@hienlh/ppm 0.20.0 → 0.20.2

package/src/providers/codex-app-server/codex-usage-limit.ts

@@ -0,0 +1,69 @@
+/**
+ * Recognising a Codex usage-limit refusal.
+ *
+ * Codex reports an exhausted quota as an ordinary `error` notification — the same shape it
+ * uses for a malformed request or a dead sandbox — so the wording is the only thing that
+ * separates "this account is out of credit until 4:21 PM" from a failure that switching
+ * accounts cannot fix. Matching text is therefore load-bearing here rather than cosmetic:
+ * it decides whether the turn moves to another account or stops in front of the user.
+ *
+ * The patterns are deliberately narrow. A false positive parks a working account for
+ * hours, so a match needs the phrase Codex actually uses and not the bare word "limit",
+ * which also shows up in context-window and file-size errors.
+ */
+
+const USAGE_LIMIT_PATTERNS = [
+  /hit\s+your\s+(?:usage|rate)\s+limit/i,
+  /reached\s+your\s+usage\s+limit/i,
+  /usage\s+limit\s+reached/i,
+];
+
+/** Whether this error text means the account's quota is spent. */
+export function isCodexUsageLimit(message: string): boolean {
+  return USAGE_LIMIT_PATTERNS.some((re) => re.test(message));
+}
+
+/** The message carried by a codex `error` notification, whatever shape it arrived in. */
+export function codexErrorMessage(params: unknown): string {
+  const p = (params && typeof params === "object" ? params : {}) as Record<string, unknown>;
+  const err = (p.error && typeof p.error === "object" ? p.error : {}) as Record<string, unknown>;
+  if (typeof err.message === "string") return err.message;
+  if (typeof p.message === "string") return p.message;
+  return "";
+}
+
+/** Turn an hour/minute into the next epoch-ms at which the clock next reads that time. */
+function nextOccurrence(hour: number, minute: number, ampm?: string): number | undefined {
+  if (!Number.isFinite(hour) || hour > 23 || minute > 59) return undefined;
+  let h = hour;
+  if (ampm === "pm" && h < 12) h += 12;
+  if (ampm === "am" && h === 12) h = 0;
+  const now = new Date();
+  const reset = new Date(now);
+  reset.setHours(h, minute, 0, 0);
+  // Already past today, so the refusal must be pointing at tomorrow.
+  if (reset.getTime() <= now.getTime()) reset.setDate(reset.getDate() + 1);
+  return reset.getTime();
+}
+
+/**
+ * When the refused account is worth trying again, read out of the refusal itself.
+ *
+ * Codex phrases it two ways — an absolute "try again at 4:21 PM" and a relative "try again
+ * in 3 hours" — and both are parsed because the caller uses the answer to decide how long
+ * to park the account. Returns null when the message says nothing about a reset, which the
+ * caller treats as "park for the default window" rather than "do not park".
+ */
+export function parseCodexUsageLimitReset(message: string): { text?: string; atMs?: number } | null {
+  const relative = /try\s+again\s+in\s+(\d+)\s*(second|minute|hour|day)s?/i.exec(message);
+  if (relative) {
+    const n = Number(relative[1]);
+    const unitMs = { second: 1000, minute: 60_000, hour: 3_600_000, day: 86_400_000 }[relative[2]!.toLowerCase()]!;
+    return { text: `in ${n} ${relative[2]!.toLowerCase()}${n === 1 ? "" : "s"}`, atMs: Date.now() + n * unitMs };
+  }
+  const absolute = /(?:try\s+again|resets?)\s+(?:at\s+)?(\d{1,2})(?::(\d{2}))?\s*(am|pm)?/i.exec(message);
+  if (!absolute) return null;
+  const text = absolute[0].replace(/^(?:try\s+again|resets?)\s+(?:at\s+)?/i, "").trim();
+  const atMs = nextOccurrence(Number(absolute[1]), absolute[2] ? Number(absolute[2]) : 0, absolute[3]?.toLowerCase());
+  return { text: text || undefined, ...(atMs != null ? { atMs } : {}) };
+}

package/src/providers/codex-app-server/codex-usage-parser.ts

@@ -27,26 +27,43 @@ function toBucket(w: RateLimitWindow | null | undefined): LimitBucket | undefine
   };
 }
 
