@iislee/opencodex 2.11.0

package/src/cli/access.ts

@@ -0,0 +1,108 @@
+import {
+  CliUsageError,
+  printData,
+  rejectArgs,
+  runCliAction,
+  runtimeRequest,
+  takeFlag,
+  takeOption,
+  type RuntimeApiDeps,
+} from "./runtime-api";
+
+const USAGE = `Usage:
+  ocx access key [list] [--json]
+  ocx access key create [name] [--json]
+  ocx access key remove <id> --yes [--json]
+  ocx access endpoints [--json]
+  ocx access models [--json]
+  ocx access test <model> [--protocol <chat|responses|messages>] [--json]`;
+
+async function key(argv: string[], deps: RuntimeApiDeps): Promise<void> {
+  const args = [...argv];
+  const action = (args.shift() ?? "list").toLowerCase();
+  const wantsJson = takeFlag(args, "--json");
+  if (action === "list") {
+    rejectArgs(args, USAGE);
+    const result = await runtimeRequest<Record<string, unknown>>("/api/keys", {}, deps);
+    const keys = Array.isArray(result.keys) ? result.keys as Array<Record<string, unknown>> : [];
+    printData(result, wantsJson, keys.length
+      ? keys.map(entry => `${String(entry.id)}  ${String(entry.name)}  ${String(entry.prefix ?? "")}`)
+      : ["No API access keys configured."]);
+    return;
+  }
+  if (action === "create") {
+    const name = args.shift() ?? "default";
+    rejectArgs(args, USAGE);
+    const result = await runtimeRequest<Record<string, unknown>>("/api/keys", {
+      method: "POST",
+      body: JSON.stringify({ name }),
+    }, deps);
+    // The plaintext key is returned once. Keep text output explicit so callers know to store it.
+    printData(result, wantsJson, [
+      `Created API key ${String(result.name ?? name)} (${String(result.id ?? "")}).`,
+      `Key (shown once): ${String(result.key ?? "")}`,
+    ]);
+    return;
+  }
+  if (action === "remove" || action === "delete") {
+    const id = args.shift();
+    const yes = takeFlag(args, "--yes");
+    if (!id) throw new CliUsageError("key id is required", USAGE);
+    if (!yes) throw new CliUsageError("remove requires --yes", USAGE);
+    rejectArgs(args, USAGE);
+    const result = await runtimeRequest("/api/keys", { method: "DELETE", body: JSON.stringify({ id }) }, deps);
+    printData(result, wantsJson, [`Removed API key ${id}.`]);
+    return;
+  }
+  throw new CliUsageError(`unknown key command ${action}`, USAGE);
+}
+
+async function endpoints(argv: string[], deps: RuntimeApiDeps): Promise<void> {
+  const args = [...argv];
+  const wantsJson = takeFlag(args, "--json");
+  rejectArgs(args, USAGE);
+  const result = await runtimeRequest<Record<string, unknown>>("/api/keys", {}, deps);
+  const view = Object.fromEntries(Object.entries(result).filter(([key]) => key.endsWith("Endpoint") || key === "baseUrl" || key === "endpoint"));
+  printData(view, wantsJson, Object.entries(view).map(([name, value]) => `${name}: ${String(value)}`));
+}
+
+async function models(argv: string[], deps: RuntimeApiDeps): Promise<void> {
+  const args = [...argv];
+  const wantsJson = takeFlag(args, "--json");
+  rejectArgs(args, USAGE);
+  const result = await runtimeRequest<Record<string, unknown>>("/v1/models", {}, deps);
+  const rows = Array.isArray(result.data) ? result.data as Array<Record<string, unknown>> : [];
+  printData(result, wantsJson, rows.map(row => `${String(row.id)}  ${String(row.owned_by ?? "")}`.trimEnd()));
+}
+
+async function testModel(argv: string[], deps: RuntimeApiDeps): Promise<void> {
+  const args = [...argv];
+  const model = args.shift();
+  const wantsJson = takeFlag(args, "--json");
+  const protocol = takeOption(args, "--protocol") ?? "chat";
