@bridge4dev/runner 0.66.0 → 0.67.0

package/dist/auth-relay.js

@@ -10,7 +10,8 @@ import { applyStoredClaudeToken, environmentCarriesStoredToken, extractOauthToke
 import { invalidateUsageCache } from './adapters/claude-usage.js';
 import { AccountError, activeAccountId, adoptLoginResult as adoptClaudeLogin, buildAccountList, clearLoginExpired, discardStagingHome as discardClaudeStagingHome, identityProbeEnv, machineLoginStatus, markLoginExpired, prepareStagingHome as prepareClaudeStagingHome, readActiveAccountSummary, refreshAccountIdentity, savedLoginStatus, setActiveAccount, } from './claude-homes.js';
 import { MACHINE_ACCOUNT_ID, clearRefusal, noteRefusal, refusalActive } from './login-marks.js';
-import { adoptLoginResult, discardStagingHome, prepareStagingHome, repairCodexAuth, stagingCodexHomePath, } from './adapters/codex-home.js';
+import { adoptLoginResult as adoptCodexLogin, discardStagingHome as discardCodexStagingHome, prepareStagingHome as prepareCodexStagingHome, readCodexCredentialFile, repairCodexAuth, } from './adapters/codex-home.js';
+import { activeCodexAccountId, clearCodexLoginExpired, codexActiveAccountSummary, codexRowRefused, markCodexLoginExpired, } from './codex-accounts.js';
 const execFileAsync = promisify(execFile);
 /* eslint-disable no-control-regex -- this module parses raw pty output, so
    matching ANSI/OSC escape bytes (\x1b, \x07) is exactly the point. */
@@ -21,7 +22,13 @@ const CODE_EXCHANGE_TIMEOUT_MS = 60_000;
 const RELAY_MAX_LIFETIME_MS = 16 * 60_000;
 const URL_PATTERNS = {
     claude: /https:\/\/(?:claude\.com|claude\.ai)\/[^\s\x07\x1b"']+/,
-    codex: /https:\/\/[^\s\x07\x1b"']+/,
+    // A page a person opens, never an endpoint of the provider's API (D26, S4 item
+    // 5a). When codex fails to get a device code it prints «Error logging in with
+    // device code: error sending request for url
+    // (https://auth.openai.com/api/accounts/deviceauth/usercode)», and the old
+    // any-https pattern handed that address to the window as the sign-in link –
+    // without a code, onto a page that answers «Authentication Error».
+    codex: /https:\/\/(?![^\s\x07\x1b"']*\/api\/)[^\s\x07\x1b"']+/,
 };
 /**
  * Rejoin a secret the pty split across lines, so the masker can see it.
@@ -219,7 +226,21 @@ export class AuthRelay {
      * (it prints an inference-only token, D1), so a «saved account» made from it
      * would be a row with no login. `machine` keeps the fallback it always had.
      */
-    async startAccountLogin(target) {
+    async startAccountLogin(target, agent = 'claude') {
+        if (agent === 'codex') {
+            // R13: the machine row of Codex is the host user's own `~/.codex/auth.json`,
+            // which DevBridge has never written and does not start writing. A sign-in
+            // from the window always adds (or renews) a saved login.
+            if (target === 'machine') {
+                throw new AccountError('the login of this machine is the Codex login of its own user – sign in again in the terminal on the machine (`codex login`)');
+            }
+            this.cancel();
+            this.assertCanRun('codex');
+            return this.startWith('codex', this.commands.codex ?? '', false, {
+                flow: 'account',
+                target: 'saved',
+            });
+        }
         this.cancel();
         this.assertCanRun('claude');
         const command = this.commands.claude ?? '';
@@ -258,7 +279,9 @@ export class AuthRelay {
         // sign-in (or letting it time out) left the server permanently signed out
         // with no way back except restarting the daemon — and writing through the
         // link would have overwritten the host user's own account (QA-100 MINOR-5).
-        const stagingHome = agent === 'codex' ? prepareStagingHome() : null;
+        // Whichever door started it, the result is a saved login (#422 S4): Codex
+        // has no «machine login» DevBridge may write.
