@bitkyc08/opencodex 2.41.0 → 2.43.0-preview.20260906

package/src/oauth/anthropic-routing.ts

@@ -152,6 +152,7 @@ export function sweepExpiredAnthropicRoutingHealth(now = Date.now()): number {
 export function clearAnthropicAccountPoolState(): void {
   upstreamHealth.clear();
   sessionAffinity.clear();
+  quorumCache = null;
 }
 
 export function anthropicSessionAffinitySizeForTests(): number {
@@ -236,6 +237,79 @@ export function getEligibleAnthropicAccounts(now = Date.now()): string[] {
     .map(account => account.id);
 }
 
+/**
+ * How long a quorum answer may be reused before the store is consulted again.
+ *
+ * This predicate now runs on the INITIAL resolution of every Anthropic request, not just after a
+ * 429, so an uncached implementation puts a synchronous file read in front of ordinary traffic:
+ * `getAccountSet` goes through `loadAuthStore`, which has no cache of its own and chmods the
+ * config dir, chmods the secret, reads the whole file and normalizes it on every call.
+ *
+ * Two seconds matches the generic module's `PRESENCE_CACHE_TTL_MS` for the same reason: short
+ * enough that a login in another window is visible before the operator can switch back and send a
+ * prompt, long enough that a burst of requests shares one read. The cache holds a BOOLEAN derived
+ * from a count — never a credential, never an account id.
+ *
+ * Staleness is bounded by consequence, not only by the TTL. Explicit invalidation covers the
+ * roster mutations this module can see (rotation, pool-state reset, affinity clear on account
+ * removal, manual selection), but not one it cannot: a 401 elsewhere flagging an account
+ * `needsReauth` drops the real quorum to one while a cached `true` survives for up to 2s.
+ *
+ * That window is harmless in both directions, which is why it is left rather than plumbed
+ * through the store. A stale `true` only lets the caller ASK for an alternate;
+ * `pickAlternateAnthropicAccount` re-reads the roster through `getEligibleAnthropicAccounts`,
+ * skips the reauth-flagged account and returns `null`, so the 429 surfaces exactly as it would
+ * have. A stale `false` costs one un-rotated 429 and self-corrects on the next read. Neither
+ * can dispatch on an unusable credential, which is the only outcome worth adding a store hook
+ * to prevent.
+ */
+const QUORUM_CACHE_TTL_MS = 2_000;
+
+let quorumCache: { value: boolean; readAt: number } | null = null;
+
+/**
+ * Whether a 429 has somewhere to go: two or more accounts that could serve traffic if asked.
+ *
+ * Reactive failover is a safety net, not a routing policy. It runs only AFTER upstream refused,
+ * it cannot spread load across a healthy session, and it cannot fire at all unless the operator
+ * deliberately logged in twice. So it activates on presence, exactly like an `apiKeyPool` of two
+ * keys does in `providers/key-failover.ts` -- and unlike the PROACTIVE pool (affinity,
+ * quota-ranked new-session picks, `autoSwitchThreshold`, `strategy`), which changes which
+ * account serves a healthy request and therefore stays behind `anthropicAccountPool.enabled`.
+ *
+ * Cooldowns are deliberately ignored here. They are transient and per-request, while this
+ * answers the durable question "did the operator store a second account". Counting a cooled
+ * account as absent would switch the feature off for the length of the cooldown -- precisely
+ * when it is needed.
+ *
+ * `isPoolCredentialUsable` is still applied, so the fail-closed background `local-cli` rule
+ * holds: an expired background slot is not a quorum and cannot be adopted.
+ */
+export function hasAnthropicFailoverQuorum(now = Date.now()): boolean {
+  // Monotonic guard: a caller-supplied `now` that predates the cached read (tests pass explicit
+  // clocks) must not be served from a future entry.
+  if (quorumCache && now >= quorumCache.readAt && now - quorumCache.readAt < QUORUM_CACHE_TTL_MS) {
+    return quorumCache.value;
+  }
+  const set = getAccountSet(PROVIDER);
+  let value = false;
+  if (set) {
+    let usable = 0;
+    for (const account of set.accounts) {
+      if (account.needsReauth === true) continue;
+      if (!isPoolCredentialUsable(account.id, now)) continue;
+      if (++usable >= 2) { value = true; break; }
+    }
+  }
+  quorumCache = { value, readAt: now };
+  return value;
+}
+
+/** Test seam and manual-recovery hook: force the next quorum question to re-read the store. */
+export function forgetAnthropicFailoverQuorum(): void {
+  quorumCache = null;
+}
+
 /** Earliest remaining cooldown among cooled Anthropic accounts, for client Retry-After. */
 export function getAnthropicPoolRetryAfterSeconds(now = Date.now()): number | null {
   const set = getAccountSet(PROVIDER);
@@ -559,6 +633,10 @@ export function clearAnthropicSessionAffinityForAccount(accountId: string): void
   for (const [key, entry] of sessionAffinity) {
     if (entry.accountId === accountId) sessionAffinity.delete(key);
   }
+  // The roster just lost or changed a member. This is the account-removal path, so the next
+  // activation question must re-read rather than answer from a count taken while the account
+  // was still present -- otherwise a delete leaves a stale quorum for the length of the TTL.
+  quorumCache = null;
 }
 