+  if (!model) throw new CliUsageError("model is required", USAGE);
+  if (!(["chat", "responses", "messages"] as const).includes(protocol as "chat" | "responses" | "messages")) {
+    throw new CliUsageError("--protocol must be chat, responses, or messages", USAGE);
+  }
+  rejectArgs(args, USAGE);
+  const request = protocol === "responses"
+    ? { path: "/v1/responses", body: { model, input: "Reply with OK.", max_output_tokens: 16 } }
+    : protocol === "messages"
+      ? { path: "/v1/messages", body: { model, messages: [{ role: "user", content: "Reply with OK." }], max_tokens: 16 } }
+      : { path: "/v1/chat/completions", body: { model, messages: [{ role: "user", content: "Reply with OK." }], max_tokens: 16, stream: false } };
+  const result = await runtimeRequest(request.path, { method: "POST", body: JSON.stringify(request.body) }, deps);
+  printData(result, wantsJson, [`${model}: ${protocol} request succeeded.`]);
+}
+
+export async function handleAccessCommand(argv: string[], deps: RuntimeApiDeps = {}): Promise<number> {
+  return runCliAction(async () => {
+    const [sub = "key", ...rest] = argv;
+    if (sub === "key" || sub === "keys") await key(rest, deps);
+    else if (sub === "endpoints") await endpoints(rest, deps);
+    else if (sub === "models") await models(rest, deps);
+    else if (sub === "test") await testModel(rest, deps);
+    else throw new CliUsageError(`unknown access command ${sub}`, USAGE);
+  });
+}
+
+export const ACCESS_USAGE = USAGE;

package/src/cli/account-api.ts

@@ -0,0 +1,268 @@
+/**
+ * Data-access layer for `ocx account` (issue #180) — live-proxy HTTP client and
+ * per-family account readers. Kept separate from account.ts (command handlers)
+ * per the 400-line module budget.
+ */
+import { findLiveProxy, probeHostname } from "../server/proxy-liveness";
+import { runningProxyUpdateHeaders } from "../oauth/login-cli";
+import { isPublicOAuthProvider } from "../oauth/index";
+import { getProviderRegistryEntry, providerCodexAccountMode } from "../providers/registry";
+import type { OcxConfig } from "../types";
+
+export type AccountType = "codex" | "oauth" | "api-key";
+
+export interface AccountRow {
+  provider: string;
+  type: AccountType;
+  id: string;
+  label?: string;
+  email?: string;
+  plan?: string;
+  masked?: string;
+  active: boolean;
+  needsReauth?: boolean;
+  quota?: CodexQuotaDto | null;
+}
+
+export type ClassifyResult = { type: AccountType } | { error: string };
+
+export type AccountStdin = NodeJS.ReadableStream & { isTTY?: boolean };
+
+export interface AccountDeps {
+  /** Test injection: skip findLiveProxy and call the API at this base URL. */
+  baseUrl?: string;
+  fetchImpl?: typeof fetch;
+  loadConfigImpl?: () => OcxConfig;
+  stdinImpl?: AccountStdin;
+  stdinTimeoutMs?: number;
+}
+
+export function classifyAccount(config: OcxConfig, name: string): ClassifyResult {
+  const provider = config.providers?.[name];
+  if (providerCodexAccountMode(name, provider)) return { type: "codex" };
+  const entry = getProviderRegistryEntry(name);
+  if (entry?.authKind === "local") {
+    return { error: `provider "${name}" is a local provider and has no credentials` };
+  }
+  if (provider?.authMode === "forward") {
+    return { error: `provider "${name}" uses forward auth and has no switchable credentials` };
+  }
+  if (provider?.authMode === "key") return { type: "api-key" };
+  if (provider && !provider.authMode && (provider.apiKey || (provider.apiKeyPool?.length ?? 0) > 0)) {
+    return { type: "api-key" };
+  }
