Upload 12 files

Dockerfile

@@ -16,10 +16,14 @@ RUN npm install -g @openai/codex && codex --version
 # uid 1000, so reuse it instead of creating a duplicate.
 ENV HOME=/home/node \
     PATH=/home/node/.local/bin:$PATH \
-    # Point Codex at the persistent bucket so auth.json + sessions survive restarts.
-    CODEX_HOME=/data/.codex \
+    # CODEX_HOME on FAST LOCAL disk (Codex's SQLite I/O on a network bucket is the
+    # main latency killer). Use /tmp — always writable on HF Spaces regardless of
+    # the runtime user. auth.json is seeded from / synced back to the bucket.
+    CODEX_HOME=/tmp/.codex \
+    AUTH_PERSIST_DIR=/data/.codex \
     # Defaults (override via Space variables/secrets).
     CODEX_SANDBOX=workspace-write \
+    CODEX_EFFORT=low \
     PORT=7860
 
 WORKDIR /app

README.md

@@ -63,7 +63,17 @@ Optional **variables**:
 |---|---|---|
 | `CODEX_SANDBOX` | `workspace-write` | `read-only` for chat-only, `workspace-write` to let Codex edit files |
 | `CODEX_MODEL` | (unset) | pin a Codex model, e.g. `gpt-5-codex` |
-| `CODEX_TIMEOUT` | `600` | max seconds per request |
+| `CODEX_TIMEOUT` | `180` | max seconds between Codex output events |
+| `CODEX_MAX_CONCURRENCY` | `4` | max Codex turns running at once (resource cap) |
+| `CODEX_QUEUE_TIMEOUT` | `90` | seconds a request waits in queue before `429` |
+
+### Concurrency
+
+- Requests for **different** sessions run in parallel, up to `CODEX_MAX_CONCURRENCY`.
+- Requests for the **same** session are **serialized** — two calls never resume the
+  same Codex thread or write the same workspace at once (prevents corruption).
+- When all slots are busy and the queue wait exceeds `CODEX_QUEUE_TIMEOUT`, the API
+  returns **HTTP 429** so clients can back off and retry.
 
 ### 3. Upload your login (`auth.json`)
 On your **local machine** (with a browser):

app.py

@@ -21,6 +21,7 @@ import asyncio
 import json
 import os
 import re
+import shutil
 import time
 import uuid
 from contextlib import aclosing
@@ -46,12 +47,17 @@ except ImportError:
 # Config
 # --------------------------------------------------------------------------- #
 CODEX_BIN = os.environ.get("CODEX_BIN", "codex")  # on the Space this is `codex`
-CODEX_HOME = os.environ.get("CODEX_HOME", "/data/.codex")
+# CODEX_HOME lives on FAST LOCAL disk (Codex hammers SQLite here every turn — a
+# network bucket makes that brutally slow). auth.json is seeded from / synced
+# back to AUTH_PERSIST_DIR (the /data bucket) so the login still persists.
+CODEX_HOME = os.environ.get("CODEX_HOME", "/tmp/.codex")
+AUTH_PERSIST_DIR = Path(os.environ.get("AUTH_PERSIST_DIR", "/data/.codex"))
 AUTH_FILE = Path(CODEX_HOME) / "auth.json"
 SESSIONS_ROOT = Path(os.environ.get("SESSIONS_ROOT", "/data/sessions"))
 API_TOKEN = os.environ.get("API_TOKEN", "")  # HF secret; if empty, auth is OPEN
 DEFAULT_SANDBOX = os.environ.get("CODEX_SANDBOX", "workspace-write")  # or read-only
 CODEX_MODEL = os.environ.get("CODEX_MODEL", "").strip()  # optional override
+CODEX_EFFORT = os.environ.get("CODEX_EFFORT", "low").strip()  # minimal|low|medium|high
 READ_TIMEOUT = float(os.environ.get("CODEX_TIMEOUT", "180"))  # per-output-gap secs
 # Max Codex turns running at once across all sessions (each is a heavy process).
 MAX_CONCURRENCY = int(os.environ.get("CODEX_MAX_CONCURRENCY", "4"))
@@ -143,6 +149,26 @@ def _check_auth(authorization: Optional[str]) -> None:
         raise HTTPException(status_code=401, detail="Invalid or missing API token.")
 