 /**
@@ -573,7 +651,13 @@ export function rotateAnthropicAccountOn429(
   sessionKey?: string | null,
   now = Date.now(),
 ): string | null {
-  if (!isAnthropicAccountPoolEnabled(config)) return null;
+  // Reactive 429 failover is NOT gated on the pool flag. That flag buys PROACTIVE routing --
+  // session affinity, quota-ranked new-session selection, autoSwitchThreshold, strategy -- all
+  // of which move a HEALTHY request and stay opt-in. Rotating away from an account upstream has
+  // just rate-limited is a different thing: it only ever runs after a refusal, and stranding a
+  // 429 while a second logged-in account sits idle is a defect, not a configuration choice.
+  // Presence is the activation rule, the same one an apiKeyPool of two keys already uses.
+  if (!isAnthropicAccountPoolEnabled(config) && !hasAnthropicFailoverQuorum(now)) return null;
 
   const parsedRetry = parseRetryAfterMs(retryAfterHeader, now);
   const cooldownMs = parsedRetry ?? DEFAULT_COOLDOWN_MS;
@@ -584,8 +668,17 @@ export function rotateAnthropicAccountOn429(
   sweepExpiredOnWrite(now);
   clearAnthropicSessionAffinityForAccount(failedAccountId);
   notePoolRotationFailure(POOL_KEY_ANTHROPIC, failedAccountId);
-
-  const next = pickAlternateAnthropicAccount(config, failedAccountId, now);
+  // A rotation means the roster in use just changed; do not answer the next activation question
+  // from a count read taken before the failure.
+  quorumCache = null;
+
+  // The pool's strategy is a PROACTIVE policy. When the pool is disabled, reactive
+  // presence-only recovery must not silently reactivate round-robin/fill-first merely
+  // because those dormant values remain in config. The quota picker is the neutral
+  // recovery policy already used by the default strategy.
+  const next = isAnthropicAccountPoolEnabled(config)
+    ? pickAlternateAnthropicAccount(config, failedAccountId, now)
+    : pickLowestUsage(config, failedAccountId, now);
   if (!next) {
     console.warn("[anthropic-pool] all eligible Anthropic OAuth accounts are in cooldown; returning 429");
     return null;
@@ -614,6 +707,9 @@ export function promoteAnthropicActiveAccount(accountId: string): void {
 export function resetAnthropicRoutingForManualSelection(accountId: string): void {
   sessionAffinity.clear();
   seedPoolRotationAccount(POOL_KEY_ANTHROPIC, accountId);
+  // A manual account selection is an operator statement about the roster; do not answer the
+  // next activation question from a count read before it.
+  quorumCache = null;
 }
 
