@goodandready/dsh-subscriptions 0.6.72 → 0.6.83

package/lib/vault-sync.js

@@ -0,0 +1,414 @@
+// #562: Automated Encrypted Vault Sync via WebDAV, S3, or Private Gist
+// Supports periodic or on-change backup and synchronization of credentials.
+
+import { createHmac, createHash } from 'node:crypto'
+import { exportVault, importVault } from './vault.js'
+import { normalizeSlots } from './accounts.js'
+import { Config, plainConfig, revisionOf } from './config-schema.js'
+import { validateCredentialBlob } from './blob.js'
+
+let syncStatus = {
+  enabled: false,
+  backend: 'webdav',
+  lastPushAt: null,
+  lastPullAt: null,
+  lastPushStatus: 'idle',
+  lastPullStatus: 'idle',
+  lastExportedAt: null,
+  lastError: null,
+}
+
+export function getVaultSyncStatus() {
+  return { ...syncStatus }
+}
+
+export function resetVaultSyncStatus() {
+  syncStatus = {
+    enabled: false,
+    backend: 'webdav',
+    lastPushAt: null,
+    lastPullAt: null,
+    lastPushStatus: 'idle',
+    lastPullStatus: 'idle',
+    lastExportedAt: null,
+    lastError: null,
+  }
+}
+
+// --- Driver: WebDAV ---
+
+export async function pushToWebdav({ url, username, password, encryptedData, fetchFn = fetch }) {
+  if (!url) throw new Error('WebDAV URL is required')
+  const headers = {
+    'Content-Type': 'text/plain; charset=utf-8',
+  }
+  if (username || password) {
+    headers['Authorization'] = 'Basic ' + Buffer.from(`${username || ''}:${password || ''}`).toString('base64')
+  }
+  const res = await fetchFn(url, {
+    method: 'PUT',
+    headers,
+    body: encryptedData,
+  })
+  if (!res.ok && res.status !== 201 && res.status !== 204) {
+    throw new Error(`WebDAV push failed: HTTP ${res.status} ${res.statusText}`)
+  }
+  return { ok: true, status: res.status }
+}
+
+export async function pullFromWebdav({ url, username, password, fetchFn = fetch }) {
+  if (!url) throw new Error('WebDAV URL is required')
+  const headers = {}
+  if (username || password) {
+    headers['Authorization'] = 'Basic ' + Buffer.from(`${username || ''}:${password || ''}`).toString('base64')
+  }
+  const res = await fetchFn(url, {
+    method: 'GET',
+    headers,
+  })
+  if (!res.ok) {
+    throw new Error(`WebDAV pull failed: HTTP ${res.status} ${res.statusText}`)
+  }
+  return res.text()
+}
+
+// --- Driver: Gist (GitHub / Gitea) ---
+
+export async function pushToGist({ baseUrl = 'https://api.github.com', gistId, token, encryptedData, fetchFn = fetch }) {
+  if (!token) throw new Error('Gist access token is required')
+  const cleanBase = baseUrl.replace(/\/+$/, '')
+  const headers = {
+    'Authorization': `token ${token}`,
+    'Accept': 'application/vnd.github.v3+json, application/json',
+    'Content-Type': 'application/json',
+    'User-Agent': 'dsh-subscriptions-vault-sync',
+  }
+
+  const files = {
+    'dsh-subscriptions-vault.enc': { content: encryptedData },
+  }
+
+  if (gistId) {
+    const res = await fetchFn(`${cleanBase}/gists/${gistId}`, {
+      method: 'PATCH',
+      headers,
+      body: JSON.stringify({
+        description: 'dsh-subscriptions encrypted vault',
+        files,
+      }),
+    })
+    if (!res.ok) throw new Error(`Gist update failed: HTTP ${res.status} ${res.statusText}`)
+    const json = await res.json()
+    return { ok: true, gistId: json.id || gistId }
+  }
+
+  // Create new secret gist
+  const res = await fetchFn(`${cleanBase}/gists`, {
+    method: 'POST',
+    headers,
