@iam-brain/opencode-codex-auth 0.3.1 → 1.0.0

package/dist/lib/codex-native/collaboration.js

@@ -0,0 +1,306 @@
+export const CODEX_PLAN_MODE_INSTRUCTIONS_FALLBACK = `# Plan Mode (Conversational)
+
+You work in 3 phases, and you should *chat your way* to a great plan before finalizing it. A great plan is very detailed-intent- and implementation-wise-so that it can be handed to another engineer or agent to be implemented right away. It must be **decision complete**, where the implementer does not need to make any decisions.
+
+## Mode rules (strict)
+
+You are in **Plan Mode** until a developer message explicitly ends it.
+
+Plan Mode is not changed by user intent, tone, or imperative language. If a user asks for execution while still in Plan Mode, treat it as a request to **plan the execution**, not perform it.
+
+## Plan Mode vs update_plan tool
+
+Plan Mode is a collaboration mode that can involve requesting user input and eventually issuing a <proposed_plan> block.
+
+Separately, \`update_plan\` is a checklist/progress/TODOs tool; it does not enter or exit Plan Mode. Do not confuse it with Plan mode or try to use it while in Plan mode. If you try to use \`update_plan\` in Plan mode, it will return an error.
+
+## Execution vs. mutation in Plan Mode
+
+You may explore and execute **non-mutating** actions that improve the plan. You must not perform **mutating** actions.
+
+### Allowed (non-mutating, plan-improving)
+
+Actions that gather truth, reduce ambiguity, or validate feasibility without changing repo-tracked state. Examples:
+
+* Reading or searching files, configs, schemas, types, manifests, and docs
+* Static analysis, inspection, and repo exploration
+* Dry-run style commands when they do not edit repo-tracked files
+* Tests, builds, or checks that may write to caches or build artifacts (for example, \`target/\`, \`.cache/\`, or snapshots) so long as they do not edit repo-tracked files
+
+### Not allowed (mutating, plan-executing)
+
+Actions that implement the plan or change repo-tracked state. Examples:
+
+* Editing or writing files
+* Running formatters or linters that rewrite files
+* Applying patches, migrations, or codegen that updates repo-tracked files
+* Side-effectful commands whose purpose is to carry out the plan rather than refine it
+
+When in doubt: if the action would reasonably be described as "doing the work" rather than "planning the work," do not do it.
+
+## PHASE 1 - Ground in the environment (explore first, ask second)
+
+Begin by grounding yourself in the actual environment. Eliminate unknowns in the prompt by discovering facts, not by asking the user. Resolve all questions that can be answered through exploration or inspection. Identify missing or ambiguous details only if they cannot be derived from the environment. Silent exploration between turns is allowed and encouraged.
+
+Before asking the user any question, perform at least one targeted non-mutating exploration pass (for example: search relevant files, inspect likely entrypoints/configs, confirm current implementation shape), unless no local environment/repo is available.
+
+Exception: you may ask clarifying questions about the user's prompt before exploring, ONLY if there are obvious ambiguities or contradictions in the prompt itself. However, if ambiguity might be resolved by exploring, always prefer exploring first.
+
+Do not ask questions that can be answered from the repo or system (for example, "where is this struct?" or "which UI component should we use?" when exploration can make it clear). Only ask once you have exhausted reasonable non-mutating exploration.
+
+## PHASE 2 - Intent chat (what they actually want)
+
+* Keep asking until you can clearly state: goal + success criteria, audience, in/out of scope, constraints, current state, and the key preferences/tradeoffs.
+* Bias toward questions over guessing: if any high-impact ambiguity remains, do NOT plan yet-ask.
+
+## PHASE 3 - Implementation chat (what/how we'll build)
+
+* Once intent is stable, keep asking until the spec is decision complete: approach, interfaces (APIs/schemas/I/O), data flow, edge cases/failure modes, testing + acceptance criteria, rollout/monitoring, and any migrations/compat constraints.
+
+## Asking questions
+
+Critical rules:
+
+* Strongly prefer using the \`request_user_input\` tool to ask any questions.
+* Offer only meaningful multiple-choice options; don't include filler choices that are obviously wrong or irrelevant.
+* In rare cases where an unavoidable, important question can't be expressed with reasonable multiple-choice options (due to extreme ambiguity), you may ask it directly without the tool.
+
+You SHOULD ask many questions, but each question must:
+
+* materially change the spec/plan, OR
+* confirm/lock an assumption, OR
+* choose between meaningful tradeoffs.
+* not be answerable by non-mutating commands.
+
+Use the \`request_user_input\` tool only for decisions that materially change the plan, for confirming important assumptions, or for information that cannot be discovered via non-mutating exploration.
+
+## Two kinds of unknowns (treat differently)
+
+1. **Discoverable facts** (repo/system truth): explore first.
+
+   * Before asking, run targeted searches and check likely sources of truth (configs/manifests/entrypoints/schemas/types/constants).
+   * Ask only if: multiple plausible candidates; nothing found but you need a missing identifier/context; or ambiguity is actually product intent.
+   * If asking, present concrete candidates (paths/service names) + recommend one.
+   * Never ask questions you can answer from your environment (e.g., "where is this struct").
+
+2. **Preferences/tradeoffs** (not discoverable): ask early.
+
+   * These are intent or implementation preferences that cannot be derived from exploration.
+   * Provide 2-4 mutually exclusive options + a recommended default.
+   * If unanswered, proceed with the recommended option and record it as an assumption in the final plan.
+
+## Finalization rule
+
+Only output the final plan when it is decision complete and leaves no decisions to the implementer.
+
+When you present the official plan, wrap it in a <proposed_plan> block so the client can render it specially:
+
+1) The opening tag must be on its own line.
+2) Start the plan content on the next line (no text on the same line as the tag).
+3) The closing tag must be on its own line.
+4) Use Markdown inside the block.
+5) Keep the tags exactly as <proposed_plan> and </proposed_plan> (do not translate or rename them), even if the plan content is in another language.
+
+Example:
+
+<proposed_plan>
+plan content
+</proposed_plan>
+
+plan content should be human and agent digestible. The final plan must be plan-only and include:
+
+* A clear title
+* A brief summary section
+* Important changes or additions to public APIs/interfaces/types
+* Test cases and scenarios
+* Explicit assumptions and defaults chosen where needed
+
+Do not ask "should I proceed?" in the final output. The user can easily switch out of Plan mode and request implementation if you have included a <proposed_plan> block in your response. Alternatively, they can decide to stay in Plan mode and continue refining the plan.
+
+Only produce at most one <proposed_plan> block per turn, and only when you are presenting a complete spec.`;
+let codexPlanModeInstructions = CODEX_PLAN_MODE_INSTRUCTIONS_FALLBACK;
+export function getCodexPlanModeInstructions() {
+    return codexPlanModeInstructions;
+}
+export function setCodexPlanModeInstructions(next) {
+    const trimmed = next?.trim();