 /**

package/src/oauth/chatgpt-device.ts

@@ -0,0 +1,187 @@
+import type { OAuthController, OAuthCredentials } from "./types";
+import { CHATGPT_CLIENT_ID, CHATGPT_TOKEN_URL, credsFromToken } from "./chatgpt";
+
+/**
+ * OpenAI deviceauth (device-code) grant for the ChatGPT/Codex provider.
+ *
+ * The callback flow in `./chatgpt` needs a browser and a listener on
+ * localhost:1455. A hub running headless in a container or over SSH has
+ * neither, which left "copy the long redirect URL out of the browser error
+ * page" as the only way to add an account there (#3366).
+ *
+ * This is the same grant Codex CLI uses. Three steps, and the middle one is
+ * where it differs from RFC 8628: the poll returns an authorization code plus
+ * a SERVER-generated PKCE verifier, which is then spent at the ordinary token
+ * endpoint. We never generate the verifier ourselves here.
+ */
+const USERCODE_URL = "https://auth.openai.com/api/accounts/deviceauth/usercode";
+const DEVICE_TOKEN_URL = "https://auth.openai.com/api/accounts/deviceauth/token";
+const DEVICE_REDIRECT_URI = "https://auth.openai.com/deviceauth/callback";
+
+/** Where the user types the short code. Fixed, and safe to show anywhere. */
+export const DEVICE_VERIFICATION_URL = "https://auth.openai.com/codex/device";
+
+/** The grant's own lifetime. Polling past this only produces a worse error message. */
+const DEVICE_FLOW_TTL_MS = 15 * 60 * 1000;
+const DEFAULT_POLL_INTERVAL_MS = 5_000;
+const MIN_POLL_INTERVAL_MS = 1_000;
+/**
+ * Above ~2^31 ms a timer overflows and fires immediately, which would turn a
+ * hostile or corrupt `interval` into a hot loop against an auth endpoint. The
+ * grant only lives 15 minutes, so anything longer is meaningless anyway.
+ */
+const MAX_POLL_INTERVAL_MS = DEVICE_FLOW_TTL_MS;
+
+/**
+ * Upstream sends `interval` as a number in some responses and a string in
+ * others. A string would make `setTimeout` treat it as 0 and turn the poll
+ * into a hot loop against an auth endpoint, so coerce and floor it.
+ */
+function normalizeIntervalMs(raw: unknown): number {
+  const seconds = typeof raw === "number" ? raw : typeof raw === "string" ? Number(raw) : NaN;
+  if (!Number.isFinite(seconds) || seconds <= 0) return DEFAULT_POLL_INTERVAL_MS;
+  const ms = Math.round(seconds * 1000);
+  return Math.min(MAX_POLL_INTERVAL_MS, Math.max(MIN_POLL_INTERVAL_MS, ms));
+}
+
+function nonEmptyString(value: unknown): string | undefined {
+  return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+
+async function sleep(ms: number, signal?: AbortSignal): Promise<void> {
+  if (signal?.aborted) throw new Error("Login cancelled");
+  await new Promise<void>((resolve, reject) => {
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    const onAbort = (): void => {
+      clearTimeout(timer);
+      reject(new Error("Login cancelled"));
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+
+/**
+ * Device-flow errors carry the HTTP status and nothing else.
+ *
+ * The callback flow's `safeErrorDescription` reflects the upstream body into
+ * the message, which is fine for an OAuth error envelope but not here: these
+ * endpoints can echo request material, and this message reaches CLI output,
+ * the GUI, and issue reports.
+ */
+function deviceError(stage: string, status: number): Error {
+  return new Error(`ChatGPT device authorization ${stage} failed: HTTP ${status}`);
+}
+
+interface DeviceUserCode {
+  deviceAuthId: string;
+  userCode: string;
+  intervalMs: number;
+}
+
+async function requestUserCode(signal?: AbortSignal): Promise<DeviceUserCode> {
+  const response = await fetch(USERCODE_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ client_id: CHATGPT_CLIENT_ID }),
+    signal,
+  });
+  if (!response.ok) throw deviceError("request", response.status);
+  const payload = (await response.json()) as Record<string, unknown>;