+/** A window at least this long is a plan's long bucket rather than its short one. */
+const LONG_WINDOW_MINS = 24 * 60;
+
 /**
- * Map codex `account/rateLimits/read` → PPM UsageInfo. `primary` window ≈ short
- * (5h-like) bucket, `secondary` ≈ long (weekly-like) bucket. Empty/missing → {}.
+ * Map codex `account/rateLimits/read` → PPM UsageInfo.
+ *
+ * `primary` and `secondary` are positions, not meanings, and each window states its own
+ * length in `windowDurationMins` — so that is what decides which bucket it belongs to. A
+ * Plus plan sends a 300-minute window followed by a 10080-minute one, which is the layout
+ * the old positional reading assumed. A ChatGPT Business plan sends the 10080-minute weekly
+ * window **alone, in the primary slot**, and reading position as meaning labelled that
+ * account's weekly quota "5-Hour" — complete with a reset nearly seven days out — while
+ * leaving its actual Weekly row empty.
+ *
+ * Empty/missing → `{}`, which the UI reads as "the quota could not be read" and is a
+ * different thing from a plan that genuinely has only one window.
  */
 export function parseCodexUsage(res: GetAccountRateLimitsResponse | null | undefined): UsageInfo {
   const snap = res?.rateLimits;
   if (!snap) return {};
-  const primary = snap.primary ?? null;
-  const secondary = snap.secondary ?? null;
   const out: UsageInfo = {};
-  if (primary?.usedPercent != null) {
-    out.fiveHour = primary.usedPercent / 100;
-    out.fiveHourResetsAt = toIso(primary.resetsAt);
-    out.session = toBucket(primary);
-  }
-  if (secondary?.usedPercent != null) {
-    out.sevenDay = secondary.usedPercent / 100;
-    out.sevenDayResetsAt = toIso(secondary.resetsAt);
-    out.weekly = toBucket(secondary);
-  }
+  const windows = [snap.primary ?? null, snap.secondary ?? null];
+  windows.forEach((w, slot) => {
+    if (w?.usedPercent == null) return;
+    // A window with no declared duration leaves nothing to read, so the slot it arrived in
+    // is the best guess remaining: primary is the short one wherever both are present.
+    const isLong = w.windowDurationMins != null ? w.windowDurationMins >= LONG_WINDOW_MINS : slot === 1;
+    if (isLong) {
+      out.sevenDay = w.usedPercent / 100;
+      out.sevenDayResetsAt = toIso(w.resetsAt);
+      out.weekly = toBucket(w);
+    } else {
+      out.fiveHour = w.usedPercent / 100;
+      out.fiveHourResetsAt = toIso(w.resetsAt);
+      out.session = toBucket(w);
+    }
+  });
   if (snap.planType) out.activeAccountLabel = String(snap.planType);
   return out;
 }

package/src/server/routes/chat.ts

@@ -498,6 +498,23 @@ chatRoutes.put("/sessions/:id/account", async (c) => {
   if (!bindPickedAccount(sessionId, providerId, body.accountId)) {
     return c.json(err(bindRefusalReason(providerId, body.accountId)), 400);
   }
+  // Codex binds an account by spawning its app-server with that account's CODEX_HOME, so a
+  // subprocess already running keeps serving the old account however the binding reads — the
+  // switch appeared to do nothing until something else happened to kill it. Dropping it while
+  // idle makes the next message respawn on the account the user just picked. Claude needs
+  // none of this: it reads the binding per turn, and there is nothing stale to clear.
+  if (providerId === "codex") {
+    const { listRunningSessions, dropIdleSubprocess } = await import("../ws/chat.ts");
+    // Never mid-turn. The answer being streamed would be lost, and the switch takes effect
+    // on the next message either way — which is exactly what the picker promises.
+    if (!listRunningSessions().some((s) => s.sessionId === sessionId)) {
+      dropIdleSubprocess(
+        sessionId,
+        "account_switch",
+        "Subprocess released: the session was moved to another Codex account",
+      );
+    }
+  }
   return c.json(ok({ accountId: body.accountId }));
 });
 
