@code-yeongyu/senpi-ai 2026.11.3-2 → 2026.11.4-2

package/dist/api/anthropic-messages.js

@@ -952,11 +952,11 @@ export const stream = (model, context, options) => {
                     });
                 }
                 const cacheRetention = resolveCacheRetention(options?.cacheRetention ?? model.cacheRetention, options?.env, "short");
-                const cacheSessionId = cacheRetention === "none" ? undefined : options?.sessionId;
+                const affinityKey = cacheRetention === "none" ? undefined : (options?.sessionAffinityKey ?? options?.sessionId);
                 openClient = () => {
                     client = createClient(model, apiKey, options?.interleavedThinking ?? true, shouldUseFineGrainedToolStreamingBeta(model, normalizedContext), options?.refusalFallbacks !== undefined && configuredBetaHeader(model, options) !== null, optionsHeaders, getAnthropicCompat(model).supportsGzipRequestBody
                         ? withGzipRequestBodies(options?.fetch)
-                        : options?.fetch, copilotDynamicHeaders, cacheSessionId, options?.env, federation);
+                        : options?.fetch, copilotDynamicHeaders, affinityKey, options?.env, federation);
                 };
                 openClient();
             }
@@ -1602,7 +1602,7 @@ export const streamSimple = (model, context, options) => {
         thinkingBudgetTokens: Math.min(adjusted.thinkingBudget, Math.max(0, maxTokens - 1024)),
     });
 };
-function createClient(model, apiKey, interleavedThinking, useFineGrainedToolStreamingBeta, useServerSideFallbackBeta, optionsHeaders, fetch, dynamicHeaders, sessionId, env, federation) {
+function createClient(model, apiKey, interleavedThinking, useFineGrainedToolStreamingBeta, useServerSideFallbackBeta, optionsHeaders, fetch, dynamicHeaders, affinityKey, env, federation) {
     // Adaptive thinking models have interleaved thinking built in, so skip the beta header.
     const needsInterleavedBeta = interleavedThinking && !supportsAdaptiveThinking(model);
     const betaFeatures = [];
@@ -1652,11 +1652,11 @@ function createClient(model, apiKey, interleavedThinking, useFineGrainedToolStre
     // API key, header-owned auth, or workload identity federation.
     const affinityCompat = getAnthropicCompat(model);
     const sessionAffinityHeaders = {};
-    if (sessionId && affinityCompat.sendSessionAffinityHeaders) {
+    if (affinityKey && affinityCompat.sendSessionAffinityHeaders) {
         // OpenRouter routes prompt-cache affinity through its own header name and
         // rejects x-session-affinity (earendil-works/pi#9102).
         const header = affinityCompat.sessionAffinityFormat === "openrouter" ? "x-session-id" : "x-session-affinity";
-        sessionAffinityHeaders[header] = sessionId;
+        sessionAffinityHeaders[header] = affinityKey;
     }
     const defaultHeaders = sanitizeAdaptiveThinkingHeaders(model, mergeClientHeaders(model, {
         accept: "application/json",

package/dist/api/lazy.js

@@ -1,9 +1,11 @@
+import { readProviderDiagnostic } from "../provider-diagnostic.js";
 import { assistantEvents, pushAssistantProgress, setAssistantReader } from "../utils/assistant-capture.js";
 import { AssistantMessageEventStream } from "../utils/event-stream.js";
 import { isOAuthRefreshUnavailableError } from "../utils/oauth-refresh-error.js";
 import { describeReplacedInstall } from "../utils/provider-failure-description.js";
 import { OAUTH_REFRESH_UNAVAILABLE_DIAGNOSTIC } from "../utils/retry.js";
 function createSetupErrorMessage(model, error) {
+    const providerDiagnostic = readProviderDiagnostic(error);
     return {
         role: "assistant",
         content: [],
@@ -20,6 +22,7 @@ function createSetupErrorMessage(model, error) {
         },
         stopReason: "error",
         errorMessage: describeReplacedInstall(error) ?? (error instanceof Error ? error.message : String(error)),
+        ...(providerDiagnostic === undefined ? {} : { providerDiagnostic }),
         ...(isOAuthRefreshUnavailableError(error)
             ? {
                 diagnostics: [

package/dist/api/openai-completions.js

@@ -239,6 +239,17 @@ function parseLegacyEncryptedReasoningDetail(signature) {
         return undefined;
     }
 }
+/**
+ * Replays a thought signature that an OpenAI-compatible proxy returned in a tool call's
+ * `provider_specific_fields` (LiteLLM serving Gemini) on the same field, so the replayed call
+ * keeps it even though its id is normalized. A legacy encrypted reasoning detail sharing the
+ * `thoughtSignature` slot travels through `reasoning_details` instead.
