@armadra/agent 0.5.1 → 0.6.0

package/dist/auth/chatgpt/cli.d.ts

@@ -0,0 +1,33 @@
+/**
+ * `ama auth login | logout | status chatgpt`（docs/wave6-plan.md §4.2、D16）。[W6-O]
+ *
+ * - login：flavor 取 `--flavor` > 用户级 `auth.chatgpt.flavor` > siwc；`--paste` / `--device`（只 codex）/ 缺省
+ *   浏览器；codex 首次在 TTY 下一次性确认「非官方、仅个人使用」（非 TTY 需 `--yes`），`acknowledgedAt` 入条目；
+ *   成功后在刷新锁下写 auth.json（0600）。
+ * - logout：SIWC 先撤销 refresh token（失败照样删本地，提示到 ChatGPT 设置里断开）；codex 只删本地。
+ * - status：flavor、计划、掩码邮箱、access token 剩余、needsLogin；codex 另查 `wham/usage` 显示配额。
+ *
+ * 输出里从不出现 token、code、账户 id；错误按码渲染（i18n），不回显响应原文。
+ */
+import { type ChatGptFlavor } from "../../config/types-w6.js";
+import type { CliIo } from "../../cli/deps.js";
+import { type BrowserOpener } from "../oauth/browser.js";
+import type { FetchLike } from "../oauth/token-client.js";
+export interface AuthCliDeps {
+    fetch?: FetchLike;
+    openBrowser?: BrowserOpener;
+    now?: () => number;
+    /** `--paste` 读回调 URL；缺省 `io.readStdin`（TTY 下一行不回显）。 */
+    readLine?: () => Promise<string>;
+}
+export interface AuthCliArgs {
+    positionals: string[];
+    values: Map<string, string>;
+    flags: Set<string>;
+    path: string;
+}
+/** AmaError → 本地化的一行（不含响应原文）。 */
+export declare function loginErrorText(error: unknown, flavor: ChatGptFlavor): string;
+export declare function runLogin(args: AuthCliArgs, io: CliIo, deps?: AuthCliDeps): Promise<number>;
+export declare function runLogout(args: AuthCliArgs, io: CliIo, deps?: AuthCliDeps): Promise<number>;
+export declare function runStatus(args: AuthCliArgs, io: CliIo, deps?: AuthCliDeps): Promise<number>;

