@iislee/opencodex 2.11.0 → 2.35.0

package/src/oauth/open-browser-choice.ts

@@ -0,0 +1,26 @@
+import type { OcxConfig } from "../types";
+
+/**
+ * Whether a login should open a browser on the machine running the proxy.
+ *
+ * Both login routes share this so the two surfaces cannot drift: a per-request
+ * `openBrowser` beats the persisted setting, and the persisted setting beats
+ * the historical default. It lives in `src/oauth/` rather than beside either
+ * route because `src/codex/auth-api.ts` and
+ * `src/server/management/oauth-account-routes.ts` both already import from
+ * here, so no new edge is added to the import graph.
+ *
+ * The default is the important part. An operator who upgrades and configures
+ * nothing must see exactly what they saw before, so only an explicit `false`
+ * declines — `undefined`, `true`, and a malformed value all open.
+ *
+ * A malformed request field is ignored rather than rejected on purpose: this is
+ * a display preference, and no login should fail because of one.
+ */
+export function shouldOpenBrowserForLogin(
+  requested: unknown,
+  config: Pick<OcxConfig, "oauthOpenBrowser">,
+): boolean {
+  if (typeof requested === "boolean") return requested;
+  return config.oauthOpenBrowser !== false;
+}

package/src/oauth/store.ts

@@ -10,10 +10,11 @@
  * Exceptions:
  * - `chatgpt` stays single-slot (always replaced): codex-auth-api uses it as a scratch slot
  *   for Codex pool logins, which have their own ledger (codex-accounts.json).
- * - Credentials without identity (no accountId/email) replace the active slot
- *   instead of appending: their refresh tokens rotate, so a derived id would duplicate the
- *   same human on every re-login. Kimi extracts JWT `user_id`/`sub` as accountId; Cursor
- *   extracts JWT `sub` — both append distinct accounts under multiauth.
+ * - Credentials without identity (no accountId/email) replace the active slot on a normal
+ *   login: their refresh tokens rotate, so a derived id would duplicate the same human on every
+ *   re-login. An explicit add-account login instead preserves the prior slot and appends a
+ *   distinct one. Kimi extracts JWT `user_id`/`sub` as accountId; Cursor extracts JWT `sub` —
+ *   both append distinct identified accounts under multiauth.
  */
 import { createHash, randomUUID } from "node:crypto";
 import { chmodSync, closeSync, copyFileSync, existsSync, fstatSync, mkdirSync, openSync, readFileSync, statSync, unlinkSync, writeFileSync } from "node:fs";
@@ -29,7 +30,14 @@ import {
 import { validateCopilotApiBaseUrl } from "./github-copilot";
 import type { OAuthCredentialSource, OAuthCredentials, ProviderAccount, ProviderAccountSet } from "./types";
 
-type AuthStore = Record<string, ProviderAccountSet>;
+export type AuthStore = Record<string, ProviderAccountSet>;
+
+export type AuthStoreBufferSnapshot =
+  | { readonly kind: "ready"; readonly store: AuthStore }
+  | { readonly kind: "absent" }
+  | { readonly kind: "malformed" };
+
+const authStoreDecoder = new TextDecoder("utf-8", { fatal: true });
 let lastReconciledGeneration = 0;
 let liveOAuthAccountKeys = new Set<string>();
 
@@ -142,6 +150,27 @@ export function loadAuthStore(): AuthStore {
   return loadAuthStoreInternal().store;
 }
 
+/**
+ * Pure normalization for auth-store bytes already read by another owner.
+ * This function performs no filesystem consultation, hardening, backup, or persistence.
+ */
+export function normalizeAuthStoreBuffer(buffer: Uint8Array | null): AuthStoreBufferSnapshot {
+  if (buffer === null) return { kind: "absent" };
+  try {
+    const parsed: unknown = JSON.parse(authStoreDecoder.decode(buffer));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return { kind: "malformed" };
+    }
+    const { store } = normalizeAuthStore(parsed);
+    if (Object.keys(parsed).length > 0 && Object.keys(store).length === 0) {
+      return { kind: "malformed" };
+    }
+    return { kind: "ready", store };
+  } catch {
+    return { kind: "malformed" };
+  }
+}
+
 /**
  * Observe-only auth store read for diagnostics (`ocx doctor` / status).
  * Does not chmod paths or backup invalid JSON — corrupt files are treated as empty.
@@ -149,11 +178,8 @@ export function loadAuthStore(): AuthStore {
 export function peekAuthStore(): AuthStore {
   const path = getAuthStorePath();
   if (!existsSync(path)) return {};
-  try {
-    return normalizeAuthStore(JSON.parse(readFileSync(path, "utf-8"))).store;
-  } catch {
-    return {};
-  }
+  const snapshot = normalizeAuthStoreBuffer(readFileSync(path));
+  return snapshot.kind === "ready" ? snapshot.store : {};
 }
 
 function persist(store: AuthStore): void {
@@ -261,15 +287,29 @@ function normalizeCredential(cred: unknown): OAuthCredentials | null {
 }
 