+ */
+function withProviderThoughtSignature(call, thoughtSignature) {
+    if (!thoughtSignature || parseLegacyEncryptedReasoningDetail(thoughtSignature) !== undefined)
+        return call;
+    return { ...call, provider_specific_fields: { thought_signature: thoughtSignature } };
+}
 function fillMissingCommonReasoningDetailFields(target, source) {
     target.id ??= source.id;
     target.format ||= source.format;
@@ -713,6 +724,10 @@ export const stream = (model, context, options) => {
                             if (!block.name && name) {
                                 block.name = name;
                             }
+                            const thoughtSignature = toolCall.provider_specific_fields?.thought_signature;
+                            if (typeof thoughtSignature === "string" && thoughtSignature.length > 0) {
+                                block.thoughtSignature = thoughtSignature;
+                            }
                             let delta = "";
                             if (toolCall.function?.arguments) {
                                 delta = toolCall.function.arguments;
@@ -1377,23 +1392,23 @@ export function convertMessages(model, context, compat, options = {}) {
                 assistantMsg.tool_calls = toolCalls.map((tc) => {
                     const customInputProperty = options?.grammarToolInputProperties?.get(tc.name);
                     if (customInputProperty !== undefined) {
-                        return {
+                        return withProviderThoughtSignature({
                             id: tc.id,
                             type: "custom",
                             custom: {
                                 name: tc.name,
                                 input: sanitizeSurrogates(getGrammarToolInput(tc.name, tc.arguments, customInputProperty)),
                             },
-                        };
+                        }, tc.thoughtSignature);
                     }
-                    return {
+                    return withProviderThoughtSignature({
                         id: tc.id,
                         type: "function",
                         function: {
                             name: tc.name,
                             arguments: JSON.stringify(tc.arguments),
                         },
-                    };
+                    }, tc.thoughtSignature);
                 });
             }
             if (preservedReasoningDetails) {

package/dist/api/simple-options.js

@@ -118,6 +118,7 @@ export function buildBaseOptions(model, context, options, apiKey) {
         transport: options?.transport,
         cacheRetention: options?.cacheRetention ?? model.cacheRetention,
         sessionId: options?.sessionId,
+        sessionAffinityKey: options?.sessionAffinityKey,
         headers: options?.headers,
         extraBody: options?.extraBody,
         onPayload: options?.onPayload,

package/dist/auth/oauth/openai-chatgpt.d.ts

@@ -4,6 +4,50 @@
  * This public-client flow uses no client secret and sends the resulting user
  * access token directly to api.openai.com.
