@bitkyc08/opencodex 2.80.0 → 2.82.0

package/src/oauth/anthropic-send-ownership.ts

@@ -0,0 +1,41 @@
+/** Ownership captured before a physical send, independent of subsequent cooldown observations. */
+import type { OAuthAccessSnapshot } from "./index";
+import { credentialGeneration, getAccountSet, type AuthStore } from "./store";
+import { isAnthropicInstanceId, type AnthropicInstanceId } from "../providers/anthropic-instance-id";
+import { anthropicCooldownRecoveryFor } from "../providers/quota/anthropic-cooldown-recovery";
+import { captureProviderAccountQuotaEpoch } from "../providers/quota/account-cache";
+
+export type AnthropicPhysicalSendOwnership = Readonly<{
+  provider: AnthropicInstanceId;
+  accountId: string;
+  accessToken: string;
+  generation: string;
+  accountIncarnation: number;
+  loginId?: string;
+  addedAt?: number;
+  quotaEpoch: number;
+}>;
+
+/** Namespace API: config/target admission remains with the config-aware physical caller. */
+export function captureAnthropicPhysicalSendOwnership(snapshot: OAuthAccessSnapshot): AnthropicPhysicalSendOwnership | null {
+  if (!isAnthropicInstanceId(snapshot.provider)) return null;
+  const row = getAccountSet(snapshot.provider)?.accounts.find(account => account.id === snapshot.accountId);
+  if (!row || row.paused || row.needsReauth || row.credential.access !== snapshot.accessToken
+    || credentialGeneration(row.credential) !== snapshot.generation) return null;
+  return Object.freeze({
+    provider: snapshot.provider, accountId: snapshot.accountId,
+    accessToken: snapshot.accessToken, generation: snapshot.generation,
+    accountIncarnation: anthropicCooldownRecoveryFor(snapshot.provider).reserveAnthropicAccountIncarnation(snapshot.accountId),
+    loginId: row.loginId, addedAt: row.addedAt,
+    quotaEpoch: captureProviderAccountQuotaEpoch(snapshot.provider),
+  });
+}
+
+/** Pure ownership read: never adopt or reserve the replacement account's current incarnation. */
+export function anthropicPhysicalSendOwnershipIsCurrent(owner: AnthropicPhysicalSendOwnership, store?: AuthStore): boolean {
+  const row = (store ? store[owner.provider] : getAccountSet(owner.provider))?.accounts.find(account => account.id === owner.accountId);
+  return !!row && row.loginId === owner.loginId && row.addedAt === owner.addedAt
+    && row.credential.access === owner.accessToken && credentialGeneration(row.credential) === owner.generation
+    && anthropicCooldownRecoveryFor(owner.provider).anthropicAccountIncarnation(owner.accountId) === owner.accountIncarnation
+    && captureProviderAccountQuotaEpoch(owner.provider) === owner.quotaEpoch;
+}

package/src/oauth/anthropic.ts

@@ -4,6 +4,8 @@ import { bindAnthropicIdentity, resolveAnthropicAccountIdentity } from "./anthro
 import { generatePKCE } from "./pkce";
 import type { LocalTokenImportMode, OAuthController, OAuthCredentials } from "./types";
 import { outboundProxyConfigured, startupOutboundProxyConfigured } from "../lib/proxy-env";
+import type { AnthropicInstanceId } from "../providers/anthropic-instance-id";
+import { AnthropicLocalCliImportError } from "./store-anthropic-instance";
 
 const CLIENT_ID = atob("OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl");
 const AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
@@ -178,9 +180,10 @@ export class AnthropicOAuthFlow extends OAuthCallbackFlow {
 