 /**
- * Stable short account id. MUST be deterministic for a given credential: legacy
- * single-credential stores are re-normalized on EVERY load without being persisted,
+ * Stable collision-resistant account id. MUST be deterministic for a given credential:
+ * legacy single-credential stores are re-normalized on EVERY load without being persisted,
  * so a time-salted id would differ between two loads (getAccountSet vs
  * getAccountCredential), surfacing as a spurious OAuthLoginRequiredError and making
  * refresh persists silently miss the account (rotated refresh token lost).
+ *
+ * Keep 128 bits of SHA-256 rather than the historical 32-bit prefix. Existing persisted
+ * account ids are read as-is; only newly-derived ids and legacy normalization use this width.
  */
 function newAccountId(cred: OAuthCredentials): string {
   const identity = cred.accountId ?? cred.email ?? cred.refresh;
-  return createHash("sha256").update(identity).digest("hex").slice(0, 8);
+  return createHash("sha256").update(identity).digest("hex").slice(0, 32);
+}
+
+/** Allocate a persisted slot id without reusing any existing account's ownership key. */
+function distinctAccountId(cred: OAuthCredentials, accounts: readonly ProviderAccount[]): string {
+  const base = newAccountId(cred);
+  const occupied = new Set(accounts.map(account => account.id));
+  if (!occupied.has(base)) return base;
+  for (let suffix = 1; ; suffix += 1) {
+    const candidate = `${base}-${suffix}`;
+    if (!occupied.has(candidate)) return candidate;
+  }
 }
 
 function normalizeAccount(value: unknown): ProviderAccount | null {
@@ -425,10 +465,11 @@ function serializeMutation<T>(work: () => Promise<T>, retainedValues: readonly u
   drainOAuthMutations();
   return result;
 }
-export function mutateStore<T>(fn:(store:AuthStore)=>T|Promise<T>, retainedValues: readonly unknown[] = [], options?: { waitMs?: number }):Promise<T>{return serializeMutation(async()=>{const guard=await createOAuthFileLock({path:getAuthStoreLockPath(),staleAfterMs:30000}).acquire();try{
+export function mutateStore<T>(fn:(store:AuthStore)=>T|Promise<T>, retainedValues: readonly unknown[] = [], options?: { waitMs?: number; assertBeforePersist?: () => void }):Promise<T>{return serializeMutation(async()=>{const guard=await createOAuthFileLock({path:getAuthStoreLockPath(),staleAfterMs:30000}).acquire();try{
     const { store, hadLegacy } = loadAuthStoreInternal();
     if (hadLegacy) backupLegacyOnce();
     const result = await fn(store);
+    options?.assertBeforePersist?.();
     persist(store);
     return result;
   }finally{guard.release();}}, retainedValues, options?.waitMs);
@@ -445,12 +486,13 @@ export function getCredential(provider: string): OAuthCredentials | null {
  * Persist a credential as the ACTIVE account. Identity-matching (accountId ?? email) upserts
  * the same human's slot; a new identity appends a new account. Credentials without identity
  * (rotating refresh tokens would fabricate duplicates) and single-slot providers replace the
- * active slot / whole set instead.
+ * active slot / whole set instead. An explicit add-account login can preserve the legacy slot;
+ * an identity-less credential then gets its deterministic refresh-derived account id.
  */
 export async function saveCredential(
   provider: string,
   cred: OAuthCredentials,
-  opts: { preserveIdentityless?: boolean } = {},
+  opts: { preserveIdentityless?: boolean; assertBeforePersist?: () => void } = {},
 ): Promise<void> {
   const safe = normalizeCredential(cred);
   if (!safe) return;
@@ -480,35 +522,95 @@ export async function saveCredential(
         delete active.needsReauth;
         return;
       }
-      const id = newAccountId(safe);
+      const id = distinctAccountId(safe, set.accounts);
+      set.accounts.push({ id, credential: safe, addedAt: Date.now() });
+      set.activeAccountId = id;
+      return;
+    }
+    if (opts.preserveIdentityless) {
+      const id = distinctAccountId(safe, set.accounts);
       set.accounts.push({ id, credential: safe, addedAt: Date.now() });
       set.activeAccountId = id;
       return;
     }
-    // No identity: replace the active slot in place (single-account semantics).
+    // No identity during a normal login: replace the active slot in place.
     const active = set.accounts.find(a => a.id === set.activeAccountId);
     if (active) {
       active.credential = safe;
       delete active.needsReauth;
     } else {
-      const id = newAccountId(safe);
+      const id = distinctAccountId(safe, set.accounts);
       set.accounts.push({ id, credential: safe, addedAt: Date.now() });
       set.activeAccountId = id;
     }
+  }, [provider, safe], { assertBeforePersist: opts.assertBeforePersist });
+}
+
+/**
+ * Atomically insert or replace an identity-bearing credential and report the disposition.
+ * Importers use this instead of a read-then-save pair so duplicate detection and persistence
+ * happen inside the existing serialized temp-then-rename store mutation.
+ */
+export async function upsertCredentialByIdentity(
+  provider: string,
+  cred: OAuthCredentials,
+): Promise<"inserted" | "updated"> {
+  const safe = normalizeCredential(cred);
+  if (!safe || (!safe.accountId && !safe.email)) {
+    throw new Error("Refusing to persist OAuth credential without verified identity");
+  }
+  return await mutateStore(store => {
+    const set = store[provider];
+    const matchesEmailOnly = (account: ProviderAccount): boolean => {
+      if (account.credential.accountId) return false;
+      return Boolean(
+        safe.email
+        && account.credential.email
+        && account.credential.email.toLowerCase() === safe.email.toLowerCase(),
+      );
+    };
+    const existing = safe.accountId
+      ? set?.accounts.find(account => account.credential.accountId === safe.accountId)
+        ?? set?.accounts.find(matchesEmailOnly)
+      : set?.accounts.find(matchesEmailOnly);
+    if (existing && set) {
+      existing.credential = safe;
+      delete existing.needsReauth;
+      set.activeAccountId ??= existing.id;
+      return "updated";
+    }
+    const id = newAccountId(safe);
+    const account: ProviderAccount = { id, credential: safe, addedAt: Date.now() };
+    if (set) {
+      set.accounts.push(account);
+      set.activeAccountId ??= id;
+    } else {
+      store[provider] = { activeAccountId: id, accounts: [account] };
+    }
+    return "inserted";
   }, [provider, safe]);
 }
 