+    codexPlanModeInstructions = trimmed ? trimmed : CODEX_PLAN_MODE_INSTRUCTIONS_FALLBACK;
+}
+export const CODEX_CODE_MODE_INSTRUCTIONS = "you are now in code mode.";
+export const CODEX_ORCHESTRATOR_INSTRUCTIONS = `# Sub-agents
+
+If subagent tools are unavailable, proceed solo and ignore subagent-specific guidance.
+
+When subagents are available, delegate independent work in parallel, coordinate them with wait/send_input-style flow, and synthesize results before finalizing.
+
+When subagents are active, your primary role is coordination and synthesis; avoid doing worker implementation in parallel with active workers unless needed for unblock/fallback.`;
+const OPENCODE_TOOLING_TRANSLATION_INSTRUCTIONS = `# Tooling Compatibility (OpenCode)
+
+Translate Codex-style tool intent to OpenCode-native tools:
+
+- exec_command -> bash
+- read/search/list -> read, grep, glob
+- apply_patch/edit_file -> apply_patch
+- spawn_agent -> task (launch a subagent)
+- send_input -> task with existing task_id (continue the same subagent)
+- wait -> do not return final output until spawned task(s) complete; poll/resume via task tool as needed
+- close_agent -> stop reusing task_id (no dedicated close tool in OpenCode)
+
+Always use the available OpenCode tool names and schemas in this runtime.`;
+const CODEX_STYLE_TOOLING_INSTRUCTIONS = `# Tooling Compatibility (Codex-style)
+
+Prefer Codex-style workflow semantics and naming when reasoning about steps. If an exact Codex tool is unavailable, fall back to the nearest OpenCode equivalent and continue.`;
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function asString(value) {
+    if (typeof value !== "string")
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed ? trimmed : undefined;
+}
+export function resolveHookAgentName(agent) {
+    const direct = asString(agent);
+    if (direct)
+        return direct;
+    if (!isRecord(agent))
+        return undefined;
+    return asString(agent.name) ?? asString(agent.agent);
+}
+function normalizeAgentName(agentName) {
+    return agentName.trim().toLowerCase().replace(/\s+/g, "-");
+}
+function tokenizeAgentName(normalizedAgentName) {
+    return normalizedAgentName
+        .split(/[-./:_]+/)
+        .map((token) => token.trim())
+        .filter((token) => token.length > 0);
+}
+function isCodexFamily(tokens) {
+    return tokens[0] === "codex";
+}
+function isPlanPrimary(tokens) {
+    return tokens.length === 1 && tokens[0] === "plan";
+}
+function isOrchestratorPrimary(tokens) {
+    return tokens.length === 1 && tokens[0] === "orchestrator";
+}
+export function resolveCollaborationProfile(agent) {
+    const name = resolveHookAgentName(agent);
+    if (!name)
+        return { enabled: false };
+    const normalizedAgentName = normalizeAgentName(name);
+    const tokens = tokenizeAgentName(normalizedAgentName);
+    if (tokens.length === 0)
+        return { enabled: false, normalizedAgentName };
+    const codexFamily = isCodexFamily(tokens);
+    const hasPlanToken = tokens.includes("plan") || tokens.includes("planner");
+    const hasOrchestratorToken = tokens.includes("orchestrator");
+    if ((isPlanPrimary(tokens) || (codexFamily && hasPlanToken)) && !hasOrchestratorToken) {
+        return {
+            enabled: true,
+            normalizedAgentName,
+            kind: "plan",
+            isOrchestrator: false
+        };
+    }
+    if (isOrchestratorPrimary(tokens) || (codexFamily && hasOrchestratorToken)) {
+        return {
+            enabled: true,
+            normalizedAgentName,
+            kind: "code",
+            isOrchestrator: true
+        };
+    }
+    if (codexFamily &&
+        tokens.some((token) => ["default", "code", "review", "compact", "compaction", "execute", "pair", "pairprogramming"].includes(token))) {
+        return {
+            enabled: true,
+            normalizedAgentName,
+            kind: "code",
+            isOrchestrator: false
+        };
+    }
+    return { enabled: false, normalizedAgentName };
+}
+export function resolveCollaborationInstructions(kind, instructions) {
+    if (kind === "plan")
+        return instructions.plan;
+    return instructions.code;
+}
+export function resolveToolingInstructions(profile) {
+    return profile === "codex" ? CODEX_STYLE_TOOLING_INSTRUCTIONS : OPENCODE_TOOLING_TRANSLATION_INSTRUCTIONS;
+}
+export function mergeInstructions(base, extra) {
+    const normalizedExtra = extra.trim();
+    if (!normalizedExtra)
+        return base?.trim() ?? "";
+    const normalizedBase = base?.trim();
+    if (!normalizedBase)
+        return normalizedExtra;
+    if (normalizedBase.includes(normalizedExtra))
+        return normalizedBase;
+    return `${normalizedBase}\n\n${normalizedExtra}`;
+}
+export function isOrchestratorInstructions(instructions) {
+    if (!instructions)
+        return false;
+    const normalized = instructions.trim();
+    if (!normalized)
+        return false;
+    if (normalized.includes("description: Codex-style orchestration profile for parallel delegation and synthesis.")) {
+        return true;
+    }
+    if (!normalized.includes("# Sub-agents"))
+        return false;
+    const lower = normalized.toLowerCase();
+    if (/\bspawn_agent\b/.test(lower))
+        return true;
+    const legacyMarkers = [
+        "you are codex, a coding agent based on gpt-5.",
+        "you and the user share the same workspace and collaborate to achieve the user's goals."
+    ];
+    if (legacyMarkers.some((marker) => lower.includes(marker)))
+        return true;
+    const strongMarkers = [
+        "if subagent tools are unavailable, proceed solo and ignore subagent-specific guidance.",
+        "when subagents are available, delegate independent work in parallel, coordinate them with wait/send_input-style flow, and synthesize results before finalizing.",
+        "when subagents are active, your primary role is coordination and synthesis; avoid doing worker implementation in parallel with active workers unless needed for unblock/fallback.",
+        "coordinate them via wait / send_input",
+        "sub-agents are their to make you go fast",
+        "ask the user before shutting sub-agents down unless you need to because you reached the agent limit"
+    ];
+    if (strongMarkers.some((marker) => lower.includes(marker)))
+        return true;
+    return (lower.includes("delegate independent work in parallel") &&
+        (lower.includes("wait/send_input-style flow") || lower.includes("wait / send_input")) &&
+        lower.includes("synthesize"));
+}
+export function resolveSubagentHeaderValue(agent) {
+    const profile = resolveCollaborationProfile(agent);
+    const normalized = profile.normalizedAgentName;
+    if (!profile.enabled || !normalized) {
+        return undefined;
+    }
+    const tokens = tokenizeAgentName(normalized);
+    const isPrimary = isPlanPrimary(tokens) ||
+        isOrchestratorPrimary(tokens) ||
+        (tokens[0] === "codex" &&
+            (tokens.includes("orchestrator") ||
+                tokens.includes("default") ||
+                tokens.includes("code") ||
+                tokens.includes("plan") ||
+                tokens.includes("planner") ||
+                tokens.includes("execute") ||
+                tokens.includes("pair") ||
+                tokens.includes("pairprogramming")));
+    if (isPrimary)
+        return undefined;
+    if (tokens.includes("review"))
+        return "review";
+    if (tokens.includes("compact") || tokens.includes("compaction") || normalized === "compaction") {
+        return "compact";
+    }
+    return "collab_spawn";
+}
+//# sourceMappingURL=collaboration.js.map