 
+# Codex rotates auth.json in CODEX_HOME (local disk) when it refreshes the token.
+# Persist that rotated copy back to the bucket so the login survives restarts.
+_last_auth_mtime = AUTH_FILE.stat().st_mtime if AUTH_FILE.exists() else 0.0
+
+
+def _sync_auth_back() -> None:
+    try:
+        if not AUTH_FILE.exists():
+            return
+        global _last_auth_mtime
+        m = AUTH_FILE.stat().st_mtime
+        if m <= _last_auth_mtime:
+            return  # unchanged since last sync — skip the (slow) bucket write
+        AUTH_PERSIST_DIR.mkdir(parents=True, exist_ok=True)
+        shutil.copy2(AUTH_FILE, AUTH_PERSIST_DIR / "auth.json")
+        _last_auth_mtime = m
+    except Exception:
+        pass  # best-effort; never fail a request over this
+
+
 def _require_login() -> None:
     if not AUTH_FILE.exists():
         raise HTTPException(
@@ -256,6 +282,7 @@ async def health():
         "auth_required": bool(API_TOKEN),
         "sandbox": DEFAULT_SANDBOX,
         "engine": "app-server",
+        "effort": CODEX_EFFORT,
         "max_concurrency": MAX_CONCURRENCY,
         "active_sessions": len(_SESSION_LOCKS),
     }
@@ -308,6 +335,7 @@ async def chat_completions(
         sandbox=DEFAULT_SANDBOX,
         model=CODEX_MODEL or None,
         read_timeout=READ_TIMEOUT,
+        effort=CODEX_EFFORT or None,
     )
 
     if req.stream:
@@ -335,6 +363,7 @@ async def chat_completions(
         raise HTTPException(status_code=502, detail=f"Codex engine: {e}")
     finally:
         guard.release()
+        _sync_auth_back()
 
     return JSONResponse(_completion_payload("".join(content_parts), model_name, usage))
 
@@ -375,6 +404,7 @@ async def _sse_stream(turn, model: str, session_dir, include_usage: bool, guard)
         yield chunk({"content": f"\n\n[codex error: {e}]"})
     finally:
         guard.release()
+        _sync_auth_back()
 
     yield chunk({}, finish="stop")
     if include_usage:

chatscript.py

@@ -0,0 +1,76 @@
+# ============================================================================
+#  Codex-as-API  ->  live STREAMING chat  (async, for Google Colab)
+#  HOW TO USE: open https://colab.research.google.com  ->  new notebook  ->
+#  paste this WHOLE file into ONE cell  ->  Run.  A "you>" box appears;
+#  type a message and watch the reply stream in token-by-token.
+#  Type  exit  (or quit) to stop.
+# ============================================================================
+
+# --- install (quiet) -------------------------------------------------------
+!pip -q install openai nest_asyncio
+
+import asyncio, nest_asyncio
+from openai import AsyncOpenAI
+
+nest_asyncio.apply()   # lets asyncio run inside Colab's event loop
+
+# --- YOUR API settings (edit these) ----------------------------------------
+BASE_URL = "https://sarveshpatel-codex.hf.space/v1"   # your Space + /v1
+API_KEY  = "CURSEOFWITCHER"                            # your API_TOKEN secret
+MODEL    = "codex"
+SESSION  = "colab-chat"   # same string = the chat remembers context server-side
+
+client = AsyncOpenAI(
+    base_url=BASE_URL,
+    api_key=API_KEY,
+    default_headers={"X-Session-Id": SESSION},   # persistent memory
+)
+
+
+async def stream_reply(user_text: str):
+    """Stream one assistant reply, printing tokens as they arrive."""
+    stream = await client.chat.completions.create(
+        model=MODEL,
+        messages=[{"role": "user", "content": user_text}],
+        stream=True,
+    )
+    print("ai > ", end="", flush=True)
+    full = []
+    async for chunk in stream:
+        if not chunk.choices:
+            continue
+        delta = chunk.choices[0].delta.content
+        if delta:
+            full.append(delta)
+            print(delta, end="", flush=True)   # live streaming output
+    print("\n")
+    return "".join(full)
+
+
+def chat():
+    """Interactive REPL. Each turn streams live; the session remembers context."""
+    print(f"Chatting with Codex (session='{SESSION}'). Type 'exit' to stop.\n")
+    while True:
+        try:
+            user = input("you> ").strip()
+        except (EOFError, KeyboardInterrupt):
+            print("\n[chat ended]")
+            break
+        if not user:
+            continue
+        if user.lower() in ("exit", "quit"):
+            print("[chat ended]")
+            break
+        asyncio.run(stream_reply(user))
+
+
+# Start chatting.
+chat()
+
+# ---------------------------------------------------------------------------
+# NOTES:
+#   * Want a fresh conversation? change SESSION to a new string and re-run.
+#   * One-off (no memory)? set SESSION = None and remove default_headers.
+#   * Prefer a non-streaming single call? use stream=False and read
+#     resp.choices[0].message.content.
+# ---------------------------------------------------------------------------