  */
-import type { OAuthAuth } from "../types.ts";
-export declare const openaiChatGPTOAuth: OAuthAuth;
+import type { LoginOptions, LogoutOptions, OAuthCredential, OAuthRevocationResult, ProviderAuthInteraction } from "../types.ts";
+import { type OpenAIIdTokenDependencies } from "./openai-id-token.ts";
+declare function revokeSession(credential: OAuthCredential, options?: LogoutOptions): Promise<OAuthRevocationResult>;
+export declare function createOpenAIChatGPTOAuth(dependencies?: Partial<OpenAIIdTokenDependencies>): {
+    name: string;
+    isSubscription: true;
+    loginLabel: string;
+    login: (interaction: ProviderAuthInteraction, options?: LoginOptions & {
+        readonly preferredCallbackPort?: number;
+    }) => Promise<OAuthCredential>;
+    refresh: (credential: OAuthCredential, signal: AbortSignal) => Promise<OAuthCredential>;
+    revoke: typeof revokeSession;
+    check({ credential }: {
+        ctx: import("../types.ts").AuthContext;
+        credential?: OAuthCredential;
+        signal: AbortSignal;
+    }): Promise<{
+        type: "oauth";
+        source: string;
+    } | undefined>;
+    toAuth(credential: OAuthCredential): Promise<{
+        apiKey: string;
+    }>;
+};
+export declare const openaiChatGPTOAuth: {
+    name: string;
+    isSubscription: true;
+    loginLabel: string;
+    login: (interaction: ProviderAuthInteraction, options?: LoginOptions & {
+        readonly preferredCallbackPort?: number;
+    }) => Promise<OAuthCredential>;
+    refresh: (credential: OAuthCredential, signal: AbortSignal) => Promise<OAuthCredential>;
+    revoke: typeof revokeSession;
+    check({ credential }: {
+        ctx: import("../types.ts").AuthContext;
+        credential?: OAuthCredential;
+        signal: AbortSignal;
+    }): Promise<{
+        type: "oauth";
+        source: string;
+    } | undefined>;
+    toAuth(credential: OAuthCredential): Promise<{
+        apiKey: string;
+    }>;
+};
+export {};
 //# sourceMappingURL=openai-chatgpt.d.ts.map

package/dist/auth/oauth/openai-chatgpt.js

@@ -7,18 +7,18 @@
 import { randomBytes } from "node:crypto";
 import { createServer } from "node:http";
 import { configuredOAuthBrandName, oauthErrorHtml, oauthSuccessHtml } from "../../utils/oauth-page.js";
-import { OAuthTokenEndpointError } from "../../utils/oauth-refresh-error.js";
-import { getProviderEnvValue } from "../../utils/provider-env.js";
+import { classifyOAuthRefreshFailure, OAuthClientConfigurationError, OAuthReauthorizationRequiredError, OAuthTokenEndpointError, } from "../../utils/oauth-refresh-error.js";
+import { createOpenAIIdTokenVerifier } from "./openai-id-token.js";
 import { getWireIdentity } from "../../wire-identity.js";
 import { generatePKCE } from "./pkce.js";
-// every login registers a new client with this ID; OpenAI returns the issued client ID in the callback
+// Only first-time registration uses this entrypoint; returning accounts keep their issued ID.
 const DYNAMIC_CLIENT_ID = "dynamic_agent_client";
 const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 const AUTHORIZE_URL = "https://auth.openai.com/api/accounts/authorize";
 const TOKEN_URL = "https://auth.openai.com/api/accounts/oauth/token";
 const DISCOVERY_URL = "https://auth.openai.com/.well-known/openid-configuration";
 const RESOURCE = "https://api.openai.com/v1";
-const CALLBACK_HOST = getProviderEnvValue("PI_OAUTH_CALLBACK_HOST") || "127.0.0.1";
+const CALLBACK_HOST = "127.0.0.1";
 const CALLBACK_PORT = 1455;
 const CALLBACK_PATH = "/auth/callback";
 const REDIRECT_URI = `http://127.0.0.1:${CALLBACK_PORT}${CALLBACK_PATH}`;
@@ -26,24 +26,65 @@ const DIRECT_TOKEN_SCOPE = "chatgpt.tokens.use.direct";
 const SCOPE = `openid profile email offline_access resource.invoke ${DIRECT_TOKEN_SCOPE}`;
 // Refresh this long before the real expiry so a request never starts with a token about to expire.