+        const stagingHome = agent === 'codex' ? prepareCodexStagingHome() : null;
         // A saved Claude account signs in inside its own staging home (#422 R2).
         // `captureToken` never reaches here with `saved` – see `startAccountLogin`.
         const claudeStaging = agent === 'claude' && door.flow === 'account' && door.target === 'saved'
@@ -266,12 +289,16 @@ export class AuthRelay {
             : null;
         const proc = spawn('script', ['-qec', command, '/dev/null'], {
             stdio: ['pipe', 'pipe', 'pipe'],
-            env: door.flow === 'account'
-                ? // The staging home, or the machine's own `~/.claude` (no variable);
-                    // and in both, no operator token and no API key (§8).
-                    identityProbeEnv(claudeStaging, relayEnv())
-                : // Codex must log in to a home WE control, never the host user's ~/.codex.
-                    relayEnv(stagingHome ? { CODEX_HOME: stagingHome } : {}),
+            env: stagingHome
+                ? // Codex must log in to a home WE control, never the host user's ~/.codex –
+                    // whichever door started it (the account door once ran it without this
+                    // variable, and the CLI wrote its login into the user's own home).
+                    relayEnv({ CODEX_HOME: stagingHome })
+                : door.flow === 'account'
+                    ? // The staging home, or the machine's own `~/.claude` (no variable);
+                        // and in both, no operator token and no API key (§8).
+                        identityProbeEnv(claudeStaging, relayEnv())
+                    : relayEnv(),
         });
         const relay = {
             agent,
@@ -284,6 +311,7 @@ export class AuthRelay {
             flow: door.flow,
             target: door.target,
             claudeStaging,
+            codexStaging: stagingHome,
             exchanging: false,
             killTimer: setTimeout(() => {
                 if (this.active === relay)
@@ -304,28 +332,41 @@ export class AuthRelay {
             // exits once the browser side is confirmed. That exit IS the completion
             // signal — promote the staging credential, or throw it away.
             //
-            // Only when this relay is still the current one: the staging home is a
-            // single fixed path, so a cancelled login's exit handler firing late
-            // would otherwise delete the home a NEW login is already writing into.
-            if (relay.agent !== 'codex' || this.active !== relay)
+            // Only when this relay is still the current one: a cancelled login was
+            // abandoned (its home removed) by whoever took the slot, and its late exit
+            // must not store anything in its name.
+            if (relay.agent !== 'codex' || this.active !== relay || !relay.codexStaging)
                 return;
+            if (code !== 0) {
+                this.discardStaging(relay);
+                return;
+            }
+            const staging = relay.codexStaging;
+            relay.codexStaging = null;
             try {
-                if (code === 0 && adoptLoginResult(stagingCodexHomePath())) {
-                    log.info('codex: device login completed — credential adopted');
-                    // The ONLY place a Codex sign-in can be reported as finished. Its
-                    // flow never sends `login_code` (device auth needs no paste-back),
-                    // so without this line a refusal we recorded earlier would keep the
-                    // panel demanding a re-login the user has just done — #121's own
-                    // complaint, reproduced on the other half of the panel (QA-117 H1).
-                    clearAgentAuthFailure('codex');
-                }
-                else {
-                    discardStagingHome();
-                }
+                // By rename, one subscription – one row, and the signed-in row is the one
+                // new sessions start under (S4 item 5, R15). The window learns it from the
+                // list (§8: device sign-in finishes without `login_code`).
+                // The one-login window's door (`flow: 'legacy'`) replaces the login in
+                // use instead of adding a row beside it: with the organization's option
+                // off, «a token overwrites the token» is what a sign-in has always meant
+                // (D27), and DevBridge writes no machine login for Codex to overwrite.
+                const stored = adoptCodexLogin(staging, { replaceActive: relay.flow === 'legacy' });
+                log.info('codex: device login completed — credential stored', {
+                    account: stored.id,
+                    replaced: Boolean(stored.replaced),
+                });
+                // The ONLY place a Codex sign-in can be reported as finished. Its
+                // flow never sends `login_code` (device auth needs no paste-back),
+                // so without this line a refusal we recorded earlier would keep the
+                // panel demanding a re-login the user has just done — #121's own
+                // complaint, reproduced on the other half of the panel (QA-117 H1).