package/dist/lib/codex-native/collaboration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"collaboration.js","sourceRoot":"","sources":["../../../lib/codex-native/collaboration.ts"],"names":[],"mappings":"AAeA,MAAM,CAAC,MAAM,qCAAqC,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2GAuHsD,CAAA;AAE3G,IAAI,yBAAyB,GAAG,qCAAqC,CAAA;AAErE,MAAM,UAAU,4BAA4B;IAC1C,OAAO,yBAAyB,CAAA;AAClC,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,IAAwB;IACnE,MAAM,OAAO,GAAG,IAAI,EAAE,IAAI,EAAE,CAAA;IAC5B,yBAAyB,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,qCAAqC,CAAA;AACvF,CAAC;AAED,MAAM,CAAC,MAAM,4BAA4B,GAAG,2BAA2B,CAAA;AAEvE,MAAM,CAAC,MAAM,+BAA+B,GAAG;;;;;;kLAMmI,CAAA;AAElL,MAAM,yCAAyC,GAAG;;;;;;;;;;;;0EAYwB,CAAA;AAE1E,MAAM,gCAAgC,GAAG;;+KAEsI,CAAA;AAE/K,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAC/C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IAC5B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;AACtC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC9B,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IACzB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACtC,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;AACtD,CAAC;AAED,SAAS,kBAAkB,CAAC,SAAiB;IAC3C,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;AAC5D,CAAC;AAED,SAAS,iBAAiB,CAAC,mBAA2B;IACpD,OAAO,mBAAmB;SACvB,KAAK,CAAC,UAAU,CAAC;SACjB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AACxC,CAAC;AAED,SAAS,aAAa,CAAC,MAAgB;IACrC,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,CAAA;AAC9B,CAAC;AAED,SAAS,aAAa,CAAC,MAAgB;IACrC,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAA;AACpD,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAgB;IAC7C,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,cAAc,CAAA;AAC5D,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAAc;IACxD,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAA;IACxC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IAEpC,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAA;IACpD,MAAM,MAAM,GAAG,iBAAiB,CAAC,mBAAmB,CAAC,CAAA;IACrD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAA;IAEvE,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;IACzC,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IAC1E,MAAM,oBAAoB,GAAG,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;IAE5D,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,YAAY,CAAC,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACtF,OAAO;YACL,OAAO,EAAE,IAAI;YACb,mBAAmB;YACnB,IAAI,EAAE,MAAM;YACZ,cAAc,EAAE,KAAK;SACtB,CAAA;IACH,CAAC;IAED,IAAI,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,oBAAoB,CAAC,EAAE,CAAC;QAC3E,OAAO;YACL,OAAO,EAAE,IAAI;YACb,mBAAmB;YACnB,IAAI,EAAE,MAAM;YACZ,cAAc,EAAE,IAAI;SACrB,CAAA;IACH,CAAC;IAED,IACE,WAAW;QACX,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACpB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,iBAAiB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC7G,EACD,CAAC;QACD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,mBAAmB;YACnB,IAAI,EAAE,MAAM;YACZ,cAAc,EAAE,KAAK;SACtB,CAAA;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAA;AAChD,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,IAAgC,EAChC,YAA6C;IAE7C,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,YAAY,CAAC,IAAI,CAAA;IAC7C,OAAO,YAAY,CAAC,IAAI,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,OAAiC;IAC1E,OAAO,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,yCAAyC,CAAA;AAC3G,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAwB,EAAE,KAAa;IACvE,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IACpC,IAAI,CAAC,eAAe;QAAE,OAAO,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IAC/C,MAAM,cAAc,GAAG,IAAI,EAAE,IAAI,EAAE,CAAA;IACnC,IAAI,CAAC,cAAc;QAAE,OAAO,eAAe,CAAA;IAC3C,IAAI,cAAc,CAAC,QAAQ,CAAC,eAAe,CAAC;QAAE,OAAO,cAAc,CAAA;IACnE,OAAO,GAAG,cAAc,OAAO,eAAe,EAAE,CAAA;AAClD,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,YAAgC;IACzE,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAA;IAC/B,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,EAAE,CAAA;IACtC,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAA;IAC7B,IAAI,UAAU,CAAC,QAAQ,CAAC,uFAAuF,CAAC,EAAE,CAAC;QACjH,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,KAAK,CAAA;IAEtD,MAAM,KAAK,GAAG,UAAU,CAAC,WAAW,EAAE,CAAA;IACtC,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAE9C,MAAM,aAAa,GAAG;QACpB,+CAA+C;QAC/C,wFAAwF;KACzF,CAAA;IACD,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAEvE,MAAM,aAAa,GAAG;QACpB,wFAAwF;QACxF,iKAAiK;QACjK,mLAAmL;QACnL,uCAAuC;QACvC,0CAA0C;QAC1C,qGAAqG;KACtG,CAAA;IACD,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAEvE,OAAO,CACL,KAAK,CAAC,QAAQ,CAAC,uCAAuC,CAAC;QACvD,CAAC,KAAK,CAAC,QAAQ,CAAC,4BAA4B,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QACrF,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAC7B,CAAA;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAc;IACvD,MAAM,OAAO,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAA;IAClD,MAAM,UAAU,GAAG,OAAO,CAAC,mBAAmB,CAAA;IAC9C,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;QACpC,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAA;IAC5C,MAAM,SAAS,GACb,aAAa,CAAC,MAAM,CAAC;QACrB,qBAAqB,CAAC,MAAM,CAAC;QAC7B,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO;YACpB,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC;gBAC9B,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAC1B,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACvB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACvB,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAC1B,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAC1B,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACvB,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAA;IAE1C,IAAI,SAAS;QAAE,OAAO,SAAS,CAAA;IAC/B,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAA;IAC9C,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;QAC/F,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,cAAc,CAAA;AACvB,CAAC"}