@@ -893,7 +910,7 @@ chatRoutes.post("/sessions/:id/images/strip", async (c) => {
     const mode: StripMode = (body as { mode?: unknown }).mode === "all" ? "all" : "oversized";
     const includeAttachments = (body as { includeAttachments?: unknown }).includeAttachments === true;
 
-    const { listRunningSessions, dropSubprocessForTranscriptRewrite } = await import("../ws/chat.ts");
+    const { listRunningSessions, dropIdleSubprocess } = await import("../ws/chat.ts");
     if (listRunningSessions().some((s) => s.sessionId === sessionId)) {
       return c.json(err("Session is running — wait for the turn to finish"), 409);
     }
@@ -906,7 +923,11 @@ chatRoutes.post("/sessions/:id/images/strip", async (c) => {
     // re-sends the oversized attachment from memory and fails exactly as before, which is the
     // failure this endpoint exists to clear. Drop it so the turn is rebuilt from the file we
     // are about to rewrite.
-    dropSubprocessForTranscriptRewrite(sessionId);
+    dropIdleSubprocess(
+      sessionId,
+      "transcript_rewritten",
+      "Subprocess released: the transcript was rewritten, so the next turn is rebuilt from disk",
+    );
 
     const result = await stripTranscriptImagesFile(found.path, mode, { includeAttachments });
     return c.json(ok({

package/src/server/routes/codex-accounts.ts

@@ -1,7 +1,7 @@
 import { Hono } from "hono";
 import { ok, err } from "../../types/api.ts";
-import { listCodexAccounts, removeCodexAccount, getAllCodexUsages, getCodexStrategy, setCodexStrategy, selectCodexAccount, setCodexAccountStatus, type CodexStrategy } from "../../services/codex-account.service.ts";
-import { addApiKeyAccount, startDeviceLogin, getDeviceLoginStatus, cancelDeviceLogin } from "../../services/codex-account-login.ts";
+import { listCodexAccounts, removeCodexAccount, getAllCodexUsages, getCodexStrategy, setCodexStrategy, selectCodexAccount, setCodexAccountStatus, codexUsageLevel, type CodexStrategy } from "../../services/codex-account.service.ts";
+import { addApiKeyAccount, startDeviceLogin, getDeviceLoginStatus, cancelDeviceLogin, startBrowserLogin, submitBrowserCallback, getBrowserLoginStatus, cancelBrowserLogin } from "../../services/codex-account-login.ts";
 import { exportCodexEncrypted, importCodexEncrypted } from "../../services/codex-account-portability.ts";
 
 /** Codex multi-account management. Mounted under /api/codex-accounts (auth-guarded). */
@@ -29,7 +29,7 @@ codexAccountsRoutes.post("/pick", async (c) => {
   const usages = await getAllCodexUsages();
   // A failed usage fetch yields {} → +Infinity, which the selector reads as "unknown", not
   // as "capped": an account we could not measure stays a candidate.
-  const picked = selectCodexAccount({ usageOf: (id) => usages[id]?.fiveHour ?? Number.POSITIVE_INFINITY });
+  const picked = selectCodexAccount({ usageOf: (id) => codexUsageLevel(usages[id]) });
   if (!picked) return c.json(ok(null));
   return c.json(ok({ id: picked.id, label: picked.label }));
 });
@@ -86,6 +86,35 @@ codexAccountsRoutes.delete("/device-login/:id", (c) => {
   return c.json(ok({ cancelled: true }));
 });
 