+  const deviceAuthId = nonEmptyString(payload.device_auth_id);
+  // Upstream accepts both spellings, so a response using the alias must not be
+  // rejected as malformed.
+  const userCode = nonEmptyString(payload.user_code) ?? nonEmptyString(payload.usercode);
+  if (!deviceAuthId || !userCode) {
+    throw new Error("ChatGPT device authorization response missing required fields");
+  }
+  return { deviceAuthId, userCode, intervalMs: normalizeIntervalMs(payload.interval) };
+}
+
+interface DeviceGrant {
+  authorizationCode: string;
+  codeVerifier: string;
+}
+
+/**
+ * Poll until the user finishes at the verification page.
+ *
+ * Pending is signalled by 403/404 rather than an `authorization_pending` body,
+ * so status is the whole protocol here: any other non-2xx is terminal, and
+ * treating it as pending would keep hammering a permanently failing endpoint.
+ */
+async function pollForGrant(
+  device: DeviceUserCode,
+  signal?: AbortSignal,
+): Promise<DeviceGrant> {
+  const deadline = Date.now() + DEVICE_FLOW_TTL_MS;
+  while (Date.now() < deadline) {
+    if (signal?.aborted) throw new Error("Login cancelled");
+    const response = await fetch(DEVICE_TOKEN_URL, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ device_auth_id: device.deviceAuthId, user_code: device.userCode }),
+      signal,
+    });
+    if (response.status === 403 || response.status === 404) {
+      // Cap the wait at the time actually left. Sleeping a full interval past
+      // the deadline is how a 15-minute grant turns into a 20-minute wait.
+      const remaining = deadline - Date.now();
+      if (remaining <= 0) break;
+      await sleep(Math.min(device.intervalMs, remaining), signal);
+      continue;
+    }
+    if (!response.ok) throw deviceError("poll", response.status);
+    // The deadline is checked again here, not only at the top of the loop: a
+    // single poll can itself outlive the grant, and accepting a code that
+    // expired mid-flight just moves the failure to the token exchange.
+    if (Date.now() >= deadline) break;
+    const payload = (await response.json()) as Record<string, unknown>;
+    const authorizationCode = nonEmptyString(payload.authorization_code);
+    const codeVerifier = nonEmptyString(payload.code_verifier);
+    if (!authorizationCode || !codeVerifier) {
+      throw new Error("ChatGPT device authorization response missing required fields");
+    }
+    return { authorizationCode, codeVerifier };
+  }
+  throw new Error("ChatGPT device authorization expired");
+}
+
+async function exchangeGrant(grant: DeviceGrant, signal?: AbortSignal): Promise<OAuthCredentials> {
+  const response = await fetch(CHATGPT_TOKEN_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "authorization_code",
+      client_id: CHATGPT_CLIENT_ID,
+      code: grant.authorizationCode,
+      code_verifier: grant.codeVerifier,
+      redirect_uri: DEVICE_REDIRECT_URI,
+    }).toString(),
+    signal,
+  });
+  if (!response.ok) throw deviceError("token exchange", response.status);
+  return credsFromToken((await response.json()) as Record<string, unknown>);
+}
+
+/**
+ * Run the device flow to completion.
+ *
+ * `deviceCode` in the `onAuth` payload is the HUMAN code, matching kimi, nous,
+ * and github-copilot. The opaque `device_auth_id` never leaves this module:
+ * every device-code surface renders `deviceCode` verbatim, and the management
+ * login route also uses its presence to decide a flow must not be handed to a
+ * local browser spawn.
+ */
+export async function loginChatGPTDevice(ctrl: OAuthController): Promise<OAuthCredentials> {
+  const device = await requestUserCode(ctrl.signal);
+  ctrl.onAuth?.({
+    url: DEVICE_VERIFICATION_URL,
+    instructions: `Enter code: ${device.userCode}`,
+    deviceCode: device.userCode,
+  });
+  const grant = await pollForGrant(device, ctrl.signal);
+  return exchangeGrant(grant, ctrl.signal);
+}

