw.get("upstream_base_url"), DEFAULT_CODEX_BASE_URL), + "codex_version": _as_str(raw.get("codex_version")), + "models": _as_str_list(raw.get("models")), + "request_timeout_seconds": _as_int(raw.get("request_timeout_seconds"), 120), + "proxy_base_path": _normalize_base_path(raw.get("proxy_base_path"), "/oauth/codex"), + "callback_path": _normalize_base_path(raw.get("callback_path"), "/auth/callback"), + "require_proxy_token": _as_bool(raw.get("require_proxy_token"), False), + "proxy_token": _as_str(raw.get("proxy_token")), + } + + +def _as_str(value: Any) -> str: + if value is None: + return "" + return str(value).strip() + + +def _as_int(value: Any, default: int) -> int: + try: + return int(value) + except (TypeError, ValueError): + return default + + +def _as_bool(value: Any, default: bool) -> bool: + if value is None or value == "": + return default + if isinstance(value, bool): + return value + if isinstance(value, (int, float)): + return bool(value) + normalized = str(value).strip().lower() + if normalized in {"1", "true", "yes", "on", "enabled"}: + return True + if normalized in {"0", "false", "no", "off", "disabled"}: + return False + return default + + +def _as_str_list(value: Any) -> list[str]: + if value is None: + return [] + if isinstance(value, str): + values = value.replace(",", "\n").splitlines() + elif isinstance(value, (list, tuple, set)): + values = list(value) + else: + values = [value] + + result: list[str] = [] + seen: set[str] = set() + for item in values: + text = _as_str(item) + if not text or text in seen: + continue + seen.add(text) + result.append(text) + return result + + +def _trim_url(value: Any, default: str) -> str: + text = _as_str(value) or default + return text.rstrip("/") + + +def _normalize_base_path(value: Any, default: str) -> str: + text = _as_str(value) or default + if not text.startswith("/"): + text = "/" + text + return text.rstrip("/") or default diff --git a/plugins/_oauth/helpers/route_bootstrap.py b/plugins/_oauth/helpers/route_bootstrap.py new file mode 100644 index 000000000..aea58d8a2 --- /dev/null +++ b/plugins/_oauth/helpers/route_bootstrap.py @@ -0,0 +1,26 @@ +from __future__ import annotations + + +def install_route_hooks() -> None: + from helpers.ui_server import UiServerRuntime + + if getattr(UiServerRuntime, "_a0_oauth_route_hooks_installed", False): + return + + original_register_http_routes = UiServerRuntime.register_http_routes + + def register_http_routes(self): + result = original_register_http_routes(self) + from plugins._oauth.helpers.routes import register_oauth_routes + + register_oauth_routes(self.webapp) + return result + + UiServerRuntime.register_http_routes = register_http_routes + UiServerRuntime._a0_oauth_route_hooks_installed = True + + +def is_installed() -> bool: + from helpers.ui_server import UiServerRuntime + + return bool(getattr(UiServerRuntime, "_a0_oauth_route_hooks_installed", False)) diff --git a/plugins/_oauth/helpers/routes.py b/plugins/_oauth/helpers/routes.py new file mode 100644 index 000000000..6815dfea4 --- /dev/null +++ b/plugins/_oauth/helpers/routes.py @@ -0,0 +1,372 @@ +from __future__ import annotations + +import ipaddress +import json +import time +from typing import Any + +from flask import Response, jsonify, request, stream_with_context + +from plugins._oauth.helpers import codex +from plugins._oauth.helpers.config import codex_config +from plugins._oauth.helpers.state import pop_attempt + + +def register_oauth_routes(app) -> None: + cfg = codex_config() + base = cfg["proxy_base_path"] + + routes = [ + (f"{base}/health", "oauth_codex_health", codex_health, ["GET"]), + (f"{base}/callback", "oauth_codex_callback", codex_callback, ["GET"]), + (cfg["callback_path"], "oauth_codex_compat_callback", codex_callback, ["GET"]), + (f"{base}/v1/models", "oauth_codex_models", codex_models, ["GET", "OPTIONS"]), + ( + f"{base}/v1/responses", + "oauth_codex_responses", + codex_responses, + ["POST", "OPTIONS"], + ), + ( + f"{base}/v1/chat/completions", + "oauth_codex_chat_completions", + codex_chat_completions, + ["POST", "OPTIONS"], + ), + ] + for rule, endpoint, view_func, methods in routes: + if endpoint in app.view_functions: + continue + app.add_url_rule(rule, endpoint, view_func, methods=methods) + + +def codex_health(): + return jsonify({"ok": True, "provider": "codex", "base_path": codex_config()["proxy_base_path"]}) + + +def codex_callback(): + error = request.args.get("error") + if error: + description = request.args.get("error_description") or error + return _html_page("Codex Sign-In Failed", description), 400 + + state = request.args.get("state", "") + code = request.args.get("code", "") + attempt = pop_attempt(state) + if not attempt: + return _html_page("Codex Sign-In Expired", "Return to Agent Zero and start a new Codex connection."), 400 + if not code: + return _html_page("Codex Sign-In Failed", "The OAuth callback did not include an authorization code."), 400 + + try: + auth = codex.complete_login(code, attempt.redirect_uri, attempt.verifier) + info = codex.status() + except Exception as exc: + return _html_page("Codex Sign-In Failed", str(exc)), 500 + + email = info.get("email") or "Connected" + detail = f"{email}\n{auth.account_id}" + return _html_page("Codex Connected", detail) + + +def codex_models(): + if request.method == "OPTIONS": + return _options_response() + denied = _proxy_denied_response() + if denied: + return denied + try: + models = codex.fetch_models() + return jsonify( + { + "object": "list", + "data": [ + { + "id": model, + "object": "model", + "created": 0, + "owned_by": "codex-oauth", + } + for model in models + ], + } + ) + except Exception as exc: + return _json_error(str(exc), status=502, code="upstream_error") + + +def codex_responses(): + if request.method == "OPTIONS": + return _options_response() + denied = _proxy_denied_response() + if denied: + return denied + + body = request.get_json(silent=True) + if not isinstance(body, dict): + return _json_error("Request body must be a JSON object.") + + wants_stream = body.get("stream") is True + upstream_body = codex.prepare_responses_body(body, force_stream=True) + try: + upstream = codex.request_codex( + "/responses", + method="POST", + headers={"Content-Type": "application/json"}, + body=json.dumps(upstream_body), + stream=True, + ) + except Exception as exc: + return _json_error(str(exc), status=502, code="upstream_error") + + if not upstream.ok: + return _copy_upstream_response(upstream) + if wants_stream: + return _stream_upstream_sse(upstream) + + try: + completed = codex.collect_completed_response(upstream) + except Exception as exc: + return _json_error(str(exc), status=502, code="upstream_error") + return jsonify(completed) + + +def codex_chat_completions(): + if request.method == "OPTIONS": + return _options_response() + denied = _proxy_denied_response() + if denied: + return denied + + body = request.get_json(silent=True) + if not isinstance(body, dict): + return _json_error("Request body must be a JSON object.") + + try: + response_body = codex.chat_messages_to_response_body(body) + except Exception as exc: + return _json_error(str(exc)) + + wants_stream = body.get("stream") is True + response_body["stream"] = True + try: + upstream = codex.request_codex( + "/responses", + method="POST", + headers={"Content-Type": "application/json"}, + body=json.dumps(codex.prepare_responses_body(response_body, force_stream=True)), + stream=True, + ) + except