@iislee/opencodex 2.11.0

package/src/cloud/onedrive-graph.ts

@@ -0,0 +1,108 @@
+/**
+ * Minimal Microsoft Graph OneDrive helpers (upload / download / ensure folder).
+ * Remote root: /OpenCodex/sync/ under the user's OneDrive.
+ */
+import { getValidOneDriveAccessToken } from "./onedrive-auth";
+
+const GRAPH = "https://graph.microsoft.com/v1.0";
+const REMOTE_ROOT = "OpenCodex/sync";
+
+function encodePath(relativePath: string): string {
+  // Graph path encoding: each segment URI-encoded, colon syntax for path
+  return relativePath
+    .split("/")
+    .filter(Boolean)
+    .map(seg => encodeURIComponent(seg))
+    .join("/");
+}
+
+async function authHeaders(): Promise<Headers> {
+  const { token } = await getValidOneDriveAccessToken();
+  return new Headers({ Authorization: `Bearer ${token}` });
+}
+
+/** Ensure OpenCodex/sync folder exists (idempotent). */
+export async function ensureSyncFolder(): Promise<void> {
+  const headers = await authHeaders();
+  // Create OpenCodex then sync via children path
+  for (const folder of ["OpenCodex", "OpenCodex/sync"]) {
+    const parent = folder.includes("/") ? folder.split("/").slice(0, -1).join("/") : "";
+    const name = folder.split("/").pop()!;
+    const parentUrl = parent
+      ? `${GRAPH}/me/drive/root:/${encodePath(parent)}:/children`
+      : `${GRAPH}/me/drive/root/children`;
+    const res = await fetch(parentUrl, {
+      method: "POST",
+      headers: {
+        Authorization: headers.get("Authorization")!,
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify({
+        name,
+        folder: {},
+        "@microsoft.graph.conflictBehavior": "fail",
+      }),
+      signal: AbortSignal.timeout(30_000),
+    });
+    if (res.status === 409 || res.ok) continue;
+    // 409 conflict = already exists for some tenants; also accept nameAlreadyExists
+    const body = await res.text();
+    if (res.status === 409 || body.includes("nameAlreadyExists")) continue;
+    // If fail conflict, try again with replace noop by GETting
+    const check = await fetch(`${GRAPH}/me/drive/root:/${encodePath(folder)}`, {
+      headers,
+      signal: AbortSignal.timeout(15_000),
+    });
+    if (check.ok) continue;
+    throw new Error(`failed to ensure OneDrive folder ${folder}: ${res.status} ${body.slice(0, 300)}`);
+  }
+}
+
+export async function uploadTextFile(relativePath: string, content: string | Buffer, contentType = "application/json"): Promise<void> {
+  await ensureSyncFolder();
+  const headers = await authHeaders();
+  const path = `${REMOTE_ROOT}/${relativePath}`.replace(/\/+/g, "/");
+  const url = `${GRAPH}/me/drive/root:/${encodePath(path)}:/content`;
+  const body = typeof content === "string" ? content : new Uint8Array(content);
+  const res = await fetch(url, {
+    method: "PUT",
+    headers: {
+      Authorization: headers.get("Authorization")!,
+      "Content-Type": contentType,
+    },
+    body,
+    signal: AbortSignal.timeout(120_000),
+  });
+  if (!res.ok) {
+    const text = await res.text();
+    throw new Error(`OneDrive upload failed for ${relativePath}: ${res.status} ${text.slice(0, 400)}`);
+  }
+}
+
+export async function downloadFile(relativePath: string): Promise<Buffer | null> {
+  const headers = await authHeaders();
+  const path = `${REMOTE_ROOT}/${relativePath}`.replace(/\/+/g, "/");
+  const url = `${GRAPH}/me/drive/root:/${encodePath(path)}:/content`;
+  const res = await fetch(url, {
+    headers,
+    signal: AbortSignal.timeout(120_000),
+  });
+  if (res.status === 404) return null;
+  if (!res.ok) {
+    const text = await res.text();
+    throw new Error(`OneDrive download failed for ${relativePath}: ${res.status} ${text.slice(0, 400)}`);
+  }
+  return Buffer.from(await res.arrayBuffer());
+}
+
