@codemieai/code 0.13.1 → 0.14.1

package/dist/providers/plugins/sso/proxy/plugins/codex-model-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-model-resolver.d.ts","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/codex-model-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAoBH,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,UAAU,GAAG,aAAa,GAAG,YAAY,CAAC;AAEjF,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,cAAc,CAAC;IACrB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAyCD;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAG/D;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAyBtE;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EAAE,EACnB,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,oBAAoB,CAwBtB"}

package/dist/providers/plugins/sso/proxy/plugins/codex-model-resolver.js

@@ -0,0 +1,129 @@
+/**
+ * Deployment-name resolution for Codex clients.
+ *
+ * The Codex desktop app owns the `model` key in `~/.codex/config.toml`: it
+ * writes its model-picker selection back to that file, overwriting whatever the
+ * connector pinned. The names it picks come from its own bundled catalog and are
+ * undated (`gpt-5.6-luna`, `gpt-5.5`, `gpt-5.2`), while CodeMie deployments are
+ * dated (`gpt-5.6-luna-2026-07-09`). The gateway rejects the undated form, so
+ * every picker selection would fail without this mapping.
+ *
+ * Self-contained on purpose: the proxy must not depend on the Codex agent
+ * plugin, which installs independently of the provider stack.
+ */
+/**
+ * Release date embedded in a CodeMie deployment name, e.g. `-2026-07-09`.
+ *
+ * Not anchored to end-of-string: a deployment may carry a suffix after the date
+ * (`gpt-5-2025-08-07-preview`). Anchoring would fail the match there, and the
+ * version reader would then take `2025` as the minor version — the exact
+ * date-as-version inversion this module exists to avoid.
+ */
+const DEPLOYMENT_DATE_PATTERN = /[-._](20\d{2})[-._](\d{2})[-._](\d{2})/;
+/**
+ * Parse a model name into its identity.
+ *
+ * The release date is stripped BEFORE the version is read — otherwise
+ * `gpt-5-2025-08-07` reads as major 5, minor 2025 and never matches a request
+ * for `gpt-5`.
+ */
+function parseIdentity(name) {
+    const lower = name.trim().toLowerCase();
+    const dateMatch = lower.match(DEPLOYMENT_DATE_PATTERN);
+    const withoutDate = dateMatch ? lower.slice(0, dateMatch.index) : lower;
+    // Dotted and dashed minor versions are the same model: the app sends `gpt-5.2`
+    // for the deployment CodeMie names `gpt-5-2-...`.
+    const canonical = withoutDate.replace(/\./g, '-').replace(/-+$/, '');
+    const versionMatch = canonical.match(/^gpt-(\d+)(?:-(\d+))?/);
+    if (!versionMatch)
+        return null;
+    const rest = canonical.slice(versionMatch[0].length).replace(/^-/, '');
+    return {
+        major: Number(versionMatch[1]),
+        minor: Number(versionMatch[2] ?? 0),
+        variant: rest,
+    };
+}
+function sameIdentity(a, b) {
+    return a.major === b.major && a.minor === b.minor && a.variant === b.variant;
+}
+/** Model families that cannot serve a Codex Responses request. */
+const INCOMPATIBLE_NAME_PATTERN = /claude|sonnet|opus|haiku|anthropic|gemini|qwen|deepseek|llama|mistral|grok|embedding/i;
+/** Model families that can. */
+const COMPATIBLE_NAME_PATTERN = /codex|^gpt[-._]?5(?:[-._]|\b)|^gpt[-._]?6(?:[-._]|\b)/i;
+/**
+ * True when a deployment can serve a Codex Responses request.
+ *
+ * The gateway lists every model the account can reach, including Claude and
+ * embedding deployments. Substituting one of those for an unmatched Codex
+ * request would be far worse than passing the request through and letting the
+ * gateway report the real problem.
+ */
+export function isCodexServableDeployment(name) {
+    if (INCOMPATIBLE_NAME_PATTERN.test(name))
+        return false;
+    return COMPATIBLE_NAME_PATTERN.test(name);
+}
+/**
+ * Rank deployments newest-first, so a caller with no pinned model can still
+ * choose a sensible substitute — the same choice `connect` would have pinned.
+ */
+export function rankDeploymentsByRecency(available) {
+    return available
+        .map((id) => {
+        const identity = parseIdentity(id);
+        const dateMatch = id.toLowerCase().match(DEPLOYMENT_DATE_PATTERN);
+        return {
+            id,
+            score: [
+                identity?.major ?? 0,
+                identity?.minor ?? 0,
+                /mini|nano/i.test(id) ? 0 : 1,
+                dateMatch ? Number(dateMatch[1]) : 0,
+                dateMatch ? Number(dateMatch[2]) : 0,
+                dateMatch ? Number(dateMatch[3]) : 0,
+            ],
+        };
+    })
+        .sort((a, b) => {
+        for (let i = 0; i < a.score.length; i++) {
+            const diff = (b.score[i] ?? 0) - (a.score[i] ?? 0);
+            if (diff !== 0)
+                return diff;
+        }
+        return a.id.localeCompare(b.id);
+    })
+        .map((entry) => entry.id);
+}
+/**
+ * Resolve the model a Codex client asked for to a deployment the gateway has.
+ *
+ * Returns the request unchanged when it is already a known deployment, the
+ * matching dated deployment when the request identifies one, the pinned
+ * fallback when nothing matches, or the request untouched when there is no
+ * fallback to offer. Never throws — an unresolvable request is passed upstream
+ * so the gateway's own error reaches the client.
+ */
+export function resolveCodexDeployment(requested, available, pinnedFallback) {
+    if (available.includes(requested)) {
+        return { model: requested, kind: 'exact' };
+    }
+    const wanted = parseIdentity(requested);
+    if (wanted) {
+        const matches = available.filter((candidate) => {
+            const identity = parseIdentity(candidate);
+            return identity !== null && sameIdentity(identity, wanted);
+        });
+        // Rank rather than take the first: gateway order is arbitrary and in practice
+        // lists the oldest deployment first, so `find` would pin a stale date when
+        // several deployments share one identity.
+        if (matches.length > 0) {
+            return { model: rankDeploymentsByRecency(matches)[0], kind: 'resolved' };
+        }
+    }
+    if (pinnedFallback && available.includes(pinnedFallback)) {
+        return { model: pinnedFallback, kind: 'substituted', requested };
+    }
+    return { model: requested, kind: 'unresolved' };
+}
+//# sourceMappingURL=codex-model-resolver.js.map