package/dist/lib/codex-native/oauth-auth-methods.d.ts

@@ -0,0 +1,45 @@
+import type { CodexSpoofMode } from "../config";
+import type { OpenAIAuthMode } from "../types";
+import { type PkceCodes, type TokenResponse } from "./oauth-utils";
+type OAuthSuccess = {
+    type: "success";
+    refresh: string;
+    access: string;
+    expires: number;
+    accountId?: string;
+};
+type OAuthFailure = {
+    type: "failed";
+};
+type OAuthCallbackResult = OAuthSuccess | OAuthFailure;
+type OAuthAuthorizePayload = {
+    url: string;
+    instructions: string;
+    method: "auto";
+    callback: () => Promise<OAuthCallbackResult>;
+};
+type AuthMenuResult = "add" | "exit";
+type BrowserAuthorizeDeps = {
+    authMode: OpenAIAuthMode;
+    spoofMode: CodexSpoofMode;
+    runInteractiveAuthMenu: (options: {
+        allowExit: boolean;
+    }) => Promise<AuthMenuResult>;
+    startOAuthServer: () => Promise<{
+        redirectUri: string;
+    }>;
+    waitForOAuthCallback: (pkce: PkceCodes, state: string, authMode: OpenAIAuthMode) => Promise<TokenResponse>;
+    scheduleOAuthServerStop: (delayMs: number, reason: "success" | "error" | "other") => void;
+    persistOAuthTokens: (tokens: TokenResponse) => Promise<void>;
+    openAuthUrl: (url: string) => void;
+    shutdownGraceMs: number;
+    shutdownErrorGraceMs: number;
+};
+type HeadlessAuthorizeDeps = {
+    spoofMode: CodexSpoofMode;
+    persistOAuthTokens: (tokens: TokenResponse) => Promise<void>;
+};
+export declare function createBrowserOAuthAuthorize(deps: BrowserAuthorizeDeps): (inputs?: Record<string, string>) => Promise<OAuthAuthorizePayload>;
+export declare function createHeadlessOAuthAuthorize(deps: HeadlessAuthorizeDeps): () => Promise<OAuthAuthorizePayload>;
+export {};
+//# sourceMappingURL=oauth-auth-methods.d.ts.map