+  if (isPublicOAuthProvider(name)) return { type: "oauth" };
+  if (provider) return { type: "api-key" };
+  return { error: `unknown provider "${name}"` };
+}
+
+export interface ApiResult {
+  /** 0 = network-level failure (proxy unreachable). */
+  status: number;
+  json: Record<string, unknown>;
+}
+
+export async function apiJson(
+  deps: AccountDeps,
+  baseUrl: string,
+  method: "GET" | "PUT" | "POST" | "DELETE",
+  path: string,
+  body?: unknown,
+): Promise<ApiResult> {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  try {
+    const res = await fetchImpl(`${baseUrl}${path}`, {
+      method,
+      headers: runningProxyUpdateHeaders(),
+      body: body === undefined ? undefined : JSON.stringify(body),
+    });
+    const json = (await res.json().catch(() => ({}))) as Record<string, unknown>;
+    return { status: res.status, json };
+  } catch {
+    return { status: 0, json: {} };
+  }
+}
+
+export async function resolveBaseUrl(deps: AccountDeps): Promise<string | null> {
+  if (deps.baseUrl) return deps.baseUrl;
+  const live = await findLiveProxy();
+  if (!live) return null;
+  return `http://${probeHostname(live.hostname)}:${live.port}`;
+}
+
+export function proxyUnreachable(): number {
+  console.error("Proxy not reachable. Start it with 'ocx start' or 'ocx ensure'.");
+  return 1;
+}
+
+export function apiError(json: Record<string, unknown>, fallback: string): number {
+  const message = typeof json.error === "string" ? json.error : fallback;
+  console.error(`Error: ${message}`);
+  return 1;
+}
+
+export interface FamilyRows {
+  rows: AccountRow[];
+  activeId: string | null;
+  autoSwitchThreshold?: number;
+  /** HTTP status for a completed family read, including failures. */
+  status?: number;
+  /** Set when the family endpoint returned an error. */
+  errorJson?: Record<string, unknown>;
+  networkDown?: boolean;
+}
+
+export interface CodexQuotaDto {
+  weeklyPercent?: number;
+  monthlyPercent?: number;
+  weeklyResetAt?: number;
+  monthlyResetAt?: number;
+}
+
+export interface ProviderQuotaWindowDto {
+  label: string;
+  percent: number;
+  resetAt?: number;
+}
+
+export interface ProviderQuotaDto extends CodexQuotaDto {
+  fiveHourPercent?: number;
+  fiveHourResetAt?: number;
+  customWindows?: ProviderQuotaWindowDto[];
+  updatedAt?: number;
+}
+
+export interface ProviderQuotaReportDto {
+  provider: string;
+  label?: string;
+  source?: string;
+  quota: ProviderQuotaDto;
+  updatedAt?: number;
+  reverseEngineered?: boolean;
+}
+
+interface CodexAccountDto {
+  id: string;
+  alias?: string;
+  email?: string;
+  plan?: string;
+  isMain?: boolean;
+  needsReauth?: boolean;
+  quota?: CodexQuotaDto | null;
+}
+
+function projectQuota(quota: CodexQuotaDto | null | undefined): CodexQuotaDto | null {
+  if (!quota) return null;
+  const projected: CodexQuotaDto = {};
+  for (const key of ["weeklyPercent", "monthlyPercent", "weeklyResetAt", "monthlyResetAt"] as const) {
+    if (typeof quota[key] === "number" && Number.isFinite(quota[key])) projected[key] = quota[key];
+  }
+  return projected;
+}
+
+export async function fetchCodexRows(
+  deps: AccountDeps,
+  baseUrl: string,
+  forceRefresh = false,
+): Promise<FamilyRows> {
+  const accountsPath = `/api/codex-auth/accounts${forceRefresh ? "?refresh=1" : ""}`;
+  const [accountsRes, activeRes] = await Promise.all([
+    apiJson(deps, baseUrl, "GET", accountsPath),
+    apiJson(deps, baseUrl, "GET", "/api/codex-auth/active"),
+  ]);
+  if (accountsRes.status !== 0 && accountsRes.status !== 200) {