package/dist/providers/plugins/sso/proxy/plugins/codex-model-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-model-resolver.js","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/codex-model-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;;;;;GAOG;AACH,MAAM,uBAAuB,GAAG,wCAAwC,CAAC;AAmBzE;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACvD,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAExE,+EAA+E;IAC/E,kDAAkD;IAClD,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAErE,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC9D,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAE/B,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAEvE,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACnC,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,CAAgB,EAAE,CAAgB;IACtD,OAAO,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC;AAC/E,CAAC;AAED,kEAAkE;AAClE,MAAM,yBAAyB,GAC7B,uFAAuF,CAAC;AAE1F,+BAA+B;AAC/B,MAAM,uBAAuB,GAAG,wDAAwD,CAAC;AAEzF;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,OAAO,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAmB;IAC1D,OAAO,SAAS;SACb,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;QACV,MAAM,QAAQ,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,SAAS,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAClE,OAAO;YACL,EAAE;YACF,KAAK,EAAE;gBACL,QAAQ,EAAE,KAAK,IAAI,CAAC;gBACpB,QAAQ,EAAE,KAAK,IAAI,CAAC;gBACpB,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC7B,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACpC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACpC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aACrC;SACF,CAAC;IACJ,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACnD,IAAI,IAAI,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC9B,CAAC;QACD,OAAO,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,SAAiB,EACjB,SAAmB,EACnB,cAAkC;IAElC,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC7C,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE;YAC7C,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;YAC1C,OAAO,QAAQ,KAAK,IAAI,IAAI,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;QACH,8EAA8E;QAC9E,2EAA2E;QAC3E,0CAA0C;QAC1C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,KAAK,EAAE,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,IAAI,cAAc,IAAI,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACzD,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;IACnE,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AAClD,CAAC"}

package/dist/providers/plugins/sso/proxy/plugins/codex-request-normalizer.plugin.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Codex Request Normalizer Plugin
+ * Priority: 14 (runs before generic request sanitization, alongside the other
+ * per-client normalizers)
+ *
+ * The Codex desktop app owns the `model` key in `~/.codex/config.toml`: it
+ * writes its model-picker selection back to that file, overwriting whatever
+ * `codemie proxy connect --codex-desktop` pinned. The names its picker offers
+ * come from the app's own bundled catalog and are undated (`gpt-5.6-luna`,
+ * `gpt-5.5`), while CodeMie deployments carry a release date
+ * (`gpt-5.6-luna-2026-07-09`). The gateway rejects the undated form with
+ * "Invalid model name", and the app then cascades through further catalog
+ * entries that fail the same way.
+ *
+ * This plugin maps the requested name onto a deployment the gateway actually
+ * has, so the picker works instead of failing.
+ */
+import { ProxyPlugin, PluginContext, ProxyInterceptor } from './types.js';
+export declare function repairEmptyToolDescriptions(node: unknown): number;
+export declare class CodexRequestNormalizerPlugin implements ProxyPlugin {
+    id: string;
+    name: string;
+    version: string;
+    priority: number;
+    createInterceptor(context: PluginContext): Promise<ProxyInterceptor>;
+}
+//# sourceMappingURL=codex-request-normalizer.plugin.d.ts.map

package/dist/providers/plugins/sso/proxy/plugins/codex-request-normalizer.plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-request-normalizer.plugin.d.ts","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/codex-request-normalizer.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AA6C1E,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAEjE;AAgDD,qBAAa,4BAA6B,YAAW,WAAW;IAC9D,EAAE,SAA6C;IAC/C,IAAI,SAA8B;IAClC,OAAO,SAAW;IAClB,QAAQ,SAAM;IAER,iBAAiB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC;CAQ3E"}

package/dist/providers/plugins/sso/proxy/plugins/codex-request-normalizer.plugin.js