+                clearAgentAuthFailure('codex', stored.id);
             }
             catch (error) {
-                log.warn('codex: could not finish the device login', { error: String(error) });
-                discardStagingHome();
+                log.warn('codex: could not finish the device login', {
+                    error: maskString(String(error)).slice(0, 300),
+                });
             }
         });
         proc.on('error', (error) => {
@@ -336,15 +377,20 @@ export class AuthRelay {
         const deadline = Date.now() + URL_START_TIMEOUT_MS;
         for (;;) {
             const url = extractLoginUrl(agent, relay.buffer);
-            if (url && this.active !== relay) {
+            // Codex: a link is half of the sign-in, the one-time code the other half,
+            // and the CLI prints them on two lines that can arrive in two reads. A link
+            // without its code sends the person to a page that asks for something the
+            // window never showed (D26) – so both, or the CLI's own words about why not.
+            const code = agent === 'codex' ? extractDeviceCode(relay.buffer) : null;
+            const ready = url !== null && (agent !== 'codex' || code !== null);
+            if (ready && this.active !== relay) {
                 // A newer start took the slot while this one waited: its CLI is killed,
                 // and a link to it would lead nowhere – a code pasted for it would reach
                 // the newer CLI (found by the tests of the S2 check).
                 this.abandon(relay);
                 throw new Error('a newer sign-in was started on this server – use its link');
             }
-            if (url) {
-                const code = agent === 'codex' ? extractDeviceCode(relay.buffer) : null;
+            if (ready && url) {
                 return { url, ...(code ? { code } : {}), expectsCode: agent === 'claude' };
             }
             if (relay.exited) {
@@ -354,7 +400,9 @@ export class AuthRelay {
             }
             if (Date.now() > deadline) {
                 this.abandon(relay);
-                throw new Error(`${agent} login did not print a sign-in URL in time`);
+                throw new Error(url
+                    ? `${agent} login printed a link but no one-time code in time – start again`
+                    : `${agent} login did not print a sign-in URL in time`);
             }
             await sleep(200);
         }
@@ -581,12 +629,15 @@ export class AuthRelay {
     }
     /** A sign-in that will not be adopted leaves nothing behind (§8, S2 item 2). */
     discardStaging(relay) {
-        const staging = relay.claudeStaging;
-        if (!staging)
-            return;
+        const claude = relay.claudeStaging;
+        const codex = relay.codexStaging;
         relay.claudeStaging = null;
+        relay.codexStaging = null;
         try {
-            discardClaudeStagingHome(staging);
+            if (claude)
+                discardClaudeStagingHome(claude);
+            if (codex)
+                discardCodexStagingHome(codex);
         }
         catch (error) {
             log.warn('auth-relay: could not remove an abandoned sign-in home', {
@@ -654,8 +705,19 @@ export async function claudeAuthStatus(homedir = os.homedir(), options = {}) {
 export function noteAgentAuthFailure(agent, accountId = MACHINE_ACCOUNT_ID) {
     noteRefusal(agent, accountId);
     log.warn('auth-relay: agent sign-in refused during a session', { agent, account: accountId });
-    if (agent !== 'claude')
+    if (agent === 'codex') {
+        // A saved Codex login keeps the mark on disk, as a Claude one does (D2) –
+        // but only while it is the login in use. Codex refuses to refresh a session
+        // whose account is no longer the one `auth.json` points at («you have since
+        // signed in to another account»), and that refusal says nothing about the
+        // login of the account the session started under: marking it would put
+        // «sign in again» on a login that is perfectly good (found by the
+        // independent check of S4).