codex_engine.py

@@ -37,6 +37,9 @@ async def _send(proc: asyncio.subprocess.Process, obj: dict) -> None:
     await proc.stdin.drain()
 
 
+_AUTH_DEAD = ("session has ended", "log in again", "failed to refresh token")
+
+
 async def run_turn(
     *,
     codex_bin: str,
@@ -47,6 +50,7 @@ async def run_turn(
     sandbox: str,
     model: Optional[str],
     read_timeout: float,
+    effort: Optional[str] = None,
 ) -> AsyncIterator[dict]:
     """
     Async generator that drives one turn and yields events:
@@ -85,16 +89,20 @@ async def run_turn(
             except json.JSONDecodeError:
                 continue  # non-JSON log line on stdout — ignore
 
-    async def await_response(req_id: int) -> dict:
-        """Read until the response for req_id; ignore notifications meanwhile."""
+    async def await_response_raw(req_id: int) -> dict:
+        """Read until the response for req_id; return the raw message (result or error)."""
         while True:
             msg = await read_msg()
             if msg is None:
                 raise CodexError("app-server closed before responding")
             if msg.get("id") == req_id and ("result" in msg or "error" in msg):
-                if "error" in msg:
-                    raise CodexError(f"app-server error: {msg['error']}")
-                return msg.get("result", {})
+                return msg
+
+    async def await_response(req_id: int) -> dict:
+        msg = await await_response_raw(req_id)
+        if "error" in msg:
+            raise CodexError(f"app-server error: {msg['error']}")
+        return msg.get("result", {})
 
     try:
         # 1) initialize handshake
@@ -116,7 +124,9 @@ async def run_turn(
         await await_response(0)
         await _send(proc, {"method": "initialized"})
 
-        # 2) start or resume the thread
+        # 2) resume the thread if we have one; fall back to a fresh thread if the
+        #    rollout is gone (e.g. CODEX_HOME is local and the Space restarted).
+        tid = None
         if thread_id:
             await _send(proc, {
                 "method": "thread/resume",
@@ -129,7 +139,11 @@ async def run_turn(
                     "excludeTurns": True,
                 },
             })
-        else:
+            resumed = await await_response_raw(1)
+            if "result" in resumed:
+                tid = (resumed["result"].get("thread") or {}).get("id")
+
+        if tid is None:  # no thread_id, or resume failed -> start fresh
             params = {
                 "cwd": str(workspace),
                 "approvalPolicy": "never",
@@ -137,10 +151,10 @@ async def run_turn(
             }
             if model:
                 params["model"] = model
-            await _send(proc, {"method": "thread/start", "id": 1, "params": params})
+            await _send(proc, {"method": "thread/start", "id": 2, "params": params})
+            start_result = await await_response(2)
+            tid = (start_result.get("thread") or {}).get("id")
 