@@ -0,0 +1,242 @@
+/**
+ * Codex Request Normalizer Plugin
+ * Priority: 14 (runs before generic request sanitization, alongside the other
+ * per-client normalizers)
+ *
+ * The Codex desktop app owns the `model` key in `~/.codex/config.toml`: it
+ * writes its model-picker selection back to that file, overwriting whatever
+ * `codemie proxy connect --codex-desktop` pinned. The names its picker offers
+ * come from the app's own bundled catalog and are undated (`gpt-5.6-luna`,
+ * `gpt-5.5`), while CodeMie deployments carry a release date
+ * (`gpt-5.6-luna-2026-07-09`). The gateway rejects the undated form with
+ * "Invalid model name", and the app then cascades through further catalog
+ * entries that fail the same way.
+ *
+ * This plugin maps the requested name onto a deployment the gateway actually
+ * has, so the picker works instead of failing.
+ */
+import { logger } from '../../../../../utils/logger.js';
+import { fetchCodeMieLlmModels } from '../../sso.http-client.js';
+import { isCodexServableDeployment, rankDeploymentsByRecency, resolveCodexDeployment, } from './codex-model-resolver.js';
+const ALLOWED_CLIENTS = ['codex-desktop'];
+/** Re-list deployments occasionally so a long-lived daemon picks up new models. */
+const MODEL_CACHE_TTL_MS = 10 * 60 * 1000;
+/** How long to wait before retrying after a failed or empty listing. */
+const MODEL_RETRY_BACKOFF_MS = 60 * 1000;
+/**
+ * Repair empty `description` fields on tool definitions, in place.
+ *
+ * Azure — which backs CodeMie deployments through LiteLLM — rejects a tool whose
+ * `description` is an empty string ("Expected a string with minimum length 1"),
+ * while direct OpenAI accepts it. The Codex desktop app and the MCP servers it
+ * loads do emit empty descriptions, so a turn that works against OpenAI fails
+ * here. The client cannot be fixed from our side, so the proxy repairs it.
+ *
+ * Scoped deliberately to arrays literally named `tools`: a JSON-schema property
+ * description is legitimately allowed to be empty and is not what Azure rejects,
+ * so rewriting one would silently alter the tool's schema.
+ *
+ * An empty description carries no information the model does not already have
+ * from the tool's name, so the name is the least-lossy replacement. The key is
+ * dropped when there is no usable name, which the gateway also accepts.
+ *
+ * Returns the number of descriptions repaired.
+ */
+/**
+ * Depth ceiling for the walk. Request bodies are client-controlled — Codex
+ * accumulates conversation history plus nested MCP tool schemas — so an
+ * unbounded walk risks a RangeError escaping into the proxy pipeline. Real
+ * bodies nest far shallower than this.
+ */
+const MAX_WALK_DEPTH = 64;
+export function repairEmptyToolDescriptions(node) {
+    return walk(node, 0, new WeakSet());
+}
+function repairToolEntry(tool) {
+    if (tool === null || typeof tool !== 'object' || Array.isArray(tool))
+        return false;
+    const toolRecord = tool;
+    if (typeof toolRecord.description !== 'string')
+        return false;
+    if (toolRecord.description.trim() !== '')
+        return false;
+    const name = typeof toolRecord.name === 'string' ? toolRecord.name.trim() : '';
+    if (name !== '') {
+        toolRecord.description = name;
+    }
+    else {
+        delete toolRecord.description;
+    }
+    return true;
+}
+function walk(node, depth, seen) {
+    if (depth > MAX_WALK_DEPTH)
+        return 0;
+    if (node === null || typeof node !== 'object')
+        return 0;
+    // Guard against cycles. The function is exported and takes `unknown`, so it
+    // cannot assume its input came from JSON.parse.
+    if (seen.has(node))
+        return 0;
+    seen.add(node);
+    if (Array.isArray(node)) {
+        return node.reduce((count, item) => count + walk(item, depth + 1, seen), 0);
+    }
+    let repaired = 0;
+    const record = node;
+    for (const [key, value] of Object.entries(record)) {
+        if (key === 'tools' && Array.isArray(value)) {
+            for (const tool of value) {
+                if (repairToolEntry(tool))
+                    repaired++;
+            }
+        }
+        // Recurse regardless: a `tools` array can sit at any depth, and the entries
+        // of one may themselves nest further structures.
+        repaired += walk(value, depth + 1, seen);
+    }
+    return repaired;
+}
+export class CodexRequestNormalizerPlugin {
+    id = '@codemie/proxy-codex-request-normalizer';
+    name = 'Codex Request Normalizer';
+    version = '1.0.0';
+    priority = 14;
+    async createInterceptor(context) {
+        const clientType = context.config.clientType;
+        if (!clientType || !ALLOWED_CLIENTS.includes(clientType)) {
+            throw new Error(`Plugin disabled for agent: ${clientType}`);
+        }
+        return new CodexRequestNormalizerInterceptor(context);
+    }
+}
+class CodexRequestNormalizerInterceptor {
+    context;
+    name = 'codex-request-normalizer';
+    availableModels = [];
+    loadedAt = 0;
+    lastAttemptAt = 0;
+    inFlight = null;
+    constructor(context) {
+        this.context = context;
+    }
+    /** Test seam — lets the suite supply a deployment list without a network call. */
+    setAvailableModelsForTest(models) {
+        this.availableModels = models;
+        this.loadedAt = Date.now();
+    }
+    async onRequest(context) {
+        if (!context.requestBody || !context.headers['content-type']?.includes('application/json')) {
+            return;
+        }
+        let body;
+        try {
+            body = JSON.parse(context.requestBody.toString('utf-8'));
+        }
+        catch {
+            // Not JSON — pass through unchanged.
+            return;
+        }
+        const repairedDescriptions = repairEmptyToolDescriptions(body);
+        if (repairedDescriptions > 0) {
+            logger.debug(`[${this.name}] Replaced ${repairedDescriptions} empty tool description(s) rejected by upstream`);
+        }
+        if (typeof body.model !== 'string' || body.model === '') {
+            if (repairedDescriptions > 0)
+                this.writeBody(context, body);
+            return;
+        }
+        await this.ensureModelsLoaded();
+        if (this.availableModels.length === 0) {
+            // Never block a turn on an unavailable model list; the gateway's own
+            // error is more useful than a guess.
+            if (repairedDescriptions > 0)
+                this.writeBody(context, body);
+            return;
+        }
+        const resolution = resolveCodexDeployment(body.model, this.availableModels, this.resolveFallbackModel());
+        if (resolution.kind === 'exact' || resolution.kind === 'unresolved') {
+            if (repairedDescriptions > 0)
+                this.writeBody(context, body);
+            return;
+        }
+        if (resolution.kind === 'substituted') {
+            logger.info(`[${this.name}] CodeMie has no deployment for "${resolution.requested}"; ` +
+                `using pinned model "${resolution.model}" instead`);
+        }
+        else {
+            logger.debug(`[${this.name}] Resolved "${body.model}" to deployment "${resolution.model}"`);
+        }
+        body.model = resolution.model;
+        this.writeBody(context, body);
+    }
+    /** Serialize the mutated body back onto the request, keeping content-length honest. */
+    writeBody(context, body) {
+        context.requestBody = Buffer.from(JSON.stringify(body), 'utf-8');
+        context.headers['content-length'] = String(context.requestBody.length);
+    }
+    /**
+     * The model to substitute when CodeMie carries nothing matching the request.
+     *
+     * `config.model` is normally absent here: the daemon is spawned before the
+     * connector resolves a model, because discovery itself goes through this
+     * proxy. So the fallback cannot depend on a pinned value — it defaults to the
+     * newest available deployment, which is what `connect` would have pinned.
+     */
+    resolveFallbackModel() {
+        const pinned = this.context.config.model;
+        if (pinned && this.availableModels.includes(pinned))
+            return pinned;
+        return rankDeploymentsByRecency(this.availableModels)[0];
+    }
+    /**
+     * Load the deployment list once, then refresh it on a TTL. Concurrent requests
+     * share a single in-flight fetch so a burst of turns does not fan out into a
+     * burst of list calls.
+     */
+    async ensureModelsLoaded() {
+        const now = Date.now();
+        const fresh = this.availableModels.length > 0 && now - this.loadedAt < MODEL_CACHE_TTL_MS;
+        if (fresh)
+            return;
+        // Negative cache: without this, expired credentials or a 5xx gateway turn
+        // every single request into a fresh listing call, because a failed load
+        // leaves availableModels empty and so never looks "fresh".
+        const backingOff = this.lastAttemptAt !== 0
+            && now - this.lastAttemptAt < MODEL_RETRY_BACKOFF_MS;
+        if (backingOff)
+            return;
+        if (this.inFlight)
+            return this.inFlight;
+        this.inFlight = this.loadModels().finally(() => { this.inFlight = null; });
+        return this.inFlight;
+    }
+    async loadModels() {
+        this.lastAttemptAt = Date.now();
+        const credentials = this.context.credentials;
+        if (!credentials) {
+            logger.debug(`[${this.name}] No credentials available; model names pass through unchanged`);
+            return;
+        }
+        try {
+            const apiUrl = credentials.apiUrl || this.context.config.targetApiUrl;
+            const models = 'cookies' in credentials
+                ? await fetchCodeMieLlmModels(apiUrl, credentials.cookies)
+                : await fetchCodeMieLlmModels(apiUrl, credentials.token);
+            this.availableModels = models
+                .filter((model) => model.enabled !== false)
+                .map((model) => model.deployment_name || model.base_name)
+                .filter((name) => Boolean(name))
+                // Only Codex-servable deployments may be resolved to or substituted.
+                .filter(isCodexServableDeployment);
+            this.loadedAt = Date.now();
+            logger.debug(`[${this.name}] Loaded ${this.availableModels.length} deployments for model resolution`);
+        }
+        catch (error) {
+            // A failed list must not fail the request.
+            logger.debug(`[${this.name}] Could not list deployments; passing model names through: ` +
+                `${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+}
+//# sourceMappingURL=codex-request-normalizer.plugin.js.map

