@bridge4dev/runner 0.66.0 → 0.67.0

package/dist/account-commands.d.ts

@@ -1,9 +1,9 @@
-import type { AccountLoginCodeResult, AccountLoginTarget, LoginStartResult } from './auth-relay.js';
+import type { AccountLoginCodeResult, AccountLoginTarget, LoginStartResult, RelayAgent } from './auth-relay.js';
 /**
  * Several logins of one agent, on the wire (#422 S2, plan §8).
  *
- * Five commands, each a thin door over what `claude-homes.ts` already does on
- * the machine. New NAMES rather than new arguments of `login_start`: an older
+ * Five commands, each a thin door over what `claude-homes.ts` (Claude) and
+ * `codex-accounts.ts` (Codex, S4) already do on the machine. New NAMES rather than new arguments of `login_start`: an older
  * runner silently ignores an argument it does not know and would sign in over
  * the machine login while the API believed a saved account was being added; an
  * unknown name it answers «Unknown command» at once.
@@ -21,10 +21,9 @@ export declare const ACCOUNT_COMMANDS: readonly ["agent_accounts", "agent_accoun
 export type AccountCommand = (typeof ACCOUNT_COMMANDS)[number];
 /**
  * The agents this runner keeps several logins for (`capabilities.accounts`,
- * R11). Codex joins in S4; until then its account commands are refused with a
- * sentence rather than half-served.
+ * R11). Codex joined in S4 – the same five commands and the same card.
  */
-export declare const ACCOUNT_AGENTS: readonly ["claude"];
+export declare const ACCOUNT_AGENTS: readonly ["claude", "codex"];
 /** What `supervisor.ts` sends back as `command_result`, minus the envelope. */
 export type AccountCommandReply = {
     ok: true;
@@ -36,7 +35,7 @@ export type AccountCommandReply = {
 };
 /** The two sign-in steps the commands drive – `AuthRelay`, or a test double. */
 export interface AccountSignIn {
-    startAccountLogin(target: AccountLoginTarget): Promise<LoginStartResult>;
+    startAccountLogin(target: AccountLoginTarget, agent?: RelayAgent): Promise<LoginStartResult>;
     submitAccountCode(code: string): Promise<AccountLoginCodeResult>;
 }
 export declare function isAccountCommand(name: string): name is AccountCommand;

package/dist/account-commands.js

@@ -1,11 +1,12 @@
-import { AccountError, forgetAccount, isAccountId, listAccounts, setActiveAccount, } from './claude-homes.js';
-import { MACHINE_ACCOUNT_ID } from './login-marks.js';
+import { forgetAccount, listAccounts, setActiveAccount } from './claude-homes.js';
+import { activateCodexAccount, forgetCodexAccount, listCodexAccounts } from './codex-accounts.js';
+import { AccountError, MACHINE_ACCOUNT_ID, isAccountId } from './login-marks.js';
 import { maskString } from './policy.js';
 /**
  * Several logins of one agent, on the wire (#422 S2, plan §8).
  *
- * Five commands, each a thin door over what `claude-homes.ts` already does on
- * the machine. New NAMES rather than new arguments of `login_start`: an older
+ * Five commands, each a thin door over what `claude-homes.ts` (Claude) and
+ * `codex-accounts.ts` (Codex, S4) already do on the machine. New NAMES rather than new arguments of `login_start`: an older
  * runner silently ignores an argument it does not know and would sign in over
  * the machine login while the API believed a saved account was being added; an
  * unknown name it answers «Unknown command» at once.
@@ -28,10 +29,9 @@ export const ACCOUNT_COMMANDS = [
 ];
 /**
  * The agents this runner keeps several logins for (`capabilities.accounts`,
- * R11). Codex joins in S4; until then its account commands are refused with a
- * sentence rather than half-served.
+ * R11). Codex joined in S4 – the same five commands and the same card.