+    return { rows: [], activeId: null, status: accountsRes.status, errorJson: accountsRes.json };
+  }
+  if (activeRes.status !== 0 && activeRes.status !== 200) {
+    return { rows: [], activeId: null, status: activeRes.status, errorJson: activeRes.json };
+  }
+  if (accountsRes.status === 0 || activeRes.status === 0) {
+    return { rows: [], activeId: null, status: 0, networkDown: true };
+  }
+  const activeId = typeof activeRes.json.activeCodexAccountId === "string"
+    ? activeRes.json.activeCodexAccountId
+    : null;
+  const autoSwitchThreshold = typeof activeRes.json.autoSwitchThreshold === "number"
+    ? activeRes.json.autoSwitchThreshold
+    : undefined;
+  const accounts = Array.isArray(accountsRes.json.accounts) ? accountsRes.json.accounts as CodexAccountDto[] : [];
+  const rows = accounts.map(a => ({
+    provider: "openai",
+    type: "codex" as const,
+    id: a.id,
+    label: a.alias ?? a.plan ?? a.email,
+    email: a.email,
+    plan: a.plan,
+    active: a.id === activeId,
+    needsReauth: a.needsReauth,
+    ...(forceRefresh ? { quota: projectQuota(a.quota) } : {}),
+  }));
+  return { rows, activeId, autoSwitchThreshold, status: 200 };
+}
+
+interface OAuthAccountDto {
+  id: string;
+  alias?: string;
+  email?: string;
+  active?: boolean;
+  needsReauth?: boolean;
+}
+
+async function fetchOAuthRows(deps: AccountDeps, baseUrl: string, name: string): Promise<FamilyRows> {
+  const res = await apiJson(deps, baseUrl, "GET", `/api/oauth/accounts?provider=${encodeURIComponent(name)}`);
+  if (res.status === 0) return { rows: [], activeId: null, status: 0, networkDown: true };
+  if (res.status !== 200) return { rows: [], activeId: null, status: res.status, errorJson: res.json };
+  const activeId = typeof res.json.activeAccountId === "string" ? res.json.activeAccountId : null;
+  const accounts = Array.isArray(res.json.accounts) ? res.json.accounts as OAuthAccountDto[] : [];
+  const rows = accounts.map((a, i) => ({
+    provider: name,
+    type: "oauth" as const,
+    id: a.id,
+    label: a.alias ?? a.email ?? `Account ${i + 1}`,
+    email: a.email,
+    active: a.active ?? a.id === activeId,
+    needsReauth: a.needsReauth,
+  }));
+  return { rows, activeId, status: 200 };
+}
+
+interface ApiKeyDto {
+  id: string;
+  label?: string;
+  masked?: string;
+  active?: boolean;
+}
+
+async function fetchKeyRows(deps: AccountDeps, baseUrl: string, name: string): Promise<FamilyRows> {
+  const res = await apiJson(deps, baseUrl, "GET", `/api/providers/keys?name=${encodeURIComponent(name)}`);
+  if (res.status === 0) return { rows: [], activeId: null, status: 0, networkDown: true };
+  if (res.status !== 200) return { rows: [], activeId: null, status: res.status, errorJson: res.json };
+  const activeId = typeof res.json.activeId === "string" ? res.json.activeId : null;
+  const keys = Array.isArray(res.json.keys) ? res.json.keys as ApiKeyDto[] : [];
+  const rows = keys.map(k => ({
+    provider: name,
+    type: "api-key" as const,
+    id: k.id,
+    label: k.label ?? k.masked,
+    masked: k.masked,
+    active: k.active ?? k.id === activeId,
+  }));
+  return { rows, activeId, status: 200 };
+}
+
+export function fetchRows(deps: AccountDeps, baseUrl: string, name: string, type: AccountType): Promise<FamilyRows> {
+  if (type === "codex") return fetchCodexRows(deps, baseUrl);
+  if (type === "oauth") return fetchOAuthRows(deps, baseUrl, name);
+  return fetchKeyRows(deps, baseUrl, name);
+}
+
+export async function fetchProviderQuotaReport(
+  deps: AccountDeps,
+  baseUrl: string,