Exception as exc: + return _json_error(str(exc), status=502, code="upstream_error") + + if not upstream.ok: + return _copy_upstream_response(upstream) + if wants_stream: + return _stream_chat_completion(upstream, str(body.get("model") or response_body["model"])) + + try: + completed = codex.collect_completed_response(upstream) + except Exception as exc: + return _json_error(str(exc), status=502, code="upstream_error") + + text = codex.response_text(completed) + return jsonify( + { + "id": f"chatcmpl_{int(time.time() * 1000)}", + "object": "chat.completion", + "created": int(time.time()), + "model": body.get("model") or response_body["model"], + "choices": [ + { + "index": 0, + "message": {"role": "assistant", "content": text}, + "finish_reason": "stop", + } + ], + "usage": completed.get("usage") or {}, + } + ) + + +def _stream_upstream_sse(upstream): + headers = codex.response_headers(upstream) + headers.setdefault("Content-Type", "text/event-stream") + headers.setdefault("Cache-Control", "no-cache") + return Response( + stream_with_context(upstream.iter_content(chunk_size=8192)), + status=upstream.status_code, + headers=headers, + ) + + +def _stream_chat_completion(upstream, model: str): + created = int(time.time()) + chunk_id = f"chatcmpl_{int(time.time() * 1000)}" + + def generate(): + yield _sse_data( + { + "id": chunk_id, + "object": "chat.completion.chunk", + "created": created, + "model": model, + "choices": [{"index": 0, "delta": {"role": "assistant"}, "finish_reason": None}], + } + ) + for event in codex.iter_sse_events(upstream): + data = event.get("data") + if not data: + continue + try: + parsed = json.loads(data) + except json.JSONDecodeError: + continue + if not isinstance(parsed, dict): + continue + for delta in codex.extract_sse_text_deltas(parsed, event.get("event", "")): + yield _sse_data( + { + "id": chunk_id, + "object": "chat.completion.chunk", + "created": created, + "model": model, + "choices": [ + { + "index": 0, + "delta": {"content": delta}, + "finish_reason": None, + } + ], + } + ) + yield _sse_data( + { + "id": chunk_id, + "object": "chat.completion.chunk", + "created": created, + "model": model, + "choices": [{"index": 0, "delta": {}, "finish_reason": "stop"}], + } + ) + yield "data: [DONE]\n\n" + + return Response( + stream_with_context(generate()), + headers={"Content-Type": "text/event-stream", "Cache-Control": "no-cache"}, + ) + + +def _copy_upstream_response(upstream): + return Response( + upstream.content, + status=upstream.status_code, + headers=codex.response_headers(upstream), + ) + + +def _proxy_denied_response() -> Response | None: + if _proxy_authorized(): + return None + return _json_error("Codex/ChatGPT account proxy access denied.", status=403, code="access_denied") + + +def _proxy_authorized() -> bool: + cfg = codex_config() + token = cfg["proxy_token"] + supplied = _supplied_proxy_token() + if token and supplied == token: + return True + if cfg["require_proxy_token"]: + return False + return _host_is_local(request.host) or _remote_is_loopback(request.remote_addr) + + +def _supplied_proxy_token() -> str: + auth = request.headers.get("Authorization", "") + if auth.lower().startswith("bearer "): + return auth[7:].strip() + return ( + request.headers.get("X-API-Key") + or request.args.get("api_key") + or request.args.get("key") + or "" + ).strip() + + +def _host_is_local(host: str) -> bool: + hostname = (host or "").split(":", 1)[0].strip("[]").lower() + if hostname in {"localhost", "127.0.0.1", "::1"}: + return True + try: + return ipaddress.ip_address(hostname).is_loopback + except ValueError: + return False + + +def _remote_is_loopback(addr: str | None) -> bool: + try: + return ipaddress.ip_address(addr or "").is_loopback + except ValueError: + return False + + +def _json_error(message: str, *, status: int = 400, code: str = "invalid_request") -> Response: + return jsonify({"error": {"message": message, "type": code, "code": code}}), status + + +def _options_response() -> Response: + return Response(status=204) + + +def _sse_data(payload: dict[str, Any]) -> str: + return f"data: {json.dumps(payload, separators=(',', ':'))}\n\n" + + +def _html_page(title: str, body: str) -> str: + return f""" + + + + + {_escape_html(title)} + + + +

+

{_escape_html(title)}

+

{_escape_html(body)}

+
+ +""" + + +def _escape_html(value: str) -> str: + return ( + value.replace("&", "&") + .replace("<", "<") + .replace(">", ">") + .replace('"', """) + .replace("'", "'") + ) diff --git a/plugins/_oauth/helpers/state.py b/plugins/_oauth/helpers/state.py new file mode 100644 index 000000000..f0906c20f --- /dev/null +++ b/plugins/_oauth/helpers/state.py @@ -0,0 +1,118 @@ +from __future__ import annotations + +import threading +import time +from dataclasses import dataclass + + +LOGIN_TTL_SECONDS = 10 * 60 + + +@dataclass(frozen=True) +class LoginAttempt: + state: str + verifier: str + redirect_uri: str + created_at: float + + @property + def expires_at(self) -> float: + return self.created_at + LOGIN_TTL_SECONDS + + def expired(self) -> bool: + return time.time() > self.expires_at + + +@dataclass(frozen=True) +class DeviceAttempt: + attempt_id: str + device_auth_id: str + user_code: str + interval: int + expires_at_value: float + + @property + def expires_at(self) -> float: + return self.expires_at_value + + def expired(self) -> bool: + return time.time() > self.expires_at + + +_lock = threading.RLock() +_attempts: dict[str, LoginAttempt] = {} +_device_attempts: dict[str, DeviceAttempt] = {} + + +def put_attempt(state: str, verifier: str, redirect_uri: str) -> LoginAttempt: + cleanup_expired() + attempt = LoginAttempt( + state=state, + verifier=verifier, + redirect_uri=redirect_uri, + created_at=time.time(), + ) + with _lock: + _attempts[state] = attempt + return attempt + + +def pop_attempt(state: str) -> LoginAttempt | None: + cleanup_expired() + with _lock: + attempt = _attempts.pop(state, None) + if attempt is None or attempt.expired(): + return None + return attempt + + +def put_device_attempt( + attempt_id: str, + device_auth_id: str, + user_code: str, + interval: int, + expires_at: float, +) -> DeviceAttempt: + cleanup_expired() + attempt = DeviceAttempt( + attempt_id=attempt_id, + device_auth_id=device_auth_id, + user_code=user_code, + interval=interval, + expires_at_value=expires_at, + ) + with _lock: + _device_attempts[attempt_id] = attempt + return attempt + + +def get_device_attempt(attempt_id: str) -> DeviceAttempt | None: + cleanup_expired() + with _lock: + attempt = _device_attempts.get(attempt_id) + if attempt is None or attempt.expired(): + return None + return attempt + + +def pop_device_attempt(attempt_id: str) -> DeviceAttempt | None: + cleanup_expired() + with _lock: + return _device_attempts.pop(attempt_id, None) + + +def cleanup_expired() -> None: + now = time.time() + with _lock: + expired = [ + state for state, attempt in _attempts.items() if now > attempt.expires_at + ] + for state in expired: + _attempts.pop(state, None) + expired_devices = [ + attempt_id + for attempt_id, attempt in _device_attempts.items() + if now > attempt.expires_at + ] + for attempt_id in expired_devices: + _device_attempts.pop(attempt_id, None) diff --git a/plugins/_oauth/plugin.yaml