@iam-brain/opencode-codex-auth 0.3.0 → 0.3.2

package/dist/lib/codex-native/acquire-auth.js

@@ -0,0 +1,338 @@
+import { PluginFatalError, formatWaitTime, isPluginFatalError } from "../fatal-errors";
+import { ensureIdentityKey, normalizeEmail, normalizePlan } from "../identity";
+import { createStickySessionState, selectAccount } from "../rotation";
+import { ensureOpenAIOAuthDomain, saveAuthStorage } from "../storage";
+import { parseJwtClaims } from "../claims";
+import { formatAccountLabel } from "./accounts";
+import { extractAccountId, refreshAccessToken } from "./oauth-utils";
+const AUTH_REFRESH_FAILURE_COOLDOWN_MS = 30_000;
+const AUTH_REFRESH_LEASE_MS = 30_000;
+function isOAuthTokenRefreshError(value) {
+    return value instanceof Error && ("status" in value || "oauthCode" in value);
+}
+export function createAcquireOpenAIAuthInputDefaults() {
+    return {
+        stickySessionState: createStickySessionState(),
+        hybridSessionState: createStickySessionState()
+    };
+}
+export async function acquireOpenAIAuth(input) {
+    let access;
+    let accountId;
+    let identityKey;
+    let accountLabel;
+    let email;
+    let plan;
+    const attempted = new Set();
+    let sawInvalidGrant = false;
+    let sawRefreshFailure = false;
+    let sawMissingRefresh = false;
+    let totalAccounts = 0;
+    let rotationLogged = false;
+    try {
+        if (input.isSubagentRequest && input.context?.sessionKey) {
+            input.seenSessionKeys.delete(input.context.sessionKey);
+            input.stickySessionState.bySessionKey.delete(input.context.sessionKey);
+            input.hybridSessionState.bySessionKey.delete(input.context.sessionKey);
+        }
+        while (true) {
+            let refreshClaim;
+            let shouldStop = false;
+            await saveAuthStorage(undefined, (authFile) => {
+                const now = Date.now();
+                const openai = authFile.openai;
+                if (!openai || openai.type !== "oauth") {
+                    throw new PluginFatalError({
+                        message: "Not authenticated with OpenAI. Run `opencode auth login`.",
+                        status: 401,
+                        type: "oauth_not_configured",
+                        param: "auth"
+                    });
+                }
+                const domain = ensureOpenAIOAuthDomain(authFile, input.authMode);
+                totalAccounts = domain.accounts.length;
+                if (domain.accounts.length === 0) {
+                    throw new PluginFatalError({
+                        message: `No OpenAI ${input.authMode} accounts configured. Run \`opencode auth login\`.`,
+                        status: 401,
+                        type: "no_accounts_configured",
+                        param: "accounts"
+                    });
+                }
+                const enabled = domain.accounts.filter((account) => account.enabled !== false);
+                if (enabled.length === 0) {
+                    throw new PluginFatalError({
+                        message: `No enabled OpenAI ${input.authMode} accounts available. Enable an account or run \`opencode auth login\`.`,
+                        status: 403,
+                        type: "no_enabled_accounts",
+                        param: "accounts"
+                    });
+                }
+                const rotationStrategy = input.configuredRotationStrategy ?? domain.strategy ?? "sticky";
+                if (!rotationLogged) {
+                    input.log?.debug("rotation begin", {
+                        strategy: rotationStrategy,
+                        activeIdentityKey: domain.activeIdentityKey,
+                        totalAccounts: domain.accounts.length,
+                        enabledAccounts: enabled.length,
+                        mode: input.authMode,
+                        sessionKey: input.context?.sessionKey ?? null
+                    });
+                    rotationLogged = true;
+                }
+                if (attempted.size >= domain.accounts.length) {
+                    shouldStop = true;
+                    return;
+                }
+                const sessionState = rotationStrategy === "sticky"
+                    ? input.stickySessionState
+                    : rotationStrategy === "hybrid"
+                        ? input.hybridSessionState
+                        : undefined;
+                const selected = selectAccount({
+                    accounts: domain.accounts,
+                    strategy: rotationStrategy,
+                    activeIdentityKey: domain.activeIdentityKey,
+                    now,
+                    stickyPidOffset: input.pidOffsetEnabled,
+                    stickySessionKey: input.isSubagentRequest ? undefined : input.context?.sessionKey,
+                    stickySessionState: sessionState,
+                    onDebug: (event) => {
+                        input.log?.debug("rotation decision", event);
+                    }
+                });
+                if (!selected) {
+                    input.log?.debug("rotation stop: no selectable account", {
+                        attempted: attempted.size,
+                        totalAccounts: domain.accounts.length
+                    });
+                    shouldStop = true;
+                    return;
+                }
+                const selectedIndex = domain.accounts.findIndex((account) => account === selected);
+                const attemptKey = selected.identityKey ??
+                    selected.refresh ??