package/dist/lib/codex-native/oauth-auth-methods.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-auth-methods.d.ts","sourceRoot":"","sources":["../../../lib/codex-native/oauth-auth-methods.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAC/C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAG9C,OAAO,EAYL,KAAK,SAAS,EACd,KAAK,aAAa,EACnB,MAAM,eAAe,CAAA;AAEtB,KAAK,YAAY,GAAG;IAClB,IAAI,EAAE,SAAS,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,KAAK,YAAY,GAAG;IAClB,IAAI,EAAE,QAAQ,CAAA;CACf,CAAA;AAED,KAAK,mBAAmB,GAAG,YAAY,GAAG,YAAY,CAAA;AAEtD,KAAK,qBAAqB,GAAG;IAC3B,GAAG,EAAE,MAAM,CAAA;IACX,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,CAAA;CAC7C,CAAA;AAED,KAAK,cAAc,GAAG,KAAK,GAAG,MAAM,CAAA;AAEpC,KAAK,oBAAoB,GAAG;IAC1B,QAAQ,EAAE,cAAc,CAAA;IACxB,SAAS,EAAE,cAAc,CAAA;IACzB,sBAAsB,EAAE,CAAC,OAAO,EAAE;QAAE,SAAS,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,cAAc,CAAC,CAAA;IACpF,gBAAgB,EAAE,MAAM,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACxD,oBAAoB,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,KAAK,OAAO,CAAC,aAAa,CAAC,CAAA;IAC1G,uBAAuB,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,GAAG,OAAO,KAAK,IAAI,CAAA;IACzF,kBAAkB,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5D,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;IAClC,eAAe,EAAE,MAAM,CAAA;IACvB,oBAAoB,EAAE,MAAM,CAAA;CAC7B,CAAA;AAED,KAAK,qBAAqB,GAAG;IAC3B,SAAS,EAAE,cAAc,CAAA;IACzB,kBAAkB,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC7D,CAAA;AAoBD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,oBAAoB,IACtD,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAG,OAAO,CAAC,qBAAqB,CAAC,CAkH/E;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,qBAAqB,SACrD,OAAO,CAAC,qBAAqB,CAAC,CA6FhD"}

package/dist/lib/codex-native/oauth-auth-methods.js

@@ -0,0 +1,182 @@
+import { resolveRequestUserAgent } from "./client-identity";
+import { resolveCodexOriginator } from "./originator";
+import { buildAuthorizeUrl, CLIENT_ID, extractAccountId, fetchWithTimeout, generatePKCE, generateState, ISSUER, OAUTH_DEVICE_AUTH_TIMEOUT_MS, OAUTH_HTTP_TIMEOUT_MS, OAUTH_POLLING_SAFETY_MARGIN_MS, sleep } from "./oauth-utils";
+function resolveDeviceAuthUserAgent(spoofMode) {
+    const originator = resolveCodexOriginator(spoofMode);
+    const userAgent = resolveRequestUserAgent(spoofMode, originator);
+    if (spoofMode !== "native")
+        return userAgent;
+    const prefix = userAgent.split(" ", 1)[0];
+    return prefix || userAgent;
+}
+function toOAuthSuccess(tokens) {
+    return {
+        type: "success",
+        refresh: tokens.refresh_token,
+        access: tokens.access_token,
+        expires: Date.now() + (tokens.expires_in ?? 3600) * 1000,
+        accountId: extractAccountId(tokens)
+    };
+}
+export function createBrowserOAuthAuthorize(deps) {
+    return async (inputs) => {
+        const runSingleBrowserOAuthInline = async () => {
+            const { redirectUri } = await deps.startOAuthServer();
+            const pkce = await generatePKCE();
+            const state = generateState();
+            const authUrl = buildAuthorizeUrl(redirectUri, pkce, state, deps.spoofMode === "codex" ? "codex_cli_rs" : "opencode");
+            const callbackPromise = deps.waitForOAuthCallback(pkce, state, deps.authMode);
+            deps.openAuthUrl(authUrl);
+            process.stdout.write(`\nGo to: ${authUrl}\n`);
+            process.stdout.write("Complete authorization in your browser. This window will close automatically.\n");
+            let authFailed = false;
+            try {
+                const tokens = await callbackPromise;
+                await deps.persistOAuthTokens(tokens);
+                process.stdout.write("\nAccount added.\n\n");
+                return tokens;
+            }
+            catch (error) {
+                authFailed = true;
+                const reason = error instanceof Error ? error.message : "Authorization failed";
+                process.stdout.write(`\nAuthorization failed: ${reason}\n\n`);
+                return null;
+            }
+            finally {
+                deps.scheduleOAuthServerStop(authFailed ? deps.shutdownErrorGraceMs : deps.shutdownGraceMs, authFailed ? "error" : "success");
+            }
+        };
+        const runInteractiveBrowserAuthLoop = async () => {
+            let lastAddedTokens;
+            while (true) {
+                const menuResult = await deps.runInteractiveAuthMenu({ allowExit: true });
+                if (menuResult === "exit") {
+                    if (!lastAddedTokens) {
+                        return {
+                            url: "",
+                            method: "auto",
+                            instructions: "Login cancelled.",
+                            callback: async () => ({ type: "failed" })
+                        };
+                    }
+                    const latest = lastAddedTokens;
+                    return {
+                        url: "",
+                        method: "auto",
+                        instructions: "",
+                        callback: async () => toOAuthSuccess(latest)
+                    };
+                }
+                const tokens = await runSingleBrowserOAuthInline();