+export async function remoteFileExists(relativePath: string): Promise<boolean> {
+  const headers = await authHeaders();
+  const path = `${REMOTE_ROOT}/${relativePath}`.replace(/\/+/g, "/");
+  const url = `${GRAPH}/me/drive/root:/${encodePath(path)}`;
+  const res = await fetch(url, { headers, signal: AbortSignal.timeout(15_000) });
+  return res.ok;
+}
+
+export function remoteSyncRootDescription(): string {
+  return `OneDrive:/${REMOTE_ROOT}/`;
+}

package/src/cloud/settings.ts

@@ -0,0 +1,75 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { hostname } from "node:os";
+import { join } from "node:path";
+import { createHash, randomBytes } from "node:crypto";
+import { getConfigDir } from "../config";
+import { hardenSecretPath } from "../lib/windows-secret-acl";
+import type { CloudSyncSettings } from "./types";
+
+export function cloudSyncSettingsPath(): string {
+  return join(getConfigDir(), "cloud-sync.json");
+}
+
+export function deviceIdPath(): string {
+  return join(getConfigDir(), "device-id");
+}
+
+export function getOrCreateDeviceId(): string {
+  const path = deviceIdPath();
+  if (existsSync(path)) {
+    try {
+      const id = readFileSync(path, "utf8").trim();
+      if (id) return id;
+    } catch { /* recreate */ }
+  }
+  const id = createHash("sha256").update(randomBytes(32)).digest("hex").slice(0, 16);
+  writeFileSync(path, `${id}\n`, { encoding: "utf8", mode: 0o600 });
+  hardenSecretPath(path, { required: true });
+  return id;
+}
+
+export function getDeviceName(): string {
+  try { return hostname() || "unknown-device"; } catch { return "unknown-device"; }
+}
+
+export function readCloudSyncSettings(): CloudSyncSettings {
+  const path = cloudSyncSettingsPath();
+  if (!existsSync(path)) return { provider: "onedrive" };
+  try {
+    const raw = JSON.parse(readFileSync(path, "utf8")) as CloudSyncSettings;
+    return { ...raw, provider: "onedrive" };
+  } catch {
+    return { provider: "onedrive" };
+  }
+}
+
+export function writeCloudSyncSettings(settings: CloudSyncSettings): void {
+  const path = cloudSyncSettingsPath();
+  const next: CloudSyncSettings = { ...settings, provider: "onedrive" };
+  writeFileSync(path, `${JSON.stringify(next, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+  hardenSecretPath(path, { required: true });
+}
+
+/** Resolve Microsoft public client id: flag > env > settings. */
+export function resolveClientId(explicit?: string): string {
+  const fromFlag = explicit?.trim();
+  if (fromFlag) return fromFlag;
+  const fromEnv = process.env.OPENCODEX_MS_CLIENT_ID?.trim() || process.env.OPENCODEX_ONEDRIVE_CLIENT_ID?.trim();
+  if (fromEnv) return fromEnv;
+  const fromSettings = readCloudSyncSettings().clientId?.trim();
+  if (fromSettings) return fromSettings;
+  throw new Error(
+    "Microsoft client_id required.\n"
+    + "  1) Register an app at https://portal.azure.com → App registrations\n"
+    + "  2) Supported accounts: personal + organizational\n"
+    + "  3) Platform: Mobile and desktop (or none). Device-code login does not need a redirect URI.\n"
+    + "     Do NOT use http://localhost:10100/#cloud — Azure rejects # fragments in redirect URIs.\n"
+    + "  4) Authentication → Allow public client flows = Yes\n"
+    + "     (or Manifest: \"allowPublicClient\": true). Device code requires a public/mobile client.\n"
+    + "  5) API permissions (delegated Microsoft Graph): User.Read, Files.ReadWrite, offline_access\n"
+    + "     Personal-MSA-only apps use /consumers (set automatically).\n"
+    + "  6) Then:\n"
+    + "       ocx sync-cloud set-client-id <YOUR_CLIENT_ID>\n"
+    + "     or export OPENCODEX_MS_CLIENT_ID=<YOUR_CLIENT_ID>",
+  );
+}

package/src/cloud/sync.ts

@@ -0,0 +1,212 @@
+/**
+ * Push / pull OpenCodex local state to OneDrive.