+                    (selectedIndex >= 0 ? `idx:${selectedIndex}` : `idx:${attempted.size}`);
+                if (attempted.has(attemptKey)) {
+                    input.log?.debug("rotation stop: duplicate attempt key", {
+                        attemptKey,
+                        selectedIdentityKey: selected.identityKey,
+                        selectedIndex
+                    });
+                    shouldStop = true;
+                    return;
+                }
+                attempted.add(attemptKey);
+                if (!input.isSubagentRequest && input.context?.sessionKey && sessionState) {
+                    input.persistSessionAffinityState();
+                }
+                input.log?.debug("rotation candidate selected", {
+                    attemptKey,
+                    selectedIdentityKey: selected.identityKey,
+                    selectedIndex,
+                    selectedEnabled: selected.enabled !== false,
+                    selectedCooldownUntil: selected.cooldownUntil ?? null,
+                    selectedExpires: selected.expires ?? null
+                });
+                accountLabel = formatAccountLabel(selected, selectedIndex >= 0 ? selectedIndex : 0);
+                email = selected.email;
+                plan = selected.plan;
+                if (selected.access && selected.expires && selected.expires > now) {
+                    selected.lastUsed = now;
+                    access = selected.access;
+                    accountId = selected.accountId;
+                    identityKey = selected.identityKey;
+                    if (selected.identityKey)
+                        domain.activeIdentityKey = selected.identityKey;
+                    return;
+                }
+                if (!selected.refresh) {
+                    sawMissingRefresh = true;
+                    selected.cooldownUntil = now + AUTH_REFRESH_FAILURE_COOLDOWN_MS;
+                    return;
+                }
+                if (!selected.identityKey) {
+                    sawRefreshFailure = true;
+                    selected.cooldownUntil = now + AUTH_REFRESH_FAILURE_COOLDOWN_MS;
+                    return;
+                }
+                selected.refreshLeaseUntil = now + AUTH_REFRESH_LEASE_MS;
+                refreshClaim = {
+                    identityKey: selected.identityKey,
+                    refreshToken: selected.refresh
+                };
+            });
+            if (access)
+                break;
+            if (!refreshClaim) {
+                if (shouldStop || (totalAccounts > 0 && attempted.size >= totalAccounts)) {
+                    break;
+                }
+                continue;
+            }
+            try {
+                const tokens = await refreshAccessToken(refreshClaim.refreshToken);
+                const refreshedExpires = Date.now() + (tokens.expires_in ?? 3600) * 1000;
+                const refreshedAccountId = extractAccountId(tokens);
+                const claims = parseJwtClaims(tokens.id_token ?? tokens.access_token);
+                await saveAuthStorage(undefined, (authFile) => {
+                    const domain = ensureOpenAIOAuthDomain(authFile, input.authMode);
+                    const selected = domain.accounts.find((account) => account.identityKey === refreshClaim?.identityKey);
+                    if (!selected)
+                        return;
+                    if (selected.enabled === false) {
+                        delete selected.refreshLeaseUntil;
+                        return;
+                    }
+                    const now = Date.now();
+                    if (typeof selected.refreshLeaseUntil !== "number" || selected.refreshLeaseUntil <= now) {
+                        delete selected.refreshLeaseUntil;
+                        return;
+                    }
+                    selected.refresh = tokens.refresh_token;
+                    selected.access = tokens.access_token;
+                    selected.expires = refreshedExpires;
+                    selected.accountId = refreshedAccountId || selected.accountId;
+                    if (claims?.email)
+                        selected.email = normalizeEmail(claims.email);
+                    if (claims?.plan)
+                        selected.plan = normalizePlan(claims.plan);
+                    ensureIdentityKey(selected);
+                    selected.lastUsed = now;
+                    delete selected.refreshLeaseUntil;
+                    delete selected.cooldownUntil;
+                    if (selected.identityKey)
+                        domain.activeIdentityKey = selected.identityKey;
+                    accountLabel = formatAccountLabel(selected, 0);
+                    email = selected.email;
+                    plan = selected.plan;
+                    access = selected.access;
+                    accountId = selected.accountId;
+                    identityKey = selected.identityKey;
+                });
+            }
+            catch (error) {
+                const invalidGrant = isOAuthTokenRefreshError(error) && error.oauthCode?.toLowerCase() === "invalid_grant";
+                if (invalidGrant) {
+                    sawInvalidGrant = true;
+                }
+                else {
+                    sawRefreshFailure = true;
+                }
+                await saveAuthStorage(undefined, (authFile) => {
+                    const domain = ensureOpenAIOAuthDomain(authFile, input.authMode);
+                    const selected = domain.accounts.find((account) => account.identityKey === refreshClaim?.identityKey);
+                    if (!selected)
+                        return;
+                    delete selected.refreshLeaseUntil;
+                    if (invalidGrant) {
+                        selected.enabled = false;
+                        delete selected.cooldownUntil;
+                        return;