+    body: JSON.stringify({
+      description: 'dsh-subscriptions encrypted vault',
+      public: false,
+      files,
+    }),
+  })
+  if (!res.ok) throw new Error(`Gist creation failed: HTTP ${res.status} ${res.statusText}`)
+  const json = await res.json()
+  return { ok: true, gistId: json.id }
+}
+
+export async function pullFromGist({ baseUrl = 'https://api.github.com', gistId, token, fetchFn = fetch }) {
+  if (!gistId) throw new Error('Gist ID is required')
+  const cleanBase = baseUrl.replace(/\/+$/, '')
+  const headers = {
+    'Accept': 'application/vnd.github.v3+json, application/json',
+    'User-Agent': 'dsh-subscriptions-vault-sync',
+  }
+  if (token) headers['Authorization'] = `token ${token}`
+
+  const res = await fetchFn(`${cleanBase}/gists/${gistId}`, {
+    method: 'GET',
+    headers,
+  })
+  if (!res.ok) throw new Error(`Gist pull failed: HTTP ${res.status} ${res.statusText}`)
+  const json = await res.json()
+  const file = json.files && json.files['dsh-subscriptions-vault.enc']
+  if (!file || !file.content) {
+    throw new Error('dsh-subscriptions-vault.enc not found in Gist')
+  }
+  return file.content
+}
+
+// --- Driver: S3 (SigV4) ---
+
+function hmac(key, str) {
+  return createHmac('sha256', key).update(str, 'utf8').digest()
+}
+
+function sha256Hex(data) {
+  return createHash('sha256').update(data, 'utf8').digest('hex')
+}
+
+export function buildS3SigV4Headers({ method, url, region = 'us-east-1', accessKey, secretKey, body = '', date = new Date() }) {
+  const parsed = new URL(url)
+  const host = parsed.host
+  const path = parsed.pathname || '/'
+
+  const amzDate = date.toISOString().replace(/[:-]|\.\d{3}/g, '')
+  const dateStamp = amzDate.slice(0, 8)
+
+  const payloadHash = sha256Hex(body)
+  const canonicalHeaders = `host:${host}\nx-amz-content-sha256:${payloadHash}\nx-amz-date:${amzDate}\n`
+  const signedHeaders = 'host;x-amz-content-sha256;x-amz-date'
+
+  const canonicalReq = [
+    method.toUpperCase(),
+    path,
+    parsed.search.slice(1),
+    canonicalHeaders,
+    signedHeaders,
+    payloadHash,
+  ].join('\n')
+
+  const credentialScope = `${dateStamp}/${region}/s3/aws4_request`
+  const stringToSign = [
+    'AWS4-HMAC-SHA256',
+    amzDate,
+    credentialScope,
+    sha256Hex(canonicalReq),
+  ].join('\n')
+
+  const kDate = hmac('AWS4' + secretKey, dateStamp)
+  const kRegion = hmac(kDate, region)
+  const kService = hmac(kRegion, 's3')
+  const kSigning = hmac(kService, 'aws4_request')
+  const signature = createHmac('sha256', kSigning).update(stringToSign, 'utf8').digest('hex')
+
+  const authHeader = `AWS4-HMAC-SHA256 Credential=${accessKey}/${credentialScope}, SignedHeaders=${signedHeaders}, Signature=${signature}`
+
+  return {
+    'host': host,
+    'x-amz-date': amzDate,
+    'x-amz-content-sha256': payloadHash,
+    'Authorization': authHeader,
+  }
+}
+
+export async function pushToS3({ endpoint, bucket, key = 'dsh-subscriptions-vault.enc', region = 'us-east-1', accessKey, secretKey, encryptedData, fetchFn = fetch }) {
+  if (!endpoint || !accessKey || !secretKey) throw new Error('S3 endpoint, access key, and secret key are required')
+  let cleanEndpoint = endpoint.replace(/\/+$/, '')
+  let targetUrl = bucket ? `${cleanEndpoint}/${bucket}/${key.replace(/^\/+/, '')}` : `${cleanEndpoint}/${key.replace(/^\/+/, '')}`
+
+  const headers = buildS3SigV4Headers({
+    method: 'PUT',
+    url: targetUrl,