+  name: string,
+): Promise<{ status: number; report: ProviderQuotaReportDto | null; errorJson?: Record<string, unknown> }> {
+  const res = await apiJson(deps, baseUrl, "GET", "/api/provider-quotas?refresh=1");
+  if (res.status !== 200) return { status: res.status, report: null, errorJson: res.json };
+  const reports = Array.isArray(res.json.reports) ? res.json.reports as ProviderQuotaReportDto[] : [];
+  return { status: 200, report: reports.find(report => report?.provider === name) ?? null };
+}

package/src/cli/account-auth.ts

@@ -0,0 +1,223 @@
+import {
+  CliUsageError,
+  printData,
+  readSecretLine,
+  rejectArgs,
+  runCliAction,
+  runtimeRequest,
+  takeFlag,
+  takeOption,
+  takeOptionWithSyntax,
+  type CliStdin,
+  type RuntimeApiDeps,
+} from "./runtime-api";
+
+const USAGE = `Usage:
+  ocx account login <provider> [--id <account-id>] [--reauth] [--code -] [--no-wait] [--json]
+  ocx account code <provider> [--flow <flow-id>] [--json]   (reads the code from stdin)
+  ocx account cancel <provider> [--flow <flow-id>] [--json]
+  ocx account reset-credits <account-id|main> [--consume --yes] [--json]
+
+The redirect URL or authorization code is a short-lived credential. Pipe it in
+rather than passing it as an argument, where it lands in shell history and is
+visible to anyone who can run ps:
+  pbpaste | ocx account code <provider> --flow <flow-id>
+  ocx account login <provider> --code -   (same, for the login flow)`;
+
+const CODEX_NAMES = new Set(["openai", "codex", "chatgpt"]);
+
+interface LoginStart {
+  url?: string;
+  flowId?: string;
+  instructions?: string;
+  deviceCode?: string;
+}
+
+/** `-` means "read it from stdin", the documented way to pass a code silently. */
+const STDIN_SENTINEL = "-";
+
+const ARGV_WARNING =
+  "warning: the authorization code was passed as a command-line argument, so it is now in your shell history and was visible in the process list while this ran. Pipe it on stdin instead, or pass `-` to read from stdin.";
+
+/**
+ * Resolve the code, preferring stdin.
+ *
+ * Never logs the value itself — the warning names the exposure, not the
+ * credential. What this closes is shell history, `ps`, and this program's own
+ * output; a code pasted at an interactive prompt is still visible on the
+ * terminal, exactly as it is in the existing interactive login.
+ */
+async function resolveCode(
+  supplied: { value: string; inline: boolean } | undefined,
+  deps: RuntimeApiDeps,
+  required: boolean,
+): Promise<string | undefined> {
+  if (supplied && supplied.value !== STDIN_SENTINEL) {
+    console.error(ARGV_WARNING);
+    return supplied.value;
+  }
+  if (!supplied && !required) return undefined;
+  const input: CliStdin = deps.stdinImpl ?? process.stdin;
+  if (input.isTTY) console.error("Paste the redirect URL or authorization code, then press Enter:");
+  return await readSecretLine(deps, "authorization code");
+}
+
+async function login(argv: string[], deps: RuntimeApiDeps): Promise<void> {
+  const args = [...argv];
+  const provider = args.shift()?.trim().toLowerCase();
+  const wantsJson = takeFlag(args, "--json");
+  const noWait = takeFlag(args, "--no-wait");
+  const reauth = takeFlag(args, "--reauth");
+  const id = takeOption(args, "--id");
+  const suppliedCode = takeOptionWithSyntax(args, "--code");
+  if (!provider) throw new CliUsageError("provider is required", USAGE);
+  rejectArgs(args, USAGE);
+  // Only resolve when --code was actually given: a plain `ocx account login`
+  // opens the browser flow and polls, and must not block on stdin.