 const EXPIRY_MARGIN_MS = 3 * 60 * 1000;
+class OpenAIReauthorizationError extends Error {
+    constructor(code) {
+        super(code === "invalid_account"
+            ? "The selected ChatGPT account needs an issued client ID and verified subject"
+            : code === "client_mismatch"
+                ? "ChatGPT reauthorization returned a different client ID"
+                : "ChatGPT reauthorization returned a different account");
+        this.name = "OpenAIReauthorizationError";
+        this.code = code;
+    }
+}
+class OpenAIConsentDeclinedError extends Error {
+    constructor() {
+        super("ChatGPT consent declined");
+        this.code = "consent_declined";
+        this.name = "OpenAIConsentDeclinedError";
+    }
+}
+class OpenAIPlanUsageNotEnabledError extends Error {
+    constructor() {
+        super("ChatGPT plan usage is not enabled. Enable ChatGPT plan usage or use an API key.");
+        this.code = "plan_usage_not_enabled";
+        this.recovery = ["enable_plan_usage", "use_api_key"];
+        this.name = "OpenAIPlanUsageNotEnabledError";
+    }
+}
 function randomValue() {
     return randomBytes(32).toString("base64url");
 }
-function authorizationResultFromCallback(url, expectedState) {
-    const code = url.searchParams.get("code");
-    if (!code)
-        throw new Error("Missing authorization code");
+function authorizationResultFromCallback(url, expectedState, knownClient) {
     const state = url.searchParams.get("state");
     if (!state)
         throw new Error("Missing OAuth state");
     if (state !== expectedState)
         throw new Error("OAuth state mismatch");
-    const clientId = url.searchParams.get("client_id")?.trim();
+    const error = url.searchParams.get("error");
+    if (error === "access_denied")
+        throw new OpenAIConsentDeclinedError();
+    if (error)
+        throw new Error(`ChatGPT authorization failed: ${error}`);
+    const code = url.searchParams.get("code");
+    if (!code)
+        throw new Error("Missing authorization code");
+    const suppliedClientId = url.searchParams.get("client_id");
+    if (knownClient?.purpose === "reauthorize" &&
+        suppliedClientId !== null &&
+        suppliedClientId !== knownClient.clientId) {
+        throw new OpenAIReauthorizationError("client_mismatch");
+    }
+    const callbackClientId = suppliedClientId?.trim();
+    if (knownClient?.purpose === "consent" && callbackClientId && callbackClientId !== knownClient.clientId) {
+        throw new Error("ChatGPT consent callback client ID mismatch");
+    }
+    const clientId = knownClient?.clientId ?? callbackClientId;
     if (!clientId)
         throw new Error("OpenAI OAuth registration callback did not contain an issued client ID");
     return { code, clientId };
 }
-function authorizationResultFromManualInput(input, expectedState) {
+function authorizationResultFromManualInput(input, expectedState, redirectUri, knownClient) {
     let url;
     try {
         url = new URL(input.trim());
@@ -51,21 +92,19 @@ function authorizationResultFromManualInput(input, expectedState) {
     catch {
         throw new Error("Paste the full callback URL from the browser");
     }
-    const expected = new URL(REDIRECT_URI);
+    const expected = new URL(redirectUri);
     if (url.origin !== expected.origin || url.pathname !== expected.pathname) {
-        throw new Error(`The pasted callback URL must start with ${REDIRECT_URI}`);
+        throw new Error(`The pasted callback URL must start with ${redirectUri}`);
     }
-    const error = url.searchParams.get("error");
-    if (error)
-        throw new Error(`ChatGPT authorization failed: ${error}`);
-    return authorizationResultFromCallback(url, expectedState);
+    return authorizationResultFromCallback(url, expectedState, knownClient);
 }
 function sendHtml(response, status, body) {
     response.writeHead(status, { "Content-Type": "text/html; charset=utf-8" });
     response.end(body);
 }
-function startCallbackServer(expectedState) {
+function startCallbackServer(expectedState, preferredPort, knownClient) {
     return new Promise((resolve, reject) => {
+        let redirectUri = REDIRECT_URI;
         let resolveResult;
         let rejectResult;
         const result = new Promise((resolveAuthorization, rejectAuthorization) => {
@@ -74,24 +113,23 @@ function startCallbackServer(expectedState) {
         });
         const server = createServer((request, response) => {
             try {
-                const url = new URL(request.url || "", REDIRECT_URI);
+                const url = new URL(request.url || "", redirectUri);
                 if (url.pathname !== CALLBACK_PATH) {