+/** Browser OAuth uses the same durable polling as device-code login. */
+codexAccountsRoutes.post("/browser-login", async (c) => {
+  const body = await c.req.json<{ label?: string }>().catch(() => ({} as { label?: string }));
+  if (body.label !== undefined && typeof body.label !== "string") return c.json(err("label must be a string"), 400);
+  c.header("Cache-Control", "no-store");
+  try { return c.json(ok(await startBrowserLogin(body.label))); }
+  catch (e) { return c.json(err((e as Error).message), 400); }
+});
+
+codexAccountsRoutes.post("/browser-login/:id/callback", async (c) => {
+  const body = await c.req.json<{ callbackUrl?: string }>().catch(() => ({} as { callbackUrl?: string }));
+  c.header("Cache-Control", "no-store");
+  if (typeof body.callbackUrl !== "string") return c.json(err("callbackUrl is required"), 400);
+  try {
+    submitBrowserCallback(c.req.param("id"), body.callbackUrl);
+    return c.json(ok({ submitted: true }));
+  } catch (e) { return c.json(err((e as Error).message), 400); }
+});
+
+codexAccountsRoutes.get("/browser-login/:id/status", (c) => {
+  c.header("Cache-Control", "no-store");
+  return c.json(ok(getBrowserLoginStatus(c.req.param("id"))));
+});
+
+codexAccountsRoutes.delete("/browser-login/:id", (c) => {
+  cancelBrowserLogin(c.req.param("id"));
+  return c.json(ok({ cancelled: true }));
+});
+
 /** Download a password-encrypted backup of codex accounts (auth.json + apiKey creds). */
 codexAccountsRoutes.post("/export", async (c) => {
   const body = await c.req.json<{ password?: string; accountIds?: string[] }>().catch(() => ({} as { password?: string; accountIds?: string[] }));

package/src/server/ws/chat.ts

@@ -164,27 +164,31 @@ function releaseSubprocess(sessionId: string, reason: string, note: string): voi
 }
 
 /**
- * Drop a session's live subprocess so its next turn is rebuilt from the transcript on disk.
+ * Drop a session's live subprocess so its next turn is rebuilt from what is on disk.
  *
- * Routes that rewrite the JSONL need this. The subprocess holds the conversation in memory,
- * so a rewrite it never learns about simply does not apply: the user strips an oversized
- * image, sends again, and the same image is re-sent from memory and fails identically.
- * `listRunningSessions()` does not cover it — that skips `phase === "idle"`, and a warm idle
- * subprocess is exactly this case. Unlike `releaseSubprocess` it does not require the session
- * to be clientless, because the tab being open is the normal way to reach the strip button.
+ * Two kinds of caller need this, both because the subprocess holds state that a change
+ * made behind its back cannot reach. A route that rewrites the JSONL: the user strips an
+ * oversized image, sends again, and the same image is re-sent from memory and fails
+ * identically. And a codex account switch: the app-server was spawned with one account's
+ * CODEX_HOME and keeps serving that account no matter what the session's binding now says.
+ *
+ * `listRunningSessions()` does not cover either case — that skips `phase === "idle"`, and a
+ * warm idle subprocess is exactly what both are about. Unlike `releaseSubprocess` this does
+ * not require the session to be clientless, because having the tab open is the normal way
+ * to reach both buttons.
  */
-export function dropSubprocessForTranscriptRewrite(sessionId: string): void {
+export function dropIdleSubprocess(sessionId: string, reason: string, note: string): void {
   const entry = activeSessions.get(sessionId);
   if (!entry) return;
   const provider = providerRegistry.get(entry.providerId);
   if (!provider?.hasStreamingSession?.(sessionId)) return;
-  provider.abortQuery?.(sessionId, "transcript_rewritten");
+  provider.abortQuery?.(sessionId, reason);
   if (entry.cacheReleaseTimer) {
     clearTimeout(entry.cacheReleaseTimer);
     entry.cacheReleaseTimer = undefined;
   }
-  console.log(`[chat] session=${sessionId} released subprocess (transcript_rewritten)`);
-  logSessionEvent(sessionId, "INFO", "Subprocess released: the transcript was rewritten, so the next turn is rebuilt from disk");
+  console.log(`[chat] session=${sessionId} released subprocess (${reason})`);
+  logSessionEvent(sessionId, "INFO", note);
 }
 