+    region,
+    accessKey,
+    secretKey,
+    body: encryptedData,
+  })
+  headers['Content-Type'] = 'text/plain; charset=utf-8'
+
+  const res = await fetchFn(targetUrl, {
+    method: 'PUT',
+    headers,
+    body: encryptedData,
+  })
+  if (!res.ok && res.status !== 200 && res.status !== 204) {
+    throw new Error(`S3 push failed: HTTP ${res.status} ${res.statusText}`)
+  }
+  return { ok: true, status: res.status }
+}
+
+export async function pullFromS3({ endpoint, bucket, key = 'dsh-subscriptions-vault.enc', region = 'us-east-1', accessKey, secretKey, fetchFn = fetch }) {
+  if (!endpoint || !accessKey || !secretKey) throw new Error('S3 endpoint, access key, and secret key are required')
+  let cleanEndpoint = endpoint.replace(/\/+$/, '')
+  let targetUrl = bucket ? `${cleanEndpoint}/${bucket}/${key.replace(/^\/+/, '')}` : `${cleanEndpoint}/${key.replace(/^\/+/, '')}`
+
+  const headers = buildS3SigV4Headers({
+    method: 'GET',
+    url: targetUrl,
+    region,
+    accessKey,
+    secretKey,
+    body: '',
+  })
+
+  const res = await fetchFn(targetUrl, {
+    method: 'GET',
+    headers,
+  })
+  if (!res.ok) {
+    throw new Error(`S3 pull failed: HTTP ${res.status} ${res.statusText}`)
+  }
+  return res.text()
+}
+
+// --- Sync Coordination: Push & Pull ---
+
+export async function syncVaultPush({ live, store, fetchFn = fetch }) {
+  const cfg = live && typeof live === 'function' ? live() : (live || {})
+  const passphrase = String(cfg.vaultSyncPassphrase || '').trim()
+  if (!passphrase) {
+    throw new Error('vaultSyncPassphrase is required to sync vault')
+  }
+
+  syncStatus.enabled = Boolean(cfg.vaultSyncEnabled)
+  syncStatus.backend = cfg.vaultSyncBackend || 'webdav'
+  syncStatus.lastPushStatus = 'running'
+
+  try {
+    const slots = cfg.slots || []
+    const blobs = {}
+    for (const slot of normalizeSlots(slots)) {
+      try {
+        const blob = await store.loadBlob(slot.ref)
+        if (blob) blobs[slot.ref] = blob
+      } catch { /* ignore */ }
+    }
+
+    const { vault, slotCount, blobCount } = exportVault({ slots, blobs }, passphrase)
+    const backend = cfg.vaultSyncBackend || 'webdav'
+
+    if (backend === 'webdav') {
+      await pushToWebdav({
+        url: cfg.vaultSyncWebdavUrl,
+        username: cfg.vaultSyncWebdavUsername,
+        password: cfg.vaultSyncWebdavPassword,
+        encryptedData: vault,
+        fetchFn,
+      })
+    } else if (backend === 'gist') {
+      const res = await pushToGist({
+        baseUrl: cfg.vaultSyncGistBaseUrl || 'https://api.github.com',
+        gistId: cfg.vaultSyncGistId,
+        token: cfg.vaultSyncGistToken,
+        encryptedData: vault,
+        fetchFn,
+      })
+      if (res.gistId && !cfg.vaultSyncGistId) {
+        syncStatus.lastGistId = res.gistId
+      }
+    } else if (backend === 's3') {
+      await pushToS3({
+        endpoint: cfg.vaultSyncS3Endpoint,
+        bucket: cfg.vaultSyncS3Bucket,
+        key: cfg.vaultSyncS3Key || 'dsh-subscriptions-vault.enc',
+        region: cfg.vaultSyncS3Region || 'us-east-1',
+        accessKey: cfg.vaultSyncS3AccessKey,
+        secretKey: cfg.vaultSyncS3SecretKey,
+        encryptedData: vault,
+        fetchFn,
+      })
+    } else {
+      throw new Error(`unsupported vault sync backend: ${backend}`)
+    }
+
+    syncStatus.lastPushAt = new Date().toISOString()
+    syncStatus.lastPushStatus = 'ok'
+    syncStatus.lastError = null