+        if (accountId !== MACHINE_ACCOUNT_ID && accountId === activeCodexAccountId()) {
+            markCodexLoginExpired(accountId);
+        }
         return;
+    }
     if (accountId !== MACHINE_ACCOUNT_ID) {
         markLoginExpired(accountId);
         return;
@@ -676,8 +738,11 @@ export function clearAgentAuthFailure(agent, accountId = MACHINE_ACCOUNT_ID) {
     if (clearRefusal(agent, accountId)) {
         log.info('auth-relay: agent sign-in is working again', { agent, account: accountId });
     }
-    if (agent !== 'claude')
+    if (agent === 'codex') {
+        if (accountId !== MACHINE_ACCOUNT_ID)
+            clearCodexLoginExpired(accountId);
         return;
+    }
     // A machine session that worked on the credentials FILE says nothing about the
     // captured token: its mark is lifted only by a session that ran with it.
     if (accountId !== MACHINE_ACCOUNT_ID || environmentCarriesStoredToken()) {
@@ -714,14 +779,35 @@ function logVerdictChange(agent, status) {
  * Codex reports its own login state via an exit code (0 signed in / 1 not).
  * Probed against the RUNNER's home: the host user can be signed in while our
  * isolated home is not, and it is ours that sessions use.
+ *
+ * About the login new sessions start under (#422 S4): the machine login through
+ * the link, or the saved login the link points at – named in `activeAccount`,
+ * read locally from the file, no CLI for it (R14).
  */
 export async function codexAuthStatus() {
     // Re-assert the credential before judging it. The link into the shared store
     // can disappear under a live daemon (codex has its own auth.json removal
     // path), and reporting "login expired" about a credential that is merely
     // unlinked — while the user's own file is valid for another week — is the
-    // exact complaint this fixes.
+    // exact complaint this fixes. Forcing nothing (S4 item 2): a saved login in
+    // use stays in use.
     const home = repairCodexAuth();
+    const accountId = home.accountId ?? MACHINE_ACCOUNT_ID;
+    const activeAccount = codexActiveAccountSummary(accountId);
+    const verdict = await codexHomeVerdict(home);
+    // A saved login a session was refused with stays refused until its file is
+    // written again (D2) – the same rule as a saved Claude login.
+    if (verdict.status === 'ok' && codexRowRefused(accountId)) {
+        return {
+            ...verdict,
+            status: 'expired',
+            detail: 'the agent was refused with this account – sign in again',
+            activeAccount,
+        };
+    }
+    return { ...verdict, activeAccount };
+}
+async function codexHomeVerdict(home) {
     const local = readCodexCredential(home.path);
     if (home.auth === 'missing' && !local) {
         return { status: 'missing', detail: 'not signed in on this server' };
@@ -733,7 +819,11 @@ export async function codexAuthStatus() {
         });
         return {
             status: 'ok',
-            detail: home.auth === 'linked' ? 'signed in with ChatGPT (shared login)' : 'signed in with ChatGPT',
+            detail: home.auth === 'linked'
+                ? 'signed in with ChatGPT (shared login)'
+                : home.auth === 'account'
+                    ? 'signed in with ChatGPT (saved login)'
+                    : 'signed in with ChatGPT',
             ...(local?.expiresAt ? { expiresAt: local.expiresAt } : {}),
         };
     }
@@ -763,30 +853,19 @@ export async function codexAuthStatus() {
 /**
  * Read what the runner's own auth.json says, without ever logging a token.
  * Used only to tell "no credential" apart from "credential past its date" —
- * the CLI probe is local and cannot detect a server-side revocation.
+ * the CLI probe is local and cannot detect a server-side revocation. The
+ * reading itself lives in `codex-home.ts`, where the saved logins are judged by
+ * the same lines.
  */
 function readCodexCredential(homePath) {
-    try {
-        const raw = JSON.parse(fs.readFileSync(path.join(homePath, 'auth.json'), 'utf8'));
-        const access = raw.tokens?.access_token;
-        if (!access)
-            return null;
-        // A refresh token means the access token's own expiry is not the whole
-        // story — codex renews it on its own.
-        if (raw.tokens?.refresh_token)
-            return { expired: false };
-        const payload = access.split('.')[1];
-        if (!payload)
-            return { expired: false };
-        const claims = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
-        if (typeof claims.exp !== 'number')
-            return { expired: false };
-        const expiresAt = new Date(claims.exp * 1000).toISOString();
-        return { expiresAt, expired: claims.exp * 1000 < Date.now() };
-    }
-    catch {
+    const credential = readCodexCredentialFile(path.join(homePath, 'auth.json'));
+    // Only a ChatGPT login has tokens to date; an API key is left to `codex login status`.