 /** Tear down the longest-idle subprocesses once too many sessions are holding one. */

package/src/services/codex-account-cooldown.ts

@@ -0,0 +1,56 @@
+/**
+ * Codex accounts parked after the app-server refused a turn for an exhausted quota.
+ *
+ * Kept apart from the account rows on purpose. `CodexAccountStatus` is the user's switch —
+ * on or off — and writing a quota refusal into it would show an account the user never
+ * disabled as switched off in Settings, with no way to tell the two apart when it came
+ * back. Parking is the server's own short-lived opinion about an account, so it lives in
+ * memory and lapses on its own.
+ *
+ * In-memory is also the honest lifetime: the park exists to stop a rotation from handing
+ * the next turn straight back to the account that just refused it, and a server restart
+ * re-learns that on the first refusal anyway.
+ */
+
+/** accountId → epoch ms at which the account is worth trying again. */
+const parkedUntil = new Map<string, number>();
+
+/**
+ * How long an account sits out when the refusal carried no reset time.
+ *
+ * Codex's short bucket is five hours, so that is the cheapest correct guess. Guessing long
+ * is safe in a way guessing short is not: an account that recovers early is only skipped
+ * while another one can serve, whereas a park that lapses too early sends the turn back to
+ * an account that refuses it again.
+ */
+const DEFAULT_PARK_MS = 5 * 60 * 60 * 1000;
+
+/** Park an account until its quota resets. `resetAtMs` in the past falls back to the default. */
+export function markCodexAccountUsageLimited(accountId: string, resetAtMs?: number): void {
+  const now = Date.now();
+  const until = resetAtMs != null && resetAtMs > now ? resetAtMs : now + DEFAULT_PARK_MS;
+  parkedUntil.set(accountId, until);
+}
+
+/** Whether the account is still sitting out. Lapsed entries are dropped as they are read. */
+export function isCodexAccountUsageLimited(accountId: string): boolean {
+  const until = parkedUntil.get(accountId);
+  if (until == null) return false;
+  if (until <= Date.now()) { parkedUntil.delete(accountId); return false; }
+  return true;
+}
+
+/** When the account is next worth trying, or null if it is not parked. */
+export function codexUsageLimitResetAt(accountId: string): number | null {
+  return isCodexAccountUsageLimited(accountId) ? parkedUntil.get(accountId)! : null;
+}
+
+/** Let an account back in early — a successful turn proves the park is stale. */
+export function clearCodexAccountUsageLimit(accountId: string): void {
+  parkedUntil.delete(accountId);
+}
+
+/** Test seam: forget every park. */
+export function _resetCodexCooldownsForTesting(): void {
+  parkedUntil.clear();
+}

package/src/services/codex-account-login.ts

@@ -1,7 +1,7 @@
 /**
  * Codex account login orchestration. Logs codex into a per-account CODEX_HOME
  * via a short-lived app-server, verifies with account/read, then persists the
- * account. Two headless paths:
+ * account. Supports API keys, device codes and browser OAuth callbacks.
  *   - apiKey: instant (account/login/start stores the key; validated on first use).
  *   - chatgptDeviceCode: returns a user-code + URL; the app-server's
  *     account/login/completed notification finalizes the account in the
@@ -15,7 +15,8 @@
  */
 import { randomUUID } from "node:crypto";
 import { mkdirSync, rmSync } from "node:fs";
-import { CodexJsonRpcClient } from "../providers/codex-app-server/codex-jsonrpc-client.ts";
+import { buildCodexCallback, checkCodexLoginPort, parseBrowserLogin, type BrowserLoginCallback } from "./codex-login-callback.ts";
+import { CodexJsonRpcClient, CONTROL_REQUEST_TIMEOUT_MS } from "../providers/codex-app-server/codex-jsonrpc-client.ts";
 import { codexAccountHome, createCodexAccount, type CodexAccount } from "./codex-account.service.ts";
 
 const CLIENT_INFO = { name: "ppm", title: "PPM", version: "0.0.0" };
@@ -29,13 +30,13 @@ export interface LoginClient {
   start(opts?: { cwd?: string; codexHome?: string }): void;
   onNotification(fn: (n: { method: string; params?: unknown }) => void): void;
   onClose(fn: (code: number | null) => void): void;
-  request<T = unknown>(method: string, params?: unknown): Promise<T>;
+  request<T = unknown>(method: string, params?: unknown, timeoutMs?: number): Promise<T>;
   notify(method: string, params?: unknown): void;
   close(): void;
 }
 