+                if (tokens) {
+                    lastAddedTokens = tokens;
+                    continue;
+                }
+                return {
+                    url: "",
+                    method: "auto",
+                    instructions: "Authorization failed.",
+                    callback: async () => ({ type: "failed" })
+                };
+            }
+        };
+        if (inputs && process.env.OPENCODE_NO_BROWSER !== "1" && process.stdin.isTTY && process.stdout.isTTY) {
+            return runInteractiveBrowserAuthLoop();
+        }
+        const { redirectUri } = await deps.startOAuthServer();
+        const pkce = await generatePKCE();
+        const state = generateState();
+        const authUrl = buildAuthorizeUrl(redirectUri, pkce, state, deps.spoofMode === "codex" ? "codex_cli_rs" : "opencode");
+        const callbackPromise = deps.waitForOAuthCallback(pkce, state, deps.authMode);
+        deps.openAuthUrl(authUrl);
+        return {
+            url: authUrl,
+            instructions: "Complete authorization in your browser. If you close the tab early, cancel (Ctrl+C) and retry.",
+            method: "auto",
+            callback: async () => {
+                let authFailed = false;
+                try {
+                    const tokens = await callbackPromise;
+                    await deps.persistOAuthTokens(tokens);
+                    return toOAuthSuccess(tokens);
+                }
+                catch (error) {
+                    if (error instanceof Error) {
+                        // callback failures map to a generic failed result
+                    }
+                    authFailed = true;
+                    return { type: "failed" };
+                }
+                finally {
+                    deps.scheduleOAuthServerStop(authFailed ? deps.shutdownErrorGraceMs : deps.shutdownGraceMs, authFailed ? "error" : "success");
+                }
+            }
+        };
+    };
+}
+export function createHeadlessOAuthAuthorize(deps) {
+    return async () => {
+        const deviceResponse = await fetchWithTimeout(`${ISSUER}/api/accounts/deviceauth/usercode`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                "User-Agent": resolveDeviceAuthUserAgent(deps.spoofMode)
+            },
+            body: JSON.stringify({ client_id: CLIENT_ID })
+        }, OAUTH_HTTP_TIMEOUT_MS);
+        if (!deviceResponse.ok) {
+            throw new Error("Failed to initiate device authorization");
+        }
+        const deviceData = (await deviceResponse.json());
+        const interval = Math.max(parseInt(deviceData.interval) || 5, 1) * 1000;
+        return {
+            url: `${ISSUER}/codex/device`,
+            instructions: `Enter code: ${deviceData.user_code}`,
+            method: "auto",
+            async callback() {
+                const startedAt = Date.now();
+                while (true) {
+                    if (Date.now() - startedAt > OAUTH_DEVICE_AUTH_TIMEOUT_MS) {
+                        return { type: "failed" };
+                    }
+                    const response = await fetchWithTimeout(`${ISSUER}/api/accounts/deviceauth/token`, {
+                        method: "POST",
+                        headers: {
+                            "Content-Type": "application/json",
+                            "User-Agent": resolveDeviceAuthUserAgent(deps.spoofMode)
+                        },
+                        body: JSON.stringify({
+                            device_auth_id: deviceData.device_auth_id,
+                            user_code: deviceData.user_code
+                        })
+                    }, OAUTH_HTTP_TIMEOUT_MS);
+                    if (response.ok) {
+                        const data = (await response.json());
+                        const tokenResponse = await fetchWithTimeout(`${ISSUER}/oauth/token`, {
+                            method: "POST",
+                            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+                            body: new URLSearchParams({
+                                grant_type: "authorization_code",
+                                code: data.authorization_code,
+                                redirect_uri: `${ISSUER}/deviceauth/callback`,
+                                client_id: CLIENT_ID,
+                                code_verifier: data.code_verifier
+                            }).toString()
+                        }, OAUTH_HTTP_TIMEOUT_MS);
+                        if (!tokenResponse.ok) {
+                            throw new Error(`Token exchange failed: ${tokenResponse.status}`);
+                        }
+                        const tokens = (await tokenResponse.json());
+                        await deps.persistOAuthTokens(tokens);
+                        return toOAuthSuccess(tokens);
+                    }
+                    if (response.status !== 403 && response.status !== 404) {
+                        return { type: "failed" };
+                    }
+                    await sleep(interval + OAUTH_POLLING_SAFETY_MARGIN_MS);
+                }
+            }
+        };
+    };
+}
+//# sourceMappingURL=oauth-auth-methods.js.map