+                    }
+                    if (selected.enabled === false)
+                        return;
+                    selected.cooldownUntil = Date.now() + AUTH_REFRESH_FAILURE_COOLDOWN_MS;
+                });
+            }
+            if (access)
+                break;
+            if (totalAccounts > 0 && attempted.size >= totalAccounts) {
+                break;
+            }
+        }
+        if (!access) {
+            await saveAuthStorage(undefined, (authFile) => {
+                const now = Date.now();
+                const openai = authFile.openai;
+                if (!openai || openai.type !== "oauth") {
+                    throw new PluginFatalError({
+                        message: "Not authenticated with OpenAI. Run `opencode auth login`.",
+                        status: 401,
+                        type: "oauth_not_configured",
+                        param: "auth"
+                    });
+                }
+                const domain = ensureOpenAIOAuthDomain(authFile, input.authMode);
+                const enabledAfterAttempts = domain.accounts.filter((account) => account.enabled !== false);
+                if (enabledAfterAttempts.length === 0 && sawInvalidGrant) {
+                    throw new PluginFatalError({
+                        message: "All enabled OpenAI refresh tokens were rejected (invalid_grant). Run `opencode auth login` to reauthenticate.",
+                        status: 401,
+                        type: "refresh_invalid_grant",
+                        param: "auth"
+                    });
+                }
+                const nextAvailableAt = enabledAfterAttempts.reduce((current, account) => {
+                    const cooldownUntil = typeof account.refreshLeaseUntil === "number" && account.refreshLeaseUntil > now
+                        ? account.refreshLeaseUntil
+                        : account.cooldownUntil;
+                    if (typeof cooldownUntil !== "number" || cooldownUntil <= now)
+                        return current;
+                    if (current === undefined || cooldownUntil < current)
+                        return cooldownUntil;
+                    return current;
+                }, undefined);
+                if (nextAvailableAt !== undefined) {
+                    const waitMs = Math.max(0, nextAvailableAt - now);
+                    throw new PluginFatalError({
+                        message: `All enabled OpenAI accounts are cooling down. Try again in ${formatWaitTime(waitMs)} or run \`opencode auth login\`.`,
+                        status: 429,
+                        type: "all_accounts_cooling_down",
+                        param: "accounts"
+                    });
+                }
+                if (sawInvalidGrant) {
+                    throw new PluginFatalError({
+                        message: "OpenAI refresh token was rejected (invalid_grant). Run `opencode auth login` to reauthenticate this account.",
+                        status: 401,
+                        type: "refresh_invalid_grant",
+                        param: "auth"
+                    });
+                }
+                if (sawMissingRefresh) {
+                    throw new PluginFatalError({
+                        message: "Selected OpenAI account is missing a refresh token. Run `opencode auth login` to reauthenticate.",
+                        status: 401,
+                        type: "missing_refresh_token",
+                        param: "accounts"
+                    });
+                }
+                if (sawRefreshFailure) {
+                    throw new PluginFatalError({
+                        message: "Failed to refresh OpenAI access token. Run `opencode auth login` and try again.",
+                        status: 401,
+                        type: "refresh_failed",
+                        param: "auth"
+                    });
+                }
+                throw new PluginFatalError({
+                    message: `No enabled OpenAI ${input.authMode} accounts available. Enable an account or run \`opencode auth login\`.`,
+                    status: 403,
+                    type: "no_enabled_accounts",
+                    param: "accounts"
+                });
+            });
+        }
+    }
+    catch (error) {
+        if (isPluginFatalError(error))
+            throw error;
+        throw new PluginFatalError({
+            message: "Unable to access OpenAI auth storage. Check plugin configuration and run `opencode auth login` if needed.",
+            status: 500,
+            type: "auth_storage_error",
+            param: "auth"
+        });
+    }
+    if (!access) {
+        throw new PluginFatalError({
+            message: "No valid OpenAI access token available. Run `opencode auth login`.",
+            status: 401,
+            type: "no_valid_access_token",
+            param: "auth"
+        });
+    }
+    return { access, accountId, identityKey, accountLabel, email, plan };
+}
+//# sourceMappingURL=acquire-auth.js.map