 export async function loginAnthropic(
   ctrl: OAuthController,
-  opts?: { importLocal?: LocalTokenImportMode },
+  opts?: { importLocal?: LocalTokenImportMode; instance?: AnthropicInstanceId },
 ): Promise<OAuthCredentials> {
   const importLocal = opts?.importLocal ?? "off";
+  if (opts?.instance === "anthropic2" && importLocal !== "off") throw new AnthropicLocalCliImportError();
   if (importLocal !== "off") {
     const { detectClaudeCodeToken } = await import("./local-token-detect");
     const local = detectClaudeCodeToken();

package/src/oauth/chatgpt.ts

@@ -1,6 +1,106 @@
 import { OAuthCallbackFlow } from "./callback-server";
 import type { OAuthController, OAuthCredentials } from "./types";
 import { generatePKCE } from "./pkce";
+import { classifyChatgptRefreshFailure } from "../codex/chatgpt-refresh-failure";
+import { readBoundedResponseBytes } from "../lib/bounded-body";
+
+/**
+ * Per-fetch deadline for ChatGPT auth endpoint calls. The deviceauth grant got the
+ * same bound in #3898 after one stuck TCP connection held the login slot for the
+ * whole grant; a hung refresh would pin the refresh intent lock indefinitely.
+ */
+export const CHATGPT_FETCH_TIMEOUT_MS = 30_000;
+
+/** Non-HTTP failures retain no caller reason, upstream error, or cause. */
+export class ChatGptTokenRequestError extends Error {
+  readonly terminal = false;
+
+  constructor(kind: "abort" | "timeout" | "transport") {
+    super(kind === "abort" ? "ChatGPT token request cancelled"
+      : kind === "timeout" ? "ChatGPT token request timed out" : "ChatGPT token request failed");
+    this.name = kind === "abort" ? "AbortError" : kind === "timeout" ? "TimeoutError" : "ChatGptTokenRequestError";
+  }
+}
+
+const CHATGPT_ERROR_BODY_MAX_BYTES = 16 * 1024;
+const CHATGPT_SUCCESS_BODY_MAX_BYTES = 64 * 1024;
+
+/** One deadline covers headers and body; every settled call detaches its caller. */
+async function chatGptTokenRequest(
+  body: URLSearchParams,
+  label: "ChatGPT refresh" | "ChatGPT token exchange",
+  options: { signal?: AbortSignal; timeoutMs?: number },
+): Promise<OAuthCredentials> {
+  const controller = new AbortController();
+  const onAbort = () => controller.abort(new ChatGptTokenRequestError("abort"));
+  options.signal?.addEventListener("abort", onAbort, { once: true });
+  if (options.signal?.aborted) onAbort();
+  const timer = setTimeout(() => controller.abort(new ChatGptTokenRequestError("timeout")),
+    options.timeoutMs ?? CHATGPT_FETCH_TIMEOUT_MS);
+  let endpointError: ChatGptTokenError | undefined;
+  try {
+    controller.signal.throwIfAborted();
+    const response = await fetch(TOKEN_URL, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: body.toString(),
+      signal: controller.signal,
+    });
+    const result = await readBoundedResponseBytes(response, {
+      signal: controller.signal,
+      maxBytes: response.ok ? CHATGPT_SUCCESS_BODY_MAX_BYTES : CHATGPT_ERROR_BODY_MAX_BYTES,
+    });
+    controller.signal.throwIfAborted();
+    const text = new TextDecoder().decode(result.bytes);
+    if (!response.ok) {
+      endpointError = chatGptTokenError(response.status, result.oversized ? "" : text, label);
+      throw endpointError;
+    }
+    if (result.oversized) throw new ChatGptTokenRequestError("transport");
+    return credsFromToken(JSON.parse(text) as Record<string, unknown>);
+  } catch (error) {
+    if (controller.signal.aborted) throw controller.signal.reason;
+    if (endpointError && error === endpointError) throw endpointError;
+    throw new ChatGptTokenRequestError("transport");
+  } finally {
+    clearTimeout(timer);
+    options.signal?.removeEventListener("abort", onAbort);
+  }
+}
+
+/**
+ * Token-endpoint failure carrying the HTTP status, the allowlisted OAuth error code,
+ * and a terminal verdict requiring an explicit grant-refusal code. The shared
+ * Codex classifier supplies the code vocabulary; free text is never grant evidence.
+ */
+export class ChatGptTokenError extends Error {
+  constructor(
+    public readonly httpStatus: number,
+    public readonly oauthError: string | undefined,
+    public readonly terminal: boolean,
+    message: string,
+  ) {
+    super(message);
+    this.name = "ChatGptTokenError";
+  }
+}
+
+function chatGptTokenError(status: number, body: string, label: string): ChatGptTokenError {
+  const failure = classifyChatgptRefreshFailure(status, body);
+  // Reclassify the allowlisted code alone to reuse the shared terminal vocabulary
+  // without its description-only compatibility rule for other Codex callers.
+  const terminal = failure.reason !== "unknown" && failure.code !== undefined
+    && classifyChatgptRefreshFailure(status, JSON.stringify({ error: failure.code })).reason !== "unknown";
+  // The message carries the status and the allowlisted OAuth code only — never the
+  // free-text `error_description`, which can echo OAuth material into log surfaces
+  // (the same closed vocabulary the pool's noteChatgptRefreshFailure logs with).
+  return new ChatGptTokenError(
+    status,
+    failure.code,
+    terminal,
+    `${label} failed: ${status} code=${failure.code ?? "none"}`,
+  );
+}
 