package/src/oauth/chatgpt.ts

@@ -5,6 +5,10 @@ import { generatePKCE } from "./pkce";
 const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 const AUTH_URL = "https://auth.openai.com/oauth/authorize";
 const TOKEN_URL = "https://auth.openai.com/oauth/token";
+
+/** Shared with the deviceauth grant in `./chatgpt-device`: same public PKCE client. */
+export const CHATGPT_CLIENT_ID = CLIENT_ID;
+export const CHATGPT_TOKEN_URL = TOKEN_URL;
 const SCOPE = "openid profile email offline_access api.connectors.read api.connectors.invoke";
 const CALLBACK_PORT = 1455;
 const CALLBACK_PATH = "/auth/callback";
@@ -46,9 +50,17 @@ export function extractEmail(idToken?: string, accessToken?: string): string | u
   return undefined;
 }
 
-function credsFromToken(data: Record<string, unknown>): OAuthCredentials {
+export function credsFromToken(data: Record<string, unknown>): OAuthCredentials {
   const idToken = typeof data.id_token === "string" ? data.id_token : undefined;
-  const accessToken = data.access_token as string;
+  // This parses a response from an external boundary, so the access token is
+  // validated rather than cast. A 200 carrying no access_token would otherwise
+  // resolve a login as successful with an undefined credential, which then gets
+  // silently declined at persistence — a success message and no account.
+  const accessToken = typeof data.access_token === "string" && data.access_token.length > 0
+    ? data.access_token
+    : undefined;
+  if (!accessToken) throw new Error("ChatGPT token response missing access token");
+  const refreshToken = typeof data.refresh_token === "string" ? data.refresh_token : "";
   // ?? only guards null/undefined; NaN or a string expires_in would otherwise
   // produce a NaN expiry that never compares as expired, and a negative duration
   // would stamp an already-past expiry — both block refresh semantics.
@@ -62,7 +74,7 @@ function credsFromToken(data: Record<string, unknown>): OAuthCredentials {
   const expires = Number.isFinite(computedExpires) ? computedExpires : Date.now() + 3600 * 1000;
   return {
     access: accessToken,
-    refresh: (data.refresh_token as string) ?? "",
+    refresh: refreshToken,
     expires,
     accountId: extractAccountId(idToken, accessToken),
     email: extractEmail(idToken, accessToken),
@@ -135,7 +147,22 @@ function safeErrorDescription(resp: Response): Promise<string> {
   });
 }
 
-export async function loginChatGPT(ctrl: OAuthController, opts?: { forceLogin?: boolean }): Promise<OAuthCredentials> {
+/**
+ * How the user proves identity. `browser` runs the localhost:1455 callback flow;
+ * `device` runs the deviceauth grant, which needs no local browser or listener
+ * and is the only workable path on a headless or remote hub (#3366).
+ */
+export type ChatGPTLoginFlow = "browser" | "device";
+
+export async function loginChatGPT(
+  ctrl: OAuthController,
+  opts?: { forceLogin?: boolean; flow?: ChatGPTLoginFlow },
+): Promise<OAuthCredentials> {
+  if (opts?.flow === "device") {
+    // Imported lazily so the callback flow does not pay for a module it never uses.
+    const { loginChatGPTDevice } = await import("./chatgpt-device");
+    return loginChatGPTDevice(ctrl);
+  }
   const flow = new ChatGPTOAuthFlow(ctrl);
   if (opts?.forceLogin) flow.forceLogin = true;
   return flow.login();

package/src/oauth/generic-account-failover.ts

@@ -148,30 +148,51 @@ export function hasFailoverAccountQuorum(providerName: string, now = Date.now())
 }
 