-        start_result = await await_response(1)
-        tid = (start_result.get("thread") or {}).get("id")
         if not tid:
             raise CodexError("app-server did not return a thread id")
 
@@ -151,7 +165,9 @@ async def run_turn(
         }
         if model:
             turn_params["model"] = model
-        await _send(proc, {"method": "turn/start", "id": 2, "params": turn_params})
+        if effort:
+            turn_params["effort"] = effort
+        await _send(proc, {"method": "turn/start", "id": 3, "params": turn_params})
 
         # 4) stream notifications until turn/completed
         delta_parts: list[str] = []
@@ -180,9 +196,18 @@ async def run_turn(
                     "completion_tokens": last.get("outputTokens", 0) or 0,
                     "total_tokens": last.get("totalTokens", 0) or 0,
                 }
+            elif method == "error":
+                err = (msg.get("params") or {}).get("error", {}) or {}
+                blob = f"{err.get('message','')} {err.get('additionalDetails') or ''}".lower()
+                # Dead login: don't sit through 5x reconnect retries (~60s). Bail now.
+                if any(s in blob for s in _AUTH_DEAD):
+                    raise CodexError(
+                        "Codex login expired (session ended). Re-run `codex login` "
+                        "and re-upload a fresh auth.json to /data/.codex/auth.json."
+                    )
             elif method == "turn/completed":
                 break
-            elif msg.get("id") == 2 and "error" in msg:
+            elif msg.get("id") == 3 and "error" in msg:
                 raise CodexError(f"turn error: {msg['error']}")
             elif msg.get("id") is not None and method is not None:
                 # Server->client request (e.g. an approval). With approvalPolicy

singlescript.py

@@ -0,0 +1,77 @@
+# ============================================================================
+#  Codex-as-API  ->  OpenAI Agents SDK  (personal "self AI" agent)
+#  HOW TO USE: open https://colab.research.google.com  ->  new notebook  ->
+#  paste this WHOLE file into ONE cell  ->  press Run.  That's it.
+#
+#  It does 4 things:
+#    1. installs the OpenAI Agents SDK
+#    2. points the SDK at YOUR Codex API (running on your Hugging Face Space)
+#    3. runs an agent and proves session memory works
+#    4. leaves you a reusable  ask("...")  helper for the next cells
+# ============================================================================
+
+# --- 1) install (quiet) ----------------------------------------------------
+!pip -q install openai-agents nest_asyncio
+
+import asyncio, nest_asyncio
+from openai import AsyncOpenAI
+from agents import Agent, Runner, OpenAIChatCompletionsModel, set_tracing_disabled
+
+nest_asyncio.apply()          # lets asyncio.run() work inside Colab's loop
+
+# --- 2) YOUR API settings (edit these) -------------------------------------
+BASE_URL = "https://sarveshpatel-codex.hf.space/v1"   # your Space + /v1
+API_KEY  = "CURSEOFWITCHER"                            # your API_TOKEN secret
+MODEL    = "codex"                                     # always "codex"
+SESSION  = "colab-self-ai"   # any string. Same string = persistent memory.
+
+# --- 3) wire the Agents SDK to your Codex API ------------------------------
+set_tracing_disabled(True)   # don't send traces to OpenAI
+
+client = AsyncOpenAI(
+    base_url=BASE_URL,
+    api_key=API_KEY,
+    default_headers={"X-Session-Id": SESSION},   # gives the agent memory
+)
+model = OpenAIChatCompletionsModel(model=MODEL, openai_client=client)
+
+# This is your agent. Change `instructions` to define its personality/role.
+self_ai = Agent(
+    name="SelfAI",
+    instructions=(
+        "You are SelfAI, my personal coding and research assistant powered by "
+        "Codex. Be concise, direct, and practical."
+    ),
+    model=model,
+)
+
+# --- 4) a reusable helper you can call in any later cell -------------------
+def ask(prompt: str) -> str:
+    """Send a message to your agent and return its reply (remembers the session)."""
+    result = asyncio.run(Runner.run(self_ai, prompt))
+    return result.final_output
+
+
+# --- 5) quick demo: connectivity + memory ----------------------------------
+print("ping  :", asyncio.run(
+    client.chat.completions.create(
+        model=MODEL, messages=[{"role": "user", "content": "Reply with exactly: PONG"}]
+    )
+).choices[0].message.content)
+
+print("agent :", ask("In one sentence, what can you help me with?"))
+print("memory>", ask("My favorite number is 42. Acknowledge in 3 words."))
+print("recall:", ask("What is my favorite number? Reply with just the number."))
+
+# ---------------------------------------------------------------------------
+# NEXT CELLS — just call ask():
+#     ask("Write a Python function to check if a string is a palindrome.")
+#     ask("Now add a test for it.")          # it remembers the previous answer
+#
+# TIPS:
+#   * New conversation? change SESSION (or set it to None for one-off calls).
+#   * Streaming / tools: this API is OpenAI-compatible, so any OpenAI client
+#     works. Note: OpenAI-style function tools aren't forwarded yet — but
+#     Codex's own tools (running code, editing files) execute server-side
+#     inside the session.
+# ---------------------------------------------------------------------------