+
+    return {
+      ok: true,
+      backend,
+      slotCount,
+      blobCount,
+      timestamp: syncStatus.lastPushAt,
+    }
+  } catch (err) {
+    syncStatus.lastPushStatus = 'error'
+    syncStatus.lastError = String(err && err.message || err)
+    throw err
+  }
+}
+
+export async function syncVaultPull({ live, store, settingsApi, syncAdapter, refreshModels, fetchFn = fetch }) {
+  const cfg = live && typeof live === 'function' ? live() : (live || {})
+  const passphrase = String(cfg.vaultSyncPassphrase || '').trim()
+  if (!passphrase) {
+    throw new Error('vaultSyncPassphrase is required to sync vault')
+  }
+
+  syncStatus.enabled = Boolean(cfg.vaultSyncEnabled)
+  syncStatus.backend = cfg.vaultSyncBackend || 'webdav'
+  syncStatus.lastPullStatus = 'running'
+
+  try {
+    const backend = cfg.vaultSyncBackend || 'webdav'
+    let encryptedData = ''
+
+    if (backend === 'webdav') {
+      encryptedData = await pullFromWebdav({
+        url: cfg.vaultSyncWebdavUrl,
+        username: cfg.vaultSyncWebdavUsername,
+        password: cfg.vaultSyncWebdavPassword,
+        fetchFn,
+      })
+    } else if (backend === 'gist') {
+      encryptedData = await pullFromGist({
+        baseUrl: cfg.vaultSyncGistBaseUrl || 'https://api.github.com',
+        gistId: cfg.vaultSyncGistId,
+        token: cfg.vaultSyncGistToken,
+        fetchFn,
+      })
+    } else if (backend === 's3') {
+      encryptedData = await pullFromS3({
+        endpoint: cfg.vaultSyncS3Endpoint,
+        bucket: cfg.vaultSyncS3Bucket,
+        key: cfg.vaultSyncS3Key || 'dsh-subscriptions-vault.enc',
+        region: cfg.vaultSyncS3Region || 'us-east-1',
+        accessKey: cfg.vaultSyncS3AccessKey,
+        secretKey: cfg.vaultSyncS3SecretKey,
+        fetchFn,
+      })
+    } else {
+      throw new Error(`unsupported vault sync backend: ${backend}`)
+    }
+
+    const result = importVault(encryptedData, passphrase)
+
+    // Merge slots into live configuration
+    if (result.slots.length && settingsApi) {
+      const revision = revisionOf(settingsApi)
+      const curSlots = Array.isArray(cfg.slots) ? cfg.slots.slice() : []
+      for (const s of result.slots) {
+        const idx = curSlots.findIndex((c) => c.provider === s.provider && Number(c.index) === Number(s.index))
+        if (idx >= 0) {
+          curSlots[idx] = { ...curSlots[idx], ...s }
+        } else {
+          curSlots.push(s)
+        }
+      }
+      const parsed = plainConfig(Config({ ...cfg, slots: curSlots }))
+      await settingsApi.replace(parsed, revision)
+    }
+
+    // Save blobs into store
+    let blobCount = 0
+    for (const [ref, blob] of Object.entries(result.blobs)) {
+      await store.saveBlob(ref, validateCredentialBlob(blob))
+      blobCount++
+    }
+
+    if (typeof syncAdapter === 'function') await syncAdapter()
+    if (typeof refreshModels === 'function') refreshModels().catch(() => {})
+
+    syncStatus.lastPullAt = new Date().toISOString()
+    syncStatus.lastExportedAt = result.exportedAt
+    syncStatus.lastPullStatus = 'ok'
+    syncStatus.lastError = null
+
+    return {
+      ok: true,
+      backend,
+      slotCount: result.slots.length,
+      blobCount,
+      exportedAt: result.exportedAt,
+      timestamp: syncStatus.lastPullAt,
+    }
+  } catch (err) {
+    syncStatus.lastPullStatus = 'error'
+    syncStatus.lastError = String(err && err.message || err)
+    throw err
+  }
+}