package/dist/lib/codex-native/oauth-auth-methods.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-auth-methods.js","sourceRoot":"","sources":["../../../lib/codex-native/oauth-auth-methods.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAA;AACrD,OAAO,EACL,iBAAiB,EACjB,SAAS,EACT,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,MAAM,EACN,4BAA4B,EAC5B,qBAAqB,EACrB,8BAA8B,EAC9B,KAAK,EAGN,MAAM,eAAe,CAAA;AA2CtB,SAAS,0BAA0B,CAAC,SAAyB;IAC3D,MAAM,UAAU,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAA;IACpD,MAAM,SAAS,GAAG,uBAAuB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;IAChE,IAAI,SAAS,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAC5C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACzC,OAAO,MAAM,IAAI,SAAS,CAAA;AAC5B,CAAC;AAED,SAAS,cAAc,CAAC,MAAqB;IAC3C,OAAO;QACL,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,MAAM,CAAC,aAAa;QAC7B,MAAM,EAAE,MAAM,CAAC,YAAY;QAC3B,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI;QACxD,SAAS,EAAE,gBAAgB,CAAC,MAAM,CAAC;KACpC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,IAA0B;IACpE,OAAO,KAAK,EAAE,MAA+B,EAAkC,EAAE;QAC/E,MAAM,2BAA2B,GAAG,KAAK,IAAmC,EAAE;YAC5E,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAA;YACrD,MAAM,IAAI,GAAG,MAAM,YAAY,EAAE,CAAA;YACjC,MAAM,KAAK,GAAG,aAAa,EAAE,CAAA;YAC7B,MAAM,OAAO,GAAG,iBAAiB,CAC/B,WAAW,EACX,IAAI,EACJ,KAAK,EACL,IAAI,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CACzD,CAAA;YACD,MAAM,eAAe,GAAG,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC7E,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;YACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,OAAO,IAAI,CAAC,CAAA;YAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iFAAiF,CAAC,CAAA;YAEvG,IAAI,UAAU,GAAG,KAAK,CAAA;YACtB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAA;gBACpC,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;gBACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAA;gBAC5C,OAAO,MAAM,CAAA;YACf,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,UAAU,GAAG,IAAI,CAAA;gBACjB,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAA;gBAC9E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,MAAM,MAAM,CAAC,CAAA;gBAC7D,OAAO,IAAI,CAAA;YACb,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,uBAAuB,CAC1B,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,EAC7D,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CACjC,CAAA;YACH,CAAC;QACH,CAAC,CAAA;QAED,MAAM,6BAA6B,GAAG,KAAK,IAAoC,EAAE;YAC/E,IAAI,eAA0C,CAAA;YAC9C,OAAO,IAAI,EAAE,CAAC;gBACZ,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;gBACzE,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;oBAC1B,IAAI,CAAC,eAAe,EAAE,CAAC;wBACrB,OAAO;4BACL,GAAG,EAAE,EAAE;4BACP,MAAM,EAAE,MAAM;4BACd,YAAY,EAAE,kBAAkB;4BAChC,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;yBAC3C,CAAA;oBACH,CAAC;oBAED,MAAM,MAAM,GAAG,eAAe,CAAA;oBAC9B,OAAO;wBACL,GAAG,EAAE,EAAE;wBACP,MAAM,EAAE,MAAM;wBACd,YAAY,EAAE,EAAE;wBAChB,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC;qBAC7C,CAAA;gBACH,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,2BAA2B,EAAE,CAAA;gBAClD,IAAI,MAAM,EAAE,CAAC;oBACX,eAAe,GAAG,MAAM,CAAA;oBACxB,SAAQ;gBACV,CAAC;gBAED,OAAO;oBACL,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,MAAM;oBACd,YAAY,EAAE,uBAAuB;oBACrC,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;iBAC3C,CAAA;YACH,CAAC;QACH,CAAC,CAAA;QAED,IAAI,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACrG,OAAO,6BAA6B,EAAE,CAAA;QACxC,CAAC;QAED,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAA;QACrD,MAAM,IAAI,GAAG,MAAM,YAAY,EAAE,CAAA;QACjC,MAAM,KAAK,GAAG,aAAa,EAAE,CAAA;QAC7B,MAAM,OAAO,GAAG,iBAAiB,CAC/B,WAAW,EACX,IAAI,EACJ,KAAK,EACL,IAAI,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CACzD,CAAA;QACD,MAAM,eAAe,GAAG,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC7E,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAEzB,OAAO;YACL,GAAG,EAAE,OAAO;YACZ,YAAY,EAAE,gGAAgG;YAC9G,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,KAAK,IAAI,EAAE;gBACnB,IAAI,UAAU,GAAG,KAAK,CAAA;gBACtB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAA;oBACpC,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;oBACrC,OAAO,cAAc,CAAC,MAAM,CAAC,CAAA;gBAC/B,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;wBAC3B,mDAAmD;oBACrD,CAAC;oBACD,UAAU,GAAG,IAAI,CAAA;oBACjB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;gBAC3B,CAAC;wBAAS,CAAC;oBACT,IAAI,CAAC,uBAAuB,CAC1B,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,EAC7D,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CACjC,CAAA;gBACH,CAAC;YACH,CAAC;SACF,CAAA;IACH,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,IAA2B;IACtE,OAAO,KAAK,IAAoC,EAAE;QAChD,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAC3C,GAAG,MAAM,mCAAmC,EAC5C;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,YAAY,EAAE,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC;aACzD;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;SAC/C,EACD,qBAAqB,CACtB,CAAA;QAED,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;QAC5D,CAAC;QAED,MAAM,UAAU,GAAG,CAAC,MAAM,cAAc,CAAC,IAAI,EAAE,CAI9C,CAAA;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAA;QAEvE,OAAO;YACL,GAAG,EAAE,GAAG,MAAM,eAAe;YAC7B,YAAY,EAAE,eAAe,UAAU,CAAC,SAAS,EAAE;YACnD,MAAM,EAAE,MAAM;YACd,KAAK,CAAC,QAAQ;gBACZ,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;gBAC5B,OAAO,IAAI,EAAE,CAAC;oBACZ,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,4BAA4B,EAAE,CAAC;wBAC1D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;oBAC3B,CAAC;oBAED,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,GAAG,MAAM,gCAAgC,EACzC;wBACE,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE;4BACP,cAAc,EAAE,kBAAkB;4BAClC,YAAY,EAAE,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC;yBACzD;wBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,cAAc,EAAE,UAAU,CAAC,cAAc;4BACzC,SAAS,EAAE,UAAU,CAAC,SAAS;yBAChC,CAAC;qBACH,EACD,qBAAqB,CACtB,CAAA;oBAED,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;wBAChB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGlC,CAAA;wBAED,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAC1C,GAAG,MAAM,cAAc,EACvB;4BACE,MAAM,EAAE,MAAM;4BACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;4BAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gCACxB,UAAU,EAAE,oBAAoB;gCAChC,IAAI,EAAE,IAAI,CAAC,kBAAkB;gCAC7B,YAAY,EAAE,GAAG,MAAM,sBAAsB;gCAC7C,SAAS,EAAE,SAAS;gCACpB,aAAa,EAAE,IAAI,CAAC,aAAa;6BAClC,CAAC,CAAC,QAAQ,EAAE;yBACd,EACD,qBAAqB,CACtB,CAAA;wBAED,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;4BACtB,MAAM,IAAI,KAAK,CAAC,0BAA0B,aAAa,CAAC,MAAM,EAAE,CAAC,CAAA;wBACnE,CAAC;wBAED,MAAM,MAAM,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAAkB,CAAA;wBAC5D,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;wBACrC,OAAO,cAAc,CAAC,MAAM,CAAC,CAAA;oBAC/B,CAAC;oBAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;wBACvD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;oBAC3B,CAAC;oBAED,MAAM,KAAK,CAAC,QAAQ,GAAG,8BAA8B,CAAC,CAAA;gBACxD,CAAC;YACH,CAAC;SACF,CAAA;IACH,CAAC,CAAA;AACH,CAAC"}

