@iam-brain/opencode-codex-auth 0.1.15 → 0.2.0

package/dist/lib/codex-native.js

@@ -1,12 +1,6 @@
-import http from "node:http";
-import os from "node:os";
-import { execFile, execFileSync } from "node:child_process";
-import { appendFileSync, chmodSync, mkdirSync, readFileSync } from "node:fs";
-import path from "node:path";
-import { promisify } from "node:util";
 import { extractAccountIdFromClaims as extractAccountIdFromClaimsBase, extractEmailFromClaims, extractPlanFromClaims, parseJwtClaims } from "./claims";
 import { CodexStatus } from "./codex-status";
-import { saveSnapshots } from "./codex-status-storage";
+import { loadSnapshots, saveSnapshots } from "./codex-status-storage";
 import { PluginFatalError, formatWaitTime, isPluginFatalError, toSyntheticErrorResponse } from "./fatal-errors";
 import { buildIdentityKey, ensureIdentityKey, normalizeEmail, normalizePlan, synchronizeIdentityKey } from "./identity";
 import { defaultSessionAffinityPath, defaultSnapshotsPath } from "./paths";
@@ -18,11 +12,18 @@ import { formatToastMessage } from "./toast";
 import { runAuthMenuOnce } from "./ui/auth-menu-runner";
 import { applyCodexCatalogToProviderModels, getCodexModelCatalog, getRuntimeDefaultsForModel, resolveInstructionsForModel } from "./model-catalog";
 import { CODEX_RS_COMPACT_PROMPT } from "./orchestrator-agents";
-import { sanitizeRequestPayloadForCompat } from "./compat-sanitizer";
 import { fetchQuotaSnapshotFromBackend } from "./codex-quota-fetch";
 import { createRequestSnapshots } from "./request-snapshots";
 import { CODEX_OAUTH_SUCCESS_HTML } from "./oauth-pages";
+import { mergeInstructions, resolveCollaborationInstructions, resolveCollaborationModeKind, resolveCollaborationProfile, resolveHookAgentName, resolveSubagentHeaderValue } from "./codex-native/collaboration";
+import { applyCatalogInstructionOverrideToRequest, applyCodexRuntimeDefaultsToParams, findCatalogModelForCandidates, getModelLookupCandidates, getModelThinkingSummariesOverride, getVariantLookupCandidates, resolvePersonalityForModel, sanitizeOutboundRequestIfNeeded } from "./codex-native/request-transform";
 import { createSessionExistsFn, loadSessionAffinity, pruneSessionAffinitySnapshot, readSessionAffinitySnapshot, saveSessionAffinity, writeSessionAffinitySnapshot } from "./session-affinity";
+import { resolveCodexOriginator } from "./codex-native/originator";
+import { tryOpenUrlInBrowser as openUrlInBrowser } from "./codex-native/browser";
+import { selectCatalogAuthCandidate } from "./codex-native/catalog-auth";
+import { buildCodexUserAgent, refreshCodexClientVersionFromGitHub, resolveCodexClientVersion, resolveRequestUserAgent } from "./codex-native/client-identity";
+import { createOAuthServerController } from "./codex-native/oauth-server";
+export { browserOpenInvocationFor } from "./codex-native/browser";
 const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 const ISSUER = "https://auth.openai.com";
 const CODEX_API_ENDPOINT = "https://chatgpt.com/backend-api/codex/responses";
@@ -55,10 +56,10 @@ const OAUTH_SERVER_SHUTDOWN_ERROR_GRACE_MS = (() => {
     const parsed = Number(raw);
     return Number.isFinite(parsed) && parsed >= 0 ? parsed : 60_000;
 })();
-const OAUTH_DEBUG_LOG_DIR = path.join(os.homedir(), ".config", "opencode", "logs", "codex-plugin");
-const OAUTH_DEBUG_LOG_FILE = path.join(OAUTH_DEBUG_LOG_DIR, "oauth-lifecycle.log");
-const execFileAsync = promisify(execFile);
-const DEFAULT_PLUGIN_VERSION = "0.1.0";
+const OPENAI_OUTBOUND_HOST_ALLOWLIST = new Set(["api.openai.com", "auth.openai.com", "chat.openai.com", "chatgpt.com"]);
+const AUTH_MENU_QUOTA_SNAPSHOT_TTL_MS = 60_000;
+const AUTH_MENU_QUOTA_FAILURE_COOLDOWN_MS = 30_000;
+const AUTH_MENU_QUOTA_FETCH_TIMEOUT_MS = 5000;
 const INTERNAL_COLLABORATION_MODE_HEADER = "x-opencode-collaboration-mode-kind";
 const SESSION_AFFINITY_MISSING_GRACE_MS = 15 * 60 * 1000;
 const CODEX_PLAN_MODE_INSTRUCTIONS = [
@@ -93,38 +94,12 @@ const STATIC_FALLBACK_MODELS = [
 function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
-export function browserOpenInvocationFor(url, platform = process.platform) {
-    if (platform === "darwin") {
-        return { command: "open", args: [url] };
-    }
-    if (platform === "win32") {
-        return { command: "cmd", args: ["/c", "start", "", url] };
-    }
-    return { command: "xdg-open", args: [url] };
-}
 export async function tryOpenUrlInBrowser(url, log) {
-    if (process.env.OPENCODE_NO_BROWSER === "1")
-        return false;
-    if (process.env.VITEST || process.env.NODE_ENV === "test")
-        return false;
-    const invocation = browserOpenInvocationFor(url);
-    emitOAuthDebug("browser_open_attempt", { command: invocation.command });
-    try {
-        await execFileAsync(invocation.command, invocation.args, { windowsHide: true, timeout: 5000 });
-        emitOAuthDebug("browser_open_success", { command: invocation.command });
-        return true;
-    }
-    catch (error) {
-        emitOAuthDebug("browser_open_failure", {
-            command: invocation.command,
-            error: error instanceof Error ? error.message : String(error)
-        });
-        log?.warn("failed to auto-open oauth URL", {
-            command: invocation.command,
-            error: error instanceof Error ? error.message : String(error)
-        });
-        return false;
-    }
+    return openUrlInBrowser({
+        url,
+        log,
+        onEvent: (event, meta) => oauthServerController.emitDebug(event, meta ?? {})
+    });
 }
 function escapeHtml(value) {
     return value
@@ -141,11 +116,7 @@ async function generatePKCE() {
     return { verifier, challenge };
 }
 function base64UrlEncode(bytes) {
-    return Buffer.from(bytes)
-        .toString("base64")
-        .replace(/\+/g, "-")
-        .replace(/\//g, "_")
-        .replace(/=+$/g, "");
+    return Buffer.from(bytes).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
 }
 function generateState() {
     return base64UrlEncode(crypto.getRandomValues(new Uint8Array(32)));
@@ -195,6 +166,8 @@ export const __testOnly = {
     modeForRuntimeMode,
     buildCodexUserAgent,
     resolveRequestUserAgent,
+    resolveCodexClientVersion,
+    refreshCodexClientVersionFromGitHub,
     resolveHookAgentName,
     resolveCollaborationModeKind,
     resolveSubagentHeaderValue,
@@ -278,8 +251,7 @@ function composeCodexSuccessRedirectUrl(tokens, options = {}) {
     const port = options.port ?? OAUTH_PORT;
     const idClaims = getOpenAIAuthClaims(tokens.id_token);
     const accessClaims = getOpenAIAuthClaims(tokens.access_token);
-    const needsSetup = !getClaimBoolean(idClaims, "completed_platform_onboarding") &&
-        getClaimBoolean(idClaims, "is_org_owner");
+    const needsSetup = !getClaimBoolean(idClaims, "completed_platform_onboarding") && getClaimBoolean(idClaims, "is_org_owner");
     const platformUrl = issuer === ISSUER ? "https://platform.openai.com" : "https://platform.api.openai.org";
     const params = new URLSearchParams({
         needs_setup: String(needsSetup),
@@ -375,254 +347,32 @@ function buildOAuthErrorHtml(error) {
   </body>
 </html>`;
 }
-let oauthServer;
-let pendingOAuth;
-let oauthServerCloseTimer;
+const oauthServerController = createOAuthServerController({
+    port: OAUTH_PORT,
+    loopbackHost: OAUTH_LOOPBACK_HOST,
+    callbackOrigin: OAUTH_CALLBACK_ORIGIN,
+    callbackUri: OAUTH_CALLBACK_URI,
+    callbackPath: OAUTH_CALLBACK_PATH,
+    callbackTimeoutMs: OAUTH_CALLBACK_TIMEOUT_MS,
+    buildOAuthErrorHtml,
+    buildOAuthSuccessHtml,
+    composeCodexSuccessRedirectUrl,
+    exchangeCodeForTokens
+});
 function isOAuthDebugEnabled() {
-    const raw = process.env.CODEX_AUTH_DEBUG?.trim().toLowerCase();
-    return raw === "1" || raw === "true" || raw === "yes" || raw === "on";
-}
-function emitOAuthDebug(event, meta = {}) {
-    if (!isOAuthDebugEnabled())
-        return;
-    const payload = {
-        ts: new Date().toISOString(),
-        pid: process.pid,
-        event,
-        ...meta