                     sendHtml(response, 404, oauthErrorHtml("Callback route not found."));
                     return;
                 }
-                const error = url.searchParams.get("error");
-                if (error) {
-                    sendHtml(response, 400, oauthErrorHtml("ChatGPT was not connected.", `Error: ${error}`));
-                    rejectResult(new Error(`ChatGPT authorization failed: ${error}`));
-                    return;
-                }
                 let authorizationResult;
                 try {
-                    authorizationResult = authorizationResultFromCallback(url, expectedState);
+                    authorizationResult = authorizationResultFromCallback(url, expectedState, knownClient);
                 }
                 catch (error) {
                     const message = error instanceof Error ? error.message : "Invalid callback";
                     sendHtml(response, 400, oauthErrorHtml(message));
+                    // Unrelated callbacks must not stop the pending login attempt.
+                    if (error instanceof OpenAIReauthorizationError ||
+                        (url.searchParams.get("state") === expectedState && url.searchParams.has("error"))) {
+                        rejectResult(error instanceof Error ? error : new Error(message));
+                    }
                     return;
                 }
                 sendHtml(response, 200, oauthSuccessHtml("ChatGPT authentication completed. You can close this window."));
@@ -101,16 +139,47 @@ function startCallbackServer(expectedState) {
                 sendHtml(response, 500, oauthErrorHtml("Internal error while processing the callback."));
             }
         });
-        server.once("error", reject);
-        server.listen(CALLBACK_PORT, CALLBACK_HOST, () => {
+        const onListening = () => {
+            server.removeListener("error", onBindError);
             server.removeListener("error", reject);
+            const address = server.address();
+            if (!address || typeof address === "string") {
+                server.close();
+                reject(new Error("OpenAI OAuth callback server did not bind to TCP"));
+                return;
+            }
+            redirectUri = `http://${CALLBACK_HOST}:${address.port}${CALLBACK_PATH}`;
             server.on("error", rejectResult);
-            resolve({ server, result });
-        });
+            resolve({ server, result, redirectUri });
+        };
+        const onBindError = (error) => {
+            server.removeListener("listening", onListening);
+            if (error.code !== "EADDRINUSE") {
+                reject(error);
+                return;
+            }
+            server.once("error", reject);
+            server.listen(0, CALLBACK_HOST, onListening);
+        };
+        server.once("error", onBindError);
+        server.listen(preferredPort, CALLBACK_HOST, onListening);
     });
 }
-async function requestToken(body, signal) {
-    const response = await fetch(TOKEN_URL, {
+/** Read machine codes only; error_description is diagnostic text, not a recovery signal. */
+function tokenErrorCode(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return undefined;
+    const error = Reflect.get(value, "error");
+    if (typeof error === "string")
+        return error;
+    const code = Reflect.get(value, "code");
+    if (typeof code === "string")
+        return code;
+    const type = Reflect.get(value, "type");
+    return tokenErrorCode(error) ?? (typeof type === "string" ? type : undefined);
+}
+async function requestToken(body, signal, fetchToken) {
+    const response = await fetchToken(TOKEN_URL, {
         method: "POST",
         headers: {
             accept: "application/json",
@@ -121,7 +190,29 @@ async function requestToken(body, signal) {
     });
     if (!response.ok) {
         const responseBody = await response.text().catch(() => "");
-        throw new OAuthTokenEndpointError(`OpenAI OAuth token request failed (${response.status}): ${responseBody || response.statusText}`, response.status);
+        const error = new OAuthTokenEndpointError(`OpenAI OAuth token request failed (${response.status}): ${responseBody || response.statusText}`, response.status);
+        if (body.get("grant_type") === "refresh_token" && classifyOAuthRefreshFailure(error) === "permanent") {
+            let code;
+            try {
+                const parsed = JSON.parse(responseBody);
+                code = tokenErrorCode(parsed);
+            }
+            catch {
+                // Non-JSON errors retain the HTTP status and diagnostic below.