+    if (credential.kind !== 'chatgpt')
         return null;
-    }
+    return {
+        ...(credential.expiresAt ? { expiresAt: credential.expiresAt } : {}),
+        expired: credential.status === 'expired',
+    };
 }
 /**
  * A verdict read off disk, overruled by what a real session experienced.
@@ -807,7 +886,7 @@ function withObservedFailures(agent, status, accountId = MACHINE_ACCOUNT_ID) {
 export async function agentAuthStatuses() {
     const [claudeRaw, codexRaw] = await Promise.all([claudeAuthStatus(), codexAuthStatus()]);
     const claude = withObservedFailures('claude', claudeRaw, claudeRaw.activeAccount?.id ?? MACHINE_ACCOUNT_ID);
-    const codex = withObservedFailures('codex', codexRaw);
+    const codex = withObservedFailures('codex', codexRaw, codexRaw.activeAccount?.id ?? MACHINE_ACCOUNT_ID);
     logVerdictChange('claude', claude);
     logVerdictChange('codex', codex);
     return { claude, codex };

package/dist/claude-homes.d.ts

@@ -1,5 +1,6 @@
 import { type ClaudeIdentity } from './agent-auth.js';
 import { type UsageReading, type UsageRow, type UsageSignature } from './adapters/claude-usage.js';
+import { AccountError, isAccountId } from './login-marks.js';
 /**
  * Several Claude logins on one machine – one HOME per account (#422, D1).
  *
@@ -41,14 +42,10 @@ export declare function claudeHomesDir(): string;
  * exactly the definition of «the machine login».
  */
 export declare function machineHome(homedir?: string): string;
-/** A saved account's id: twelve lowercase letters and digits, never `machine`. */
-export declare function isAccountId(id: unknown): id is string;
+/** The id format and the refusal live beside the machine row's id – shared by both agents. */
+export { AccountError, isAccountId };
 /** The home of a saved account. Throws on anything that is not an account id. */
 export declare function accountHome(id: string): string;
-/** A refusal meant for a person: the wire (S2) sends its message as it is. */
-export declare class AccountError extends Error {
-    constructor(message: string);
-}
 /**
  * What a saved home reaches through a link rather than owning (R20).
  *

package/dist/claude-homes.js

@@ -1,12 +1,11 @@
 import { execFile } from 'node:child_process';
-import crypto from 'node:crypto';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { sessionClaudePath } from './agent-binary.js';
 import { readAgentAuth, storedClaudeToken, storedClaudeTokenRefused, updateAgentAuth, } from './agent-auth.js';
 import { invalidateUsageCache, lastUsageRows, } from './adapters/claude-usage.js';
-import { MACHINE_ACCOUNT_ID, clearRefusal, refusalActive } from './login-marks.js';
+import { AccountError, MACHINE_ACCOUNT_ID, clearRefusal, isAccountId, newAccountId, refusalActive, } from './login-marks.js';
 import { log } from './log.js';
 import { stateDir } from './paths.js';
 import { lowerPriority } from './process-priority.js';
@@ -66,30 +65,14 @@ function configFileOf(home, homedir = os.homedir()) {
 function credentialsFileOf(home, homedir = os.homedir()) {
     return path.join(home ?? machineHome(homedir), '.credentials.json');
 }
-const ACCOUNT_ID = /^[a-z0-9]{12}$/;
-/** A saved account's id: twelve lowercase letters and digits, never `machine`. */
-export function isAccountId(id) {
-    return typeof id === 'string' && ACCOUNT_ID.test(id);
-}
-function newAccountId() {
-    // base32-ish from random bytes: 12 characters of [a-z0-9].