+ */
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { getConfigDir, loadConfig, saveConfig } from "../config";
+import { hardenSecretPath } from "../lib/windows-secret-acl";
+import { downloadFile, remoteSyncRootDescription, uploadTextFile } from "./onedrive-graph";
+import {
+  getDeviceName,
+  getOrCreateDeviceId,
+  readCloudSyncSettings,
+  writeCloudSyncSettings,
+} from "./settings";
+import type { CloudSyncManifest } from "./types";
+import { decryptVault, encryptVault, packVaultFiles, unpackVaultFiles } from "./vault";
+
+const VAULT_FILES = ["auth.json", "codex-accounts.json"] as const;
+const CONFIG_FILE = "config.json";
+const MANIFEST_FILE = "manifest.json";
+const VAULT_FILE = "vault.enc";
+const USAGE_FILE = "usage.jsonl";
+
+function localPath(name: string): string {
+  return join(getConfigDir(), name);
+}
+
+function readLocalOptional(name: string): string | null {
+  const path = localPath(name);
+  if (!existsSync(path)) return null;
+  return readFileSync(path, "utf8");
+}
+
+function writeLocal(name: string, content: string, mode = 0o600): void {
+  const path = localPath(name);
+  writeFileSync(path, content, { encoding: "utf8", mode });
+  hardenSecretPath(path, { required: true });
+}
+
+export interface PushOptions {
+  passphrase?: string;
+  includeUsage?: boolean;
+  includeVault?: boolean;
+}
+
+export interface PullOptions {
+  passphrase?: string;
+  /** Overwrite local config/auth without interactive confirm (CLI --yes). */
+  yes?: boolean;
+  includeUsage?: boolean;
+}
+
+export interface SyncResult {
+  direction: "push" | "pull";
+  remoteRoot: string;
+  files: string[];
+  hasVault: boolean;
+  updatedAt: string;
+}
+
+export async function pushToOneDrive(options: PushOptions = {}): Promise<SyncResult> {
+  const settings = readCloudSyncSettings();
+  const includeUsage = options.includeUsage ?? settings.includeUsage === true;
+  const includeVault = options.includeVault ?? Boolean(options.passphrase);
+  if (includeVault && !options.passphrase) {
+    throw new Error("vault sync requires --passphrase (min 8 chars)");
+  }
+
+  const files: string[] = [];
+  const config = loadConfig();
+  const configJson = `${JSON.stringify(config, null, 2)}\n`;
+  await uploadTextFile(CONFIG_FILE, configJson);
+  files.push(CONFIG_FILE);
+
+  let hasVault = false;
+  if (includeVault && options.passphrase) {
+    const vaultFiles: Record<string, string> = {};
+    for (const name of VAULT_FILES) {
+      const content = readLocalOptional(name);
+      if (content != null) vaultFiles[name] = content;
+    }
+    if (Object.keys(vaultFiles).length === 0) {
+      throw new Error("no vault files found (auth.json / codex-accounts.json)");
+    }
+    const packed = packVaultFiles(vaultFiles);
+    const blob = encryptVault(packed, options.passphrase);
+    await uploadTextFile(VAULT_FILE, blob, "application/octet-stream");
+    files.push(VAULT_FILE);
+    hasVault = true;
+  }
+
+  if (includeUsage) {
+    const usage = readLocalOptional(USAGE_FILE);
+    if (usage != null) {
+      await uploadTextFile(USAGE_FILE, usage, "application/x-ndjson");
+      files.push(USAGE_FILE);
+    }
+  }
+