-    };
-    const line = JSON.stringify(payload);
-    try {
-        console.error(`[codex-auth-debug] ${line}`);
-    }
-    catch {
-        // best effort stderr logging
-    }
-    try {
-        mkdirSync(OAUTH_DEBUG_LOG_DIR, { recursive: true, mode: 0o700 });
-        appendFileSync(OAUTH_DEBUG_LOG_FILE, `${line}\n`, { encoding: "utf8", mode: 0o600 });
-        chmodSync(OAUTH_DEBUG_LOG_FILE, 0o600);
-    }
-    catch {
-        // best effort file logging
-    }
-}
-function clearOAuthServerCloseTimer() {
-    if (!oauthServerCloseTimer)
-        return;
-    clearTimeout(oauthServerCloseTimer);
-    oauthServerCloseTimer = undefined;
-}
-function isLoopbackRemoteAddress(remoteAddress) {
-    if (!remoteAddress)
-        return false;
-    const normalized = remoteAddress.split("%")[0]?.toLowerCase();
-    return normalized === "127.0.0.1" || normalized === "::1" || normalized === "::ffff:127.0.0.1";
-}
-function setOAuthResponseHeaders(res, options) {
-    res.setHeader("Cache-Control", "no-store");
-    res.setHeader("Pragma", "no-cache");
-    res.setHeader("Referrer-Policy", "no-referrer");
-    res.setHeader("X-Content-Type-Options", "nosniff");
-    if (options?.contentType) {
-        res.setHeader("Content-Type", options.contentType);
-    }
-    if (options?.isHtml) {
-        res.setHeader("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline'; img-src data:; base-uri 'none'; form-action 'none'; frame-ancestors 'none'");
-    }
+    return oauthServerController.isDebugEnabled();
 }
 async function startOAuthServer() {
-    clearOAuthServerCloseTimer();
-    if (oauthServer) {
-        emitOAuthDebug("server_reuse", { port: OAUTH_PORT });
-        return { redirectUri: OAUTH_CALLBACK_URI };
-    }
-    emitOAuthDebug("server_starting", { port: OAUTH_PORT });
-    oauthServer = http.createServer((req, res) => {
-        try {
-            if (!isLoopbackRemoteAddress(req.socket.remoteAddress)) {
-                emitOAuthDebug("callback_rejected_non_loopback", {
-                    remoteAddress: req.socket.remoteAddress
-                });
-                res.statusCode = 403;
-                setOAuthResponseHeaders(res, { contentType: "text/plain; charset=utf-8" });
-                res.end("Forbidden");
-                return;
-            }
-            const url = new URL(req.url ?? "/", OAUTH_CALLBACK_ORIGIN);
-            const sendHtml = (status, html) => {
-                res.statusCode = status;
-                setOAuthResponseHeaders(res, { contentType: "text/html; charset=utf-8", isHtml: true });
-                res.end(html);
-            };
-            const redirect = (location) => {
-                res.statusCode = 302;
-                setOAuthResponseHeaders(res, { contentType: "text/plain; charset=utf-8" });
-                res.setHeader("Location", location);
-                res.end();
-            };
-            if (url.pathname === "/auth/callback") {
-                const code = url.searchParams.get("code");
-                const state = url.searchParams.get("state");
-                const error = url.searchParams.get("error");
-                const errorDescription = url.searchParams.get("error_description");
-                emitOAuthDebug("callback_hit", {
-                    hasCode: Boolean(code),
-                    hasState: Boolean(state),
-                    hasError: Boolean(error)
-                });
-                if (error) {
-                    const errorMsg = errorDescription || error;
-                    emitOAuthDebug("callback_error", { reason: errorMsg });
-                    pendingOAuth?.reject(new Error(errorMsg));
-                    pendingOAuth = undefined;
-                    sendHtml(200, buildOAuthErrorHtml(errorMsg));
-                    return;
-                }
-                if (!code) {
-                    const errorMsg = "Missing authorization code";
-                    emitOAuthDebug("callback_error", { reason: errorMsg });
-                    pendingOAuth?.reject(new Error(errorMsg));
-                    pendingOAuth = undefined;
-                    sendHtml(400, buildOAuthErrorHtml(errorMsg));
-                    return;
-                }
-                if (!pendingOAuth || state !== pendingOAuth.state) {
-                    const errorMsg = "Invalid state - potential CSRF attack";
-                    emitOAuthDebug("callback_error", { reason: errorMsg });
-                    pendingOAuth?.reject(new Error(errorMsg));
-                    pendingOAuth = undefined;
-                    sendHtml(400, buildOAuthErrorHtml(errorMsg));
-                    return;
-                }
-                const current = pendingOAuth;
-                pendingOAuth = undefined;
-                emitOAuthDebug("token_exchange_start", { authMode: current.authMode });
-                exchangeCodeForTokens(code, OAUTH_CALLBACK_URI, current.pkce)
-                    .then((tokens) => {
-                    current.resolve(tokens);
-                    emitOAuthDebug("token_exchange_success", { authMode: current.authMode });
-                    if (res.writableEnded)
-                        return;
-                    if (current.authMode === "codex") {
-                        redirect(composeCodexSuccessRedirectUrl(tokens));
-                        return;
-                    }
-                    sendHtml(200, buildOAuthSuccessHtml("native"));
-                })
-                    .catch((err) => {
-                    const oauthError = err instanceof Error ? err : new Error(String(err));
-                    current.reject(oauthError);
-                    emitOAuthDebug("token_exchange_error", { error: oauthError.message });
-                    if (res.writableEnded)
-                        return;
-                    sendHtml(500, buildOAuthErrorHtml(oauthError.message));
-                });
-                return;
-            }
-            if (url.pathname === "/success") {
-                emitOAuthDebug("callback_success_page");
-                sendHtml(200, buildOAuthSuccessHtml("codex"));
-                return;
-            }
-            if (url.pathname === "/cancel") {
-                emitOAuthDebug("callback_cancel");
-                pendingOAuth?.reject(new Error("Login cancelled"));
-                pendingOAuth = undefined;
-                res.statusCode = 200;
-                setOAuthResponseHeaders(res, { contentType: "text/plain; charset=utf-8" });
-                res.end("Login cancelled");
-                return;
-            }
-            res.statusCode = 404;
-            setOAuthResponseHeaders(res, { contentType: "text/plain; charset=utf-8" });
-            res.end("Not found");
-        }
-        catch (error) {
-            res.statusCode = 500;
-            setOAuthResponseHeaders(res, { contentType: "text/plain; charset=utf-8" });
-            res.end(`Server error: ${error.message}`);
-        }
-    });
-    try {
-        await new Promise((resolve, reject) => {
-            oauthServer?.once("error", reject);
-            oauthServer?.listen(OAUTH_PORT, OAUTH_LOOPBACK_HOST, () => resolve());
-        });
-        emitOAuthDebug("server_started", { port: OAUTH_PORT });
-    }
-    catch (error) {
-        emitOAuthDebug("server_start_error", {
-            error: error instanceof Error ? error.message : String(error)
-        });
-        const server = oauthServer;
-        oauthServer = undefined;
-        try {
-            server?.close();
-        }
-        catch {
-            // best-effort cleanup
-        }
-        throw error;
-    }
-    return { redirectUri: OAUTH_CALLBACK_URI };
+    return oauthServerController.start();
 }
 function stopOAuthServer() {
-    clearOAuthServerCloseTimer();
-    emitOAuthDebug("server_stopping", { hadPendingOAuth: Boolean(pendingOAuth) });
-    oauthServer?.close();
-    oauthServer = undefined;
-    emitOAuthDebug("server_stopped");
+    oauthServerController.stop();
 }