 const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 const AUTH_URL = "https://auth.openai.com/oauth/authorize";
@@ -202,34 +302,16 @@ export class ChatGPTOAuthFlow extends OAuthCallbackFlow {
 
   async exchangeToken(code: string, _state: string, redirectUri: string): Promise<OAuthCredentials> {
     if (!this.#verifier) throw new Error("ChatGPT PKCE verifier not initialized");
-    const resp = await fetch(TOKEN_URL, {
-      method: "POST",
-      headers: { "Content-Type": "application/x-www-form-urlencoded" },
-      body: new URLSearchParams({
-        grant_type: "authorization_code",
-        client_id: CLIENT_ID,
-        code,
-        redirect_uri: redirectUri,
-        code_verifier: this.#verifier,
-      }).toString(),
-    });
-    if (!resp.ok) {
-      const errDesc = await safeErrorDescription(resp);
-      throw new Error(`ChatGPT token exchange failed: ${resp.status} ${errDesc}`);
-    }
-    return credsFromToken((await resp.json()) as Record<string, unknown>);
+    return chatGptTokenRequest(new URLSearchParams({
+      grant_type: "authorization_code",
+      client_id: CLIENT_ID,
+      code,
+      redirect_uri: redirectUri,
+      code_verifier: this.#verifier,
+    }), "ChatGPT token exchange", { signal: this.ctrl.signal });
   }
 }
 
-function safeErrorDescription(resp: Response): Promise<string> {
-  return resp.text().catch(() => "").then(text => {
-    try {
-      const parsed = JSON.parse(text) as { error?: string; error_description?: string };
-      return [parsed.error, parsed.error_description].filter(Boolean).join(": ") || `HTTP ${resp.status}`;
-    } catch { return `HTTP ${resp.status}`; }
-  });
-}
-
 /**
  * How the user proves identity. `browser` runs the localhost:1455 callback flow;
  * `device` runs the deviceauth grant, which needs no local browser or listener
@@ -255,21 +337,11 @@ export async function loginChatGPT(
 // Codex-rs uses JSON for refresh — intentional divergence; both accepted by auth.openai.com.
 export async function refreshChatGPTToken(
   refreshToken: string,
-  options: { signal?: AbortSignal } = {},
+  options: { signal?: AbortSignal; timeoutMs?: number } = {},
 ): Promise<OAuthCredentials> {
-  const resp = await fetch(TOKEN_URL, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      grant_type: "refresh_token",
-      client_id: CLIENT_ID,
-      refresh_token: refreshToken,
-    }).toString(),
-    signal: options.signal,
-  });
-  if (!resp.ok) {
-    const errDesc = await safeErrorDescription(resp);
-    throw new Error(`ChatGPT refresh failed: ${resp.status} ${errDesc}`);
-  }
-  return credsFromToken((await resp.json()) as Record<string, unknown>);
+  return chatGptTokenRequest(new URLSearchParams({
+    grant_type: "refresh_token",
+    client_id: CLIENT_ID,
+    refresh_token: refreshToken,
+  }), "ChatGPT refresh", options);
 }