-    const alphabet = 'abcdefghijklmnopqrstuvwxyz0123456789';
-    const bytes = crypto.randomBytes(12);
-    return Array.from(bytes, (byte) => alphabet[byte % alphabet.length]).join('');
-}
+/** The id format and the refusal live beside the machine row's id – shared by both agents. */
+export { AccountError, isAccountId };
 /** The home of a saved account. Throws on anything that is not an account id. */
 export function accountHome(id) {
     if (!isAccountId(id))
         throw new AccountError(`not an account id: ${String(id).slice(0, 40)}`);
     return path.join(claudeHomesDir(), id);
 }
-/** A refusal meant for a person: the wire (S2) sends its message as it is. */
-export class AccountError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = 'AccountError';
-    }
-}
 function lstatOrNull(target) {
     try {
         return fs.lstatSync(target);

package/dist/codex-accounts.d.ts

@@ -0,0 +1,79 @@
+import { type CodexHome } from './adapters/codex-home.js';
+import type { AgentRateLimitWindow } from './adapters/types.js';
+import type { AccountCard, AccountList } from './claude-homes.js';
+/** Which row the home uses: a saved one only while its directory is there. */
+export declare function activeCodexAccountId(home?: string): string;
+/**
+ * The list of Codex logins on this machine (§8 `agent_accounts`).
+ *
+ * Repairs the home first, without forcing anything (S4 item 2), so a real file
+ * the CLI left in place of the link is back in its store before the rows are
+ * read. No subprocess anywhere in it.
+ */
+export declare function listCodexAccounts(homedir?: string): AccountList;
+/** The card of a row that just signed in – for the relay's log and the tests. */
+export declare function codexAccountCard(id: string): AccountCard;
+/**
+ * Make a row the login new Codex sessions start under (§8 `agent_account_activate`).
+ *
+ * Running sessions keep the tokens they started with; a refreshed login is
+ * returned to its own store before the link moves (S4 item 7). The machine row is
+ * refused only where the machine's owner wrote `[codex] auth = "own"`: there the
+ * host login is kept away from the runner on purpose, and the next repair would
+ * take the link out again.
+ */
+export declare function activateCodexAccount(id: string): string;
+/**
+ * Forget a saved Codex login: its file goes, its record goes (§8 `agent_account_forget`).
+ *
+ * The machine row cannot be forgotten. A row a live session runs under is
+ * refused – its process refreshes into that file until it ends. The row in use is
+ * switched to the machine login FIRST, so the link never points at nothing.
+ */
+export declare function forgetCodexAccount(id: string): {
+    active: string;
+};
+/** The account a Codex session runs under – captured at its start, kept to its end (R14). */
+export interface CodexSessionAccount {
+    id: string;
+    email?: string;
+    orgId?: string;
+    plan?: string;
+}
+/**
+ * Who the home a session is starting with belongs to: the row it is set to, and
+ * the identity of the login the link resolves to right now – read locally.
+ */
+export declare function codexSessionAccount(home: CodexHome): CodexSessionAccount;
+/**
+ * `owner` is the session object itself: a session can end twice (the boot catch
+ * calls `stop()`, and the process exit calls it again), and a bare delete by
+ * sessionId then wiped the note of the RELAUNCHED session that had taken the
+ * same id – «forget» stopped refusing the account that session was using (found
+ * by the independent check of S4).
+ */
+export declare function noteCodexSessionAccount(sessionId: string, accountId: string, owner: object): void;
+export declare function releaseCodexSessionAccount(sessionId: string, owner: object): void;
+/** Codex rows some live session process runs under right now. */
+export declare function liveCodexAccountIds(): Set<string>;
+/** Who the active row is, for `auth_status.activeAccount` (§8) – read locally, no CLI. */
+export declare function codexActiveAccountSummary(id: string, homedir?: string): {
+    id: string;
+    email?: string;
+    orgId?: string;
+};
+/** A refusal persisted on a saved row that still stands against its login file. */
+export declare function codexRowRefused(id: string): boolean;
+/** A session under this saved row was refused (D2): mark it, remove nothing. */
+export declare function markCodexLoginExpired(id: string): void;
+/** The row worked again. Writes only when there was a mark to clear. */
+export declare function clearCodexLoginExpired(id: string): void;
+/**
+ * A Codex session reported its account's windows. Codex sends these after every
+ * model request, for the account the session runs under – so for a card they
+ * are that subscription's figures, as fresh as its last working session.
+ */
+export declare function noteCodexUsage(orgId: string | undefined, windows: AgentRateLimitWindow[]): void;
+/** Forget every remembered reading – tests. */
+export declare function resetCodexUsage(): void;
+//# sourceMappingURL=codex-accounts.d.ts.map