+  const code = await resolveCode(suppliedCode, deps, false);
+
+  if (CODEX_NAMES.has(provider)) {
+    const start = await runtimeRequest<LoginStart>("/api/codex-auth/login", {
+      method: "POST",
+      body: JSON.stringify({ ...(id ? { id } : {}), ...(reauth ? { reauth: true } : {}) }),
+    }, deps);
+    if (!wantsJson) {
+      if (start.url) console.log(`Open this URL to sign in:\n${start.url}`);
+      if (start.instructions) console.log(start.instructions);
+      if (start.flowId) console.log(`Flow: ${start.flowId}`);
+    }
+    if (code && start.flowId) {
+      await runtimeRequest("/api/codex-auth/login/code", {
+        method: "POST",
+        body: JSON.stringify({ flowId: start.flowId, input: code }),
+      }, deps);
+    }
+    if (noWait) {
+      if (wantsJson) printData(start, true);
+      return;
+    }
+    if (!start.flowId) throw new CliUsageError("login did not return a flow id");
+    for (let attempt = 0; attempt < 150; attempt++) {
+      await Bun.sleep(2_000);
+      const state = await runtimeRequest<Record<string, unknown>>(
+        `/api/codex-auth/login-status?flowId=${encodeURIComponent(start.flowId)}${id ? `&accountId=${encodeURIComponent(id)}` : ""}${reauth ? "&reauth=1" : ""}`,
+        {}, deps,
+      );
+      if (state.status === "done") {
+        printData(state, wantsJson, [`Logged in${state.email ? ` as ${String(state.email)}` : ""}.`]);
+        return;
+      }
+      if (state.status === "error" || state.status === "expired") {
+        throw new CliUsageError(String(state.error ?? `login ${state.status}`));
+      }
+    }
+    throw new CliUsageError("login timed out");
+  }
+
+  if (id && !reauth) throw new CliUsageError("--id is only valid with --reauth for provider OAuth accounts", USAGE);
+  const start = await runtimeRequest<LoginStart>("/api/oauth/login", {
+    method: "POST",
+    body: JSON.stringify({ provider, addAccount: !reauth, ...(reauth && id ? { accountId: id, reauth: true } : {}) }),
+  }, deps);
+  if (!wantsJson) {
+    if (start.url) console.log(`Open this URL to sign in:\n${start.url}`);
+    if (start.instructions) console.log(start.instructions);
+    if (start.deviceCode) console.log(`Device code: ${start.deviceCode}`);
+  }
+  if (code) {
+    await runtimeRequest("/api/oauth/login/code", {
+      method: "POST",
+      body: JSON.stringify({ provider, input: code }),
+    }, deps);
+  }
+  if (noWait) {
+    if (wantsJson) printData(start, true);
+    return;
+  }
+  for (let attempt = 0; attempt < 100; attempt++) {
+    await Bun.sleep(2_000);
+    const state = await runtimeRequest<Record<string, unknown>>(`/api/oauth/status?provider=${encodeURIComponent(provider)}`, {}, deps);
+    if (state.error) throw new CliUsageError(String(state.error));
+    if (state.loggedIn === true) {
+      printData(state, wantsJson, [`Logged in to ${provider}.`]);
+      return;
+    }
+  }
+  throw new CliUsageError("login timed out");
+}
+
+async function code(argv: string[], deps: RuntimeApiDeps): Promise<void> {
+  const args = [...argv];
+  const provider = args.shift()?.trim().toLowerCase();
+  // Flags first. Taking the positional before parsing them made
+  // `ocx account code openai --flow f1` read `--flow` as the code and then
+  // reject `f1` as an unexpected argument.