package/dist/lib/codex-native/acquire-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"acquire-auth.js","sourceRoot":"","sources":["../../../lib/codex-native/acquire-auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACtF,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE9E,OAAO,EAAE,wBAAwB,EAAE,aAAa,EAA2B,MAAM,aAAa,CAAA;AAC9F,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAErE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAA+B,MAAM,eAAe,CAAA;AAEjG,MAAM,gCAAgC,GAAG,MAAM,CAAA;AAC/C,MAAM,qBAAqB,GAAG,MAAM,CAAA;AAEpC,SAAS,wBAAwB,CAAC,KAAc;IAC9C,OAAO,KAAK,YAAY,KAAK,IAAI,CAAC,QAAQ,IAAI,KAAK,IAAI,WAAW,IAAI,KAAK,CAAC,CAAA;AAC9E,CAAC;AAoBD,MAAM,UAAU,oCAAoC;IAIlD,OAAO;QACL,kBAAkB,EAAE,wBAAwB,EAAE;QAC9C,kBAAkB,EAAE,wBAAwB,EAAE;KAC/C,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAA6B;IACnE,IAAI,MAA0B,CAAA;IAC9B,IAAI,SAA6B,CAAA;IACjC,IAAI,WAA+B,CAAA;IACnC,IAAI,YAAgC,CAAA;IACpC,IAAI,KAAyB,CAAA;IAC7B,IAAI,IAAwB,CAAA;IAC5B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAA;IACnC,IAAI,eAAe,GAAG,KAAK,CAAA;IAC3B,IAAI,iBAAiB,GAAG,KAAK,CAAA;IAC7B,IAAI,iBAAiB,GAAG,KAAK,CAAA;IAC7B,IAAI,aAAa,GAAG,CAAC,CAAA;IACrB,IAAI,cAAc,GAAG,KAAK,CAAA;IAE1B,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC;YACzD,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;YACtD,KAAK,CAAC,kBAAkB,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;YACtE,KAAK,CAAC,kBAAkB,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;QACxE,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;YACZ,IAAI,YAAsC,CAAA;YAC1C,IAAI,UAAU,GAAG,KAAK,CAAA;YAEtB,MAAM,eAAe,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,EAAE;gBAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;gBACtB,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAA;gBAC9B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBACvC,MAAM,IAAI,gBAAgB,CAAC;wBACzB,OAAO,EAAE,2DAA2D;wBACpE,MAAM,EAAE,GAAG;wBACX,IAAI,EAAE,sBAAsB;wBAC5B,KAAK,EAAE,MAAM;qBACd,CAAC,CAAA;gBACJ,CAAC;gBAED,MAAM,MAAM,GAAG,uBAAuB,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;gBAChE,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAA;gBACtC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACjC,MAAM,IAAI,gBAAgB,CAAC;wBACzB,OAAO,EAAE,aAAa,KAAK,CAAC,QAAQ,oDAAoD;wBACxF,MAAM,EAAE,GAAG;wBACX,IAAI,EAAE,wBAAwB;wBAC9B,KAAK,EAAE,UAAU;qBAClB,CAAC,CAAA;gBACJ,CAAC;gBAED,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,CAAA;gBAC9E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACzB,MAAM,IAAI,gBAAgB,CAAC;wBACzB,OAAO,EAAE,qBAAqB,KAAK,CAAC,QAAQ,wEAAwE;wBACpH,MAAM,EAAE,GAAG;wBACX,IAAI,EAAE,qBAAqB;wBAC3B,KAAK,EAAE,UAAU;qBAClB,CAAC,CAAA;gBACJ,CAAC;gBAED,MAAM,gBAAgB,GAAqB,KAAK,CAAC,0BAA0B,IAAI,MAAM,CAAC,QAAQ,IAAI,QAAQ,CAAA;gBAC1G,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,gBAAgB,EAAE;wBACjC,QAAQ,EAAE,gBAAgB;wBAC1B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;wBAC3C,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;wBACrC,eAAe,EAAE,OAAO,CAAC,MAAM;wBAC/B,IAAI,EAAE,KAAK,CAAC,QAAQ;wBACpB,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,IAAI,IAAI;qBAC9C,CAAC,CAAA;oBACF,cAAc,GAAG,IAAI,CAAA;gBACvB,CAAC;gBAED,IAAI,SAAS,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;oBAC7C,UAAU,GAAG,IAAI,CAAA;oBACjB,OAAM;gBACR,CAAC;gBAED,MAAM,YAAY,GAChB,gBAAgB,KAAK,QAAQ;oBAC3B,CAAC,CAAC,KAAK,CAAC,kBAAkB;oBAC1B,CAAC,CAAC,gBAAgB,KAAK,QAAQ;wBAC7B,CAAC,CAAC,KAAK,CAAC,kBAAkB;wBAC1B,CAAC,CAAC,SAAS,CAAA;gBAEjB,MAAM,QAAQ,GAAG,aAAa,CAAC;oBAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,QAAQ,EAAE,gBAAgB;oBAC1B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;oBAC3C,GAAG;oBACH,eAAe,EAAE,KAAK,CAAC,gBAAgB;oBACvC,gBAAgB,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU;oBACjF,kBAAkB,EAAE,YAAY;oBAChC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;wBACjB,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAA;oBAC9C,CAAC;iBACF,CAAC,CAAA;gBAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,sCAAsC,EAAE;wBACvD,SAAS,EAAE,SAAS,CAAC,IAAI;wBACzB,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;qBACtC,CAAC,CAAA;oBACF,UAAU,GAAG,IAAI,CAAA;oBACjB,OAAM;gBACR,CAAC;gBAED,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAA;gBAClF,MAAM,UAAU,GACd,QAAQ,CAAC,WAAW;oBACpB,QAAQ,CAAC,OAAO;oBAChB,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,aAAa,EAAE,CAAC,CAAC,CAAC,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC,CAAA;gBAEzE,IAAI,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC9B,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,sCAAsC,EAAE;wBACvD,UAAU;wBACV,mBAAmB,EAAE,QAAQ,CAAC,WAAW;wBACzC,aAAa;qBACd,CAAC,CAAA;oBACF,UAAU,GAAG,IAAI,CAAA;oBACjB,OAAM;gBACR,CAAC;gBAED,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;gBACzB,IAAI,CAAC,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,OAAO,EAAE,UAAU,IAAI,YAAY,EAAE,CAAC;oBAC1E,KAAK,CAAC,2BAA2B,EAAE,CAAA;gBACrC,CAAC;gBAED,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,6BAA6B,EAAE;oBAC9C,UAAU;oBACV,mBAAmB,EAAE,QAAQ,CAAC,WAAW;oBACzC,aAAa;oBACb,eAAe,EAAE,QAAQ,CAAC,OAAO,KAAK,KAAK;oBAC3C,qBAAqB,EAAE,QAAQ,CAAC,aAAa,IAAI,IAAI;oBACrD,eAAe,EAAE,QAAQ,CAAC,OAAO,IAAI,IAAI;iBAC1C,CAAC,CAAA;gBAEF,YAAY,GAAG,kBAAkB,CAAC,QAAQ,EAAE,aAAa,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;gBACnF,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAA;gBACtB,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAA;gBAEpB,IAAI,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC;oBAClE,QAAQ,CAAC,QAAQ,GAAG,GAAG,CAAA;oBACvB,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAA;oBACxB,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAA;oBAC9B,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAA;oBAClC,IAAI,QAAQ,CAAC,WAAW;wBAAE,MAAM,CAAC,iBAAiB,GAAG,QAAQ,CAAC,WAAW,CAAA;oBACzE,OAAM;gBACR,CAAC;gBAED,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACtB,iBAAiB,GAAG,IAAI,CAAA;oBACxB,QAAQ,CAAC,aAAa,GAAG,GAAG,GAAG,gCAAgC,CAAA;oBAC/D,OAAM;gBACR,CAAC;gBAED,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;oBAC1B,iBAAiB,GAAG,IAAI,CAAA;oBACxB,QAAQ,CAAC,aAAa,GAAG,GAAG,GAAG,gCAAgC,CAAA;oBAC/D,OAAM;gBACR,CAAC;gBAED,QAAQ,CAAC,iBAAiB,GAAG,GAAG,GAAG,qBAAqB,CAAA;gBACxD,YAAY,GAAG;oBACb,WAAW,EAAE,QAAQ,CAAC,WAAW;oBACjC,YAAY,EAAE,QAAQ,CAAC,OAAO;iBAC/B,CAAA;YACH,CAAC,CAAC,CAAA;YAEF,IAAI,MAAM;gBAAE,MAAK;YACjB,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,IAAI,UAAU,IAAI,CAAC,aAAa,GAAG,CAAC,IAAI,SAAS,CAAC,IAAI,IAAI,aAAa,CAAC,EAAE,CAAC;oBACzE,MAAK;gBACP,CAAC;gBACD,SAAQ;YACV,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,YAAY,CAAC,YAAY,CAAC,CAAA;gBAClE,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI,CAAA;gBACxE,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAA;gBACnD,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,YAAY,CAAC,CAAA;gBAErE,MAAM,eAAe,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,EAAE;oBAC5C,MAAM,MAAM,GAAG,uBAAuB,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