+            }
+            switch (code) {
+                case "invalid_grant":
+                case "invalid_refresh_token":
+                case "token_expired":
+                case "refresh_token_expired":
+                case "refresh_token_invalidated":
+                case "refresh_token_reused":
+                    throw new OAuthReauthorizationRequiredError(code, response.status);
+                case "invalid_client":
+                    throw new OAuthClientConfigurationError(response.status);
+            }
+        }
+        throw error;
     }
     const data = await response.json();
     if (typeof data !== "object" || data === null || Array.isArray(data)) {
@@ -135,7 +226,7 @@ function requireTokenString(value, field) {
     }
     return value;
 }
-function credentialFromTokenResponse(token, clientId) {
+function credentialFromTokenResponse(token, clientId, now) {
     const access = requireTokenString(token.access_token, "access_token");
     const refresh = requireTokenString(token.refresh_token, "refresh_token");
     const scope = requireTokenString(token.scope, "scope");
@@ -143,35 +234,29 @@ function credentialFromTokenResponse(token, clientId) {
         throw new Error("OpenAI OAuth token response has invalid expires_in");
     }
     const scopes = scope.trim().split(/\s+/).filter(Boolean);
-    if (!scopes.includes(DIRECT_TOKEN_SCOPE)) {
-        throw new Error(`OpenAI OAuth grant did not include ${DIRECT_TOKEN_SCOPE}`);
-    }
     return {
         type: "oauth",
         access,
         refresh,
-        expires: Date.now() + token.expires_in * 1000 - EXPIRY_MARGIN_MS,
+        expires: now() + token.expires_in * 1000 - EXPIRY_MARGIN_MS,
         clientId,
         scopes,
+        planUsageEnabled: scopes.includes(DIRECT_TOKEN_SCOPE),
     };
 }
-async function exchangeAuthorizationCode(code, verifier, clientId, signal) {
+async function exchangeAuthorizationCode(code, verifier, clientId, redirectUri, signal, nonce, deps, verifyIdToken) {
     const token = await requestToken(new URLSearchParams({
         grant_type: "authorization_code",
         client_id: clientId,
         code,
         code_verifier: verifier,
-        redirect_uri: REDIRECT_URI,
+        redirect_uri: redirectUri,
         resource: RESOURCE,
-    }), signal);
-    // Pi does not use the ID token to identify the user or read profile data.
-    // Keep the presence check as part of the token-response contract.