 async function handshake(c: LoginClient): Promise<void> {
-  await c.request("initialize", { clientInfo: CLIENT_INFO, capabilities: CAPABILITIES });
+  await c.request("initialize", { clientInfo: CLIENT_INFO, capabilities: CAPABILITIES }, CONTROL_REQUEST_TIMEOUT_MS);
   c.notify("initialized");
 }
 
@@ -72,7 +73,10 @@ export type DeviceLoginStatus =
   | { state: "done"; account: CodexAccount }
   | { state: "error"; error: string };
 
-interface DeviceLogin {
+interface ChatGptLogin {
+  method: "device" | "browser";
+  browser?: BrowserLoginCallback;
+  callbackAbort?: AbortController;
   client: LoginClient; home: string; label?: string;
   status: DeviceLoginStatus;
   timer: ReturnType<typeof setTimeout>;
@@ -80,10 +84,14 @@ interface DeviceLogin {
    * home must survive this window even if the browser walks away. */
   finalizing: boolean;
 }
-const deviceLogins = new Map<string, DeviceLogin>();
+const pendingLogins = new Map<string, ChatGptLogin>();
+
+type ChatGptLoginStart = { id: string; userCode: string; verificationUrl: string; authUrl: string };
+type CompletionNotification = { success?: boolean; error?: string | null };
 
 /** How long an unfinished authorization may sit before it is reaped. */
 const DEVICE_LOGIN_TTL = 200_000;
+const BROWSER_LOGIN_TTL = 600_000;
 /** How long a finished result stays readable for the polling browser. */
 const RESULT_GRACE_MS = 120_000;
 
@@ -92,12 +100,21 @@ function unref(t: ReturnType<typeof setTimeout>): ReturnType<typeof setTimeout>
   return t;
 }
 
+function hasPendingBrowserLogin(): boolean {
+  return [...pendingLogins.values()].some((p) => p.method === "browser" && p.status.state === "pending");
+}
+
+function isCurrentPendingLogin(id: string, p: ChatGptLogin): boolean {
+  return pendingLogins.get(id) === p && p.status.state === "pending" && !p.finalizing;
+}
+
 /** Forget a flow entirely: stop its app-server, optionally drop its home. */
-function disposeDeviceLogin(id: string, rmHome: boolean): void {
-  const p = deviceLogins.get(id);
+function disposeLogin(id: string, rmHome: boolean): void {
+  const p = pendingLogins.get(id);
   if (!p) return;
-  deviceLogins.delete(id);
+  pendingLogins.delete(id);
   clearTimeout(p.timer);
+  p.callbackAbort?.abort();
   try { p.client.close(); } catch { /* ignore */ }
   if (rmHome) { try { rmSync(p.home, { recursive: true, force: true }); } catch { /* ignore */ } }
 }
@@ -106,26 +123,30 @@ function disposeDeviceLogin(id: string, rmHome: boolean): void {
  * event that trails a success cannot overwrite it. The entry lingers for
  * RESULT_GRACE_MS — that window is what makes a lost poll response harmless. */
 function settle(id: string, status: Exclude<DeviceLoginStatus, { state: "pending" }>): void {
-  const p = deviceLogins.get(id);
+  const p = pendingLogins.get(id);
   if (!p || p.status.state !== "pending") return;
   p.status = status;
   clearTimeout(p.timer);
+  p.callbackAbort?.abort();
   try { p.client.close(); } catch { /* ignore */ }
   // A failure leaves no account owning the dir, so the half-built home goes now.
   // A success must keep it: createCodexAccount adopted it as the account's home.
   if (status.state === "error") { try { rmSync(p.home, { recursive: true, force: true }); } catch { /* ignore */ } }
-  p.timer = unref(setTimeout(() => { deviceLogins.delete(id); }, RESULT_GRACE_MS));
+  p.timer = unref(setTimeout(() => { pendingLogins.delete(id); }, RESULT_GRACE_MS));
 }
 