package/dist/lib/codex-native/oauth-persistence.d.ts

@@ -0,0 +1,4 @@
+import type { OpenAIAuthMode } from "../types";
+import { type TokenResponse } from "./oauth-utils";
+export declare function persistOAuthTokensForMode(tokens: TokenResponse, authMode: OpenAIAuthMode): Promise<void>;
+//# sourceMappingURL=oauth-persistence.d.ts.map

package/dist/lib/codex-native/oauth-persistence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-persistence.d.ts","sourceRoot":"","sources":["../../../lib/codex-native/oauth-persistence.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAiB,cAAc,EAAE,MAAM,UAAU,CAAA;AAE7D,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,eAAe,CAAA;AAEpE,wBAAsB,yBAAyB,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAwB9G"}

package/dist/lib/codex-native/oauth-persistence.js

@@ -0,0 +1,28 @@
+import { extractEmailFromClaims, extractPlanFromClaims, parseJwtClaims } from "../claims";
+import { ensureOpenAIOAuthDomain, saveAuthStorage } from "../storage";
+import { upsertAccount } from "./accounts";
+import { extractAccountId } from "./oauth-utils";
+export async function persistOAuthTokensForMode(tokens, authMode) {
+    const now = Date.now();
+    const expires = now + (tokens.expires_in ?? 3600) * 1000;
+    const claims = parseJwtClaims(tokens.id_token ?? tokens.access_token);
+    const account = {
+        enabled: true,
+        refresh: tokens.refresh_token,
+        access: tokens.access_token,
+        expires,
+        accountId: extractAccountId(tokens),
+        email: extractEmailFromClaims(claims),
+        plan: extractPlanFromClaims(claims),
+        lastUsed: now
+    };
+    await saveAuthStorage(undefined, async (authFile) => {
+        const domain = ensureOpenAIOAuthDomain(authFile, authMode);
+        const stored = upsertAccount(domain, { ...account, authTypes: [authMode] });
+        if (stored.identityKey) {
+            domain.activeIdentityKey = stored.identityKey;
+        }
+        return authFile;
+    });
+}
+//# sourceMappingURL=oauth-persistence.js.map

package/dist/lib/codex-native/oauth-persistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-persistence.js","sourceRoot":"","sources":["../../../lib/codex-native/oauth-persistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AACzF,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAErE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,EAAE,gBAAgB,EAAsB,MAAM,eAAe,CAAA;AAEpE,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,MAAqB,EAAE,QAAwB;IAC7F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACtB,MAAM,OAAO,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI,CAAA;IACxD,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,YAAY,CAAC,CAAA;IAErE,MAAM,OAAO,GAAkB;QAC7B,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,MAAM,CAAC,aAAa;QAC7B,MAAM,EAAE,MAAM,CAAC,YAAY;QAC3B,OAAO;QACP,SAAS,EAAE,gBAAgB,CAAC,MAAM,CAAC;QACnC,KAAK,EAAE,sBAAsB,CAAC,MAAM,CAAC;QACrC,IAAI,EAAE,qBAAqB,CAAC,MAAM,CAAC;QACnC,QAAQ,EAAE,GAAG;KACd,CAAA;IAED,MAAM,eAAe,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;QAClD,MAAM,MAAM,GAAG,uBAAuB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;QAC1D,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;QAC3E,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC,WAAW,CAAA;QAC/C,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/lib/codex-native/oauth-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-server.d.ts","sourceRoot":"","sources":["../../../lib/codex-native/oauth-server.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAE9C,KAAK,qBAAqB,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,CAAA;AAE1D,KAAK,0BAA0B,CAAC,KAAK,EAAE,OAAO,IAAI;IAChD,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,iBAAiB,EAAE,MAAM,CAAA;IACzB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,mBAAmB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAA;IAC9C,qBAAqB,EAAE,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,KAAK,MAAM,CAAA;IAC3D,8BAA8B,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,MAAM,CAAA;IAC3D,qBAAqB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAC5F,CAAA;AAUD,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,EACxD,KAAK,EAAE,0BAA0B,CAAC,KAAK,EAAE,OAAO,CAAC,GAChD;IACD,cAAc,EAAE,MAAM,OAAO,CAAA;IAC7B,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;IAClE,KAAK,EAAE,MAAM,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC7C,IAAI,EAAE,MAAM,IAAI,CAAA;IAChB,YAAY,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,KAAK,IAAI,CAAA;IACtE,eAAe,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAC5F,CAmRA"}
+{"version":3,"file":"oauth-server.d.ts","sourceRoot":"","sources":["../../../lib/codex-native/oauth-server.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAG9C,KAAK,qBAAqB,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,CAAA;AAE1D,KAAK,0BAA0B,CAAC,KAAK,EAAE,OAAO,IAAI;IAChD,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,iBAAiB,EAAE,MAAM,CAAA;IACzB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,mBAAmB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAA;IAC9C,qBAAqB,EAAE,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,KAAK,MAAM,CAAA;IAC3D,8BAA8B,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,MAAM,CAAA;IAC3D,qBAAqB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAC5F,CAAA;AA0CD,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,EACxD,KAAK,EAAE,0BAA0B,CAAC,KAAK,EAAE,OAAO,CAAC,GAChD;IACD,cAAc,EAAE,MAAM,OAAO,CAAA;IAC7B,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;IAClE,KAAK,EAAE,MAAM,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC7C,IAAI,EAAE,MAAM,IAAI,CAAA;IAChB,YAAY,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,KAAK,IAAI,CAAA;IACtE,eAAe,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAC5F,CA2SA"}