 function scheduleOAuthServerStop(delayMs = OAUTH_SERVER_SHUTDOWN_GRACE_MS, reason = "other") {
-    if (!oauthServer)
-        return;
-    clearOAuthServerCloseTimer();
-    emitOAuthDebug("server_stop_scheduled", { delayMs, reason });
-    oauthServerCloseTimer = setTimeout(() => {
-        oauthServerCloseTimer = undefined;
-        if (pendingOAuth)
-            return;
-        emitOAuthDebug("server_stop_timer_fired", { reason });
-        stopOAuthServer();
-    }, delayMs);
+    oauthServerController.scheduleStop(delayMs, reason);
 }
 function waitForOAuthCallback(pkce, state, authMode) {
-    emitOAuthDebug("callback_wait_start", {
-        authMode,
-        stateTail: state.slice(-6)
-    });
-    return new Promise((resolve, reject) => {
-        let settled = false;
-        const resolveOnce = (tokens) => {
-            if (settled)
-                return;
-            settled = true;
-            clearTimeout(timeout);
-            emitOAuthDebug("callback_wait_resolved", { authMode });
-            resolve(tokens);
-        };
-        const rejectOnce = (error) => {
-            if (settled)
-                return;
-            settled = true;
-            clearTimeout(timeout);
-            emitOAuthDebug("callback_wait_rejected", { authMode, error: error.message });
-            reject(error);
-        };
-        const timeout = setTimeout(() => {
-            pendingOAuth = undefined;
-            emitOAuthDebug("callback_wait_timeout", { authMode, timeoutMs: OAUTH_CALLBACK_TIMEOUT_MS });
-            rejectOnce(new Error("OAuth callback timeout - authorization took too long"));
-        }, OAUTH_CALLBACK_TIMEOUT_MS);
-        pendingOAuth = {
-            pkce,
-            state,
-            authMode,
-            resolve: resolveOnce,
-            reject: rejectOnce
-        };
-    });
+    return oauthServerController.waitForCallback(pkce, state, authMode);
 }
 function modeForRuntimeMode(runtimeMode) {
     return runtimeMode === "native" ? "native" : "codex";
@@ -711,319 +461,38 @@ function rewriteUrl(requestInput) {
     const parsed = requestInput instanceof URL
         ? requestInput
         : new URL(typeof requestInput === "string" ? requestInput : requestInput.url);
-    if (parsed.pathname.includes("/v1/responses") ||
-        parsed.pathname.includes("/chat/completions")) {
+    if (parsed.pathname.includes("/v1/responses") || parsed.pathname.includes("/chat/completions")) {
         return new URL(CODEX_API_ENDPOINT);
     }
     return parsed;
 }
-function opencodeUserAgent() {
-    const version = resolvePluginVersion();
-    return `opencode/${version} (${os.platform()} ${os.release()}; ${os.arch()})`;
-}
-let cachedPluginVersion;
-let cachedMacProductVersion;
-let cachedTerminalUserAgentToken;
-function isPrintableAscii(value) {
-    if (!value)
-        return false;
-    for (let index = 0; index < value.length; index += 1) {
-        const code = value.charCodeAt(index);
-        if (code < 0x20 || code > 0x7e)
-            return false;
-    }
-    return true;
-}
-function sanitizeUserAgentCandidate(candidate, fallback, originator) {
-    if (isPrintableAscii(candidate))
-        return candidate;
-    const sanitized = Array.from(candidate)
-        .map((char) => {
-        const code = char.charCodeAt(0);
-        return code >= 0x20 && code <= 0x7e ? char : "_";
-    })
-        .join("");
-    if (isPrintableAscii(sanitized))
-        return sanitized;
-    if (isPrintableAscii(fallback))
-        return fallback;
-    return originator;
-}
-function sanitizeTerminalToken(value) {
-    return value.replace(/[^A-Za-z0-9._/-]/g, "_");
-}
-function nonEmptyEnv(env, key) {
-    const value = env[key]?.trim();
-    return value ? value : undefined;
-}
-function splitProgramAndVersion(value) {
-    const [program, version] = value.trim().split(/\s+/, 2);
-    return {
-        program: program ?? "unknown",
-        ...(version ? { version } : {})
-    };
-}
-function tmuxDisplayMessage(format) {
-    try {
-        const value = execFileSync("tmux", ["display-message", "-p", format], { encoding: "utf8" }).trim();
-        return value || undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-function resolveTerminalUserAgentToken(env = process.env) {
-    if (cachedTerminalUserAgentToken)
-        return cachedTerminalUserAgentToken;
-    const termProgram = nonEmptyEnv(env, "TERM_PROGRAM");
-    const termProgramVersion = nonEmptyEnv(env, "TERM_PROGRAM_VERSION");
-    const term = nonEmptyEnv(env, "TERM");
-    const hasTmux = Boolean(nonEmptyEnv(env, "TMUX") || nonEmptyEnv(env, "TMUX_PANE"));
-    if (termProgram && termProgram.toLowerCase() === "tmux" && hasTmux) {
-        const tmuxTermType = tmuxDisplayMessage("#{client_termtype}");
-        if (tmuxTermType) {
-            const { program, version } = splitProgramAndVersion(tmuxTermType);
-            cachedTerminalUserAgentToken = sanitizeTerminalToken(version ? `${program}/${version}` : program);
-            return cachedTerminalUserAgentToken;
-        }
-        const tmuxTermName = tmuxDisplayMessage("#{client_termname}");
-        if (tmuxTermName) {
-            cachedTerminalUserAgentToken = sanitizeTerminalToken(tmuxTermName);
-            return cachedTerminalUserAgentToken;
-        }
-    }
-    if (termProgram) {
-        cachedTerminalUserAgentToken = sanitizeTerminalToken(termProgramVersion ? `${termProgram}/${termProgramVersion}` : termProgram);
-        return cachedTerminalUserAgentToken;
-    }
-    const weztermVersion = nonEmptyEnv(env, "WEZTERM_VERSION");
-    if (weztermVersion) {
-        cachedTerminalUserAgentToken = sanitizeTerminalToken(`WezTerm/${weztermVersion}`);
-        return cachedTerminalUserAgentToken;
-    }
-    if (env.ITERM_SESSION_ID || env.ITERM_PROFILE || env.ITERM_PROFILE_NAME) {
-        cachedTerminalUserAgentToken = "iTerm.app";
-        return cachedTerminalUserAgentToken;
-    }
-    if (env.TERM_SESSION_ID) {
-        cachedTerminalUserAgentToken = "Apple_Terminal";
-        return cachedTerminalUserAgentToken;
-    }
-    if (env.KITTY_WINDOW_ID || term?.includes("kitty")) {
-        cachedTerminalUserAgentToken = "kitty";
-        return cachedTerminalUserAgentToken;
-    }
-    if (env.ALACRITTY_SOCKET || term === "alacritty") {
-        cachedTerminalUserAgentToken = "Alacritty";
-        return cachedTerminalUserAgentToken;
-    }
-    const konsoleVersion = nonEmptyEnv(env, "KONSOLE_VERSION");
-    if (konsoleVersion) {
-        cachedTerminalUserAgentToken = sanitizeTerminalToken(`Konsole/${konsoleVersion}`);
-        return cachedTerminalUserAgentToken;
-    }
-    if (env.GNOME_TERMINAL_SCREEN) {
-        cachedTerminalUserAgentToken = "gnome-terminal";
-        return cachedTerminalUserAgentToken;
-    }
-    const vteVersion = nonEmptyEnv(env, "VTE_VERSION");
-    if (vteVersion) {
-        cachedTerminalUserAgentToken = sanitizeTerminalToken(`VTE/${vteVersion}`);
-        return cachedTerminalUserAgentToken;
-    }
-    if (env.WT_SESSION) {
-        cachedTerminalUserAgentToken = "WindowsTerminal";
-        return cachedTerminalUserAgentToken;
-    }
-    if (term) {
-        cachedTerminalUserAgentToken = sanitizeTerminalToken(term);
-        return cachedTerminalUserAgentToken;
-    }
-    cachedTerminalUserAgentToken = "unknown";
-    return cachedTerminalUserAgentToken;
-}
-function resolvePluginVersion() {
-    if (cachedPluginVersion)
-        return cachedPluginVersion;
-    const fromEnv = process.env.npm_package_version?.trim();
-    if (fromEnv) {
-        cachedPluginVersion = fromEnv;
-        return cachedPluginVersion;
-    }
-    try {
-        const raw = readFileSync(new URL("../package.json", import.meta.url), "utf8");
-        const parsed = JSON.parse(raw);
-        if (typeof parsed.version === "string" && parsed.version.trim()) {
-            cachedPluginVersion = parsed.version.trim();
-            return cachedPluginVersion;
-        }
-    }
-    catch {
-        // Use fallback version below.