 /** Turn the app-server's completion notification into a persisted account. */
-async function finalizeDeviceLogin(id: string, notif: { success?: boolean; error?: string | null }): Promise<void> {
-  const p = deviceLogins.get(id);
-  if (!p || p.status.state !== "pending") return;
-  if (!notif?.success) { settle(id, { state: "error", error: notif?.error || "login not completed" }); return; }
+async function finalizeLogin(id: string, notif: CompletionNotification): Promise<void> {
+  const p = pendingLogins.get(id);
+  if (!p || p.status.state !== "pending" || p.finalizing) return;
+  if (!notif?.success) { settle(id, { state: "error", error: p.method === "browser" ? "ChatGPT sign-in failed. Start a new browser login and try again." : notif?.error || "login not completed" }); return; }
   p.finalizing = true;
+  // Authorization has completed; account/read has its own bounded timeout.
+  clearTimeout(p.timer);
   try {
-    const read = await p.client.request<AccountRead>("account/read", {});
+    const read = await p.client.request<AccountRead>("account/read", {}, CONTROL_REQUEST_TIMEOUT_MS);
     if (!read?.account) throw new Error("login completed but account is empty");
+    if (p.status.state !== "pending") return;
     const account = createCodexAccount({
       id, label: p.label || read.account.email || "ChatGPT", type: "chatgpt",
       planType: read.account.planType ?? null,
@@ -138,43 +159,97 @@ async function finalizeDeviceLogin(id: string, notif: { success?: boolean; error
 
 /** Begin a ChatGPT device-code login. Returns the code/URL the user enters in a
  * browser; the caller then polls getDeviceLoginStatus. */
-export async function startDeviceLogin(
-  label?: string,
-  makeClient: () => LoginClient = () => new CodexJsonRpcClient(),
-): Promise<{ id: string; userCode: string; verificationUrl: string }> {
+async function startChatGptLogin(
+  method: "device" | "browser",
+  label: string | undefined,
+  makeClient: () => LoginClient,
+): Promise<ChatGptLoginStart> {
+  if (method === "browser" && hasPendingBrowserLogin()) {
+    throw new Error("A browser login is already in progress. Finish or cancel it first.");
+  }
   const id = randomUUID();
   const home = codexAccountHome(id);
   mkdirSync(home, { recursive: true, mode: 0o700 });
   const client = makeClient();
   client.onNotification((n) => {
     if (n.method === "account/login/completed") {
-      void finalizeDeviceLogin(id, (n.params ?? {}) as { success?: boolean; error?: string | null });
+      void finalizeLogin(id, (n.params ?? {}) as CompletionNotification);
     }
   });
   client.onClose(() => settle(id, { state: "error", error: "login process exited" }));
-  // Never cleared by a poll: an abandoned browser cannot leak the subprocess or
-  // the half-built home the way a request-scoped timer could.
-  const timer = unref(setTimeout(() => settle(id, { state: "error", error: "timed out" }), DEVICE_LOGIN_TTL));
-  // Registered before the first I/O so a notification (or an immediate exit)
-  // arriving mid-handshake still finds its entry.
-  deviceLogins.set(id, { client, home, label, status: { state: "pending" }, timer, finalizing: false });
+  const timer = unref(setTimeout(() => settle(id, { state: "error", error: "timed out" }), method === "browser" ? BROWSER_LOGIN_TTL : DEVICE_LOGIN_TTL));
+  const pending: ChatGptLogin = { method, client, home, label, status: { state: "pending" }, timer, finalizing: false };
+  pendingLogins.set(id, pending);
   try {
+    if (method === "browser") await checkCodexLoginPort();
     client.start({ codexHome: home });
     await handshake(client);
-    const start = await client.request<{ userCode?: string; verificationUrl?: string }>(
-      "account/login/start", { type: "chatgptDeviceCode" },
+    const start = await client.request<{ userCode?: string; verificationUrl?: string; authUrl?: string }>(
+      "account/login/start", { type: method === "browser" ? "chatgpt" : "chatgptDeviceCode" }, CONTROL_REQUEST_TIMEOUT_MS,
     );
-    return { id, userCode: start?.userCode ?? "", verificationUrl: start?.verificationUrl ?? "" };
+    if (method === "browser") pending.browser = parseBrowserLogin(start.authUrl ?? "");
+    return { id, userCode: start?.userCode ?? "", verificationUrl: start?.verificationUrl ?? "", authUrl: start?.authUrl ?? "" };
   } catch (e) {
-    disposeDeviceLogin(id, true);
+    disposeLogin(id, true);
     throw e;
   }
 }
 