;oBAChE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,KAAK,YAAY,EAAE,WAAW,CAAC,CAAA;oBACrG,IAAI,CAAC,QAAQ;wBAAE,OAAM;oBAErB,IAAI,QAAQ,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;wBAC/B,OAAO,QAAQ,CAAC,iBAAiB,CAAA;wBACjC,OAAM;oBACR,CAAC;oBAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;oBACtB,IAAI,OAAO,QAAQ,CAAC,iBAAiB,KAAK,QAAQ,IAAI,QAAQ,CAAC,iBAAiB,IAAI,GAAG,EAAE,CAAC;wBACxF,OAAO,QAAQ,CAAC,iBAAiB,CAAA;wBACjC,OAAM;oBACR,CAAC;oBAED,QAAQ,CAAC,OAAO,GAAG,MAAM,CAAC,aAAa,CAAA;oBACvC,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,YAAY,CAAA;oBACrC,QAAQ,CAAC,OAAO,GAAG,gBAAgB,CAAA;oBACnC,QAAQ,CAAC,SAAS,GAAG,kBAAkB,IAAI,QAAQ,CAAC,SAAS,CAAA;oBAC7D,IAAI,MAAM,EAAE,KAAK;wBAAE,QAAQ,CAAC,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;oBAChE,IAAI,MAAM,EAAE,IAAI;wBAAE,QAAQ,CAAC,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;oBAC5D,iBAAiB,CAAC,QAAQ,CAAC,CAAA;oBAC3B,QAAQ,CAAC,QAAQ,GAAG,GAAG,CAAA;oBACvB,OAAO,QAAQ,CAAC,iBAAiB,CAAA;oBACjC,OAAO,QAAQ,CAAC,aAAa,CAAA;oBAC7B,IAAI,QAAQ,CAAC,WAAW;wBAAE,MAAM,CAAC,iBAAiB,GAAG,QAAQ,CAAC,WAAW,CAAA;oBAEzE,YAAY,GAAG,kBAAkB,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;oBAC9C,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAA;oBACtB,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAA;oBACpB,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAA;oBACxB,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAA;oBAC9B,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAA;gBACpC,CAAC,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,YAAY,GAAG,wBAAwB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,eAAe,CAAA;gBAC1G,IAAI,YAAY,EAAE,CAAC;oBACjB,eAAe,GAAG,IAAI,CAAA;gBACxB,CAAC;qBAAM,CAAC;oBACN,iBAAiB,GAAG,IAAI,CAAA;gBAC1B,CAAC;gBAED,MAAM,eAAe,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,EAAE;oBAC5C,MAAM,MAAM,GAAG,uBAAuB,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;oBAChE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,KAAK,YAAY,EAAE,WAAW,CAAC,CAAA;oBACrG,IAAI,CAAC,QAAQ;wBAAE,OAAM;oBAErB,OAAO,QAAQ,CAAC,iBAAiB,CAAA;oBACjC,IAAI,YAAY,EAAE,CAAC;wBACjB,QAAQ,CAAC,OAAO,GAAG,KAAK,CAAA;wBACxB,OAAO,QAAQ,CAAC,aAAa,CAAA;wBAC7B,OAAM;oBACR,CAAC;oBAED,IAAI,QAAQ,CAAC,OAAO,KAAK,KAAK;wBAAE,OAAM;oBACtC,QAAQ,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,gCAAgC,CAAA;gBACxE,CAAC,CAAC,CAAA;YACJ,CAAC;YAED,IAAI,MAAM;gBAAE,MAAK;YACjB,IAAI,aAAa,GAAG,CAAC,IAAI,SAAS,CAAC,IAAI,IAAI,aAAa,EAAE,CAAC;gBACzD,MAAK;YACP,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,eAAe,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,EAAE;gBAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;gBACtB,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAA;gBAC9B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBACvC,MAAM,IAAI,gBAAgB,CAAC;wBACzB,OAAO,EAAE,2DAA2D;wBACpE,MAAM,EAAE,GAAG;wBACX,IAAI,EAAE,sBAAsB;wBAC5B,KAAK,EAAE,MAAM;qBACd,CAAC,CAAA;gBACJ,CAAC;gBAED,MAAM,MAAM,GAAG,uBAAuB,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;gBAChE,MAAM,oBAAoB,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,CAAA;gBAC3F,IAAI,oBAAoB,CAAC,MAAM,KAAK,CAAC,IAAI,eAAe,EAAE,CAAC;oBACzD,MAAM,IAAI,gBAAgB,CAAC;wBACzB,OAAO,EACL,+GAA+G;wBACjH,MAAM,EAAE,GAAG;wBACX,IAAI,EAAE,uBAAuB;wBAC7B,KAAK,EAAE,MAAM;qBACd,CAAC,CAAA;gBACJ,CAAC;gBAED,MAAM,eAAe,GAAG,oBAAoB,CAAC,MAAM,CAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;oBAC3F,MAAM,aAAa,GACjB,OAAO,OAAO,CAAC,iBAAiB,KAAK,QAAQ,IAAI,OAAO,CAAC,iBAAiB,GAAG,GAAG;wBAC9E,CAAC,CAAC,OAAO,CAAC,iBAAiB;wBAC3B,CAAC,CAAC,OAAO,CAAC,aAAa,CAAA;oBAC3B,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,IAAI,GAAG;wBAAE,OAAO,OAAO,CAAA;oBAC7E,IAAI,OAAO,KAAK,SAAS,IAAI,aAAa,GAAG,OAAO;wBAAE,OAAO,aAAa,CAAA;oBAC1E,OAAO,OAAO,CAAA;gBAChB,CAAC,EAAE,SAAS,CAAC,CAAA;gBAEb,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;oBAClC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,eAAe,GAAG,GAAG,CAAC,CAAA;oBACjD,MAAM,IAAI,gBAAgB,CAAC;wBACzB,OAAO,EAAE,8DAA8D,cAAc,CAAC,MAAM,CAAC,kCAAkC;wBAC/H,MAAM,EAAE,GAAG;wBACX,IAAI,EAAE,2BAA2B;wBACjC,KAAK,EAAE,UAAU;qBAClB,CAAC,CAAA;gBACJ,CAAC;gBAED,IAAI,eAAe,EAAE,CAAC;oBACpB,MAAM,IAAI,gBAAgB,CAAC;wBACzB,OAAO,EACL,8GAA8G;wBAChH,MAAM,EAAE,GAAG;wBACX,IAAI,EAAE,uBAAuB;wBAC7B,KAAK,EAAE,MAAM;qBACd,CAAC,CAAA;gBACJ,CAAC;gBAED,IAAI,iBAAiB,EAAE,CAAC;oBACtB,MAAM,IAAI,gBAAgB,CAAC;wBACzB,OAAO,EAAE,kGAAkG;wBAC3G,MAAM,EAAE,GAAG;wBACX,IAAI,EAAE,uBAAuB;wBAC7B,KAAK,EAAE,UAAU;qBAClB,CAAC,CAAA;gBACJ,CAAC;gBAED,IAAI,iBAAiB,EAAE,CAAC;oBACtB,MAAM,IAAI,gBAAgB,CAAC;wBACzB,OAAO,EAAE,iFAAiF;wBAC1F,MAAM,EAAE,GAAG;wBACX,IAAI,EAAE,gBAAgB;wBACtB,KAAK,EAAE,MAAM;qBACd,CAAC,CAAA;gBACJ,CAAC;gBAED,MAAM,IAAI,gBAAgB,CAAC;oBACzB,OAAO,EAAE,qBAAqB,KAAK,CAAC,QAAQ,wEAAwE;oBACpH,MAAM,EAAE,GAAG;oBACX,IAAI,EAAE,qBAAqB;oBAC3B,KAAK,EAAE,UAAU;iBAClB,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,kBAAkB,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAA;QAC1C,MAAM,IAAI,gBAAgB,CAAC;YACzB,OAAO,EACL,2GAA2G;YAC7G,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,oBAAoB;YAC1B,KAAK,EAAE,MAAM;SACd,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,gBAAgB,CAAC;YACzB,OAAO,EAAE,oEAAoE;YAC7E,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,uBAAuB;YAC7B,KAAK,EAAE,MAAM;SACd,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;AACtE,CAAC"}

package/dist/lib/codex-native/auth-menu-flow.d.ts

@@ -0,0 +1,9 @@
+import type { OpenAIAuthMode } from "../types";
+type RunInteractiveAuthMenuInput = {
+    authMode: OpenAIAuthMode;
+    allowExit: boolean;
+    refreshQuotaSnapshotsForAuthMenu: () => Promise<void>;
+};
+export declare function runInteractiveAuthMenu(input: RunInteractiveAuthMenuInput): Promise<"add" | "exit">;
+export {};
+//# sourceMappingURL=auth-menu-flow.d.ts.map

package/dist/lib/codex-native/auth-menu-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-menu-flow.d.ts","sourceRoot":"","sources":["../../../lib/codex-native/auth-menu-flow.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAY9C,KAAK,2BAA2B,GAAG;IACjC,QAAQ,EAAE,cAAc,CAAA;IACxB,SAAS,EAAE,OAAO,CAAA;IAClB,gCAAgC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CACtD,CAAA;AAED,wBAAsB,sBAAsB,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,KAAK,GAAG,MAAM,CAAC,CAoLxG"}