-    }
-    cachedPluginVersion = DEFAULT_PLUGIN_VERSION;
-    return cachedPluginVersion;
-}
-function resolveMacProductVersion() {
-    if (cachedMacProductVersion)
-        return cachedMacProductVersion;
-    try {
-        const value = execFileSync("sw_vers", ["-productVersion"], { encoding: "utf8" }).trim();
-        cachedMacProductVersion = value || os.release();
-    }
-    catch {
-        cachedMacProductVersion = os.release();
-    }
-    return cachedMacProductVersion;
-}
-function normalizeArchitecture(architecture) {
-    if (architecture === "x64")
-        return "x86_64";
-    if (architecture === "arm64")
-        return "arm64";
-    return architecture || "unknown";
-}
-function resolveCodexPlatformSignature(platform = process.platform) {
-    const architecture = normalizeArchitecture(os.arch());
-    if (platform === "darwin") {
-        return `Mac OS ${resolveMacProductVersion()}; ${architecture}`;
-    }
-    if (platform === "win32") {
-        return `Windows ${os.release()}; ${architecture}`;
-    }
-    if (platform === "linux") {
-        return `Linux ${os.release()}; ${architecture}`;
-    }
-    return `${platform} ${os.release()}; ${architecture}`;
-}
-function buildCodexUserAgent(originator) {
-    if (originator === "opencode")
-        return opencodeUserAgent();
-    const buildVersion = resolvePluginVersion();
-    const terminalToken = resolveTerminalUserAgentToken();
-    const prefix = `${originator}/${buildVersion} (${resolveCodexPlatformSignature()}) ${terminalToken}`;
-    return sanitizeUserAgentCandidate(prefix, prefix, originator);
-}
-function resolveRequestUserAgent(spoofMode, originator) {
-    if (spoofMode === "codex")
-        return buildCodexUserAgent(originator);
-    return opencodeUserAgent();
-}
-function resolveHookAgentName(agent) {
-    const direct = asString(agent);
-    if (direct)
-        return direct;
-    if (!isRecord(agent))
-        return undefined;
-    return asString(agent.name) ?? asString(agent.agent);
-}
-function normalizeAgentNameForCollaboration(agentName) {
-    return agentName.trim().toLowerCase().replace(/\s+/g, "-");
-}
-function tokenizeAgentName(normalizedAgentName) {
-    return normalizedAgentName
-        .split(/[-./:_]+/)
-        .map((token) => token.trim())
-        .filter((token) => token.length > 0);
-}
-function isPluginCollaborationAgent(normalizedAgentName) {
-    const tokens = tokenizeAgentName(normalizedAgentName);
-    if (tokens.length === 0)
-        return false;
-    if (tokens[0] !== "codex")
+function isAllowedOpenAIOutboundHost(hostname) {
+    const normalized = hostname.trim().toLowerCase();
+    if (!normalized)
         return false;
-    return tokens.some((token) => [
-        "orchestrator",
-        "default",
-        "code",
-        "plan",
-        "planner",
-        "execute",
-        "pair",
-        "pairprogramming",
-        "review",
-        "compact",
-        "compaction"
-    ].includes(token));
-}
-function resolveCollaborationModeKindFromName(normalizedAgentName) {
-    const tokens = tokenizeAgentName(normalizedAgentName);
-    if (tokens.includes("plan") || tokens.includes("planner"))
-        return "plan";
-    if (tokens.includes("execute"))
-        return "execute";
-    if (tokens.includes("pair") || tokens.includes("pairprogramming"))
-        return "pair_programming";
-    return "code";
-}
-function resolveCollaborationProfile(agent) {
-    const name = resolveHookAgentName(agent);
-    if (!name)
-        return { enabled: false };
-    const normalizedAgentName = normalizeAgentNameForCollaboration(name);
-    if (!isPluginCollaborationAgent(normalizedAgentName)) {
-        return { enabled: false, normalizedAgentName };
-    }
-    return {
-        enabled: true,
-        normalizedAgentName,
-        kind: resolveCollaborationModeKindFromName(normalizedAgentName)
-    };
-}
-function resolveCollaborationModeKind(agent) {
-    const profile = resolveCollaborationProfile(agent);
-    return profile.kind ?? "code";
-}
-function resolveCollaborationInstructions(kind) {
-    if (kind === "plan")
-        return CODEX_PLAN_MODE_INSTRUCTIONS;
-    if (kind === "execute")
-        return CODEX_EXECUTE_MODE_INSTRUCTIONS;
-    if (kind === "pair_programming")
-        return CODEX_PAIR_PROGRAMMING_MODE_INSTRUCTIONS;
-    return CODEX_CODE_MODE_INSTRUCTIONS;
-}
-function mergeInstructions(base, extra) {
-    const normalizedExtra = extra.trim();
-    if (!normalizedExtra)
-        return base?.trim() ?? "";
-    const normalizedBase = base?.trim();
-    if (!normalizedBase)
-        return normalizedExtra;
-    if (normalizedBase.includes(normalizedExtra))
-        return normalizedBase;
-    return `${normalizedBase}\n\n${normalizedExtra}`;
-}
-function resolveSubagentHeaderValue(agent) {
-    const profile = resolveCollaborationProfile(agent);
-    const normalized = profile.normalizedAgentName;
-    if (!profile.enabled || !normalized) {
-        return undefined;
-    }
-    const tokens = tokenizeAgentName(normalized);
-    const isCodexPrimary = tokens[0] === "codex" &&
-        (tokens.includes("orchestrator") ||
-            tokens.includes("default") ||
-            tokens.includes("code") ||
-            tokens.includes("plan") ||
-            tokens.includes("planner") ||
-            tokens.includes("execute") ||
-            tokens.includes("pair") ||
-            tokens.includes("pairprogramming"));
-    if (isCodexPrimary) {
-        return undefined;
-    }
-    if (tokens.includes("plan") || tokens.includes("planner")) {
-        return undefined;
-    }
-    if (normalized === "compaction") {
-        return "compact";
+    if (OPENAI_OUTBOUND_HOST_ALLOWLIST.has(normalized))
+        return true;
+    return normalized.endsWith(".openai.com") || normalized.endsWith(".chatgpt.com");
+}
+function assertAllowedOutboundUrl(url) {
+    const protocol = url.protocol.trim().toLowerCase();
+    if (protocol !== "https:") {
+        throw new PluginFatalError({
+            message: `Blocked outbound request with unsupported protocol "${protocol || "unknown"}". ` +
+                "This plugin only proxies HTTPS requests to OpenAI/ChatGPT backends.",
+            status: 400,
+            type: "disallowed_outbound_protocol",
+            param: "request"
+        });
     }
-    if (normalized.includes("review"))
-        return "review";
-    if (normalized.includes("compact") || normalized.includes("compaction"))
-        return "compact";
-    return "collab_spawn";
+    if (isAllowedOpenAIOutboundHost(url.hostname))
+        return;
+    throw new PluginFatalError({
+        message: `Blocked outbound request to "${url.hostname}". ` + "This plugin only proxies OpenAI/ChatGPT backend traffic.",
+        status: 400,
+        type: "disallowed_outbound_host",
+        param: "request"
+    });
 }
 async function sessionUsesOpenAIProvider(client, sessionID) {
     const sessionApi = client?.session;
@@ -1040,9 +509,7 @@ async function sessionUsesOpenAIProvider(client, sessionID) {
             if (asString(info.role) !== "user")
                 continue;
             const model = isRecord(info.model) ? info.model : undefined;
-            const providerID = model
-                ? asString(model.providerID)
-                : asString(info.providerID);
+            const providerID = model ? asString(model.providerID) : asString(info.providerID);
             if (!providerID)
                 continue;
             return providerID === "openai";
@@ -1053,26 +520,11 @@ async function sessionUsesOpenAIProvider(client, sessionID) {
     }
     return false;
 }
-function isTuiWorkerInvocation(argv) {
-    return argv.some((entry) => /(?:^|[\\/])tui[\\/]worker\.(?:js|ts)$/i.test(entry));
-}
-function resolveCodexOriginator(spoofMode, argv = process.argv) {
-    if (spoofMode !== "codex")
-        return "opencode";
-    const normalizedArgv = argv.map((entry) => String(entry));
-    if (isTuiWorkerInvocation(normalizedArgv))
-        return "codex_cli_rs";
-    return normalizedArgv.includes("run") ? "codex_exec" : "codex_cli_rs";
-}
 function formatAccountLabel(account, index) {
     const email = account?.email?.trim();
     const plan = account?.plan?.trim();
     const accountId = account?.accountId?.trim();
-    const idSuffix = accountId
-        ? accountId.length > 6
-            ? accountId.slice(-6)
-            : accountId
-        : null;
+    const idSuffix = accountId ? (accountId.length > 6 ? accountId.slice(-6) : accountId) : null;
     if (email && plan)
         return `${email} (${plan})`;
     if (email)
@@ -1082,7 +534,7 @@ function formatAccountLabel(account, index) {
     return `Account ${index + 1}`;
 }
 function hasActiveCooldown(account, now) {
-    return typeof account.cooldownUntil === "number" && Number.isFinite(account.cooldownUntil) && account.cooldownUntil > now;
+    return (typeof account.cooldownUntil === "number" && Number.isFinite(account.cooldownUntil) && account.cooldownUntil > now);
 }
 function ensureAccountAuthTypes(account) {
     const normalized = normalizeAccountAuthTypes(account.authTypes);
@@ -1128,13 +580,12 @@ function buildAuthMenuAccounts(input) {
             const existing = rows.get(identity);
             const currentStatus = hasActiveCooldown(account, now)
                 ? "rate-limited"
-                : typeof account.expires === "number" &&
-                    Number.isFinite(account.expires) &&
-                    account.expires <= now
+                : typeof account.expires === "number" && Number.isFinite(account.expires) && account.expires <= now