package/dist/auth/chatgpt/cli.js

@@ -0,0 +1,252 @@
+/**
+ * `ama auth login | logout | status chatgpt`（docs/wave6-plan.md §4.2、D16）。[W6-O]
+ *
+ * - login：flavor 取 `--flavor` > 用户级 `auth.chatgpt.flavor` > siwc；`--paste` / `--device`（只 codex）/ 缺省
+ *   浏览器；codex 首次在 TTY 下一次性确认「非官方、仅个人使用」（非 TTY 需 `--yes`），`acknowledgedAt` 入条目；
+ *   成功后在刷新锁下写 auth.json（0600）。
+ * - logout：SIWC 先撤销 refresh token（失败照样删本地，提示到 ChatGPT 设置里断开）；codex 只删本地。
+ * - status：flavor、计划、掩码邮箱、access token 剩余、needsLogin；codex 另查 `wham/usage` 显示配额。
+ *
+ * 输出里从不出现 token、code、账户 id；错误按码渲染（i18n），不回显响应原文。
+ */
+import { isAmaError } from "../../errors.js";
+import { describeAuthFile, readAuthFile } from "../../config/auth-file.js";
+import { loadConfigFile } from "../../config/load.js";
+import { CONFIG_FILE, resolveConfigDir, resolveDataDir } from "../../config/paths.js";
+import { CHATGPT_FLAVORS, isOAuthEntry, } from "../../config/types-w6.js";
+import { formatDuration, msg } from "../../i18n/index.js";
+import { UsageError } from "../../cli/args.js";
+import { ExitCode } from "../../cli/exit-codes.js";
+import { openBrowser } from "../oauth/browser.js";
+import { readOAuthEntry, withRefreshLock, writeOAuthEntry } from "../oauth/token-store.js";
+import { fetchCodexUsage } from "./backend-client.js";
+import { maskEmail } from "./claims.js";
+import { loginChatGpt, revokeChatGpt } from "./login.js";
+import { CHATGPT_PROVIDER_ID, chatgptBaseUrl } from "./presets.js";
+import { quotaParts } from "./quota-text.js";
+function userAuthConfig(io) {
+    try {
+        const path = `${resolveConfigDir({ env: io.env })}/${CONFIG_FILE}`;
+        return loadConfigFile("config", path)?.value.auth?.chatgpt;
+    }
+    catch {
+        return undefined;
+    }
+}
+function providerOf(args, action) {
+    const provider = args.positionals[1];
+    if (provider === undefined)
+        throw new UsageError(msg().auth.needProvider(action));
+    if (args.positionals.length > 2)
+        throw new UsageError(msg().auth.extraArgs(args.positionals.slice(2).join(" ")));
+    if (provider !== CHATGPT_PROVIDER_ID)
+        throw new UsageError(msg().auth.login.onlyChatgpt(provider));
+    return provider;
+}
+/** AmaError → 本地化的一行（不含响应原文）。 */
+export function loginErrorText(error, flavor) {
+    const m = msg().auth.errors;
+    if (!isAmaError(error))
+        return error?.message ?? String(error);
+    const detail = (error.detail ?? {});
+    switch (error.code) {
+        case "oauth_ports_busy":
+            return m.portsBusy((detail.ports ?? []).join(" / "), flavor === "codex");
+        case "oauth_timeout":
+            return m.timeout;
+        case "oauth_denied":
+            return m.denied(detail.error ?? "error");
+        case "oauth_state_mismatch":
+            return m.stateMismatch;
+        case "oauth_no_code":
+            return m.noCode;
+        case "oauth_invalid_token":
+            return m.invalidToken(detail.reason ?? "invalid");
+        case "oauth_scope_missing":
+            return m.scopeMissing(detail.scope ?? "chatgpt.tokens.use.direct");
+        case "oauth_no_client_id":
+            return m.noClientId;
+        case "oauth_no_account":
+            return m.noAccount;
+        case "oauth_device_unavailable":
+            return m.deviceUnavailable;
+        case "oauth_device_unsupported":
+            return msg().auth.login.deviceNeedsCodex;
+        case "oauth_http":
+        case "oauth_bad_response":
+            return m.http(error.message);
+        case "oauth_network":