package/dist/lib/codex-native/auth-menu-flow.js

@@ -0,0 +1,192 @@
+import { extractEmailFromClaims, extractPlanFromClaims, parseJwtClaims } from "../claims";
+import { toolOutputForStatus } from "../codex-status-tool";
+import { buildIdentityKey, ensureIdentityKey } from "../identity";
+import { ensureOpenAIOAuthDomain, getOpenAIOAuthDomain, importLegacyInstallData, loadAuthStorage, saveAuthStorage, shouldOfferLegacyTransfer } from "../storage";
+import { runAuthMenuOnce } from "../ui/auth-menu-runner";
+import { shouldUseColor } from "../ui/tty/ansi";
+import { buildAuthMenuAccounts, ensureAccountAuthTypes, findDomainAccountIndex, hydrateAccountIdentityFromAccessClaims, reconcileActiveIdentityKey } from "./accounts";
+import { extractAccountId, refreshAccessToken } from "./oauth-utils";
+export async function runInteractiveAuthMenu(input) {
+    while (true) {
+        const auth = await loadAuthStorage();
+        const nativeDomain = getOpenAIOAuthDomain(auth, "native");
+        const codexDomain = getOpenAIOAuthDomain(auth, "codex");
+        const menuAccounts = buildAuthMenuAccounts({
+            native: nativeDomain,
+            codex: codexDomain,
+            activeMode: input.authMode
+        });
+        const allowTransfer = await shouldOfferLegacyTransfer();
+        const result = await runAuthMenuOnce({
+            accounts: menuAccounts,
+            allowTransfer,
+            input: process.stdin,
+            output: process.stdout,
+            handlers: {
+                onCheckQuotas: async () => {
+                    await input.refreshQuotaSnapshotsForAuthMenu();
+                    const report = await toolOutputForStatus(undefined, undefined, {
+                        style: "menu",
+                        useColor: shouldUseColor()
+                    });
+                    process.stdout.write(`\n${report}\n\n`);
+                },
+                onConfigureModels: async () => {
+                    process.stdout.write("\nConfigure provider models in opencode.json and runtime flags in codex-config.json.\n\n");
+                },
+                onTransfer: async () => {
+                    const transfer = await importLegacyInstallData();
+                    let hydrated = 0;
+                    let refreshed = 0;
+                    await saveAuthStorage(undefined, async (authFile) => {
+                        for (const mode of ["native", "codex"]) {
+                            const domain = getOpenAIOAuthDomain(authFile, mode);
+                            if (!domain)
+                                continue;
+                            for (const account of domain.accounts) {
+                                const hadIdentity = Boolean(buildIdentityKey(account));
+                                hydrateAccountIdentityFromAccessClaims(account);
+                                const hasIdentityAfterClaims = Boolean(buildIdentityKey(account));
+                                if (!hadIdentity && hasIdentityAfterClaims)
+                                    hydrated += 1;
+                                if (hasIdentityAfterClaims || account.enabled === false || !account.refresh) {
+                                    continue;
+                                }
+                                try {
+                                    const tokens = await refreshAccessToken(account.refresh);
+                                    refreshed += 1;
+                                    const now = Date.now();
+                                    const claims = parseJwtClaims(tokens.id_token ?? tokens.access_token);
+                                    account.refresh = tokens.refresh_token;
+                                    account.access = tokens.access_token;
+                                    account.expires = now + (tokens.expires_in ?? 3600) * 1000;
+                                    account.accountId = extractAccountId(tokens) || account.accountId;
+                                    account.email = extractEmailFromClaims(claims) || account.email;
+                                    account.plan = extractPlanFromClaims(claims) || account.plan;
+                                    account.lastUsed = now;
+                                    hydrateAccountIdentityFromAccessClaims(account);
+                                    if (!hadIdentity && buildIdentityKey(account))
+                                        hydrated += 1;
+                                }
+                                catch {
+                                    // best effort per-account hydration
+                                }
+                            }
+                        }
+                        return authFile;
+                    });
+                    process.stdout.write(`\nTransfer complete: imported ${transfer.imported} account(s). Hydrated ${hydrated} account(s)` +
+                        `${refreshed > 0 ? `, refreshed ${refreshed} token(s)` : ""}.\n\n`);
+                },
+                onDeleteAll: async (scope) => {
+                    await saveAuthStorage(undefined, (authFile) => {
+                        const targets = scope === "both" ? ["native", "codex"] : [scope];
+                        for (const targetMode of targets) {
+                            const domain = ensureOpenAIOAuthDomain(authFile, targetMode);
+                            domain.accounts = [];
+                            domain.activeIdentityKey = undefined;
+                        }
+                        return authFile;
+                    });
+                    const deletedLabel = scope === "both"
+                        ? "Deleted all OpenAI accounts."