                     ? "expired"
                     : "unknown";
             if (!existing) {
-                const isCurrentAccount = authMode === input.activeMode && Boolean(domain.activeIdentityKey && account.identityKey === domain.activeIdentityKey);
+                const isCurrentAccount = authMode === input.activeMode &&
+                    Boolean(domain.activeIdentityKey && account.identityKey === domain.activeIdentityKey);
                 rows.set(identity, {
                     identityKey: account.identityKey,
                     index: rows.size,
@@ -1150,8 +601,7 @@ function buildAuthMenuAccounts(input) {
                 continue;
             }
             existing.authTypes = normalizeAccountAuthTypes([...(existing.authTypes ?? []), authMode]);
-            if (typeof account.lastUsed === "number" &&
-                (!existing.lastUsed || account.lastUsed > existing.lastUsed)) {
+            if (typeof account.lastUsed === "number" && (!existing.lastUsed || account.lastUsed > existing.lastUsed)) {
                 existing.lastUsed = account.lastUsed;
             }
             if (existing.enabled === false && account.enabled !== false) {
@@ -1160,12 +610,11 @@ function buildAuthMenuAccounts(input) {
             if (existing.status !== "rate-limited" && currentStatus === "rate-limited") {
                 existing.status = "rate-limited";
             }
-            else if (existing.status !== "rate-limited" &&
-                existing.status !== "expired" &&
-                currentStatus === "expired") {
+            else if (existing.status !== "rate-limited" && existing.status !== "expired" && currentStatus === "expired") {
                 existing.status = "expired";
             }
-            const isCurrentAccount = authMode === input.activeMode && Boolean(domain.activeIdentityKey && account.identityKey === domain.activeIdentityKey);
+            const isCurrentAccount = authMode === input.activeMode &&
+                Boolean(domain.activeIdentityKey && account.identityKey === domain.activeIdentityKey);
             if (isCurrentAccount) {
                 existing.isCurrentAccount = true;
                 existing.status = "active";
@@ -1177,9 +626,7 @@ function buildAuthMenuAccounts(input) {
     return Array.from(rows.values()).map((row, index) => ({ ...row, index }));
 }
 function hydrateAccountIdentityFromAccessClaims(account) {
-    const claims = typeof account.access === "string" && account.access.length > 0
-        ? parseJwtClaims(account.access)
-        : undefined;
+    const claims = typeof account.access === "string" && account.access.length > 0 ? parseJwtClaims(account.access) : undefined;
     if (!account.accountId)
         account.accountId = extractAccountIdFromClaims(claims);
     if (!account.email)
@@ -1193,35 +640,6 @@ function hydrateAccountIdentityFromAccessClaims(account) {
     ensureAccountAuthTypes(account);
     synchronizeIdentityKey(account);
 }
-async function selectCatalogAuthCandidate(authMode, pidOffsetEnabled, rotationStrategy) {
-    try {
-        const auth = await loadAuthStorage();
-        const domain = getOpenAIOAuthDomain(auth, authMode);
-        if (!domain) {
-            return {};
-        }
-        const selected = selectAccount({
-            accounts: domain.accounts,
-            strategy: rotationStrategy ?? domain.strategy,
-            activeIdentityKey: domain.activeIdentityKey,
-            now: Date.now(),
-            stickyPidOffset: pidOffsetEnabled
-        });
-        if (!selected?.access) {
-            return { accountId: selected?.accountId };
-        }
-        if (selected.expires && selected.expires <= Date.now()) {
-            return { accountId: selected.accountId };
-        }
-        return {
-            accessToken: selected.access,
-            accountId: selected.accountId
-        };
-    }
-    catch {
-        return {};
-    }
-}
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -1231,352 +649,9 @@ function asString(value) {
     const trimmed = value.trim();
     return trimmed ? trimmed : undefined;
 }
-function asStringArray(value) {
-    if (!Array.isArray(value))
-        return undefined;
-    return value.filter((item) => typeof item === "string" && item.trim().length > 0);
-}
-function normalizeReasoningSummaryOption(value) {
-    const normalized = asString(value)?.toLowerCase();
-    if (!normalized || normalized === "none")
-        return undefined;
-    if (normalized === "auto" || normalized === "concise" || normalized === "detailed")
-        return normalized;
-    return undefined;
-}
-function readModelRuntimeDefaults(options) {
-    const raw = options.codexRuntimeDefaults;
-    if (!isRecord(raw))
-        return {};
-    return {
-        applyPatchToolType: asString(raw.applyPatchToolType),
-        defaultReasoningEffort: asString(raw.defaultReasoningEffort),
-        supportsReasoningSummaries: typeof raw.supportsReasoningSummaries === "boolean" ? raw.supportsReasoningSummaries : undefined,
-        reasoningSummaryFormat: asString(raw.reasoningSummaryFormat),
-        defaultVerbosity: raw.defaultVerbosity === "low" || raw.defaultVerbosity === "medium" || raw.defaultVerbosity === "high"
-            ? raw.defaultVerbosity
-            : undefined,
-        supportsVerbosity: typeof raw.supportsVerbosity === "boolean" ? raw.supportsVerbosity : undefined
-    };
-}
-function mergeUnique(values) {
-    const out = [];
-    const seen = new Set();
-    for (const value of values) {
-        if (seen.has(value))
-            continue;
-        seen.add(value);
-        out.push(value);
-    }
-    return out;
-}
-function normalizePersonalityKey(value) {
-    const normalized = asString(value)?.toLowerCase();
-    if (!normalized)
-        return undefined;
-    if (normalized.includes("/") || normalized.includes("\\") || normalized.includes("..")) {
-        return undefined;
-    }
-    return normalized;
-}
-function getModelLookupCandidates(model) {
-    const out = [];
-    const seen = new Set();
-    const add = (value) => {
-        const trimmed = value?.trim();
-        if (!trimmed)
-            return;
-        if (seen.has(trimmed))
-            return;
-        seen.add(trimmed);
-        out.push(trimmed);
-    };
-    add(model.id);
-    add(model.api?.id);
-    add(model.id?.split("/").pop());
-    add(model.api?.id?.split("/").pop());
-    return out;
-}
-function getVariantLookupCandidates(input) {
-    const out = [];
-    const seen = new Set();
-    const add = (value) => {
-        const trimmed = value?.trim();
-        if (!trimmed)
-            return;
-        if (seen.has(trimmed))
-            return;
-        seen.add(trimmed);
-        out.push(trimmed);
-    };
-    if (isRecord(input.message)) {
-        add(asString(input.message.variant));
-    }
-    for (const candidate of input.modelCandidates) {
-        const slash = candidate.lastIndexOf("/");
-        if (slash <= 0 || slash >= candidate.length - 1)
-            continue;
-        add(candidate.slice(slash + 1));
-    }
-    return out;
-}
-const EFFORT_SUFFIX_REGEX = /-(none|minimal|low|medium|high|xhigh)$/i;
-function stripEffortSuffix(value) {
-    return value.replace(EFFORT_SUFFIX_REGEX, "");
-}
-function findCatalogModelForCandidates(catalogModels, modelCandidates) {
-    if (!catalogModels || catalogModels.length === 0)
-        return undefined;
-    const wanted = new Set();
-    for (const candidate of modelCandidates) {
-        const normalized = candidate.trim().toLowerCase();
-        if (!normalized)
-            continue;
-        wanted.add(normalized);
-        wanted.add(stripEffortSuffix(normalized));
-    }
-    return catalogModels.find((model) => {
-        const slug = model.slug.trim().toLowerCase();
-        if (!slug)
-            return false;
-        return wanted.has(slug) || wanted.has(stripEffortSuffix(slug));
-    });
-}
-function resolveCaseInsensitiveEntry(entries, candidate) {
-    if (!entries)
-        return undefined;
-    const direct = entries[candidate];
-    if (direct !== undefined)
-        return direct;
-    const lowered = entries[candidate.toLowerCase()];
-    if (lowered !== undefined)
-        return lowered;
-    const loweredCandidate = candidate.toLowerCase();
-    for (const [name, entry] of Object.entries(entries)) {
-        if (name.trim().toLowerCase() === loweredCandidate) {
-            return entry;
-        }
-    }
-    return undefined;
-}
-function getModelPersonalityOverride(customSettings, modelCandidates, variantCandidates) {
-    const models = customSettings?.models;
-    if (!models)
-        return undefined;
-    for (const candidate of modelCandidates) {
-        const entry = resolveCaseInsensitiveEntry(models, candidate);
-        if (!entry)
-            continue;
-        for (const variantCandidate of variantCandidates) {
-            const variantEntry = resolveCaseInsensitiveEntry(entry.variants, variantCandidate);
-            const variantPersonality = normalizePersonalityKey(variantEntry?.options?.personality);
-            if (variantPersonality)
-                return variantPersonality;
-        }
-        const modelPersonality = normalizePersonalityKey(entry.options?.personality);
-        if (modelPersonality)
-            return modelPersonality;
-    }
-    return undefined;
-}
-function getModelThinkingSummariesOverride(customSettings, modelCandidates, variantCandidates) {
-    const models = customSettings?.models;
-    if (!models)
-        return undefined;
-    for (const candidate of modelCandidates) {