b/plugins/_oauth/plugin.yaml new file mode 100644 index 000000000..f7894f122 --- /dev/null +++ b/plugins/_oauth/plugin.yaml @@ -0,0 +1,9 @@ +name: _oauth +title: OAuth Connections +description: Generic local OAuth bridge for account-backed providers. Includes Codex/ChatGPT Account as the first provider. +version: 0.1.0 +always_enabled: false +settings_sections: + - external +per_project_config: false +per_agent_config: false diff --git a/plugins/_oauth/webui/config.html b/plugins/_oauth/webui/config.html new file mode 100644 index 000000000..f78307ef3 --- /dev/null +++ b/plugins/_oauth/webui/config.html @@ -0,0 +1,391 @@ + + + OAuth Connections + + + + +
+ +
+ + + + diff --git a/plugins/_oauth/webui/oauth-config-store.js b/plugins/_oauth/webui/oauth-config-store.js new file mode 100644 index 000000000..2d3d1bcca --- /dev/null +++ b/plugins/_oauth/webui/oauth-config-store.js @@ -0,0 +1,192 @@ +import { createStore } from "/js/AlpineStore.js"; +import { callJsonApi } from "/js/api.js"; +import { + toastFrontendError, + toastFrontendInfo, + toastFrontendSuccess, +} from "/components/notifications/notification-store.js"; + +const STATUS_API = "/plugins/_oauth/status"; +const START_DEVICE_LOGIN_API = "/plugins/_oauth/start_device_login"; +const POLL_DEVICE_LOGIN_API = "/plugins/_oauth/poll_device_login"; +const MODELS_API = "/plugins/_oauth/models"; +const MAX_POLL_MS = 120000; + +function ensureConfig(config) { + if (!config || typeof config !== "object") return null; + config.codex = config.codex && typeof config.codex === "object" ? config.codex : {}; + const codex = config.codex; + codex.enabled = codex.enabled !== false; + codex.auth_file_path = String(codex.auth_file_path || ""); + codex.issuer = String(codex.issuer || "https://auth.openai.com"); + codex.token_url = String(codex.token_url || "https://auth.openai.com/oauth/token"); + codex.client_id = String(codex.client_id || "app_EMoamEEZ73f0CkXaXp7hrann"); + codex.upstream_base_url = String(codex.upstream_base_url || "https://chatgpt.com/backend-api/codex"); + codex.proxy_base_path = String(codex.proxy_base_path || "/oauth/codex"); + codex.callback_path = String(codex.callback_path || "/auth/callback"); + codex.require_proxy_token = Boolean(codex.require_proxy_token); + codex.proxy_token = String(codex.proxy_token || ""); + codex.codex_version = String(codex.codex_version || ""); + codex.models = Array.isArray(codex.models) ? codex.models : []; + return config; +} + +function messageOf(error) { + return error instanceof Error ? error.message : String(error); +} + +export const store = createStore("oauthConfig", { + config: null, + status: null, + loadingStatus: false, + connecting: false, + loadingModels: false, + models: [], + device: null, + pollTimer: null, + pollStartedAt: 0, + + async init(config) { + this.bindConfig(config); + await this.loadStatus(); + }, + + cleanup() { + this.stopPolling(); + this.config = null; + this.status = null; + this.models = []; + this.device = null; + }, + + bindConfig(config) { + const safeConfig = ensureConfig(config); + if (!safeConfig) return; + if (this.config === safeConfig) return; + this.config = safeConfig; + }, + + codex() { + return this.config?.codex || {}; + }, + + connected() { + return Boolean(this.status?.codex?.connected); + }, + + statusLabel() { + if (this.loadingStatus) return "Checking"; + return this.connected() ? "Connected" : "Not connected"; + }, + + endpointUrl() { + const base = this.codex().proxy_base_path || "/oauth/codex"; + return `${window.location.origin}${base}/v1`; + }, + + callbackUrl() { + const path = this.codex().callback_path || "/auth/callback"; + return `${window.location.origin}${path}`; + }, + + async