package/dist/providers/plugins/sso/proxy/plugins/codex-request-normalizer.plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-request-normalizer.plugin.js","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/codex-request-normalizer.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,eAAe,GAAG,CAAC,eAAe,CAAC,CAAC;AAE1C,mFAAmF;AACnF,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE1C,wEAAwE;AACxE,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC;;;;;;;;;;;;;;;;;;GAkBG;AACH;;;;;GAKG;AACH,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B,MAAM,UAAU,2BAA2B,CAAC,IAAa;IACvD,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,OAAO,EAAU,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,eAAe,CAAC,IAAa;IACpC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAEnF,MAAM,UAAU,GAAG,IAA+B,CAAC;IACnD,IAAI,OAAO,UAAU,CAAC,WAAW,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC7D,IAAI,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAEvD,MAAM,IAAI,GAAG,OAAO,UAAU,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAChB,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC;IAChC,CAAC;SAAM,CAAC;QACN,OAAO,UAAU,CAAC,WAAW,CAAC;IAChC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,IAAI,CAAC,IAAa,EAAE,KAAa,EAAE,IAAqB;IAC/D,IAAI,KAAK,GAAG,cAAc;QAAE,OAAO,CAAC,CAAC;IACrC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IAExD,4EAA4E;IAC5E,gDAAgD;IAChD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAEf,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,MAAM,CAAS,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,MAAM,MAAM,GAAG,IAA+B,CAAC;IAE/C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,GAAG,KAAK,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,eAAe,CAAC,IAAI,CAAC;oBAAE,QAAQ,EAAE,CAAC;YACxC,CAAC;QACH,CAAC;QACD,4EAA4E;QAC5E,iDAAiD;QACjD,QAAQ,IAAI,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,OAAO,4BAA4B;IACvC,EAAE,GAAG,yCAAyC,CAAC;IAC/C,IAAI,GAAG,0BAA0B,CAAC;IAClC,OAAO,GAAG,OAAO,CAAC;IAClB,QAAQ,GAAG,EAAE,CAAC;IAEd,KAAK,CAAC,iBAAiB,CAAC,OAAsB;QAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QAC7C,IAAI,CAAC,UAAU,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,8BAA8B,UAAU,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,OAAO,IAAI,iCAAiC,CAAC,OAAO,CAAC,CAAC;IACxD,CAAC;CACF;AAED,MAAM,iCAAiC;IAQR;IAP7B,IAAI,GAAG,0BAA0B,CAAC;IAE1B,eAAe,GAAa,EAAE,CAAC;IAC/B,QAAQ,GAAG,CAAC,CAAC;IACb,aAAa,GAAG,CAAC,CAAC;IAClB,QAAQ,GAAyB,IAAI,CAAC;IAE9C,YAA6B,OAAsB;QAAtB,YAAO,GAAP,OAAO,CAAe;IAAG,CAAC;IAEvD,kFAAkF;IAClF,yBAAyB,CAAC,MAAgB;QACxC,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAqB;QACnC,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC3F,OAAO;QACT,CAAC;QAED,IAAI,IAA6B,CAAC;QAClC,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;YACrC,OAAO;QACT,CAAC;QAED,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,oBAAoB,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,KAAK,CACV,IAAI,IAAI,CAAC,IAAI,cAAc,oBAAoB,iDAAiD,CACjG,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;YACxD,IAAI,oBAAoB,GAAG,CAAC;gBAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtC,qEAAqE;YACrE,qCAAqC;YACrC,IAAI,oBAAoB,GAAG,CAAC;gBAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,sBAAsB,CACvC,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,oBAAoB,EAAE,CAC5B,CAAC;QAEF,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,IAAI,UAAU,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACpE,IAAI,oBAAoB,GAAG,CAAC;gBAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QAED,IAAI,UAAU,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACtC,MAAM,CAAC,IAAI,CACT,IAAI,IAAI,CAAC,IAAI,oCAAoC,UAAU,CAAC,SAAS,KAAK;gBAC1E,uBAAuB,UAAU,CAAC,KAAK,WAAW,CACnD,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,eAAe,IAAI,CAAC,KAAK,oBAAoB,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC;QAC9F,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,uFAAuF;IAC/E,SAAS,CAAC,OAAqB,EAAE,IAA6B;QACpE,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QACjE,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACzE,CAAC;IAED;;;;;;;OAOG;IACK,oBAAoB;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QACzC,IAAI,MAAM,IAAI,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;QACnE,OAAO,wBAAwB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,kBAAkB;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,GAAG,IAAI,CAAC,QAAQ,GAAG,kBAAkB,CAAC;QAC1F,IAAI,KAAK;YAAE,OAAO;QAElB,0EAA0E;QAC1E,wEAAwE;QACxE,2DAA2D;QAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,KAAK,CAAC;eACtC,GAAG,GAAG,IAAI,CAAC,aAAa,GAAG,sBAAsB,CAAC;QACvD,IAAI,UAAU;YAAE,OAAO;QAEvB,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QAExC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEhC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;QAC7C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,gEAAgE,CAAC,CAAC;YAC5F,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;YACtE,MAAM,MAAM,GAAG,SAAS,IAAI,WAAW;gBACrC,CAAC,CAAC,MAAM,qBAAqB,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC;gBAC1D,CAAC,CAAC,MAAM,qBAAqB,CAAC,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;YAE3D,IAAI,CAAC,eAAe,GAAG,MAAM;iBAC1B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC;iBAC1C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,SAAS,CAAC;iBACxD,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBAChD,qEAAqE;iBACpE,MAAM,CAAC,yBAAyB,CAAC,CAAC;YACrC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAE3B,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,YAAY,IAAI,CAAC,eAAe,CAAC,MAAM,mCAAmC,CAAC,CAAC;QACxG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,2CAA2C;YAC3C,MAAM,CAAC,KAAK,CACV,IAAI,IAAI,CAAC,IAAI,6DAA6D;gBAC1E,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC5D,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/providers/plugins/sso/proxy/plugins/index.d.ts