  */
-export const ACCOUNT_AGENTS = ['claude'];
+export const ACCOUNT_AGENTS = ['claude', 'codex'];
 export function isAccountCommand(name) {
     return ACCOUNT_COMMANDS.includes(name);
 }
@@ -48,9 +48,8 @@ function accountIdArg(value) {
 }
 export async function runAccountCommand(name, args, signIn) {
     const agent = args['agent'];
-    if (agent === 'codex') {
-        return { ok: false, error: 'several Codex logins are not supported by this runner yet' };
-    }
+    if (agent === 'codex')
+        return runCodexAccountCommand(name, args, signIn);
     if (agent !== 'claude')
         return { ok: false, error: 'agent must be claude or codex' };
     try {
@@ -96,4 +95,48 @@ export async function runAccountCommand(name, args, signIn) {
         return refusal(error);
     }
 }
+/**
+ * The same five doors for Codex (#422 S4). What differs is said where it differs:
+ * the machine login is the host user's own file (no sign-in into it, R13), and a
+ * device sign-in finishes on the provider's page – there is no code to send; the
+ * window learns the result from the list (§8).
+ */
+async function runCodexAccountCommand(name, args, signIn) {
+    try {
+        switch (name) {
+            case 'agent_accounts':
+                return { ok: true, result: listCodexAccounts() };
+            case 'agent_account_login_start': {
+                const target = args['target'];
+                if (target !== 'machine' && target !== 'saved') {
+                    return { ok: false, error: 'target must be machine or saved' };
+                }
+                return { ok: true, result: await signIn.startAccountLogin(target, 'codex') };
+            }
+            case 'agent_account_login_code': {
+                const result = {
+                    ok: false,
+                    detail: 'a Codex sign-in finishes on the provider page – there is no code to send; the account list shows it once it is done',
+                };
+                return { ok: false, error: result.detail, result };
+            }
+            case 'agent_account_activate': {
+                const id = accountIdArg(args['id']);
+                if (!id)
+                    return { ok: false, error: 'no such account on this server' };
+                return { ok: true, result: { active: activateCodexAccount(id) } };
+            }
+            case 'agent_account_forget': {
+                const id = accountIdArg(args['id']);
+                if (!id)
+                    return { ok: false, error: 'no such account on this server' };
+                const { active } = forgetCodexAccount(id);
+                return { ok: true, result: { ok: true, active } };
+            }
+        }
+    }
+    catch (error) {
+        return refusal(error);
+    }
+}
 //# sourceMappingURL=account-commands.js.map

package/dist/adapters/codex-home.d.ts

@@ -1,24 +1,90 @@
 export type CodexAuthMode = 'link' | 'own';
 export interface CodexHome {
     path: string;
-    /** How the home is authenticated — reported in notices, not a secret. */
-    auth: 'linked' | 'own' | 'missing';
+    /**
+     * How the home is authenticated — reported in notices, not a secret.
+     * `account` – a saved login is linked (`accountId`); `own` – a real file the
+     * runner could not move into the store and keeps using where it is.
+     */
+    auth: 'linked' | 'account' | 'own' | 'missing';
+    /** The saved login the home is set to – present with `account`, and with `missing` under it. */
+    accountId?: string;
 }
 export declare function codexHomePath(): string;
+/** Where the saved Codex logins live – inside the one home, beside what they share. */
+export declare function codexAccountsDir(home?: string): string;
+/** The directory of one saved login. Throws on anything that is not an account id. */
+export declare function codexAccountDir(id: string, home?: string): string;
+/** The login file of one saved account. */
+export declare function codexAccountAuthFile(id: string, home?: string): string;
+/** The machine login of Codex – the host user's own file, never written by DevBridge (R13). */
+export declare function hostCodexAuthFile(homedir?: string): string;
 /**
- * Throwaway home for a device-code login. The flow runs here and is promoted
- * into the real home only on success, so an abandoned or timed-out sign-in
- * cannot destroy a credential that was working.
+ * Throwaway homes for device-code logins, one per attempt. The flow runs there
+ * and its login is moved into the store only on success, so an abandoned or
+ * timed-out sign-in cannot destroy a credential that was working.