-/** Remove the ACTIVE account; remaining accounts promote the first one. */
-export async function removeCredential(provider: string): Promise<void> {
-  await mutateStore(store => {
+/**
+ * Remove the ACTIVE account; remaining accounts promote the first one.
+ *
+ * Returns what actually happened, which a caller cannot otherwise know. A read-then-remove
+ * preflight is not equivalent: `mutateStore` serializes mutations, so between a caller's
+ * `getAccountSet` check and its `removeCredential` call another process can remove the same
+ * account, and both callers would then report a removal that only one of them performed.
+ * Deciding inside the mutation is the only place the answer is true when it is returned.
+ */
+export async function removeCredential(provider: string): Promise<"removed" | "not-found"> {
+  return await mutateStore(store => {
     const set = store[provider];
-    if (!set) return;
+    if (!set) return "not-found" as const;
     set.accounts = set.accounts.filter(a => a.id !== set.activeAccountId);
     if (set.accounts.length === 0) {
       delete store[provider];
-      return;
+      return "removed" as const;
     }
     set.activeAccountId = set.accounts[0]!.id;
+    return "removed" as const;
   }, [provider]);
 }
 
@@ -540,7 +642,12 @@ export function getAccountCredential(provider: string, accountId: string): OAuth
 }
 
 /** Persist a refreshed credential for a SPECIFIC account without touching activeAccountId. */
-export async function saveAccountCredential(provider: string, accountId: string, cred: OAuthCredentials): Promise<void> {
+export async function saveAccountCredential(
+  provider: string,
+  accountId: string,
+  cred: OAuthCredentials,
+  opts: { assertBeforePersist?: () => void } = {},
+): Promise<void> {
   const safe = normalizeCredential(cred);
   if (!safe) return;
   await mutateStore(store => {
@@ -548,7 +655,7 @@ export async function saveAccountCredential(provider: string, accountId: string,
     if (!account) return;
     account.credential = safe;
     delete account.needsReauth;
-  }, [provider, accountId, safe]);
+  }, [provider, accountId, safe], { assertBeforePersist: opts.assertBeforePersist });
 }
 
 export async function setActiveAccount(provider: string, accountId: string): Promise<boolean> {