 /**
- * Whether generic rotation is active for this provider.
+ * Whether REACTIVE 429 rotation is active for this provider.
  *
- * Precedence, most specific first:
+ * Presence is the only rule: two or more eligible stored accounts. The
+ * `oauthAccountFailover.enabled` booleans no longer suppress it.
  *
- *   1. `providers.<name>.oauthAccountFailover.enabled` — an operator may accept rotation on one
- *      provider and refuse it on another, because provider terms differ.
- *   2. `oauthAccountFailover.enabled` — the global switch. Anyone who already wrote `false` keeps
- *      strict single-account behaviour across this change.
- *   3. Presence: 2 or more eligible stored accounts (#2568d, owner decision).
+ * That is a deliberate narrowing of #2568d. Rotation here runs only after upstream has already
+ * refused the request, so the choice the old knob offered was between "retry on the second
+ * account you deliberately logged in" and "return a 429 while that account sits idle". The
+ * second is a defect, not a preference — and an operator who does not want rotation expresses
+ * that by not storing a second account, exactly as they do for `apiKeyPool`.
  *
- * Only an explicit boolean overrides presence. A malformed value falls through instead of
- * throwing, because a typo in a knob must not take a provider out of service.
+ * The knob is not gone. It still governs {@link isProactivePreferenceEnabled}, which decides
+ * whether a HEALTHY request may be steered to a different account before dispatch — a real
+ * behavioural choice that remains refusable — and it still carries `strategy` and
+ * `autoSwitchThreshold`.
  */
 export function isGenericOAuthFailoverEnabled(
   config: OcxConfig,
   providerName: string,
   now = Date.now(),
 ): boolean {
+  const provider = config.providers?.[providerName];
+  if (!provider || !isGenericFailoverProvider(providerName, provider)) return false;
+  return hasFailoverAccountQuorum(providerName, now);
+}
+
+/**
+ * Whether the pre-dispatch account PREFERENCE may run for this provider.
+ *
+ * Unlike reactive rotation, this moves a request that upstream has not refused, so it stays
+ * refusable: an explicit provider value wins over the global default, and a global `false`
+ * turns it off only when the provider has no override. A malformed value falls through rather
+ * than taking a provider out of service.
+ */
+function isProactivePreferenceEnabled(config: OcxConfig, providerName: string, now: number): boolean {
   const provider = config.providers?.[providerName];
   if (!provider || !isGenericFailoverProvider(providerName, provider)) return false;
   const perProvider = provider.oauthAccountFailover?.enabled;
-  if (typeof perProvider === "boolean") return perProvider;
-  const global = config.oauthAccountFailover?.enabled;
-  if (typeof global === "boolean") return global;
+  // Preserve the published narrow-over-broad precedence. A provider-specific true may
+  // opt this provider into proactive preference even when the global default is false;
+  // a provider-specific false refuses it even when the global setting is true.
+  if (typeof perProvider === "boolean") {
+    return perProvider && hasFailoverAccountQuorum(providerName, now);
+  }
+  if (config.oauthAccountFailover?.enabled === false) return false;
   return hasFailoverAccountQuorum(providerName, now);
 }
 
@@ -265,7 +286,9 @@ export function preferredInitialAccount(
   providerName: string,
   now = Date.now(),
 ): string | null {
-  if (!isGenericOAuthFailoverEnabled(config, providerName)) return null;
+  // The PROACTIVE predicate, not the reactive one: this steers a request upstream has not
+  // refused, so `oauthAccountFailover.enabled: false` must still be able to refuse it.
+  if (!isProactivePreferenceEnabled(config, providerName, now)) return null;
   // This runs on the initial resolution of EVERY request, and `loadAuthStore` has no
   // cache: each call chmods the config dir, chmods the secret, reads the whole file and
   // normalizes it (store.ts:136-151). So the store is consulted at most ONCE here, behind