+            return m.network(error.message);
+        case "auth_lock_timeout":
+            return m.lockTimeout;
+        case "aborted":
+            return m.aborted;
+        default:
+            return error.message;
+    }
+}
+function parseFlavor(raw, config) {
+    const value = raw ?? config?.flavor ?? "siwc";
+    if (!CHATGPT_FLAVORS.includes(value))
+        throw new UsageError(msg().auth.login.badFlavor(value));
+    return value;
+}
+function parsePort(raw) {
+    if (raw === undefined)
+        return undefined;
+    const port = Number(raw);
+    if (!Number.isInteger(port) || port < 0 || port > 65_535)
+        throw new UsageError(msg().auth.login.badPort(raw));
+    return port;
+}
+/** 确认输入两种语言都认（y / yes / 是 / 好），与界面语言无关。 */
+function isYes(answer) {
+    return /^\s*(y|yes|\u662f|\u597d)\s*$/i.test(answer);
+}
+export async function runLogin(args, io, deps = {}) {
+    const m = msg().auth.login;
+    const provider = providerOf(args, "login");
+    const config = userAuthConfig(io);
+    const flavor = parseFlavor(args.values.get("flavor"), config);
+    const port = parsePort(args.values.get("port"));
+    if (args.flags.has("paste") && args.flags.has("device"))
+        throw new UsageError(m.pasteDevice);
+    const method = args.flags.has("device")
+        ? "device"
+        : args.flags.has("paste")
+            ? "paste"
+            : "browser";
+    if (method === "device" && flavor !== "codex")
+        throw new UsageError(m.deviceNeedsCodex);
+    const existing = readOAuthEntry(args.path, provider);
+    let acknowledgedAt;
+    if (flavor === "codex") {
+        acknowledgedAt = existing?.flavor === "codex" ? existing.acknowledgedAt : undefined;
+        if (acknowledgedAt === undefined) {
+            io.stderr(`${m.codexNotice}\n`);
+            if (!args.flags.has("yes")) {
+                if (!io.stdinIsTTY) {
+                    io.stderr(`ama: ${m.codexNeedsYes}\n`);
+                    return ExitCode.Usage;
+                }
+                io.stderr(m.codexConfirm);
+                const answer = await io.readStdin();
+                io.stderr("\n");
+                if (!isYes(answer)) {
+                    io.stderr(`ama: ${m.cancelled}\n`);
+                    return ExitCode.RuntimeError;
+                }
+            }
+            acknowledgedAt = new Date((deps.now ?? Date.now)()).toISOString();
+        }
+    }
+    const onStep = (step) => {
+        if (step.kind === "open_url")
+            io.stderr(`${step.opened ? m.openedBrowser(step.url) : m.openUrl(step.url)}\n`);
+        else if (step.kind === "paste_prompt")
+            io.stderr(m.pastePrompt(step.url));
+        else
+            io.stderr(`${m.deviceCode(step.url, step.userCode)}\n`);
+    };
+    let entry;
+    try {
+        entry = await loginChatGpt({
+            flavor,
+            method,
+            noBrowser: args.flags.has("no-browser"),
+            dataDir: resolveDataDir({ env: io.env }),
+            env: io.env,
+            config,
+            entry: existing,
+            port,
+            acknowledgedAt,
+            deps: {
+                fetch: deps.fetch ?? fetch,
+                openBrowser: deps.openBrowser ?? openBrowser,
+                onStep,
+                readLine: async () => {
+                    const line = await (deps.readLine ?? (() => io.readStdin()))();
+                    if (io.stdinIsTTY)
+                        io.stderr("\n");
+                    return line;
+                },