package/lib/vault.js

@@ -17,7 +17,7 @@ export function exportVault({ slots = [], blobs = {}, exportedBy = 'dsh-subscrip
 
   const payload = {
     format: VAULT_FORMAT,
-    version: '0.6.18',
+    version: '0.6.77',
     exportedAt: new Date().toISOString(),
     exportedBy,
     slots: Array.isArray(slots) ? slots : [],

package/lib/vendor-factory.js

@@ -111,14 +111,14 @@ export function createVendorFromProfile(profile) {
       return null
     },
     check: undefined,
-    async* streamOnce({ blob, options, fetchImpl, headers, config, signal }) {
+    async* streamOnce({ blob, options, fetchImpl, headers, signal }) {
       const body = codexResponsesBody(options, "")
       if (!body.instructions) delete body.instructions
       const res = await fetchWithTimeout(fetchImpl || fetch, `${base}/responses`, {
         method: "POST",
         headers: {
           ...headers,
-          ...identityHeaders(blob, config),
+          ...identityHeaders(blob),
           "Content-Type": "application/json",
           Accept: "text/event-stream",
         },
@@ -139,12 +139,16 @@ export function validateProfile(raw) {
   }
   if (!/^[a-z][a-z0-9_]*$/.test(p.id)) throw new Error(`customVendors: id "${p.id}" must match [a-z][a-z0-9_]*`)
   if (p.tokenStyle && !["form", "json"].includes(p.tokenStyle)) throw new Error(`customVendors[${p.id}]: tokenStyle must be form|json`)
+  const localHostnames = new Set(["localhost", "127.0.0.1", "::1", "[::1]"])
   for (const key of ["authUrl", "tokenUrl", "baseUrl"]) {
     try {
       const u = new URL(p[key])
       if (u.protocol !== "https:" && u.protocol !== "http:") {
         throw new Error("protocol must be http: or https:")
       }
+      if (u.protocol === "http:" && !localHostnames.has(u.hostname)) {
+        throw new Error("http is allowed only for localhost")
+      }
     } catch (e) {
       throw new Error(`customVendors[${p.id}]: field ${key} must be a valid http(s) URL (${e.message || e})`)
     }

package/lib/vendors/antigravity.js

@@ -3,7 +3,7 @@ import { buildAuthorizeUrl } from '../oauth.js'
 import { googleContents } from '../messages.js'
 import { formTokenRequest, googleStream, throwHttpError, tokenBlobFromOAuth } from '../wire.js'
 import { fetchWithTimeout } from '../http.js'
-import { emailFromToken } from '../jwt.js'
+import { emailFromToken, avatarFromToken, scopesFromToken } from '../jwt.js'
 import {
   CODE_ASSIST_STREAM,
   antigravityMetadata,
@@ -18,7 +18,7 @@ import {
 
 export const id = 'antigravity'
 export const DEFAULT_CLI_CLIENT_ID = ['681255809395', 'oo8ft2oprdrnp9e3aqf6av3hmdib135j'].join('-') + '.' + 'apps.googleusercontent.com'
-export const DEFAULT_CLI_CLIENT_SECRET = ['GOCSPX', '4uHgMPm', '1o7Sk', 'geV6Cu5clXFsxl'].join('-')
+
 
 const AUTH = 'https://accounts.google.com/o/oauth2/v2/auth'
 const TOKEN = 'https://oauth2.googleapis.com/token'
@@ -125,7 +125,16 @@ export async function exchangeCode(cfg, pkce, code, fetchImpl) {
     clientId: cfg.clientId,
     ...(cfg.clientSecret ? { clientSecret: cfg.clientSecret } : {}),
   })
-  const labeled = { ...blob, email: blob.email || emailFromToken(blob.accessToken), label: blob.label || 'Antigravity' }
+  const email = blob.email || emailFromToken(blob.idToken || blob.accessToken)
+  const avatarUrl = blob.avatarUrl || avatarFromToken(blob.idToken || blob.accessToken)
+  const scopes = blob.scopes?.length ? blob.scopes : (json?.scope ? String(json.scope).split(/[\s,]+/).filter(Boolean) : scopesFromToken(blob.idToken || blob.accessToken))
+  const labeled = {
+    ...blob,
+    email,
+    avatarUrl,
+    scopes,
+    label: blob.label || email || "Antigravity",
+  }
   return withProject(labeled, fetchImpl)
 }
 
@@ -134,7 +143,7 @@ export async function refresh(cfg, blob, fetchImpl) {
   let clientSecret = (cfg?.clientSecret && String(cfg.clientSecret).trim()) || (blob?.clientSecret && String(blob.clientSecret).trim()) || ''
 
   if (!clientSecret && clientId === DEFAULT_CLI_CLIENT_ID) {
-    clientSecret = DEFAULT_CLI_CLIENT_SECRET
+    throw new Error('Google OAuth refresh requires a client secret for the default Gemini CLI client. Configure antigravityClientSecret in plugin settings.')
   }
 
   if (!clientId) {

package/lib/vendors/claude.js

@@ -2,7 +2,7 @@ import { fetchWithTimeout } from '../http.js'
 import { buildAuthorizeUrl } from '../oauth.js'
 import { anthropicPayload, modelCatalog } from '../messages.js'
 import { jsonTokenRequest, anthropicStream, httpError, tokenBlobFromOAuth, readJson } from '../wire.js'
-import { emailFromToken } from '../jwt.js'
+import { emailFromToken, planFromToken, avatarFromToken, scopesFromToken } from '../jwt.js'
 import { asUsageSnapshot, usageWindows, deepestUsedPercent } from '../usage.js'
 
 export const id = 'claude'
@@ -81,13 +81,19 @@ export function defaults() {
   }
 }
 