  */
 export declare function stagingCodexHomePath(): string;
+/**
+ * `[codex] auth` as the machine's owner WROTE it – `undefined` when the key is
+ * not in `config.toml`. Set once at daemon start.
+ *
+ * Only a mode that is really written may be forced, and even then not over a
+ * saved login (S4 item 2): the runner used to pass `link` by default from three
+ * places – the daemon start, every session start and the minute probe – and each
+ * of them would have undone a switch of account within a minute (К4).
+ */
+export declare function configureCodexAuth(mode: CodexAuthMode | undefined): void;
+export declare function configuredCodexAuth(): CodexAuthMode | undefined;
+/** Which saved login the home is set to, if any – the mark, read only. */
+export declare function markedCodexAccount(home?: string): string | null;
+/** Who a Codex login is, read locally from its own file – never a token. */
+export interface CodexIdentity {
+    email?: string;
+    /** `tokens.account_id` – the key of a Codex subscription (plan §8, S4 item 5). */
+    orgId?: string;
+    /** `chatgpt_plan_type` – `plus`, `pro`, `team`, … */
+    plan?: string;
+}
+export interface CodexCredential {
+    /**
+     * `ok` – a login the CLI can use; `expired` – a login past its date with no
+     * refresh token; `missing` – no file; `unreadable` – a file that is not a login
+     * (torn, hand-edited); `unknown` – we could not look (EACCES).
+     */
+    status: 'ok' | 'expired' | 'missing' | 'unreadable' | 'unknown';
+    /** A ChatGPT login (tokens) or an API key – only for a file that is a login. */
+    kind?: 'chatgpt' | 'apikey';
+    identity: CodexIdentity;
+    /** Only when the access token's own date is the login's date (no refresh token). */
+    expiresAt?: string;
+    /** Last write of the file, whole ms – a refusal mark older than this no longer holds. */
+    writtenMs?: number;
+}
+/**
+ * Read a Codex login file without letting a token out of this function.
+ *
+ * The identity comes from the claims of `id_token`, decoded locally (S4 item 8):
+ * `email`, and under `https://api.openai.com/auth` the plan and the ChatGPT
+ * account; `tokens.account_id` first for the key, the claim when it is absent. An
+ * internal file of the CLI (§11): whatever cannot be read is simply not there –
+ * no identity is invented, and a row without a key merges with nothing.
+ *
+ * The verdict is the pre-S4 one (`readCodexCredential`): a refresh token means
+ * the CLI renews the access token on its own, so only a lone access token past
+ * its `exp` is `expired`.
+ */
+export declare function readCodexCredentialFile(file: string): CodexCredential;
 /**
  * Create (or refresh) the runner's CODEX_HOME and return it.
  *
- * `auth: 'link'` (default) symlinks the host user's `~/.codex/auth.json` so the
- * runner uses their ChatGPT subscription and — importantly — shares one
- * credential store with their own CLI, so a token refresh on either side keeps
- * both working. `auth: 'own'` leaves the home unauthenticated until a
- * device-code login writes into it, which is the choice for full isolation.
+ * `link` (the default when nothing else is decided) symlinks the host user's
+ * `~/.codex/auth.json` so the runner uses their ChatGPT subscription and —
+ * importantly — shares one credential store with their own CLI, so a token
+ * refresh on either side keeps both working. `own` leaves the home
+ * unauthenticated until a device-code login is stored for it, which is the
+ * choice for full isolation. A saved login (`account:<id>`) is kept whatever
+ * the configured mode says (S4 item 2).
  *
  * A home under the OS temp dir still works, but codex then refuses to install
  * its helper binaries ("Refusing to create helper binaries under temporary
@@ -35,6 +101,9 @@ export declare function ensureCodexHome(options?: {
  * it only answers "is the credential still where we left it, and if not, can we
  * put it back". This is what makes a credential disappearing under a running
  * daemon self-healing instead of permanent.
+ *
+ * Forces nothing it was not told to by the machine's owner (S4 item 2): with no
+ * `[codex] auth` in `config.toml` the mark decides, and a saved login stays.