@@ -13,6 +13,7 @@ import { HeaderInjectionPlugin } from './header-injection.plugin.js';
 import { RequestSanitizerPlugin } from './request-sanitizer.plugin.js';
 import { ClaudeRequestNormalizerPlugin } from './claude-request-normalizer.plugin.js';
 import { KimiRequestNormalizerPlugin } from './kimi-request-normalizer.plugin.js';
+import { CodexRequestNormalizerPlugin } from './codex-request-normalizer.plugin.js';
 import { CodexEncryptedContentSanitizerPlugin } from './codex-encrypted-content-sanitizer.plugin.js';
 import { CopilotEncryptedContentSanitizerPlugin } from './copilot-encrypted-content-sanitizer.plugin.js';
 import { VsCodeRequestNormalizerPlugin } from './vscode-request-normalizer.plugin.js';
@@ -22,7 +23,7 @@ import { LoggingPlugin } from './logging.plugin.js';
  * Called at app startup
  */
 export declare function registerCorePlugins(): void;
-export { MCPAuthPlugin, EndpointBlockerPlugin, GatewayKeyPlugin, SSOAuthPlugin, JWTAuthPlugin, HeaderInjectionPlugin, RequestSanitizerPlugin, ClaudeRequestNormalizerPlugin, KimiRequestNormalizerPlugin, CodexEncryptedContentSanitizerPlugin, CopilotEncryptedContentSanitizerPlugin, VsCodeRequestNormalizerPlugin, LoggingPlugin, };
+export { MCPAuthPlugin, EndpointBlockerPlugin, GatewayKeyPlugin, SSOAuthPlugin, JWTAuthPlugin, HeaderInjectionPlugin, RequestSanitizerPlugin, ClaudeRequestNormalizerPlugin, KimiRequestNormalizerPlugin, CodexRequestNormalizerPlugin, CodexEncryptedContentSanitizerPlugin, CopilotEncryptedContentSanitizerPlugin, VsCodeRequestNormalizerPlugin, LoggingPlugin, };
 export { SSOSessionSyncPlugin } from './sso.session-sync.plugin.js';
 export { getPluginRegistry, resetPluginRegistry } from './registry.js';
 export * from './types.js';