+                        : `Deleted ${scope === "native" ? "Native" : "Codex"} auth from all accounts.`;
+                    process.stdout.write(`\n${deletedLabel}\n\n`);
+                },
+                onToggleAccount: async (account) => {
+                    await saveAuthStorage(undefined, (authFile) => {
+                        const authTypes = account.authTypes && account.authTypes.length > 0 ? [...account.authTypes] : ["native"];
+                        for (const mode of authTypes) {
+                            const domain = getOpenAIOAuthDomain(authFile, mode);
+                            if (!domain)
+                                continue;
+                            const idx = findDomainAccountIndex(domain, account);
+                            if (idx < 0)
+                                continue;
+                            const target = domain.accounts[idx];
+                            if (!target)
+                                continue;
+                            target.enabled = target.enabled === false;
+                            reconcileActiveIdentityKey(domain);
+                        }
+                        return authFile;
+                    });
+                    process.stdout.write("\nUpdated account status.\n\n");
+                },
+                onRefreshAccount: async (account) => {
+                    let refreshed = false;
+                    try {
+                        await saveAuthStorage(undefined, async (authFile) => {
+                            const preferred = [
+                                input.authMode,
+                                ...(account.authTypes ?? []).filter((mode) => mode !== input.authMode)
+                            ];
+                            for (const mode of preferred) {
+                                const domain = getOpenAIOAuthDomain(authFile, mode);
+                                if (!domain)
+                                    continue;
+                                const idx = findDomainAccountIndex(domain, account);
+                                if (idx < 0)
+                                    continue;
+                                const target = domain.accounts[idx];
+                                if (!target || target.enabled === false || !target.refresh)
+                                    continue;
+                                const tokens = await refreshAccessToken(target.refresh);
+                                const now = Date.now();
+                                const claims = parseJwtClaims(tokens.id_token ?? tokens.access_token);
+                                target.refresh = tokens.refresh_token;
+                                target.access = tokens.access_token;
+                                target.expires = now + (tokens.expires_in ?? 3600) * 1000;
+                                target.accountId = extractAccountId(tokens) || target.accountId;
+                                target.email = extractEmailFromClaims(claims) || target.email;
+                                target.plan = extractPlanFromClaims(claims) || target.plan;
+                                target.lastUsed = now;
+                                ensureAccountAuthTypes(target);
+                                ensureIdentityKey(target);
+                                if (target.identityKey)
+                                    domain.activeIdentityKey = target.identityKey;
+                                refreshed = true;
+                                break;
+                            }
+                            return authFile;
+                        });
+                    }
+                    catch {
+                        refreshed = false;
+                    }
+                    process.stdout.write(refreshed
+                        ? "\nAccount refreshed successfully.\n\n"
+                        : "\nAccount refresh failed. Run login to reauthenticate.\n\n");
+                },
+                onDeleteAccount: async (account, scope) => {
+                    await saveAuthStorage(undefined, (authFile) => {
+                        const targets = scope === "both" ? ["native", "codex"] : [scope];
+                        for (const mode of targets) {
+                            const domain = getOpenAIOAuthDomain(authFile, mode);
+                            if (!domain)
+                                continue;
+                            const idx = findDomainAccountIndex(domain, account);
+                            if (idx < 0)
+                                continue;
+                            domain.accounts.splice(idx, 1);
+                            reconcileActiveIdentityKey(domain);
+                        }
+                        return authFile;
+                    });
+                    const deletedLabel = scope === "both"
+                        ? "Deleted account."
+                        : `Deleted ${scope === "native" ? "Native" : "Codex"} auth from account.`;
+                    process.stdout.write(`\n${deletedLabel}\n\n`);
+                }
+            }
+        });
+        if (result === "add")
+            return "add";
+        if (result === "exit") {
+            if (input.allowExit)
+                return "exit";
+            continue;
+        }
+    }
+}
+//# sourceMappingURL=auth-menu-flow.js.map

package/dist/lib/codex-native/auth-menu-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-menu-flow.js","sourceRoot":"","sources":["../../../lib/codex-native/auth-menu-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AACzF,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AACjE,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,uBAAuB,EACvB,eAAe,EACf,eAAe,EACf,yBAAyB,EAC1B,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,sCAAsC,EACtC,0BAA0B,EAC3B,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAQpE,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAAkC;IAC7E,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,eAAe,EAAE,CAAA;QACpC,MAAM,YAAY,GAAG,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;QACzD,MAAM,WAAW,GAAG,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QACvD,MAAM,YAAY,GAAG,qBAAqB,CAAC;YACzC,MAAM,EAAE,YAAY;YACpB,KAAK,EAAE,WAAW;YAClB,UAAU,EAAE,KAAK,CAAC,QAAQ;SAC3B,CAAC,CAAA;QACF,MAAM,aAAa,GAAG,MAAM,yBAAyB,EAAE,CAAA;QAEvD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;YACnC,QAAQ,EAAE,YAAY;YACtB,aAAa;YACb,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE;gBACR,aAAa,EAAE,KAAK,IAAI,EAAE;oBACxB,MAAM,KAAK,CAAC,gCAAgC,EAAE,CAAA;oBAC9C,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,SAAS,EAAE,SAAS,EAAE;wBAC7D,KAAK,EAAE,MAAM;wBACb,QAAQ,EAAE,cAAc,EAAE;qBAC3B,CAAC,CAAA;oBACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,MAAM,CAAC,CAAA;gBACzC,CAAC;gBACD,iBAAiB,EAAE,KAAK,IAAI,EAAE;oBAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0FAA0F,CAC3F,CAAA;gBACH,CAAC;gBACD,UAAU,EAAE,KAAK,IAAI,EAAE;oBACrB,MAAM,QAAQ,GAAG,MAAM,uBAAuB,EAAE,CAAA;oBAChD,IAAI,QAAQ,GAAG,CAAC,CAAA;oBAChB,IAAI,SAAS,GAAG,CAAC,CAAA;oBACjB,MAAM,eAAe,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;wBAClD,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAU,EAAE,CAAC;4BAChD,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