-        const entry = resolveCaseInsensitiveEntry(models, candidate);
-        if (!entry)
-            continue;
-        for (const variantCandidate of variantCandidates) {
-            const variantEntry = resolveCaseInsensitiveEntry(entry.variants, variantCandidate);
-            if (typeof variantEntry?.thinkingSummaries === "boolean") {
-                return variantEntry.thinkingSummaries;
-            }
-        }
-        if (typeof entry.thinkingSummaries === "boolean") {
-            return entry.thinkingSummaries;
-        }
-    }
-    return undefined;
-}
-function resolvePersonalityForModel(input) {
-    const modelOverride = getModelPersonalityOverride(input.customSettings, input.modelCandidates, input.variantCandidates);
-    if (modelOverride)
-        return modelOverride;
-    const globalOverride = normalizePersonalityKey(input.customSettings?.options?.personality);
-    if (globalOverride)
-        return globalOverride;
-    return normalizePersonalityKey(input.fallback);
-}
-function applyCodexRuntimeDefaultsToParams(input) {
-    const options = input.output.options;
-    const modelOptions = input.modelOptions;
-    const defaults = readModelRuntimeDefaults(modelOptions);
-    const codexInstructions = asString(modelOptions.codexInstructions);
-    if (codexInstructions && (input.preferCodexInstructions || asString(options.instructions) === undefined)) {
-        options.instructions = codexInstructions;
-    }
-    if (asString(options.reasoningEffort) === undefined && defaults.defaultReasoningEffort) {
-        options.reasoningEffort = defaults.defaultReasoningEffort;
-    }
-    const reasoningEffort = asString(options.reasoningEffort);
-    const hasReasoning = reasoningEffort !== undefined && reasoningEffort !== "none";
-    const rawReasoningSummary = asString(options.reasoningSummary);
-    const hadExplicitReasoningSummary = rawReasoningSummary !== undefined;
-    const currentReasoningSummary = normalizeReasoningSummaryOption(rawReasoningSummary);
-    if (rawReasoningSummary !== undefined) {
-        if (currentReasoningSummary) {
-            options.reasoningSummary = currentReasoningSummary;
-        }
-        else {
-            delete options.reasoningSummary;
-        }
-    }
-    if (!hadExplicitReasoningSummary && currentReasoningSummary === undefined) {
-        if (hasReasoning &&
-            (defaults.supportsReasoningSummaries === true || input.thinkingSummariesOverride === true)) {
-            if (input.thinkingSummariesOverride === false) {
-                delete options.reasoningSummary;
-            }
-            else {
-                if (defaults.reasoningSummaryFormat?.toLowerCase() === "none") {
-                    delete options.reasoningSummary;
-                }
-                else {
-                    options.reasoningSummary = defaults.reasoningSummaryFormat ?? "auto";
-                }
-            }
-        }
-    }
-    if (asString(options.textVerbosity) === undefined &&
-        defaults.defaultVerbosity &&
-        (defaults.supportsVerbosity ?? true)) {
-        options.textVerbosity = defaults.defaultVerbosity;
-    }
-    if (asString(options.applyPatchToolType) === undefined && defaults.applyPatchToolType) {
-        options.applyPatchToolType = defaults.applyPatchToolType;
-    }
-    if (typeof options.parallelToolCalls !== "boolean" && input.modelToolCallCapable !== undefined) {
-        options.parallelToolCalls = input.modelToolCallCapable;
-    }
-    const shouldIncludeReasoning = hasReasoning &&
-        ((asString(options.reasoningSummary) !== undefined &&
-            asString(options.reasoningSummary)?.toLowerCase() !== "none") ||
-            defaults.supportsReasoningSummaries === true);
-    if (shouldIncludeReasoning) {
-        const include = asStringArray(options.include) ?? [];
-        options.include = mergeUnique([...include, "reasoning.encrypted_content"]);
-    }
-}
-async function sanitizeOutboundRequestIfNeeded(request, enabled) {
-    if (!enabled)
-        return { request, changed: false };
-    const method = request.method.toUpperCase();
-    if (method !== "POST")
-        return { request, changed: false };
-    let payload;
-    try {
-        const raw = await request.clone().text();
-        if (!raw)
-            return { request, changed: false };
-        payload = JSON.parse(raw);
-    }
-    catch {
-        return { request, changed: false };
-    }
-    if (!isRecord(payload))
-        return { request, changed: false };
-    const sanitized = sanitizeRequestPayloadForCompat(payload);
-    if (!sanitized.changed)
-        return { request, changed: false };
-    const headers = new Headers(request.headers);
-    headers.set("content-type", "application/json");
-    const sanitizedRequest = new Request(request.url, {
-        method: request.method,
-        headers,
-        body: JSON.stringify(sanitized.payload),
-        redirect: request.redirect
-    });
-    return { request: sanitizedRequest, changed: true };
-}
-function getVariantCandidatesFromBody(input) {
-    const out = [];
-    const seen = new Set();
-    const add = (value) => {
-        const trimmed = value?.trim().toLowerCase();
-        if (!trimmed)
-            return;
-        if (seen.has(trimmed))
-            return;
-        seen.add(trimmed);
-        out.push(trimmed);
-    };
-    const reasoning = isRecord(input.body.reasoning) ? input.body.reasoning : undefined;
-    add(asString(reasoning?.effort));
-    const normalizedSlug = input.modelSlug.trim().toLowerCase();
-    const suffix = normalizedSlug.match(EFFORT_SUFFIX_REGEX)?.[1];
-    add(suffix);
-    return out;
-}
-async function applyCatalogInstructionOverrideToRequest(input) {
-    if (!input.enabled)
-        return { request: input.request, changed: false };
-    const method = input.request.method.toUpperCase();
-    if (method !== "POST")
-        return { request: input.request, changed: false };
-    let payload;
-    try {
-        const raw = await input.request.clone().text();
-        if (!raw)
-            return { request: input.request, changed: false };
-        payload = JSON.parse(raw);
-    }
-    catch {
-        return { request: input.request, changed: false };
-    }
-    if (!isRecord(payload))
-        return { request: input.request, changed: false };
-    const modelSlugRaw = asString(payload.model);
-    if (!modelSlugRaw)
-        return { request: input.request, changed: false };
-    const modelCandidates = getModelLookupCandidates({
-        id: modelSlugRaw,
-        api: { id: modelSlugRaw }
-    });
-    const variantCandidates = getVariantCandidatesFromBody({
-        body: payload,
-        modelSlug: modelSlugRaw
-    });
-    const effectivePersonality = resolvePersonalityForModel({
-        customSettings: input.customSettings,
-        modelCandidates,
-        variantCandidates,
-        fallback: input.fallbackPersonality
-    });
-    const catalogModel = findCatalogModelForCandidates(input.catalogModels, modelCandidates);
-    if (!catalogModel)
-        return { request: input.request, changed: false };
-    const rendered = resolveInstructionsForModel(catalogModel, effectivePersonality);
-    if (!rendered)
-        return { request: input.request, changed: false };
-    if (asString(payload.instructions) === rendered) {
-        return { request: input.request, changed: false };
-    }
-    payload.instructions = rendered;
-    const headers = new Headers(input.request.headers);
-    headers.set("content-type", "application/json");
-    const updatedRequest = new Request(input.request.url, {
-        method: input.request.method,
-        headers,
-        body: JSON.stringify(payload),
-        redirect: input.request.redirect
-    });
-    return { request: updatedRequest, changed: true };
-}
 export async function CodexAuthPlugin(input, opts = {}) {
     opts.log?.debug("codex-native init");
-    const spoofMode = opts.spoofMode === "codex" ||
-        opts.spoofMode === "strict"
+    const spoofMode = opts.spoofMode === "codex" || opts.spoofMode === "strict"
         ? "codex"
         : "native";
     const runtimeMode = opts.mode === "collab" || opts.mode === "codex" || opts.mode === "native"
@@ -1586,11 +661,15 @@ export async function CodexAuthPlugin(input, opts = {}) {
             : "native";
     const collabModeEnabled = runtimeMode === "collab";
     const authMode = modeForRuntimeMode(runtimeMode);
+    void refreshCodexClientVersionFromGitHub(opts.log).catch(() => { });
     const resolveCatalogHeaders = () => {
         const originator = resolveCodexOriginator(spoofMode);
+        const codexClientVersion = resolveCodexClientVersion();
         return {
             originator,
             userAgent: resolveRequestUserAgent(spoofMode, originator),
+            clientVersion: codexClientVersion,
+            versionHeader: codexClientVersion,
             ...(spoofMode === "native" ? { openaiBeta: "responses=experimental" } : {})
         };
     };
@@ -1599,6 +678,7 @@ export async function CodexAuthPlugin(input, opts = {}) {
         log: opts.log
     });
     let lastCatalogModels;
+    const quotaFetchCooldownByIdentity = new Map();
     const showToast = async (message, variant = "info", quietMode = false) => {
         if (quietMode)
             return;
@@ -1616,6 +696,8 @@ export async function CodexAuthPlugin(input, opts = {}) {
     };
     const refreshQuotaSnapshotsForAuthMenu = async () => {
         const auth = await loadAuthStorage();
+        const snapshotPath = defaultSnapshotsPath();