start.sh

@@ -1,25 +1,33 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-# CODEX_HOME points at the persistent bucket (/data/.codex). Make sure it exists.
-mkdir -p "${CODEX_HOME}" /data/sessions
+# CODEX_HOME is on fast LOCAL disk; AUTH_PERSIST_DIR is the /data bucket where the
+# login persists across restarts. Seed the local home from the bucket on boot.
+# Default to /tmp (always writable on HF Spaces) if the env var is missing.
+: "${CODEX_HOME:=/tmp/.codex}"
+export CODEX_HOME
+AUTH_PERSIST_DIR="${AUTH_PERSIST_DIR:-/data/.codex}"
 
-# Install the global safety rules into CODEX_HOME (refresh on every boot).
+mkdir -p "${CODEX_HOME}" "${AUTH_PERSIST_DIR}" /data/sessions
+
+# Global safety rules (refresh every boot).
 cp -f /app/AGENTS.global.md "${CODEX_HOME}/AGENTS.md"
 
-# Codex needs a config.toml so it knows to use the ChatGPT login (not an API key).
-if [ ! -f "${CODEX_HOME}/config.toml" ]; then
-  cat > "${CODEX_HOME}/config.toml" <<'EOF'
-preferred_auth_method = "chatgpt"
-EOF
+# Seed auth.json from the persistent bucket into the local CODEX_HOME.
+if [ -f "${AUTH_PERSIST_DIR}/auth.json" ]; then
+  cp -f "${AUTH_PERSIST_DIR}/auth.json" "${CODEX_HOME}/auth.json"
+  echo "[start] Seeded auth.json from ${AUTH_PERSIST_DIR} — Codex login ready."
+else
+  echo "[start] WARNING: ${AUTH_PERSIST_DIR}/auth.json is MISSING."
+  echo "[start] Run 'codex login' locally and upload ~/.codex/auth.json there."
+  echo "[start] The API returns 503 until it exists."
 fi
 
-if [ -f "${CODEX_HOME}/auth.json" ]; then
-  echo "[start] Found auth.json in CODEX_HOME — Codex login is ready."
-else
-  echo "[start] WARNING: ${CODEX_HOME}/auth.json is MISSING."
-  echo "[start] Run 'codex login' locally, then upload ~/.codex/auth.json to the"
-  echo "[start] bucket at /data/.codex/auth.json. The API will return 503 until then."
+# Use the persisted config.toml if present; else write a minimal default.
+if [ -f "${AUTH_PERSIST_DIR}/config.toml" ]; then
+  cp -f "${AUTH_PERSIST_DIR}/config.toml" "${CODEX_HOME}/config.toml"
+elif [ ! -f "${CODEX_HOME}/config.toml" ]; then
+  printf 'preferred_auth_method = "chatgpt"\n' > "${CODEX_HOME}/config.toml"
 fi
 
 exec uvicorn app:app --host 0.0.0.0 --port "${PORT:-7860}"