-function oauthHeaders(token) {
-  return {
+function oauthHeaders(token, blob) {
+  const h = {
     Authorization: `Bearer ${token}`,
     Accept: 'application/json',
     'anthropic-version': '2023-06-01',
     'anthropic-beta': BETA,
   }
+  const org = blob && (blob.selectedOrgId || blob.organizationId)
+  if (org) {
+    h['anthropic-organization-id'] = String(org)
+    h['x-anthropic-organization'] = String(org)
+  }
+  return h
 }
 
 export function authorizeUrl(cfg, pkce) {
@@ -104,14 +110,56 @@ export function authorizeUrl(cfg, pkce) {
 
 async function decorate(blob, fetchImpl) {
   let email = blob.email || emailFromToken(blob.accessToken)
-  if (!email && fetchImpl && blob.accessToken) {
+  let plan = blob.plan || planFromToken(blob.accessToken)
+  let avatarUrl = blob.avatarUrl || avatarFromToken(blob.accessToken)
+  let scopes = blob.scopes || scopesFromToken(blob.accessToken)
+  let orgs = Array.isArray(blob.organizations) ? [...blob.organizations] : []
+  if (fetchImpl && blob.accessToken && (!email || !plan || !orgs.length)) {
     try {
-      const res = await fetchImpl(PROFILE, { headers: oauthHeaders(blob.accessToken) })
+      const res = await fetchImpl(PROFILE, { headers: oauthHeaders(blob.accessToken, blob) })
       const json = await readJson(res)
-      email = json.email || (json.account && json.account.email) || email
+      email = email || json.email || (json.account && json.account.email) || ""
+      plan = plan || json.plan || (json.account && (json.account.plan_type || (json.account.has_team ? "Team" : (json.account.has_pro ? "Pro" : "Free")))) || ""
+      avatarUrl = avatarUrl || json.picture || (json.account && json.account.picture) || ""
+      if (json.scope && !scopes.length) scopes = String(json.scope).split(/[\s,]+/).filter(Boolean)
+      if (Array.isArray(json.organizations)) {
+        for (const o of json.organizations) {
+          if (o && (o.id || o.uuid)) orgs.push({ id: String(o.id || o.uuid), name: String(o.name || o.title || o.id) })
+        }
+      } else if (Array.isArray(json.workspaces)) {
+        for (const w of json.workspaces) {
+          if (w && (w.id || w.uuid)) orgs.push({ id: String(w.id || w.uuid), name: String(w.name || w.title || w.id) })
+        }
+      } else if (json.account && Array.isArray(json.account.memberships)) {
+        for (const m of json.account.memberships) {
+          const o = m.organization || m
+          if (o && (o.id || o.uuid)) orgs.push({ id: String(o.id || o.uuid), name: String(o.name || o.title || o.id), role: m.role ? String(m.role) : undefined })
+        }
+      }
     } catch { /* profile is optional */ }
   }
-  return { ...blob, email, label: blob.label || email || 'Claude' }
+  const dedupedOrgs = []
+  const seen = new Set()
+  for (const o of orgs) {
+    if (!seen.has(o.id)) {
+      seen.add(o.id)
+      dedupedOrgs.push(o)
+    }
+  }
+  const selectedOrgId = blob.selectedOrgId || blob.organizationId || (dedupedOrgs[0] ? dedupedOrgs[0].id : '')
+  const selectedOrgName = blob.selectedOrgName || (dedupedOrgs.find(o => o.id === selectedOrgId)?.name || selectedOrgId)
+  return {
+    ...blob,
+    email: email || "",
+    plan: plan || "Claude Pro",
+    avatarUrl: avatarUrl || "",
+    scopes,
+    selectedOrgId,
+    selectedOrgName,
+    organizationId: selectedOrgId,
+    organizations: dedupedOrgs,
+    label: blob.label || email || "Claude",
+  }
 }
 