-    if (typeof token.id_token !== "string" || token.id_token.trim().length === 0) {
-        throw new Error("OpenAI OAuth token response did not contain an ID token");
-    }
-    return credentialFromTokenResponse(token, clientId);
+    }), signal, deps.fetch);
+    const identity = await verifyIdToken(token.id_token, clientId, nonce, signal);
+    return { ...credentialFromTokenResponse(token, clientId, deps.now), ...identity, idToken: token.id_token };
 }
-async function refreshAccessToken(credential, signal) {
+async function refreshAccessToken(credential, signal, deps) {
     const clientId = credential.clientId;
     if (typeof clientId !== "string" || clientId.trim().length === 0) {
         throw new Error("Stored OpenAI OAuth credential does not contain an issued client ID; reconnect ChatGPT");
@@ -181,8 +266,8 @@ async function refreshAccessToken(credential, signal) {
         client_id: clientId,
         refresh_token: credential.refresh,
         resource: RESOURCE,
-    }), signal);
-    return credentialFromTokenResponse(token, clientId);
+    }), signal, deps.fetch);
+    return { ...credential, ...credentialFromTokenResponse(token, clientId, deps.now) };
 }
 async function revokeSession(credential, options) {
     const unconfirmed = { status: "remote_revocation_unconfirmed" };
@@ -260,14 +345,33 @@ function agentHostId(deviceId) {
     }
     return `urn:uuid:${deviceId.toLowerCase()}`;
 }
-async function loginOpenAIChatGPT(interaction, options) {
+async function loginOpenAIChatGPT(interaction, options, deps, verifyIdToken) {
+    const existing = options?.reauthorize;
+    if (existing &&
+        (typeof existing.clientId !== "string" ||
+            !existing.clientId.trim() ||
+            existing.clientId === DYNAMIC_CLIENT_ID ||
+            typeof existing.subject !== "string" ||
+            !existing.subject.trim())) {
+        throw new OpenAIReauthorizationError("invalid_account");
+    }
+    const pendingClientId = existing?.clientId;
     const hostId = agentHostId(options?.getDeviceId?.());
+    const consentClientId = options?.planUsageConsent?.clientId;
+    if (options?.planUsageConsent && (!consentClientId?.trim() || consentClientId === DYNAMIC_CLIENT_ID)) {
+        throw new Error("Enabling ChatGPT plan usage requires the saved issued client ID");
+    }
+    const knownClient = pendingClientId
+        ? { clientId: pendingClientId, purpose: "reauthorize" }
+        : consentClientId
+            ? { clientId: consentClientId, purpose: "consent" }
+            : undefined;
     const { verifier, challenge } = await generatePKCE();
     const state = randomValue();
     const nonce = randomValue();
     let callback;
     try {
-        callback = await startCallbackServer(state);
+        callback = await startCallbackServer(state, options?.preferredCallbackPort ?? CALLBACK_PORT, knownClient);
     }
     catch (error) {
         interaction.notify({
@@ -275,14 +379,13 @@ async function loginOpenAIChatGPT(interaction, options) {
             message: `Could not listen on ${REDIRECT_URI}; paste the final redirect URL to continue. ${error instanceof Error ? error.message : String(error)}`,
         });
     }
+    const redirectUri = callback?.redirectUri ?? REDIRECT_URI;
     const authorizationUrl = new URL(AUTHORIZE_URL);
     authorizationUrl.search = new URLSearchParams({
-        client_id: DYNAMIC_CLIENT_ID,
-        // Display metadata on OpenAI's consent screen (the user can edit it); not tied to the issued client ID.
-        agent_name_hint: options?.appName ?? configuredOAuthBrandName() ?? getWireIdentity(),
+        client_id: pendingClientId ?? DYNAMIC_CLIENT_ID,
         ext_agent_host_id: hostId,
         response_type: "code",
-        redirect_uri: REDIRECT_URI,
+        redirect_uri: redirectUri,
         resource: RESOURCE,
         scope: SCOPE,
         state,
@@ -290,6 +393,20 @@ async function loginOpenAIChatGPT(interaction, options) {
         code_challenge_method: "S256",
         nonce,
     }).toString();
+    if (existing) {
+        if (existing.idToken)
+            authorizationUrl.searchParams.set("id_token_hint", existing.idToken);
+        if (existing.email)
+            authorizationUrl.searchParams.set("login_hint", existing.email);
+    }
+    else {
+        // Display metadata on OpenAI's consent screen (the user can edit it); not tied to the issued client ID.