package/dist/providers/plugins/sso/proxy/plugins/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,oCAAoC,EAAE,MAAM,+CAA+C,CAAC;AACrG,OAAO,EAAE,sCAAsC,EAAE,MAAM,iDAAiD,CAAC;AACzG,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAkB1C;AAMD,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACtB,6BAA6B,EAC7B,2BAA2B,EAC3B,oCAAoC,EACpC,sCAAsC,EACtC,6BAA6B,EAC7B,aAAa,GACd,CAAC;AACF,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACvE,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,oCAAoC,EAAE,MAAM,+CAA+C,CAAC;AACrG,OAAO,EAAE,sCAAsC,EAAE,MAAM,iDAAiD,CAAC;AACzG,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAmB1C;AAMD,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACtB,6BAA6B,EAC7B,2BAA2B,EAC3B,4BAA4B,EAC5B,oCAAoC,EACpC,sCAAsC,EACtC,6BAA6B,EAC7B,aAAa,GACd,CAAC;AACF,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACvE,cAAc,YAAY,CAAC"}

package/dist/providers/plugins/sso/proxy/plugins/index.js

@@ -14,6 +14,7 @@ import { HeaderInjectionPlugin } from './header-injection.plugin.js';
 import { RequestSanitizerPlugin } from './request-sanitizer.plugin.js';
 import { ClaudeRequestNormalizerPlugin } from './claude-request-normalizer.plugin.js';
 import { KimiRequestNormalizerPlugin } from './kimi-request-normalizer.plugin.js';
+import { CodexRequestNormalizerPlugin } from './codex-request-normalizer.plugin.js';
 import { CodexEncryptedContentSanitizerPlugin } from './codex-encrypted-content-sanitizer.plugin.js';
 import { CopilotEncryptedContentSanitizerPlugin } from './copilot-encrypted-content-sanitizer.plugin.js';
 import { VsCodeRequestNormalizerPlugin } from './vscode-request-normalizer.plugin.js';
@@ -33,6 +34,7 @@ export function registerCorePlugins() {
     registry.register(new JWTAuthPlugin());
     registry.register(new ClaudeRequestNormalizerPlugin()); // Priority 14 - normalizes thinking params for claude models
     registry.register(new KimiRequestNormalizerPlugin()); // Priority 14 - caps Kimi output token requests for upstream limits
+    registry.register(new CodexRequestNormalizerPlugin()); // Priority 14 - maps the Codex app's undated model names onto dated CodeMie deployments
     registry.register(new RequestSanitizerPlugin()); // Priority 15 - strips unsupported reasoning params
     registry.register(new CodexEncryptedContentSanitizerPlugin()); // Priority 16 - forwards Responses reasoning state; strips it only after upstream rejects a replay
     registry.register(new CopilotEncryptedContentSanitizerPlugin()); // Priority 16 - retries Copilot once after encrypted reasoning replay rejection
@@ -44,7 +46,7 @@ export function registerCorePlugins() {
 // Auto-register on import
 registerCorePlugins();
 // Re-export for convenience
-export { MCPAuthPlugin, EndpointBlockerPlugin, GatewayKeyPlugin, SSOAuthPlugin, JWTAuthPlugin, HeaderInjectionPlugin, RequestSanitizerPlugin, ClaudeRequestNormalizerPlugin, KimiRequestNormalizerPlugin, CodexEncryptedContentSanitizerPlugin, CopilotEncryptedContentSanitizerPlugin, VsCodeRequestNormalizerPlugin, LoggingPlugin, };
+export { MCPAuthPlugin, EndpointBlockerPlugin, GatewayKeyPlugin, SSOAuthPlugin, JWTAuthPlugin, HeaderInjectionPlugin, RequestSanitizerPlugin, ClaudeRequestNormalizerPlugin, KimiRequestNormalizerPlugin, CodexRequestNormalizerPlugin, CodexEncryptedContentSanitizerPlugin, CopilotEncryptedContentSanitizerPlugin, VsCodeRequestNormalizerPlugin, LoggingPlugin, };
 export { SSOSessionSyncPlugin } from './sso.session-sync.plugin.js';
 export { getPluginRegistry, resetPluginRegistry } from './registry.js';
 export * from './types.js';