package/src/oauth/token-guardian.ts

@@ -30,6 +30,7 @@ import { getMainAccountToken, MAIN_CODEX_ACCOUNT_ID } from "../codex/main-accoun
 import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "../providers/openai-tiers";
 import { providerCodexAccountMode } from "../providers/registry";
 import { captureConfigGeneration, type GenerationContext } from "../lib/state-store-sweeper";
+import { tryAcquireNativeMainProfileClaim } from "../codex/native-main-admission";
 
 export interface TokenGuardianHandle {
   stop(): void;
@@ -175,11 +176,14 @@ export async function guardianSweep(nowMs: number = Date.now()): Promise<Guardia
   ) {
     const mode = providerCodexAccountMode(OPENAI_CODEX_PROVIDER_ID, openai) ?? "pool";
     if (opts.codexWarmupEnabled) {
-      const mainToken = getMainAccountToken();
       const key = `codex:${MAIN_CODEX_ACCOUNT_ID}`;
-      if (mainToken && !inBackoff(key, nowMs)) {
+      if (!inBackoff(key, nowMs)) {
         tasks.push(async () => {
+          const nativeMainLease = tryAcquireNativeMainProfileClaim();
+          if (!nativeMainLease) return;
           try {
+            const mainToken = getMainAccountToken();
+            if (!mainToken) return;
             await warmCodexAccount({
               accessToken: mainToken.accessToken,
               chatgptAccountId: mainToken.chatgptAccountId,
@@ -190,9 +194,11 @@ export async function guardianSweep(nowMs: number = Date.now()): Promise<Guardia
           } catch (err) {
             recordFailure(key, nowMs, opts.backoffBaseSeconds, opts.backoffMaxSeconds, false, writerGeneration);
             result.failed.push(key);
+          } finally {
+            nativeMainLease.release();
           }
         });
-      } else if (mainToken) {
+      } else {
         result.skippedBackoff.push(key);
       }
     }

package/src/oauth/types.ts

@@ -1,6 +1,16 @@
 /** Minimal OAuth types, ported from jawcode packages/ai/src/utils/oauth/types.ts. */
 export type OAuthCredentialSource = "oauth" | "local-cli" | "credential-file" | "environment" | "manual";
 
+/**
+ * How the account authenticated. Mirrors `KiroAuthType` in `./kiro-credentials`, restated here so
+ * the credential-store types do not depend on the SQLite import module.
+ *
+ * `aws_sso_oidc` covers AWS Builder ID, which never issues an account-scoped CodeWhisperer
+ * profile ARN; the adapter needs that distinction to tell a Builder ID account apart from a
+ * `kiro_desktop` account whose profile import merely failed.
+ */
+export type KiroCredentialAuthType = "kiro_desktop" | "aws_sso_oidc";
+
 /** Account-scoped Kiro data required for refresh and request routing. */
 export interface KiroOAuthMetadata {
   profileArn?: string;
@@ -8,6 +18,11 @@ export interface KiroOAuthMetadata {
   apiRegion?: string;
   clientId?: string;
   clientSecret?: string;
+  /**
+   * Non-secret routing signal. Derived from the presence of a device-registration client pair, so
+   * it stays accurate even though `clientId`/`clientSecret` never leave the credential store.
+   */
+  authType?: KiroCredentialAuthType;
 }
 
 export type OAuthCredentials = {

package/src/pi/models.ts

@@ -16,8 +16,8 @@ import { copyFileSync, existsSync, mkdirSync, readFileSync } from "node:fs";
 import { dirname } from "node:path";
 import { atomicWriteFile } from "../config";
 import {
+  LOOPBACK_API_KEY_PLACEHOLDER,
   OPENCODE_PROVIDER_ID,
-  PI_API_KEY_ENV_REF,
   buildClientConfig,
   type ExportModel,
   type PiGeneratedConfig,
@@ -112,7 +112,7 @@ export function buildPiOpencodexProvider(
     return {
       baseUrl,
       api: "openai-completions",
-      apiKey: PI_API_KEY_ENV_REF,
+      apiKey: LOOPBACK_API_KEY_PLACEHOLDER,
       models: [],
     };
   }

package/src/providers/alibaba-region-migration.ts

@@ -24,7 +24,7 @@ const INTL_ID = "alibaba-token-plan-intl";
  * the one matching the destination's registry contract.
  * `defaultModel` and `note` are user-editable too and are handled below.
  */
-const USER_OWNED_FIELDS = ["apiKey", "apiKeyPool", "disabled", "baseUrl", "allowPrivateNetwork", "liveModels"] as const;
+const USER_OWNED_FIELDS = ["apiKey", "apiKeyPool", "disabled", "baseUrl", "allowPrivateNetwork", "liveModels", "modelCosts"] as const;
 
 export interface AlibabaRegionMigrationProjection {
   config: OcxConfig;