  */
 export declare function repairCodexAuth(options?: {
     auth?: CodexAuthMode;
@@ -42,20 +111,73 @@ export declare function repairCodexAuth(options?: {
 }): CodexHome;
 /**
  * Drop a linked auth.json so a device-code login writes our own file instead.
- *
- * Only ever called AFTER a login has actually succeeded in the staging home —
- * never as a pre-step. Detaching first meant an abandoned or timed-out sign-in
- * left the server permanently "not signed in", recoverable only by restarting
- * the daemon.
+ * Never a real credential: only a symlink is removed.
  */
 export declare function detachLinkedAuth(dir?: string): void;
+export interface StoredCodexLogin {
+    id: string;
+    /** The saved row whose login this one replaced – the same subscription (D19). */
+    replaced?: string;
+}
+/**
+ * Move a login file into the store (§8 `agent_account_login_code` for Codex, S4
+ * items 4 and 5) – by rename, and one subscription, one row.
+ *
+ * A known `account_id` that a saved row already has REPLACES that row's login:
+ * the row keeps its id (refusal marks and a live session are keyed by it, R15)
+ * and its `addedAt` becomes now – the date is that of the login the row holds,
+ * and a second sign-in of the same subscription must change something the
+ * window can see (S3 hands this over: `deviceSignInResult`). An unknown key
+ * merges with nothing. The machine row takes no part: it is the host's own file.
+ *
+ * The record is written BEFORE the file moves, so a failure never leaves a login
+ * nobody can list or forget; a move that fails takes its new record back.
+ */
+export declare function storeCodexLogin(source: string, options: {
+    activate: boolean;
+    home?: string;
+    replaceActive?: boolean;
+}): StoredCodexLogin;
 /**
- * Promote a credential produced by a staging login into the real home, and
- * record that this home now owns its own login.
+ * Make a row the one the home uses: the mark first, then the link.
+ *
+ * In that order on purpose – a daemon that dies between the two leaves a mark
+ * the next repair finishes (it points the link where the mark says), never a
+ * link that the next repair would undo.
+ *
+ * A real file in place of the link is dealt with FIRST (§8 `activate`, S4 item
+ * 7): the CLI may have refreshed the login in use a moment ago, and repointing
+ * over it would throw that token away.
+ */
+export declare function markActiveCodexLogin(id: string, dir?: string): void;
+export declare function setCodexActiveLogin(id: string, dir?: string): CodexHome;
+/**
+ * A fresh throwaway home for one device-code sign-in (config only, no credential).
+ *
+ * One directory per attempt, and every other one is removed first: only one
+ * sign-in runs on a machine at a time (the relay cancels the previous one before
+ * it gets here), and the pre-S4 runner kept a single fixed staging home that was
+ * never cleaned up – on this machine it had lain there since 01.08.2026.
  */
-export declare function adoptLoginResult(stagingDir: string, dir?: string): boolean;
-/** Seed a throwaway home for the device-code flow (config only, no credential). */
 export declare function prepareStagingHome(): string;
-/** Remove the staging home whatever the outcome — it may hold a credential. */
-export declare function discardStagingHome(): void;
+/** Remove one sign-in's home whatever the outcome — it may hold a credential. */
+export declare function discardStagingHome(dir: string): void;
+/**
+ * Remove every sign-in home – at daemon start (nothing can be signing in yet)
+ * and before a new sign-in. Includes the fixed-path staging home of runners
+ * before S4.
+ */
+export declare function discardAbandonedCodexStagingHomes(): number;
+/**
+ * A device-code sign-in in `stagingDir` finished: its login becomes a saved
+ * account – by rename, deduplicated by subscription – and the one in use (R15).
+ * The staging home is removed either way.
+ *
+ * `replaceActive` – the sign-in came through the one-login window, where it has
+ * always meant «this login from now on»: it takes the place of the login in use
+ * rather than adding a row (D27, for an organization without several logins).
+ */
+export declare function adoptLoginResult(stagingDir: string, options?: {
+    replaceActive?: boolean;
+}): StoredCodexLogin;
 //# sourceMappingURL=codex-home.d.ts.map