+                pages: { success: m.pageSuccess, failure: m.pageFailure },
+            },
+        });
+        await withRefreshLock(args.path, async () => writeOAuthEntry(args.path, provider, entry));
+    }
+    catch (error) {
+        io.stderr(`ama: ${loginErrorText(error, flavor)}\n`);
+        return ExitCode.RuntimeError;
+    }
+    io.stdout(`${m.loggedIn(flavor, entry.planType, maskEmail(entry.email), args.path)}\n`);
+    if (entry.planType === "free")
+        io.stdout(`${m.freePlanHint(entry.planType)}\n`);
+    if (flavor === "siwc")
+        io.stdout(`${m.siwcLimitHint}\n`);
+    io.stdout(`${m.modelHint}\n`);
+    return ExitCode.Ok;
+}
+export async function runLogout(args, io, deps = {}) {
+    const m = msg().auth.logout;
+    const provider = providerOf(args, "logout");
+    const entry = readOAuthEntry(args.path, provider);
+    if (entry === undefined) {
+        io.stderr(`${m.notLoggedIn(provider, args.path)}\n`);
+        return ExitCode.RuntimeError;
+    }
+    const revoked = entry.flavor === "siwc"
+        ? await revokeChatGpt(deps.fetch ?? fetch, entry, { env: io.env, config: userAuthConfig(io) })
+        : undefined;
+    try {
+        await withRefreshLock(args.path, async () => writeOAuthEntry(args.path, provider, undefined));
+    }
+    catch (error) {
+        io.stderr(`ama: ${loginErrorText(error, entry.flavor)}\n`);
+        return ExitCode.RuntimeError;
+    }
+    const text = revoked === undefined
+        ? m.local(provider, args.path)
+        : revoked
+            ? m.revoked(provider, args.path)
+            : m.notRevoked(provider, args.path);
+    io.stdout(`${text}\n`);
+    return ExitCode.Ok;
+}
+export async function runStatus(args, io, deps = {}) {
+    const m = msg().auth.status;
+    if (args.positionals.length > 2)
+        throw new UsageError(msg().auth.extraArgs(args.positionals.slice(2).join(" ")));
+    const only = args.positionals[1];
+    const now = (deps.now ?? Date.now)();
+    const { file } = readAuthFile(args.path);
+    const entries = Object.entries(file.providers).filter((pair) => isOAuthEntry(pair[1]) && (only === undefined || pair[0] === only));
+    if (entries.length === 0) {
+        io.stdout(`${m.none(args.path)}\n`);
+        return ExitCode.Ok;
+    }
+    const summaries = new Map(describeAuthFile(file, now).map((s) => [s.provider, s]));
+    const config = userAuthConfig(io);
+    for (const [provider, entry] of entries) {
+        const summary = summaries.get(provider);
+        io.stdout(`${m.header(provider, msg().auth.oauthSummary(entry.flavor, entry.planType, entry.needsLogin === true), maskEmail(entry.email))}\n`);
+        const left = summary?.expiresIn ?? entry.expiresAt - now;
+        if (entry.needsLogin === true)
+            io.stdout(`${m.needsLogin(provider)}\n`);
+        else
+            io.stdout(`${left > 0 ? m.expiresIn(formatDuration(left)) : m.expired}\n`);
+        if (entry.flavor === "siwc")
+            io.stdout(`${m.quotaSiwc}\n`);
+        else if (entry.needsLogin !== true && left > 0) {
+            const quota = await fetchCodexUsage(deps.fetch ?? fetch, chatgptBaseUrl("codex", io.env), {
+                flavor: "codex",
+                accessToken: entry.accessToken,
+                accountId: entry.accountId,
+                originator: config?.originator,
+            });
+            const parts = quota === undefined ? undefined : quotaParts(quota, now);
+            io.stdout(`${parts === undefined ? m.quotaUnavailable : m.quota(parts)}\n`);
+        }
+    }
+    return ExitCode.Ok;
+}