 export async function exchangeCode(cfg, pkce, code, fetchImpl) {
@@ -302,7 +350,7 @@ export async function* streamOnce({ blob, options, fetchImpl, headers, config, s
     method: 'POST',
     headers: {
       ...headers,
-      ...oauthHeaders(blob.accessToken),
+      ...oauthHeaders(blob.accessToken, blob),
       'Content-Type': 'application/json',
       Accept: 'text/event-stream',
     },

package/lib/vendors/codex.js

@@ -2,7 +2,7 @@ import { isTimeoutError, fetchWithTimeout } from "../http.js"
 import { randomUUID, createHash } from 'node:crypto'
 import { buildAuthorizeUrl } from '../oauth.js'
 import { codexResponsesBody, modelCatalog } from '../messages.js'
-import { chatgptAccountId, emailFromToken } from '../jwt.js'
+import { chatgptAccountId, emailFromToken, planFromToken, avatarFromToken, scopesFromToken, organizationsFromToken } from '../jwt.js'
 import { formTokenRequest, codexResponsesStream, readJson, tokenBlobFromOAuth, httpError } from '../wire.js'
 import { asUsageSnapshot, usageWindows, deepestUsedPercent } from '../usage.js'
 
@@ -62,11 +62,13 @@ export function authorizeUrl(cfg, pkce) {
 
 function identityHeaders(blob, config, extra) {
   const originator = config.originator || 'codex_cli_rs'
+  const activeOrgId = blob.selectedOrgId || blob.accountId || ''
   return {
     Authorization: `Bearer ${blob.accessToken}`,
     originator,
-    'chatgpt-account-id': blob.accountId || '',
-    'ChatGPT-Account-ID': blob.accountId || '',
+    'chatgpt-account-id': activeOrgId,
+    'ChatGPT-Account-ID': activeOrgId,
+    ...(activeOrgId ? { 'OpenAI-Organization': activeOrgId } : {}),
     'User-Agent': `${originator}/0.0.1`,
     'OpenAI-Beta': 'responses=experimental',
     ...(extra || {}),
@@ -75,11 +77,37 @@ function identityHeaders(blob, config, extra) {
 
 function decorate(blob, json) {
   const idToken = (json && json.id_token) || blob.idToken || ''
+  const email = blob.email || emailFromToken(idToken) || emailFromToken(blob.accessToken)
+  const plan = blob.plan || planFromToken(idToken) || planFromToken(blob.accessToken)
+  const avatarUrl = blob.avatarUrl || avatarFromToken(idToken) || avatarFromToken(blob.accessToken)
+  const scopes = blob.scopes?.length ? blob.scopes : (json?.scope ? String(json.scope).split(/[\s,]+/).filter(Boolean) : scopesFromToken(idToken || blob.accessToken))
+  const parsedOrgs = [
+    ...organizationsFromToken(idToken),
+    ...organizationsFromToken(blob.accessToken),
+  ]
+  const dedupedOrgs = Array.isArray(blob.organizations) && blob.organizations.length ? [...blob.organizations] : []
+  const seen = new Set(dedupedOrgs.map(o => o.id))
+  for (const o of parsedOrgs) {
+    if (!seen.has(o.id)) {
+      seen.add(o.id)
+      dedupedOrgs.push(o)
+    }
+  }
+  const accountId = blob.accountId || chatgptAccountId(idToken) || chatgptAccountId(blob.accessToken)
+  const selectedOrgId = blob.selectedOrgId || accountId || (dedupedOrgs[0] ? dedupedOrgs[0].id : '')
+  const selectedOrgName = blob.selectedOrgName || (dedupedOrgs.find(o => o.id === selectedOrgId)?.name || selectedOrgId)
+
   return {
     ...blob,
-    accountId: blob.accountId || chatgptAccountId(idToken) || chatgptAccountId(blob.accessToken),
-    email: blob.email || emailFromToken(idToken) || emailFromToken(blob.accessToken),
-    label: blob.label || emailFromToken(idToken) || emailFromToken(blob.accessToken) || 'ChatGPT',
+    accountId,
+    selectedOrgId,
+    selectedOrgName,
+    organizations: dedupedOrgs,
+    email,
+    plan: plan || 'ChatGPT',
+    avatarUrl,
+    scopes,
+    label: blob.label || email || 'ChatGPT',
   }
 }