package/src/oauth/generic-account-failover.ts

@@ -1,3 +1,4 @@
+import { isBuiltinAnthropicInstanceRow } from "../providers/anthropic-instance";
 /**
  * Generic OAuth multi-account 429 failover (#2568).
  *
@@ -157,7 +158,8 @@ export function kiroAutoSelection(
 
 /** True when this provider participates in generic rotation at all. */
 export function isGenericFailoverProvider(providerName: string, provider: OcxProviderConfig): boolean {
-  return provider.authMode === "oauth" && !EXCLUDED_PROVIDERS.has(providerName);
+  return provider.authMode === "oauth" && !EXCLUDED_PROVIDERS.has(providerName)
+    && !isBuiltinAnthropicInstanceRow(providerName, provider);
 }
 
 /**

package/src/oauth/health.ts

@@ -1,7 +1,8 @@
+import { isAnthropicInstanceId } from "../providers/anthropic-instance-id";
 import type { MainAccountHardLockStatus } from "../codex/main-account-hard-lock";
 import type { MainAccountExternalUsageWarning } from "../codex/main-account-external-usage";
 import { getCodexAccountHealthSnapshot, type CodexCooldownSource } from "../codex/routing";
-import { getAnthropicAccountHealthSnapshot } from "./anthropic-routing";
+import { anthropicRoutingFor } from "./anthropic-routing";
 import { isAccountNeedsReauth } from "../codex/account-runtime-state";
 import { getCodexAccountCredential, listCodexAccountIds, readCodexAccountRecord } from "../codex/account-store";
 import { MAIN_CODEX_ACCOUNT_ID } from "../codex/main-account";
@@ -10,7 +11,7 @@ import { LOCAL_MANAGEMENT_READ_PATHS } from "../lib/local-management-capability"
 import { maskAccountId } from "../lib/privacy";
 import { findLiveProxy } from "../server/proxy-liveness";
 import { fetchBoundLocalManagementRead } from "../server/local-management-read-client";
-import { loadAuthStore, peekAuthStore, peekOAuthRefreshIntent, readOAuthRefreshIntent } from "./store";
+import { accountNeedsReauthForStatus, loadAuthStore, peekAuthStore, peekOAuthRefreshIntent, readOAuthRefreshIntent } from "./store";
 import type { ProviderAccount } from "./types";
 
 export type OAuthAccountHealth =
@@ -207,12 +208,13 @@ export function projectStoredOAuthAccountHealth(
   now = Date.now(),
   opts: { observeOnly?: boolean } = {},
 ): OAuthAccountHealth {
-  const anthropicSnap = provider === "anthropic"
-    ? getAnthropicAccountHealthSnapshot(account.id, now)
+  const anthropicSnap = isAnthropicInstanceId(provider)
+    ? anthropicRoutingFor(provider).getAnthropicAccountHealthSnapshot(account.id, now)
     : null;
+  const needsReauth = accountNeedsReauthForStatus(provider, account, now);
   return projectOAuthAccountHealth({
-    needsReauth: account.needsReauth === true,
-    reauthReason: account.needsReauth === true
+    needsReauth,
+    reauthReason: needsReauth
       ? (account.needsReauthReason ?? "refresh_failed")
       : undefined,
     cooldownUntilMs: anthropicSnap?.cooldownUntil,