package/dist/auth/chatgpt/doctor.d.ts

@@ -0,0 +1,17 @@
+/**
+ * `ama doctor` 的 OAuth 行（[W6-O]）：只读文件、不刷新 token；codex flavor 且 token 未过期时查一次
+ * `wham/usage`（3 s 超时，失败静默）显示配额，SIWC 只给查看位置。
+ */
+import type { ChatGptAuthConfig, OAuthAuthEntry } from "../../config/types-w6.js";
+import type { FetchLike } from "../oauth/token-client.js";
+export interface OAuthDoctorLines {
+    line: string;
+    quota?: string;
+    problem?: string;
+}
+export declare function oauthDoctorLines(provider: string, entry: OAuthAuthEntry, options?: {
+    now?: number;
+    fetch?: FetchLike;
+    env?: Readonly<Record<string, string | undefined>>;
+    config?: ChatGptAuthConfig | undefined;
+}): Promise<OAuthDoctorLines>;

package/dist/auth/chatgpt/doctor.js

@@ -0,0 +1,36 @@
+/**
+ * `ama doctor` 的 OAuth 行（[W6-O]）：只读文件、不刷新 token；codex flavor 且 token 未过期时查一次
+ * `wham/usage`（3 s 超时，失败静默）显示配额，SIWC 只给查看位置。
+ */
+import { formatDuration, msg } from "../../i18n/index.js";
+import { fetchCodexUsage } from "./backend-client.js";
+import { chatgptBaseUrl } from "./presets.js";
+import { quotaParts } from "./quota-text.js";
+export async function oauthDoctorLines(provider, entry, options = {}) {
+    const m = msg().auth;
+    const now = options.now ?? Date.now();
+    const left = entry.expiresAt - now;
+    const state = entry.needsLogin === true
+        ? m.doctor.needsLogin
+        : left > 0
+            ? m.doctor.valid(formatDuration(left))
+            : m.doctor.expired;
+    const out = { line: m.doctor.oauth(entry.flavor, entry.planType, state) };
+    if (entry.needsLogin === true) {
+        out.problem = m.doctor.relogin(provider);
+        return out;
+    }
+    if (entry.flavor === "siwc")
+        out.quota = m.status.quotaSiwc.trim();
+    else if (left > 0) {
+        const quota = await fetchCodexUsage(options.fetch ?? fetch, chatgptBaseUrl("codex", options.env), {
+            flavor: "codex",
+            accessToken: entry.accessToken,
+            accountId: entry.accountId,
+            originator: options.config?.originator,
+        }, 3_000);
+        const parts = quota === undefined ? undefined : quotaParts(quota, now);
+        out.quota = (parts === undefined ? m.status.quotaUnavailable : m.status.quota(parts)).trim();
+    }
+    return out;
+}