+        const existingSnapshots = await loadSnapshots(snapshotPath).catch(() => ({}));
         const snapshotUpdates = {};
         for (const { mode, domain } of listOpenAIOAuthDomains(auth)) {
             for (let index = 0; index < domain.accounts.length; index += 1) {
@@ -1623,11 +705,22 @@ export async function CodexAuthPlugin(input, opts = {}) {
                 if (!account || account.enabled === false)
                     continue;
                 hydrateAccountIdentityFromAccessClaims(account);
-                let accessToken = typeof account.access === "string" && account.access.length > 0 ? account.access : undefined;
+                const identityKey = account.identityKey;
                 const now = Date.now();
-                const expired = typeof account.expires === "number" &&
-                    Number.isFinite(account.expires) &&
-                    account.expires <= now;
+                if (identityKey) {
+                    const cooldownUntil = quotaFetchCooldownByIdentity.get(identityKey);
+                    if (typeof cooldownUntil === "number" && cooldownUntil > now)
+                        continue;
+                    const existing = existingSnapshots[identityKey];
+                    if (existing &&
+                        typeof existing.updatedAt === "number" &&
+                        Number.isFinite(existing.updatedAt) &&
+                        now - existing.updatedAt < AUTH_MENU_QUOTA_SNAPSHOT_TTL_MS) {
+                        continue;
+                    }
+                }
+                let accessToken = typeof account.access === "string" && account.access.length > 0 ? account.access : undefined;
+                const expired = typeof account.expires === "number" && Number.isFinite(account.expires) && account.expires <= now;
                 if ((!accessToken || expired) && account.refresh) {
                     try {
                         await saveAuthStorage(undefined, async (authFile) => {
@@ -1658,6 +751,9 @@ export async function CodexAuthPlugin(input, opts = {}) {
                         });
                     }
                     catch (error) {
+                        if (identityKey) {
+                            quotaFetchCooldownByIdentity.set(identityKey, Date.now() + AUTH_MENU_QUOTA_FAILURE_COOLDOWN_MS);
+                        }
                         opts.log?.debug("quota check refresh failed", {
                             index,
                             mode,
@@ -1678,16 +774,20 @@ export async function CodexAuthPlugin(input, opts = {}) {
                     now: Date.now(),
                     modelFamily: "gpt-5.3-codex",
                     userAgent: resolveRequestUserAgent(spoofMode, resolveCodexOriginator(spoofMode)),
-                    log: opts.log
+                    log: opts.log,
+                    timeoutMs: AUTH_MENU_QUOTA_FETCH_TIMEOUT_MS
                 });
-                if (!snapshot)
+                if (!snapshot) {
+                    quotaFetchCooldownByIdentity.set(account.identityKey, Date.now() + AUTH_MENU_QUOTA_FAILURE_COOLDOWN_MS);
                     continue;
+                }
+                quotaFetchCooldownByIdentity.delete(account.identityKey);
                 snapshotUpdates[account.identityKey] = snapshot;
             }
         }
         if (Object.keys(snapshotUpdates).length === 0)
             return;
-        await saveSnapshots(defaultSnapshotsPath(), (current) => ({
+        await saveSnapshots(snapshotPath, (current) => ({
             ...current,
             ...snapshotUpdates
         }));
@@ -1779,9 +879,7 @@ export async function CodexAuthPlugin(input, opts = {}) {
                     },
                     onToggleAccount: async (account) => {
                         await saveAuthStorage(undefined, (authFile) => {
-                            const authTypes = account.authTypes && account.authTypes.length > 0
-                                ? [...account.authTypes]
-                                : ["native"];
+                            const authTypes = account.authTypes && account.authTypes.length > 0 ? [...account.authTypes] : ["native"];
                             for (const mode of authTypes) {
                                 const domain = getOpenAIOAuthDomain(authFile, mode);
                                 if (!domain)
@@ -1893,7 +991,9 @@ export async function CodexAuthPlugin(input, opts = {}) {
                 if (!hasOAuth)
                     return {};
                 const sessionAffinityPath = defaultSessionAffinityPath();
-                const loadedSessionAffinity = await loadSessionAffinity(sessionAffinityPath).catch(() => ({ version: 1 }));
+                const loadedSessionAffinity = await loadSessionAffinity(sessionAffinityPath).catch(() => ({
+                    version: 1
+                }));
                 const initialSessionAffinity = readSessionAffinitySnapshot(loadedSessionAffinity, authMode);
                 const sessionExists = createSessionExistsFn(process.env);
                 await pruneSessionAffinitySnapshot(initialSessionAffinity, sessionExists, {
@@ -1933,13 +1033,30 @@ export async function CodexAuthPlugin(input, opts = {}) {
                     ...resolveCatalogHeaders(),
                     onEvent: (event) => opts.log?.debug("codex model catalog", event)
                 });
-                lastCatalogModels = catalogModels;
-                applyCodexCatalogToProviderModels({
-                    providerModels: provider.models,
-                    catalogModels,
-                    fallbackModels: STATIC_FALLBACK_MODELS,
-                    personality: opts.personality
-                });
+                const applyCatalogModels = (models) => {
+                    if (models) {
+                        lastCatalogModels = models;
+                    }
+                    applyCodexCatalogToProviderModels({
+                        providerModels: provider.models,
+                        catalogModels: models ?? lastCatalogModels,
+                        fallbackModels: STATIC_FALLBACK_MODELS,
+                        personality: opts.personality
+                    });
+                };
+                applyCatalogModels(catalogModels);
+                const syncCatalogFromAuth = async (auth) => {
+                    if (!auth.accessToken)
+                        return undefined;
+                    const refreshedCatalog = await getCodexModelCatalog({
+                        accessToken: auth.accessToken,
+                        accountId: auth.accountId,
+                        ...resolveCatalogHeaders(),
+                        onEvent: (event) => opts.log?.debug("codex model catalog", event)
+                    });
+                    applyCatalogModels(refreshedCatalog);
+                    return refreshedCatalog;
+                };
                 return {
                     apiKey: OAUTH_DUMMY_KEY,
                     async fetch(requestInput, init) {
@@ -1948,9 +1065,7 @@ export async function CodexAuthPlugin(input, opts = {}) {
                         if (opts.headerTransformDebug === true) {
                             await requestSnapshots.captureRequest("before-header-transform", baseRequest, {
                                 spoofMode,
-                                ...(inboundCollaborationModeKind
-                                    ? { collaborationModeKind: inboundCollaborationModeKind }
-                                    : {})
+                                ...(inboundCollaborationModeKind ? { collaborationModeKind: inboundCollaborationModeKind } : {})
                             });
                         }
                         let outbound = new Request(rewriteUrl(baseRequest), baseRequest);
@@ -1986,6 +1101,7 @@ export async function CodexAuthPlugin(input, opts = {}) {
                             await requestSnapshots.captureRequest("after-header-transform", outbound, {
                                 spoofMode,
                                 instructionsOverridden: instructionOverride.changed,
+                                instructionOverrideReason: instructionOverride.reason,
                                 ...(collaborationModeKind ? { collaborationModeKind } : {}),
                                 ...(isSubagentRequest ? { subagent: subagentHeader } : {})
                             });
@@ -2122,8 +1238,7 @@ export async function CodexAuthPlugin(input, opts = {}) {
                                                 tokens = await refreshAccessToken(selected.refresh);
                                             }
                                             catch (error) {
-                                                if (isOAuthTokenRefreshError(error) &&
-                                                    error.oauthCode?.toLowerCase() === "invalid_grant") {
+                                                if (isOAuthTokenRefreshError(error) && error.oauthCode?.toLowerCase() === "invalid_grant") {
                                                     sawInvalidGrant = true;
                                                     selected.enabled = false;
                                                     delete selected.cooldownUntil;
@@ -2233,12 +1348,23 @@ export async function CodexAuthPlugin(input, opts = {}) {
                                         param: "auth"
                                     });
                                 }
-                                void getCodexModelCatalog({
-                                    accessToken: access,