loadStatus() { + if (this.loadingStatus) return; + this.loadingStatus = true; + try { + const response = await callJsonApi(STATUS_API, {}); + this.status = response; + } catch (error) { + void toastFrontendError(messageOf(error), "OAuth Connections"); + } finally { + this.loadingStatus = false; + } + }, + + async connectCodex() { + if (this.connecting) return; + this.connecting = true; + try { + const response = await callJsonApi(START_DEVICE_LOGIN_API, {}); + if (!response?.ok || !response.verification_url || !response.attempt_id) { + throw new Error(response?.error || "Could not start Codex sign-in."); + } + this.device = response; + window.open(response.verification_url, "_blank", "noopener,noreferrer"); + void toastFrontendInfo("Enter the code shown here in the opened browser tab.", "OAuth Connections"); + this.startPolling(); + } catch (error) { + this.connecting = false; + void toastFrontendError(messageOf(error), "OAuth Connections"); + } + }, + + startPolling() { + this.stopPolling(); + this.pollStartedAt = Date.now(); + const tick = async () => { + if (!this.device?.attempt_id) return; + try { + const response = await callJsonApi(POLL_DEVICE_LOGIN_API, { + attempt_id: this.device.attempt_id, + }); + if (!response?.ok) { + if (response?.expired) { + this.connecting = false; + this.device = null; + this.stopPolling(); + } + throw new Error(response?.error || "Could not finish Codex sign-in."); + } + if (response.completed) { + await this.loadStatus(); + this.device = null; + this.connecting = false; + this.stopPolling(); + void toastFrontendSuccess("Codex account connected.", "OAuth Connections"); + return; + } + } catch (error) { + this.connecting = false; + this.stopPolling(); + void toastFrontendError(messageOf(error), "OAuth Connections"); + return; + } + if (Date.now() - this.pollStartedAt > MAX_POLL_MS) { + this.connecting = false; + this.device = null; + this.stopPolling(); + return; + } + }; + void tick(); + const delay = Math.max(1500, Number(this.device.interval || 5) * 1000); + this.pollTimer = window.setInterval(tick, delay); + }, + + stopPolling() { + if (this.pollTimer) window.clearInterval(this.pollTimer); + this.pollTimer = null; + }, + + async loadModels() { + if (this.loadingModels) return; + this.loadingModels = true; + try { + const response = await callJsonApi(MODELS_API, {}); + if (!response?.ok) throw new Error(response?.error || "Could not load Codex models."); + this.models = Array.isArray(response.models) ? response.models : []; + void toastFrontendSuccess("Codex models loaded.", "OAuth Connections"); + } catch (error) { + this.models = []; + void toastFrontendError(messageOf(error), "OAuth Connections"); + } finally { + this.loadingModels = false; + } + }, + + cancelConnect() { + this.connecting = false; + this.device = null; + this.stopPolling(); + }, +}); diff --git a/tests/test_oauth_codex.py b/tests/test_oauth_codex.py new file mode 100644 index 000000000..784426718 --- /dev/null +++ b/tests/test_oauth_codex.py @@ -0,0 +1,156 @@ +from __future__ import annotations + +import json +import sys +from pathlib import Path + +import yaml + +sys.path.insert(0, str(Path(__file__).resolve().parents[1])) +from plugins._oauth.helpers import codex +from plugins._oauth.extensions.python._functions.models.get_api_key.end._20_codex_account_dummy_key import ( + CodexAccountDummyKey, +) + + +def test_generate_pkce_produces_urlsafe_verifier_and_challenge(): + pair = codex.generate_pkce() + + assert 43 <= len(pair.verifier) <= 128 + assert pair.verifier + assert pair.challenge + assert "=" not in pair.verifier + assert "=" not in pair.challenge + + +def