package/dist/auth/chatgpt/host-id.d.ts

@@ -0,0 +1,7 @@
+/**
+ * SIWC 的 `ext_agent_host_id`（docs/wave6-plan.md D16）：每个安装稳定不变，存
+ * `<dataDir>/chatgpt-host.json`（0600，按安装、不随 dotfiles 同步），形如 `urn:uuid:…`。[W6-O]
+ */
+export declare const HOST_ID_FILE = "chatgpt-host.json";
+export declare function hostIdPath(dataDir: string): string;
+export declare function readOrCreateHostId(dataDir: string): string;

package/dist/auth/chatgpt/host-id.js

@@ -0,0 +1,26 @@
+/**
+ * SIWC 的 `ext_agent_host_id`（docs/wave6-plan.md D16）：每个安装稳定不变，存
+ * `<dataDir>/chatgpt-host.json`（0600，按安装、不随 dotfiles 同步），形如 `urn:uuid:…`。[W6-O]
+ */
+import { randomUUID } from "node:crypto";
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+export const HOST_ID_FILE = "chatgpt-host.json";
+export function hostIdPath(dataDir) {
+    return join(dataDir, HOST_ID_FILE);
+}
+export function readOrCreateHostId(dataDir) {
+    const path = hostIdPath(dataDir);
+    try {
+        const value = JSON.parse(readFileSync(path, "utf8"));
+        if (typeof value.hostId === "string" && /^urn:uuid:[0-9a-f-]{36}$/i.test(value.hostId))
+            return value.hostId;
+    }
+    catch {
+        // 不存在或损坏：重建
+    }
+    const hostId = `urn:uuid:${randomUUID()}`;
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    writeFileSync(path, `${JSON.stringify({ version: 1, hostId }, null, 2)}\n`, { mode: 0o600 });
+    return hostId;
+}

package/dist/auth/chatgpt/login.d.ts

@@ -0,0 +1,30 @@
+/**
+ * ChatGPT 登录 / 登出编排（docs/wave6-plan.md §4.1–§4.3、D13–D16）。[W6-O]
+ *
+ * 登录：预设 → 授权码（browser / paste / device）→ 换 token（表单编码；SIWC 带 `resource`，client id 用
+ * 回调带回的签发 id）→ 校验（SIWC：JWKS 验签 iss / aud / nonce / exp + 授予 scope 含
+ * `chatgpt.tokens.use.direct`；codex：只解码取账户）→ `OAuthAuthEntry`。写文件由调用方经 token-store 做。
+ *
+ * 登出：SIWC 调 discovery 里的 `revocation_endpoint`（`token=<refresh>`、`token_type_hint=refresh_token`、
+ * `client_id`），失败不阻止删除本地条目；codex 只删本地。
+ */
+import type { ChatGptFlavor, OAuthAuthEntry } from "../../config/types-w6.js";
+import { type AuthorizationResult, type FlowDeps } from "../oauth/flows.js";
+import { type FetchLike } from "../oauth/token-client.js";
+import { type ChatGptPreset, type PresetOverrides } from "./presets.js";
+export type LoginMethod = "browser" | "paste" | "device";
+export interface ChatGptLoginOptions extends PresetOverrides {
+    flavor: ChatGptFlavor;
+    method: LoginMethod;
+    noBrowser?: boolean;
+    /** SIWC 的 `ext_agent_host_id` 存放目录（`<dataDir>`）。 */
+    dataDir: string;
+    /** codex 的一次性确认时刻（ISO）；调用方负责问。 */
+    acknowledgedAt?: string | undefined;
+    deps: FlowDeps;
+}
+export declare const DEFAULT_ACCESS_TTL_S = 3600;
+export declare function exchangeCode(fetchFn: FetchLike, preset: ChatGptPreset, auth: AuthorizationResult, signal?: AbortSignal): Promise<OAuthAuthEntry>;
+export declare function loginChatGpt(options: ChatGptLoginOptions): Promise<OAuthAuthEntry>;
+/** SIWC 登出：撤销 refresh token。返回是否确认撤销（失败 / 不支持为 false，不抛）。 */
+export declare function revokeChatGpt(fetchFn: FetchLike, entry: OAuthAuthEntry, overrides?: PresetOverrides): Promise<boolean>;