package/dist/providers/plugins/sso/proxy/plugins/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,oCAAoC,EAAE,MAAM,+CAA+C,CAAC;AACrG,OAAO,EAAE,sCAAsC,EAAE,MAAM,iDAAiD,CAAC;AACzG,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEpE;;;GAGG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IAErC,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC,sCAAsC;IAC9E,QAAQ,CAAC,QAAQ,CAAC,IAAI,qBAAqB,EAAE,CAAC,CAAC,CAAC,+CAA+C;IAC/F,QAAQ,CAAC,QAAQ,CAAC,IAAI,gBAAgB,EAAE,CAAC,CAAC,CAAC,2EAA2E;IACtH,QAAQ,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,IAAI,6BAA6B,EAAE,CAAC,CAAC,CAAC,6DAA6D;IACrH,QAAQ,CAAC,QAAQ,CAAC,IAAI,2BAA2B,EAAE,CAAC,CAAC,CAAC,oEAAoE;IAC1H,QAAQ,CAAC,QAAQ,CAAC,IAAI,sBAAsB,EAAE,CAAC,CAAC,CAAC,oDAAoD;IACrG,QAAQ,CAAC,QAAQ,CAAC,IAAI,oCAAoC,EAAE,CAAC,CAAC,CAAC,mGAAmG;IAClK,QAAQ,CAAC,QAAQ,CAAC,IAAI,sCAAsC,EAAE,CAAC,CAAC,CAAC,gFAAgF;IACjJ,QAAQ,CAAC,QAAQ,CAAC,IAAI,6BAA6B,EAAE,CAAC,CAAC,CAAC,oDAAoD;IAC5G,QAAQ,CAAC,QAAQ,CAAC,IAAI,qBAAqB,EAAE,CAAC,CAAC;IAC/C,QAAQ,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC,mDAAmD;IAC3F,QAAQ,CAAC,QAAQ,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC,CAAC,wDAAwD;AACzG,CAAC;AAED,0BAA0B;AAC1B,mBAAmB,EAAE,CAAC;AAEtB,4BAA4B;AAC5B,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACtB,6BAA6B,EAC7B,2BAA2B,EAC3B,oCAAoC,EACpC,sCAAsC,EACtC,6BAA6B,EAC7B,aAAa,GACd,CAAC;AACF,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACvE,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,oCAAoC,EAAE,MAAM,+CAA+C,CAAC;AACrG,OAAO,EAAE,sCAAsC,EAAE,MAAM,iDAAiD,CAAC;AACzG,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEpE;;;GAGG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IAErC,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC,sCAAsC;IAC9E,QAAQ,CAAC,QAAQ,CAAC,IAAI,qBAAqB,EAAE,CAAC,CAAC,CAAC,+CAA+C;IAC/F,QAAQ,CAAC,QAAQ,CAAC,IAAI,gBAAgB,EAAE,CAAC,CAAC,CAAC,2EAA2E;IACtH,QAAQ,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,IAAI,6BAA6B,EAAE,CAAC,CAAC,CAAC,6DAA6D;IACrH,QAAQ,CAAC,QAAQ,CAAC,IAAI,2BAA2B,EAAE,CAAC,CAAC,CAAC,oEAAoE;IAC1H,QAAQ,CAAC,QAAQ,CAAC,IAAI,4BAA4B,EAAE,CAAC,CAAC,CAAC,wFAAwF;IAC/I,QAAQ,CAAC,QAAQ,CAAC,IAAI,sBAAsB,EAAE,CAAC,CAAC,CAAC,oDAAoD;IACrG,QAAQ,CAAC,QAAQ,CAAC,IAAI,oCAAoC,EAAE,CAAC,CAAC,CAAC,mGAAmG;IAClK,QAAQ,CAAC,QAAQ,CAAC,IAAI,sCAAsC,EAAE,CAAC,CAAC,CAAC,gFAAgF;IACjJ,QAAQ,CAAC,QAAQ,CAAC,IAAI,6BAA6B,EAAE,CAAC,CAAC,CAAC,oDAAoD;IAC5G,QAAQ,CAAC,QAAQ,CAAC,IAAI,qBAAqB,EAAE,CAAC,CAAC;IAC/C,QAAQ,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC,mDAAmD;IAC3F,QAAQ,CAAC,QAAQ,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC,CAAC,wDAAwD;AACzG,CAAC;AAED,0BAA0B;AAC1B,mBAAmB,EAAE,CAAC;AAEtB,4BAA4B;AAC5B,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACtB,6BAA6B,EAC7B,2BAA2B,EAC3B,4BAA4B,EAC5B,oCAAoC,EACpC,sCAAsC,EACtC,6BAA6B,EAC7B,aAAa,GACd,CAAC;AACF,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACvE,cAAc,YAAY,CAAC"}