+export async function startDeviceLogin(label?: string, makeClient: () => LoginClient = () => new CodexJsonRpcClient()) {
+  const { id, userCode, verificationUrl } = await startChatGptLogin("device", label, makeClient);
+  return { id, userCode, verificationUrl };
+}
+
+export async function startBrowserLogin(label?: string, makeClient: () => LoginClient = () => new CodexJsonRpcClient()) {
+  const { id, authUrl } = await startChatGptLogin("browser", label, makeClient);
+  return { id, authUrl };
+}
+
+/** Submission is acknowledged immediately. Only the app-server notification and
+ * account/read determine success, even if the forwarding HTTP request drops. */
+export function submitBrowserCallback(id: string, callbackUrl: string, send: typeof fetch = fetch): void {
+  const p = pendingLogins.get(id);
+  if (!p || p.method !== "browser" || !p.browser) throw new Error("No browser login found. Start a new login.");
+  if (p.status.state === "done" || p.finalizing) return;
+  if (p.status.state === "error") throw new Error(p.status.error);
+  const browser = p.browser;
+  const target = buildCodexCallback(callbackUrl, browser);
+  if (browser.submitted) return;
+  browser.submitted = true;
+  const controller = new AbortController();
+  p.callbackAbort = controller;
+  const timeout = unref(setTimeout(() => controller.abort(), 30_000));
+  void (async () => {
+    try {
+      const response = await send(target, { redirect: "manual", signal: controller.signal });
+      // Do not render or log the OAuth response body or follow its redirect.
+      await response.body?.cancel();
+      if (response.status >= 400 && isCurrentPendingLogin(id, p)) {
+        settle(id, { state: "error", error: "Codex rejected the callback. Start a new browser login." });
+      }
+    } catch {
+      // A closed callback socket may mean successful login. Polling owns the result.
+      if (isCurrentPendingLogin(id, p)) browser.submitted = false;
+    } finally {
+      clearTimeout(timeout);
+      if (p.callbackAbort === controller) p.callbackAbort = undefined;
+    }
+  })();
+}
+
+export function getBrowserLoginStatus(id: string): DeviceLoginStatus {
+  const p = pendingLogins.get(id);
+  return p?.method === "browser" ? p.status : { state: "error", error: "no pending browser login for that id" };
+}
+
+export function cancelBrowserLogin(id: string): void {
+  if (pendingLogins.get(id)?.method === "browser") cancelDeviceLogin(id);
+}
+
 /** Read a device-code flow's outcome. Idempotent — repeat polls are free and a
  * dropped response costs one tick, not the flow. */
 export function getDeviceLoginStatus(id: string): DeviceLoginStatus {
-  return deviceLogins.get(id)?.status ?? { state: "error", error: "no pending device login for that id" };
+  return pendingLogins.get(id)?.status ?? { state: "error", error: "no pending device login for that id" };
 }
 
 /** Abandon a flow the user cancelled. A login already being written is left
@@ -182,7 +257,7 @@ export function getDeviceLoginStatus(id: string): DeviceLoginStatus {
  * authorization the user completed. A finished one keeps its home: an account
  * owns it now. */
 export function cancelDeviceLogin(id: string): void {
-  const p = deviceLogins.get(id);
+  const p = pendingLogins.get(id);
   if (!p || p.finalizing) return;
-  disposeDeviceLogin(id, p.status.state !== "done");
+  disposeLogin(id, p.status.state !== "done");
 }