package/dist/auth/chatgpt/login.js

@@ -0,0 +1,130 @@
+/**
+ * ChatGPT 登录 / 登出编排（docs/wave6-plan.md §4.1–§4.3、D13–D16）。[W6-O]
+ *
+ * 登录：预设 → 授权码（browser / paste / device）→ 换 token（表单编码；SIWC 带 `resource`，client id 用
+ * 回调带回的签发 id）→ 校验（SIWC：JWKS 验签 iss / aud / nonce / exp + 授予 scope 含
+ * `chatgpt.tokens.use.direct`；codex：只解码取账户）→ `OAuthAuthEntry`。写文件由调用方经 token-store 做。
+ *
+ * 登出：SIWC 调 discovery 里的 `revocation_endpoint`（`token=<refresh>`、`token_type_hint=refresh_token`、
+ * `client_id`），失败不阻止删除本地条目；codex 只删本地。
+ */
+import { AmaError } from "../../errors.js";
+import { loginBrowser, loginDevice, loginPaste, } from "../oauth/flows.js";
+import { jwtClaims } from "../oauth/jwt.js";
+import { fetchDiscovery, validateIdToken } from "../oauth/oidc.js";
+import { parseTokenResponse, postOAuth } from "../oauth/token-client.js";
+import { chatgptAccount, hasScope } from "./claims.js";
+import { readOrCreateHostId } from "./host-id.js";
+import { SIWC_REGISTRATION_CLIENT_ID, authorizeUrl, resolveChatGptPreset, } from "./presets.js";
+export const DEFAULT_ACCESS_TTL_S = 3600;
+function flowPreset(preset, hostId) {
+    return {
+        issuer: preset.issuer,
+        clientId: preset.clientId,
+        redirectPorts: preset.redirectPorts,
+        buildAuthorizeUrl: (input) => authorizeUrl(preset, { ...input, hostId }),
+    };
+}
+function issuedClientId(preset, auth, tokenClientId, idToken) {
+    if (!preset.registering)
+        return preset.clientId;
+    const fromAud = () => {
+        const aud = jwtClaims(idToken)?.["aud"];
+        const list = Array.isArray(aud) ? aud : [aud];
+        return list.find((a) => typeof a === "string" && a !== SIWC_REGISTRATION_CLIENT_ID);
+    };
+    const issued = auth.clientId ?? tokenClientId ?? fromAud();
+    if (issued === undefined || issued === SIWC_REGISTRATION_CLIENT_ID)
+        throw new AmaError("oauth_no_client_id", "dynamic registration returned no client id");
+    return issued;
+}
+export async function exchangeCode(fetchFn, preset, auth, signal) {
+    // 新注册：交换要用签发的 id（回调带回）；回调没带时先用注册入口换，再从 id_token 的 aud 取
+    const exchangeClient = preset.registering ? (auth.clientId ?? preset.clientId) : preset.clientId;
+    const params = {
+        grant_type: "authorization_code",
+        code: auth.code,
+        redirect_uri: auth.redirectUri,
+        client_id: exchangeClient,
+        code_verifier: auth.verifier,
+    };
+    if (preset.resource !== undefined)
+        params["resource"] = preset.resource;
+    const token = parseTokenResponse(await postOAuth(fetchFn, preset.tokenUrl, params, {
+        encoding: "form",
+        what: "token exchange",
+        signal,
+    }), "token exchange");
+    if (token.refreshToken === undefined)
+        throw new AmaError("oauth_bad_response", "token exchange: no refresh_token");
+    const clientId = issuedClientId(preset, auth, token.clientId, token.idToken);
+    let claims = jwtClaims(token.idToken);
+    if (preset.verifyIdToken) {
+        if (token.idToken === undefined)
+            throw new AmaError("oauth_invalid_token", "invalid id_token: missing");
+        claims = await validateIdToken(fetchFn, token.idToken, {
+            issuer: preset.issuer,
+            audience: clientId,
+            nonce: auth.nonce,
+        });
+        const scope = auth.scope ?? token.scope;
+        if (preset.requiredScope !== undefined && !hasScope(scope, preset.requiredScope))
+            throw new AmaError("oauth_scope_missing", `granted scope lacks ${preset.requiredScope}`, {
+                detail: { scope: preset.requiredScope },
+            });
+    }
+    const account = chatgptAccount(claims, preset.flavor);
+    if (preset.flavor === "codex" && account.accountId === undefined)
+        throw new AmaError("oauth_no_account", "id_token has no ChatGPT account id");
+    const now = Date.now();
+    const entry = {
+        type: "oauth",
+        flavor: preset.flavor,
+        clientId,
+        issuer: preset.issuer,
+        ...account,
+        accessToken: token.accessToken,
+        refreshToken: token.refreshToken,
+        ...(token.idToken !== undefined ? { idToken: token.idToken } : {}),
+        expiresAt: now + (token.expiresIn ?? DEFAULT_ACCESS_TTL_S) * 1000,
+        lastRefresh: new Date(now).toISOString(),
+    };
+    return entry;
+}
+export async function loginChatGpt(options) {
+    const preset = resolveChatGptPreset(options.flavor, options);
+    if (options.method === "device" && !preset.device)
+        throw new AmaError("oauth_device_unsupported", "device code login needs --flavor codex");
+    const hostId = preset.flavor === "siwc" ? readOrCreateHostId(options.dataDir) : undefined;
+    const flow = flowPreset(preset, hostId);
+    const auth = options.method === "device"
+        ? await loginDevice(flow, options.deps)
+        : options.method === "paste"
+            ? await loginPaste(flow, options.deps)
+            : await loginBrowser(flow, options.deps, { noBrowser: options.noBrowser === true });
+    const entry = await exchangeCode(options.deps.fetch, preset, auth, options.deps.signal);
+    if (options.acknowledgedAt !== undefined)
+        entry.acknowledgedAt = options.acknowledgedAt;
+    return entry;
+}
+/** SIWC 登出：撤销 refresh token。返回是否确认撤销（失败 / 不支持为 false，不抛）。 */
+export async function revokeChatGpt(fetchFn, entry, overrides = {}) {
+    const preset = resolveChatGptPreset(entry.flavor, { ...overrides, entry });
+    if (!preset.revoke)
+        return false;
+    const issuer = entry.issuer ?? preset.issuer;
+    try {
+        const discovery = await fetchDiscovery(fetchFn, issuer);
+        if (discovery.revocationEndpoint === undefined)
+            return false;
+        await postOAuth(fetchFn, discovery.revocationEndpoint, {
+            token: entry.refreshToken,
+            token_type_hint: "refresh_token",
+            client_id: entry.clientId ?? preset.clientId,
+        }, { encoding: "form", what: "token revocation" });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/auth/chatgpt/presets.d.ts