-                                    accountId,
-                                    ...resolveCatalogHeaders(),
-                                    onEvent: (event) => opts.log?.debug("codex model catalog", event)
-                                }).catch(() => { });
+                                if (spoofMode === "codex") {
+                                    const shouldAwaitCatalog = !lastCatalogModels || lastCatalogModels.length === 0;
+                                    if (shouldAwaitCatalog) {
+                                        try {
+                                            await syncCatalogFromAuth({ accessToken: access, accountId });
+                                        }
+                                        catch {
+                                            // best-effort catalog load; request can still proceed
+                                        }
+                                    }
+                                    else {
+                                        void syncCatalogFromAuth({ accessToken: access, accountId }).catch(() => { });
+                                    }
+                                }
+                                else {
+                                    void syncCatalogFromAuth({ accessToken: access, accountId }).catch(() => { });
+                                }
                                 selectedIdentityKey = identityKey;
                                 return { access, accountId, identityKey, accountLabel, email, plan };
                             },
@@ -2260,14 +1386,24 @@ export async function CodexAuthPlugin(input, opts = {}) {
                             },
                             showToast,
                             onAttemptRequest: async ({ attempt, maxAttempts, request, auth, sessionKey }) => {
-                                await requestSnapshots.captureRequest("outbound-attempt", request, {
+                                const instructionOverride = await applyCatalogInstructionOverrideToRequest({
+                                    request,
+                                    enabled: spoofMode === "codex",
+                                    catalogModels: lastCatalogModels,
+                                    customSettings: opts.customSettings,
+                                    fallbackPersonality: opts.personality
+                                });
+                                await requestSnapshots.captureRequest("outbound-attempt", instructionOverride.request, {
                                     attempt: attempt + 1,
                                     maxAttempts,
                                     sessionKey,
                                     identityKey: auth.identityKey,
                                     accountLabel: auth.accountLabel,
+                                    instructionsOverridden: instructionOverride.changed,
+                                    instructionOverrideReason: instructionOverride.reason,
                                     ...(collaborationModeKind ? { collaborationModeKind } : {})
                                 });
+                                return instructionOverride.request;
                             },
                             onAttemptResponse: async ({ attempt, maxAttempts, response, auth, sessionKey }) => {
                                 await requestSnapshots.captureResponse("outbound-response", response, {
@@ -2289,6 +1425,20 @@ export async function CodexAuthPlugin(input, opts = {}) {
                             sanitized: sanitizedOutbound.changed,
                             ...(collaborationModeKind ? { collaborationModeKind } : {})
                         });
+                        try {
+                            assertAllowedOutboundUrl(new URL(sanitizedOutbound.request.url));
+                        }
+                        catch (error) {
+                            if (isPluginFatalError(error)) {
+                                return toSyntheticErrorResponse(error);
+                            }
+                            return toSyntheticErrorResponse(new PluginFatalError({
+                                message: "Outbound request validation failed before sending to OpenAI backend.",
+                                status: 400,
+                                type: "disallowed_outbound_request",
+                                param: "request"
+                            }));
+                        }
                         let response;
                         try {
                             response = await orchestrator.execute(sanitizedOutbound.request);
@@ -2368,7 +1518,6 @@ export async function CodexAuthPlugin(input, opts = {}) {
                                 return null;
                             }
                             finally {
-                                pendingOAuth = undefined;
                                 scheduleOAuthServerStop(authFailed ? OAUTH_SERVER_SHUTDOWN_ERROR_GRACE_MS : OAUTH_SERVER_SHUTDOWN_GRACE_MS, authFailed ? "error" : "success");
                             }
                         };
@@ -2406,10 +1555,7 @@ export async function CodexAuthPlugin(input, opts = {}) {
                                 };
                             }
                         };
-                        if (inputs &&
-                            process.env.OPENCODE_NO_BROWSER !== "1" &&
-                            process.stdin.isTTY &&
-                            process.stdout.isTTY) {
+                        if (inputs && process.env.OPENCODE_NO_BROWSER !== "1" && process.stdin.isTTY && process.stdout.isTTY) {
                             return runInteractiveBrowserAuthLoop();
                         }
                         const { redirectUri } = await startOAuthServer();
@@ -2434,7 +1580,6 @@ export async function CodexAuthPlugin(input, opts = {}) {
                                     return { type: "failed" };
                                 }
                                 finally {
-                                    pendingOAuth = undefined;
                                     scheduleOAuthServerStop(authFailed ? OAUTH_SERVER_SHUTDOWN_ERROR_GRACE_MS : OAUTH_SERVER_SHUTDOWN_GRACE_MS, authFailed ? "error" : "success");
                                 }
                             }
@@ -2518,9 +1663,8 @@ export async function CodexAuthPlugin(input, opts = {}) {
         },
         "chat.message": async (hookInput, output) => {
             const directProviderID = hookInput.model?.providerID;
-            const isOpenAI = directProviderID === "openai"
-                || (directProviderID === undefined
-                    && (await sessionUsesOpenAIProvider(input.client, hookInput.sessionID)));
+            const isOpenAI = directProviderID === "openai" ||
+                (directProviderID === undefined && (await sessionUsesOpenAIProvider(input.client, hookInput.sessionID)));
             if (!isOpenAI)
                 return;
             for (const part of output.parts) {
@@ -2536,9 +1680,7 @@ export async function CodexAuthPlugin(input, opts = {}) {
             if (hookInput.model.providerID !== "openai")
                 return;
             const initialReasoningEffort = asString(output.options.reasoningEffort);
-            const collaborationProfile = collabModeEnabled
-                ? resolveCollaborationProfile(hookInput.agent)
-                : { enabled: false };
+            const collaborationProfile = collabModeEnabled ? resolveCollaborationProfile(hookInput.agent) : { enabled: false };
             const modelOptions = isRecord(hookInput.model.options) ? hookInput.model.options : {};
             const modelCandidates = getModelLookupCandidates({
                 id: hookInput.model.id,
@@ -2594,7 +1736,12 @@ export async function CodexAuthPlugin(input, opts = {}) {
             });
             if (collabModeEnabled && collaborationProfile.enabled && collaborationProfile.kind) {
                 const collaborationModeKind = collaborationProfile.kind;
-                const collaborationInstructions = resolveCollaborationInstructions(collaborationModeKind);
+                const collaborationInstructions = resolveCollaborationInstructions(collaborationModeKind, {
+                    plan: CODEX_PLAN_MODE_INSTRUCTIONS,
+                    code: CODEX_CODE_MODE_INSTRUCTIONS,
+                    execute: CODEX_EXECUTE_MODE_INSTRUCTIONS,
+                    pairProgramming: CODEX_PAIR_PROGRAMMING_MODE_INSTRUCTIONS
+                });
                 const mergedInstructions = mergeInstructions(asString(output.options.instructions), collaborationInstructions);
                 if (mergedInstructions) {
                     output.options.instructions = mergedInstructions;
@@ -2612,9 +1759,7 @@ export async function CodexAuthPlugin(input, opts = {}) {
         "chat.headers": async (hookInput, output) => {
             if (hookInput.model.providerID !== "openai")
                 return;
-            const collaborationProfile = collabModeEnabled
-                ? resolveCollaborationProfile(hookInput.agent)
-                : { enabled: false };
+            const collaborationProfile = collabModeEnabled ? resolveCollaborationProfile(hookInput.agent) : { enabled: false };
             const collaborationModeKind = collaborationProfile.enabled ? collaborationProfile.kind : undefined;
             const originator = resolveCodexOriginator(spoofMode);
             output.headers.originator = originator;