+  const wantsJson = takeFlag(args, "--json");
+  const flowId = takeOption(args, "--flow");
+  const suppliedCode = takeOptionWithSyntax(args, "--code");
+  // An unknown flag is not a credential. Without this guard `--nope` becomes
+  // the positional code and the real complaint ("unexpected argument") is
+  // replaced by a confusing one about how the code was passed.
+  const positional = args[0]?.startsWith("--") ? undefined : args.shift();
+  if (!provider) throw new CliUsageError("provider is required", USAGE);
+  // A second positional here is most likely the code, split by an unquoted
+  // space or a stray shell expansion. Naming it back would put it on stderr.
+  rejectArgs(args, USAGE, { redactValues: true });
+  if (suppliedCode && positional !== undefined) {
+    throw new CliUsageError("pass the code either positionally or with --code, not both", USAGE);
+  }
+  const input = await resolveCode(
+    suppliedCode ?? (positional === undefined ? undefined : { value: positional, inline: false }),
+    deps,
+    true,
+  );
+  if (!input) throw new CliUsageError("provider and redirect/code are required", USAGE);
+  const path = CODEX_NAMES.has(provider) ? "/api/codex-auth/login/code" : "/api/oauth/login/code";
+  if (CODEX_NAMES.has(provider) && !flowId) throw new CliUsageError("Codex login code requires --flow <flow-id>", USAGE);
+  const body = CODEX_NAMES.has(provider) ? { flowId, input } : { provider, input };
+  const result = await runtimeRequest(path, { method: "POST", body: JSON.stringify(body) }, deps);
+  printData(result, wantsJson, ["Login code submitted."]);
+}
+
+async function cancel(argv: string[], deps: RuntimeApiDeps): Promise<void> {
+  const args = [...argv];
+  const provider = args.shift()?.trim().toLowerCase();
+  const wantsJson = takeFlag(args, "--json");
+  const flowId = takeOption(args, "--flow");
+  if (!provider) throw new CliUsageError("provider is required", USAGE);
+  rejectArgs(args, USAGE);
+  const codex = CODEX_NAMES.has(provider);
+  const result = await runtimeRequest(codex ? "/api/codex-auth/login/cancel" : "/api/oauth/login/cancel", {
+    method: "POST",
+    body: JSON.stringify(codex ? { flowId } : { provider }),
+  }, deps);
+  printData(result, wantsJson, [`Cancelled ${provider} login.`]);
+}
+
+async function resetCredits(argv: string[], deps: RuntimeApiDeps): Promise<void> {
+  const args = [...argv];
+  const rawId = args.shift()?.trim();
+  const wantsJson = takeFlag(args, "--json");
+  const consume = takeFlag(args, "--consume");
+  const yes = takeFlag(args, "--yes");
+  if (!rawId) throw new CliUsageError("account id is required", USAGE);
+  if (consume && !yes) throw new CliUsageError("consuming a reset credit requires --yes", USAGE);
+  rejectArgs(args, USAGE);
+  const accountId = rawId === "main" ? "__main__" : rawId;
+  const result = consume
+    ? await runtimeRequest("/api/codex-auth/reset-credits/consume", { method: "POST", body: JSON.stringify({ accountId }) }, deps)
+    : await runtimeRequest(`/api/codex-auth/reset-credits?accountId=${encodeURIComponent(accountId)}`, {}, deps);
+  printData(result, wantsJson);
+}
+
+export async function handleAccountAuthCommand(sub: string, argv: string[], deps: RuntimeApiDeps = {}): Promise<number | null> {
+  let action: (() => Promise<void>) | undefined;
+  if (sub === "login" || sub === "reauth") action = () => login(sub === "reauth" ? [...argv, "--reauth"] : argv, deps);
+  else if (sub === "code") action = () => code(argv, deps);
+  else if (sub === "cancel") action = () => cancel(argv, deps);
+  else if (sub === "reset-credits") action = () => resetCredits(argv, deps);
+  if (!action) return null;
+  return runCliAction(action);
+}
+
+export const ACCOUNT_AUTH_USAGE = USAGE;