package/dist/providers/plugins/sso/session/processors/metrics/metrics-api-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"metrics-api-client.d.ts","sourceRoot":"","sources":["../../../../../../../src/providers/plugins/sso/session/processors/metrics/metrics-api-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EACV,aAAa,EAEb,mBAAmB,EAGpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gDAAgD,CAAC;AAC9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AA4NtG;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,aAAa,CAAC;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;GAGG;AACH,qBAAa,aAAa;IACxB;;;;;;OAMG;IACH,MAAM,CAAC,QAAQ,CAAC,oBAAoB,+BAA+B;IACnE,MAAM,CAAC,QAAQ,CAAC,uBAAuB,kCAAkC;IAEzE,OAAO,CAAC,MAAM,CAAmB;IACjC,OAAO,CAAC,MAAM,CAAU;IACxB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,UAAU,CAAS;gBAEf,OAAO,EAAE,oBAAoB;IAiBzC;;;;;;;;;;OAUG;IACG,gBAAgB,CACpB,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,GAAG,WAAW,GAAG,kBAAkB,GAAG,YAAY,CAAC,GAAG;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,EACjJ,gBAAgB,EAAE,MAAM,EACxB,MAAM,GAAE,kBAA0C,EAClD,KAAK,CAAC,EAAE,YAAY,EACpB,UAAU,CAAC,EAAE,gBAAgB,EAC7B,iBAAiB,CAAC,EAAE,qBAAqB,GACxC,OAAO,CAAC,mBAAmB,CAAC;IAyH/B;;;;;;;;;;OAUG;IACG,cAAc,CAClB,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,GAAG,WAAW,GAAG,kBAAkB,GAAG,YAAY,CAAC,GAAG;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,EACjJ,gBAAgB,EAAE,MAAM,EACxB,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,YAAY,EACpB,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,mBAAmB,CAAC;IAmF/B;;;;;OAKG;IACG,iBAAiB,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,mBAAmB,CAAC;CA6B7E"}
+{"version":3,"file":"metrics-api-client.d.ts","sourceRoot":"","sources":["../../../../../../../src/providers/plugins/sso/session/processors/metrics/metrics-api-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EACV,aAAa,EAEb,mBAAmB,EAGpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gDAAgD,CAAC;AAC9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAgPtG;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,aAAa,CAAC;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;GAGG;AACH,qBAAa,aAAa;IACxB;;;;;;OAMG;IACH,MAAM,CAAC,QAAQ,CAAC,oBAAoB,+BAA+B;IACnE,MAAM,CAAC,QAAQ,CAAC,uBAAuB,kCAAkC;IAEzE,OAAO,CAAC,MAAM,CAAmB;IACjC,OAAO,CAAC,MAAM,CAAU;IACxB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,UAAU,CAAS;gBAEf,OAAO,EAAE,oBAAoB;IAiBzC;;;;;;;;;;OAUG;IACG,gBAAgB,CACpB,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,GAAG,WAAW,GAAG,kBAAkB,GAAG,YAAY,CAAC,GAAG;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,EACjJ,gBAAgB,EAAE,MAAM,EACxB,MAAM,GAAE,kBAA0C,EAClD,KAAK,CAAC,EAAE,YAAY,EACpB,UAAU,CAAC,EAAE,gBAAgB,EAC7B,iBAAiB,CAAC,EAAE,qBAAqB,GACxC,OAAO,CAAC,mBAAmB,CAAC;IAyH/B;;;;;;;;;;OAUG;IACG,cAAc,CAClB,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,GAAG,WAAW,GAAG,kBAAkB,GAAG,YAAY,CAAC,GAAG;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,EACjJ,gBAAgB,EAAE,MAAM,EACxB,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,YAAY,EACpB,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,mBAAmB,CAAC;IAmF/B;;;;;OAKG;IACG,iBAAiB,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,mBAAmB,CAAC;CA6B7E"}

package/dist/providers/plugins/sso/session/processors/metrics/metrics-api-client.js

@@ -17,6 +17,7 @@
 import { logger } from '../../../../../../utils/logger.js';
 import { detectGitBranch } from '../../../../../../utils/processes.js';
 import { extractRepository } from '../../../../../../utils/paths.js';
+import { markAnalyticsAuthInvalid, clearAnalyticsAuthStatus } from '../../../../../../utils/analytics-auth-status.js';
 import { CODEMIE_ENDPOINTS } from '../../../sso.http-client.js';
 /**
  * Low-level HTTP client for sending metrics to CodeMie API
@@ -49,13 +50,21 @@ class MetricsApiClient {
                     logger.debug(`[MetricsApiClient] Retry attempt ${attempt} after ${delay}ms`);
                     await this.sleep(delay);
                 }
-                return await this.sendRequest(metric);
+                const response = await this.sendRequest(metric);
+                // Server accepted our credentials — clear any stale invalid-auth marker
+                await clearAnalyticsAuthStatus();
+                return response;
             }
             catch (error) {
                 lastError = error;
                 const errorMessage = error instanceof Error ? error.message : String(error);
                 const errorName = error instanceof Error ? error.name : 'Unknown';
                 const statusCode = error.statusCode;
+                // Record credential rejections (401/403 or HTML SSO login page) so the
+                // hook auth gate can prompt the user to re-authenticate
+                if (error.isAuthFailure) {
+                    await markAnalyticsAuthInvalid(statusCode ? `HTTP ${statusCode}: ${errorMessage}` : errorMessage, this.config.baseUrl);
+                }
                 if (!this.isRetryable(error)) {
                     logger.error(`[MetricsApiClient] Non-retryable error [${errorName}]: ${errorMessage}${statusCode ? ` (HTTP ${statusCode})` : ''}`);
                     throw error;
@@ -143,12 +152,14 @@ class MetricsApiClient {
                     const error = new Error(errorMessage);
                     error.statusCode = response.status;
                     error.response = data;
+                    error.isAuthFailure = response.status === 401 || response.status === 403;
                     throw error;
                 }
                 const errorMessage = 'message' in data ? data.message : response.statusText;
                 const error = new Error(`API returned ${response.status}: ${errorMessage}`);
                 error.statusCode = response.status;
                 error.response = data;
+                error.isAuthFailure = response.status === 401 || response.status === 403;
                 throw error;
             }
             const successData = data;
@@ -197,6 +208,9 @@ function parseMetricsResponse(responseText, statusCode, contentType) {
         const error = new Error(`API returned non-JSON metrics response (HTTP ${statusCode}, content-type=${contentType || 'unknown'}): ${excerpt}`);
         error.statusCode = statusCode;
         error.responseText = excerpt;
+        // An HTML page instead of JSON means the request was redirected to the SSO
+        // login page (e.g. Keycloak answers HTTP 200 + login HTML for expired cookies)
+        error.isAuthFailure = Boolean(contentType?.includes('text/html'));
         throw error;
     }
 }