@@ -0,0 +1,66 @@
+/**
+ * ChatGPT 登录预设表（docs/wave6-plan.md §4.1、D13–D16；R6 §1.1、§1.2、§4.10）。[W6-O]
+ *
+ * 两条路径共用 PKCE / 回调 / 存储 / 锁 / 配额框架，差异全部在这张表里：
+ * - `siwc`（缺省，官方动态注册）：`/api/accounts/*`，首次 `client_id=dynamic_agent_client`，回调带回签发的
+ *   id 后存进条目；表单编码、带 `resource`；id_token 必须 JWKS 验签；推理走 `api.openai.com/v1`；
+ * - `codex`（显式开启的备用）：Codex CLI 的公开客户端，`/oauth/*`，刷新 JSON 编码；id_token 只解码；
+ *   推理走 `chatgpt.com/backend-api/codex`，另发 `ChatGPT-Account-ID` 与 `originator`。
+ *
+ * 覆盖：`AMA_CHATGPT_CLIENT_ID` / `AMA_CHATGPT_ISSUER`（测试用）/ `AMA_CHATGPT_BASE_URL` > 配置
+ * `auth.chatgpt.*` > 条目里签发的 client id > 缺省。
+ */
+import type { ChatGptAuthConfig, ChatGptFlavor, OAuthAuthEntry } from "../../config/types-w6.js";
+export declare const CHATGPT_PROVIDER_ID = "chatgpt";
+export declare const DEFAULT_ISSUER = "https://auth.openai.com";
+export declare const SIWC_REGISTRATION_CLIENT_ID = "dynamic_agent_client";
+export declare const CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+export declare const SIWC_RESOURCE = "https://api.openai.com/v1";
+export declare const SIWC_REQUIRED_SCOPE = "chatgpt.tokens.use.direct";
+export declare const AGENT_NAME_HINT = "ama";
+export declare const DEFAULT_ORIGINATOR = "codex_cli_rs";
+export declare const CHATGPT_BASE_URLS: Readonly<Record<ChatGptFlavor, string>>;
+export interface AuthorizeInput {
+    redirectUri: string;
+    state: string;
+    challenge: string;
+    nonce: string;
+    /** SIWC：`<dataDir>/chatgpt-host.json` 的安装 id。 */
+    hostId?: string | undefined;
+}
+export interface ChatGptPreset {
+    flavor: ChatGptFlavor;
+    issuer: string;
+    clientId: string;
+    /** SIWC 还没有签发 id（用注册入口登录）。 */
+    registering: boolean;
+    authorizeUrl: string;
+    tokenUrl: string;
+    scopes: readonly string[];
+    redirectPorts: readonly number[];
+    /** SIWC 的 `resource`（交换与刷新都带）。 */
+    resource?: string;
+    refreshEncoding: "form" | "json";
+    /** 推理端点（渠道 baseUrl）。 */
+    baseUrl: string;
+    /** SIWC：id_token 必须 JWKS 验签，且授予 scope 含 `chatgpt.tokens.use.direct`。 */
+    verifyIdToken: boolean;
+    requiredScope?: string;
+    /** 设备码（只有 codex）。 */
+    device: boolean;
+    /** 登出调 revocation_endpoint（只有 SIWC）。 */
+    revoke: boolean;
+    originator?: string;
+}
+export interface PresetOverrides {
+    config?: ChatGptAuthConfig | undefined;
+    env?: Readonly<Record<string, string | undefined>> | undefined;
+    /** 已有条目：SIWC 复用签发的 client id。 */
+    entry?: OAuthAuthEntry | undefined;
+    /** `--port N`。 */
+    port?: number | undefined;
+}
+export declare function chatgptBaseUrl(flavor: ChatGptFlavor, env?: Readonly<Record<string, string | undefined>>): string;
+export declare function resolveChatGptPreset(flavor: ChatGptFlavor, overrides?: PresetOverrides): ChatGptPreset;
+/** 授权 URL（参数顺序固定，便于测试）。 */
+export declare function authorizeUrl(preset: ChatGptPreset, input: AuthorizeInput): string;