;4BACnD,IAAI,CAAC,MAAM;gCAAE,SAAQ;4BAErB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gCACtC,MAAM,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAA;gCACtD,sCAAsC,CAAC,OAAO,CAAC,CAAA;gCAC/C,MAAM,sBAAsB,GAAG,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAA;gCACjE,IAAI,CAAC,WAAW,IAAI,sBAAsB;oCAAE,QAAQ,IAAI,CAAC,CAAA;gCAEzD,IAAI,sBAAsB,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;oCAC5E,SAAQ;gCACV,CAAC;gCAED,IAAI,CAAC;oCACH,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;oCACxD,SAAS,IAAI,CAAC,CAAA;oCACd,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;oCACtB,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,YAAY,CAAC,CAAA;oCACrE,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,aAAa,CAAA;oCACtC,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,YAAY,CAAA;oCACpC,OAAO,CAAC,OAAO,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI,CAAA;oCAC1D,OAAO,CAAC,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,SAAS,CAAA;oCACjE,OAAO,CAAC,KAAK,GAAG,sBAAsB,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK,CAAA;oCAC/D,OAAO,CAAC,IAAI,GAAG,qBAAqB,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,CAAA;oCAC5D,OAAO,CAAC,QAAQ,GAAG,GAAG,CAAA;oCACtB,sCAAsC,CAAC,OAAO,CAAC,CAAA;oCAC/C,IAAI,CAAC,WAAW,IAAI,gBAAgB,CAAC,OAAO,CAAC;wCAAE,QAAQ,IAAI,CAAC,CAAA;gCAC9D,CAAC;gCAAC,MAAM,CAAC;oCACP,oCAAoC;gCACtC,CAAC;4BACH,CAAC;wBACH,CAAC;wBACD,OAAO,QAAQ,CAAA;oBACjB,CAAC,CAAC,CAAA;oBACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iCAAiC,QAAQ,CAAC,QAAQ,yBAAyB,QAAQ,aAAa;wBAC9F,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,SAAS,WAAW,CAAC,CAAC,CAAC,EAAE,OAAO,CACrE,CAAA;gBACH,CAAC;gBACD,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;oBAC3B,MAAM,eAAe,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,EAAE;wBAC5C,MAAM,OAAO,GAAG,KAAK,KAAK,MAAM,CAAC,CAAC,CAAE,CAAC,QAAQ,EAAE,OAAO,CAAW,CAAC,CAAC,CAAE,CAAC,KAAK,CAAW,CAAA;wBACtF,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,CAAC;4BACjC,MAAM,MAAM,GAAG,uBAAuB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;4BAC5D,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAA;4BACpB,MAAM,CAAC,iBAAiB,GAAG,SAAS,CAAA;wBACtC,CAAC;wBACD,OAAO,QAAQ,CAAA;oBACjB,CAAC,CAAC,CAAA;oBACF,MAAM,YAAY,GAChB,KAAK,KAAK,MAAM;wBACd,CAAC,CAAC,8BAA8B;wBAChC,CAAC,CAAC,WAAW,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,0BAA0B,CAAA;oBAClF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,YAAY,MAAM,CAAC,CAAA;gBAC/C,CAAC;gBACD,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;oBACjC,MAAM,eAAe,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,EAAE;wBAC5C,MAAM,SAAS,GACb,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;wBACzF,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;4BAC7B,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;4BACnD,IAAI,CAAC,MAAM;gCAAE,SAAQ;4BACrB,MAAM,GAAG,GAAG,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;4BACnD,IAAI,GAAG,GAAG,CAAC;gCAAE,SAAQ;4BACrB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;4BACnC,IAAI,CAAC,MAAM;gCAAE,SAAQ;4BACrB,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,KAAK,KAAK,CAAA;4BACzC,0BAA0B,CAAC,MAAM,CAAC,CAAA;wBACpC,CAAC;wBACD,OAAO,QAAQ,CAAA;oBACjB,CAAC,CAAC,CAAA;oBACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAA;gBACvD,CAAC;gBACD,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;oBAClC,IAAI,SAAS,GAAG,KAAK,CAAA;oBACrB,IAAI,CAAC;wBACH,MAAM,eAAe,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;4BAClD,MAAM,SAAS,GAAG;gCAChB,KAAK,CAAC,QAAQ;gCACd,GAAI,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAsB;6BAC7F,CAAA;4BACD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;gCAC7B,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;gCACnD,IAAI,CAAC,MAAM;oCAAE,SAAQ;gCACrB,MAAM,GAAG,GAAG,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;gCACnD,IAAI,GAAG,GAAG,CAAC;oCAAE,SAAQ;gCACrB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;gCACnC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO;oCAAE,SAAQ;gCACpE,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;gCACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;gCACtB,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,YAAY,CAAC,CAAA;gCACrE,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,aAAa,CAAA;gCACrC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,YAAY,CAAA;gCACnC,MAAM,CAAC,OAAO,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI,CAAA;gCACzD,MAAM,CAAC,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,SAAS,CAAA;gCAC/D,MAAM,CAAC,KAAK,GAAG,sBAAsB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAA;gCAC7D,MAAM,CAAC,IAAI,GAAG,qBAAqB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAA;gCAC1D,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAA;gCACrB,sBAAsB,CAAC,MAAM,CAAC,CAAA;gCAC9B,iBAAiB,CAAC,MAAM,CAAC,CAAA;gCACzB,IAAI,MAAM,CAAC,WAAW;oCAAE,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC,WAAW,CAAA;gCACrE,SAAS,GAAG,IAAI,CAAA;gCAChB,MAAK;4BACP,CAAC;4BACD,OAAO,QAAQ,CAAA;wBACjB,CAAC,CAAC,CAAA;oBACJ,CAAC;oBAAC,MAAM,CAAC;wBACP,SAAS,GAAG,KAAK,CAAA;oBACnB,CAAC;oBACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,SAAS;wBACP,CAAC,CAAC,uCAAuC;wBACzC,CAAC,CAAC,4DAA4D,CACjE,CAAA;gBACH,CAAC;gBACD,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;oBACxC,MAAM,eAAe,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,EAAE;wBAC5C,MAAM,OAAO,GAAG,KAAK,KAAK,MAAM,CAAC,CAAC,CAAE,CAAC,QAAQ,EAAE,OAAO,CAAW,CAAC,CAAC,CAAE,CAAC,KAAK,CAAW,CAAA;wBACtF,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;4BAC3B,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;4BACnD,IAAI,CAAC,MAAM;gCAAE,SAAQ;4BACrB,MAAM,GAAG,GAAG,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;4BACnD,IAAI,GAAG,GAAG,CAAC;gCAAE,SAAQ;4BACrB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;4BAC9B,0BAA0B,CAAC,MAAM,CAAC,CAAA;wBACpC,CAAC;wBACD,OAAO,QAAQ,CAAA;oBACjB,CAAC,CAAC,CAAA;oBACF,MAAM,YAAY,GAChB,KAAK,KAAK,MAAM;wBACd,CAAC,CAAC,kBAAkB;wBACpB,CAAC,CAAC,WAAW,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,qBAAqB,CAAA;oBAC7E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,YAAY,MAAM,CAAC,CAAA;gBAC/C,CAAC;aACF;SACF,CAAC,CAAA;QAEF,IAAI,MAAM,KAAK,KAAK;YAAE,OAAO,KAAK,CAAA;QAClC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,IAAI,KAAK,CAAC,SAAS;gBAAE,OAAO,MAAM,CAAA;YAClC,SAAQ;QACV,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/lib/codex-native/auth-menu-quotas.d.ts

@@ -0,0 +1,9 @@
+import type { CodexSpoofMode } from "../config";
+import type { Logger } from "../logger";
+export type RefreshQuotaSnapshotsInput = {
+    spoofMode: CodexSpoofMode;
+    log?: Logger;
+    cooldownByIdentity: Map<string, number>;
+};
+export declare function refreshQuotaSnapshotsForAuthMenu(input: RefreshQuotaSnapshotsInput): Promise<void>;
+//# sourceMappingURL=auth-menu-quotas.d.ts.map

package/dist/lib/codex-native/auth-menu-quotas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-menu-quotas.d.ts","sourceRoot":"","sources":["../../../lib/codex-native/auth-menu-quotas.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAC/C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAavC,MAAM,MAAM,0BAA0B,GAAG;IACvC,SAAS,EAAE,cAAc,CAAA;IACzB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,kBAAkB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACxC,CAAA;AAED,wBAAsB,gCAAgC,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CA2GvG"}