+        authorizationUrl.searchParams.set("agent_name_hint", options?.appName ?? configuredOAuthBrandName() ?? getWireIdentity());
+    }
+    if (consentClientId) {
+        authorizationUrl.searchParams.set("client_id", consentClientId);
+        authorizationUrl.searchParams.set("prompt", "consent");
+    }
     interaction.notify({
         type: "auth_url",
         url: authorizationUrl.toString(),
@@ -300,14 +417,18 @@ async function loginOpenAIChatGPT(interaction, options) {
         .prompt({
         type: "manual_code",
         message: "Complete login in your browser, or paste the final redirect URL here:",
-        placeholder: REDIRECT_URI,
+        placeholder: redirectUri,
         signal: AbortSignal.any([manualAbort.signal, interaction.signal]),
     })
-        .then((input) => authorizationResultFromManualInput(input, state));
+        .then((input) => authorizationResultFromManualInput(input, state, redirectUri, knownClient));
     try {
         const result = await (callback ? Promise.race([callback.result, manualCode]) : manualCode);
         interaction.notify({ type: "progress", message: "Exchanging authorization code for tokens..." });
-        return await exchangeAuthorizationCode(result.code, verifier, result.clientId, interaction.signal);
+        const credential = await exchangeAuthorizationCode(result.code, verifier, result.clientId, redirectUri, interaction.signal, nonce, deps, verifyIdToken);
+        if (existing && credential.subject !== existing.subject) {
+            throw new OpenAIReauthorizationError("subject_mismatch");
+        }
+        return credential;
     }
     catch (error) {
         if (interaction.signal.aborted)
@@ -325,20 +446,31 @@ async function loginOpenAIChatGPT(interaction, options) {
         callback?.server.closeAllConnections();
     }
 }
-export const openaiChatGPTOAuth = {
-    name: "OpenAI (ChatGPT subscription)",
-    isSubscription: true,
-    loginLabel: "Sign in with ChatGPT",
-    login: loginOpenAIChatGPT,
-    refresh: refreshAccessToken,
-    revoke: revokeSession,
-    async check({ credential }) {
-        if (!credential?.access || !credential.refresh || credential.signedOut === true)
-            return undefined;
-        return { type: "oauth", source: "OAuth" };
-    },
-    async toAuth(credential) {
-        return { apiKey: credential.access };
-    },
-};
+export function createOpenAIChatGPTOAuth(dependencies = {}) {
+    const deps = {
+        fetch: dependencies.fetch ?? ((url, init) => fetch(url, init)),
+        now: dependencies.now ?? (() => Date.now()),
+    };
+    const verifyIdToken = createOpenAIIdTokenVerifier(deps);
+    return {
+        name: "OpenAI (ChatGPT subscription)",
+        isSubscription: true,
+        loginLabel: "Sign in with ChatGPT",
+        login: (interaction, options) => loginOpenAIChatGPT(interaction, options, deps, verifyIdToken),
+        refresh: (credential, signal) => refreshAccessToken(credential, signal, deps),
+        revoke: revokeSession,
+        async check({ credential }) {
+            if (!credential?.access || !credential.refresh || credential.signedOut === true)
+                return undefined;
+            return { type: "oauth", source: "OAuth" };
+        },
+        async toAuth(credential) {
+            if (credential.planUsageEnabled === false || !credential.scopes?.includes(DIRECT_TOKEN_SCOPE)) {
+                throw new OpenAIPlanUsageNotEnabledError();
+            }
+            return { apiKey: credential.access };
+        },
+    };
+}
+export const openaiChatGPTOAuth = createOpenAIChatGPTOAuth();
 //# sourceMappingURL=openai-chatgpt.js.map

package/dist/auth/oauth/openai-id-token.d.ts

@@ -0,0 +1,16 @@
+export interface OpenAIIdentity {
+    subject: string;
+    /** Display metadata only; never an account identity or workspace identifier. */
+    email?: string;
+    issuer: string;
+}
+export interface OpenAIIdTokenDependencies {
+    fetch: (url: string, init?: RequestInit) => Promise<Response>;
+    now: () => number;
+}
+export declare class OpenAIIdTokenValidationError extends Error {
+    constructor(message: string);
+}
+/** Each flow instance caches discovery and keys, without caching identity claims. */
+export declare function createOpenAIIdTokenVerifier(deps: OpenAIIdTokenDependencies): (idToken: unknown, clientId: string, nonce: string, signal: AbortSignal) => Promise<OpenAIIdentity>;
+//# sourceMappingURL=openai-id-token.d.ts.map