test_build_authorize_url_uses_existing_a0_origin_callback(monkeypatch): + monkeypatch.setattr( + codex, + "codex_config", + lambda: { + "issuer": "https://auth.openai.com", + "client_id": "app_EMoamEEZ73f0CkXaXp7hrann", + "scopes": [ + "openid", + "profile", + "email", + "offline_access", + "api.connectors.read", + "api.connectors.invoke", + ], + "forced_workspace_id": "", + }, + ) + pair = codex.PkcePair(verifier="verifier", challenge="challenge") + auth_url = codex.build_authorize_url( + "http://localhost:50001/auth/callback", + "state", + pair, + ) + + assert auth_url.startswith("https://auth.openai.com/oauth/authorize?") + assert "redirect_uri=http%3A%2F%2Flocalhost%3A50001%2Fauth%2Fcallback" in auth_url + assert "code_challenge=challenge" in auth_url + assert "originator=codex_cli_rs" in auth_url + + +def test_chat_messages_to_response_body_extracts_instructions(): + body = codex.chat_messages_to_response_body( + { + "model": "gpt-5.2", + "messages": [ + {"role": "system", "content": "Be precise."}, + {"role": "user", "content": "Hello"}, + ], + "temperature": 0.2, + "reasoning_effort": "high", + } + ) + + assert body["model"] == "gpt-5.2" + assert body["instructions"] == "Be precise." + assert body["input"] == [{"role": "user", "content": "Hello"}] + assert body["temperature"] == 0.2 + assert body["reasoning"] == {"effort": "high"} + + +def test_response_text_reads_output_text_or_output_blocks(): + assert codex.response_text({"output_text": "direct"}) == "direct" + + assert ( + codex.response_text( + { + "output": [ + { + "content": [ + {"type": "output_text", "text": "a"}, + {"type": "output_text", "text": "b"}, + ] + } + ] + } + ) + == "ab" + ) + + +def test_parse_sse_block_joins_data_lines(): + event = codex.parse_sse_block( + 'event: response.completed\ndata: {"response":\ndata: {"id":"r"}}\n' + ) + + assert event["event"] == "response.completed" + assert json.loads(event["data"]) == {"response": {"id": "r"}} + + +def test_extract_sse_text_deltas_reads_chat_completion_chunks(): + deltas = codex.extract_sse_text_deltas( + { + "id": "chatcmpl_test", + "choices": [ + {"delta": {"role": "assistant"}}, + {"delta": {"content": "Hel"}}, + {"delta": {"content": "lo"}}, + ], + } + ) + + assert deltas == ["Hel", "lo"] + + +def test_collect_completed_response_falls_back_to_text_deltas(): + class FakeResponse: + def iter_content(self, chunk_size=8192, decode_unicode=True): + del chunk_size, decode_unicode + yield 'data: {"choices":[{"delta":{"content":"Hel"}}]}\n\n' + yield 'data: {"choices":[{"delta":{"content":"lo"}}]}\n\n' + yield "data: [DONE]\n\n" + + assert codex.collect_completed_response(FakeResponse()) == {"output_text": "Hello"} + + +def test_provider_config_uses_container_local_agent_zero_origin(): + provider_path = Path(__file__).resolve().parents[1] / "plugins/_oauth/conf/model_providers.yaml" + provider_config = yaml.safe_load(provider_path.read_text(encoding="utf-8")) + codex_provider = provider_config["chat"]["codex_oauth"] + + assert codex_provider["name"] == "Codex/ChatGPT Account" + assert codex_provider["models_list"]["endpoint_url"] == "/models" + assert codex_provider["kwargs"]["api_base"] == "http://127.0.0.1/oauth/codex/v1" + assert "50001" not in json.dumps(codex_provider) + + +def test_codex_provider_reports_dummy_api_key_when_missing(): + data = {"args": ("codex_oauth",), "kwargs": {}, "result": "None"} + + CodexAccountDummyKey(agent=None).execute(data=data) + + assert data["result"] == "oauth" + + +def test_codex_provider_preserves_configured_api_key(): + data = {"args": ("codex_oauth",), "kwargs": {}, "result": "configured"} + + CodexAccountDummyKey(agent=None).execute(data=data) + + assert data["result"] == "configured"