+  const updatedAt = new Date().toISOString();
+  const manifest: CloudSyncManifest = {
+    version: 1,
+    updatedAt,
+    deviceId: getOrCreateDeviceId(),
+    deviceName: getDeviceName(),
+    files,
+    hasVault,
+    includeUsage,
+  };
+  await uploadTextFile(MANIFEST_FILE, `${JSON.stringify(manifest, null, 2)}\n`);
+  files.push(MANIFEST_FILE);
+
+  writeCloudSyncSettings({
+    ...settings,
+    lastSyncAt: updatedAt,
+    lastSyncDirection: "push",
+    lastDeviceId: manifest.deviceId,
+    includeUsage,
+    includeVault,
+  });
+
+  return {
+    direction: "push",
+    remoteRoot: remoteSyncRootDescription(),
+    files,
+    hasVault,
+    updatedAt,
+  };
+}
+
+export async function pullFromOneDrive(options: PullOptions = {}): Promise<SyncResult> {
+  if (!options.yes) {
+    throw new Error("pull overwrites local state — re-run with --yes to confirm");
+  }
+
+  const manifestBuf = await downloadFile(MANIFEST_FILE);
+  if (!manifestBuf) {
+    throw new Error(`no cloud sync found at ${remoteSyncRootDescription()} — push from another machine first`);
+  }
+  const manifest = JSON.parse(manifestBuf.toString("utf8")) as CloudSyncManifest;
+  if (manifest.version !== 1) throw new Error(`unsupported remote manifest version ${manifest.version}`);
+
+  const files: string[] = [MANIFEST_FILE];
+  const configBuf = await downloadFile(CONFIG_FILE);
+  if (configBuf) {
+    // Validate by parsing + saveConfig path (structural checks)
+    const raw = JSON.parse(configBuf.toString("utf8"));
+    saveConfig(raw);
+    files.push(CONFIG_FILE);
+  }
+
+  let hasVault = false;
+  if (manifest.hasVault || manifest.files.includes(VAULT_FILE)) {
+    if (!options.passphrase) {
+      throw new Error("remote has encrypted vault — provide --passphrase to restore accounts");
+    }
+    const vaultBuf = await downloadFile(VAULT_FILE);
+    if (vaultBuf) {
+      const plain = decryptVault(vaultBuf, options.passphrase);
+      const payload = unpackVaultFiles(plain);
+      for (const [name, content] of Object.entries(payload.files)) {
+        if (!VAULT_FILES.includes(name as typeof VAULT_FILES[number])) continue;
+        writeLocal(name, content.endsWith("\n") ? content : `${content}\n`);
+        files.push(name);
+      }
+      hasVault = true;
+    }
+  }
+
+  const wantUsage = options.includeUsage ?? manifest.includeUsage;
+  if (wantUsage) {
+    const usageBuf = await downloadFile(USAGE_FILE);
+    if (usageBuf) {
+      // Merge: append remote lines not already present (simple content-hash set of last 50k lines)
+      const local = readLocalOptional(USAGE_FILE) ?? "";
+      const localLines = new Set(local.split("\n").filter(Boolean));
+      const remoteLines = usageBuf.toString("utf8").split("\n").filter(Boolean);
+      const merged = [...localLines];
+      for (const line of remoteLines) {
+        if (!localLines.has(line)) merged.push(line);
+      }
+      writeLocal(USAGE_FILE, `${merged.join("\n")}\n`);
+      files.push(USAGE_FILE);
+    }
+  }
+
+  const settings = readCloudSyncSettings();
+  writeCloudSyncSettings({
+    ...settings,
+    lastSyncAt: new Date().toISOString(),
+    lastSyncDirection: "pull",
+    lastDeviceId: getOrCreateDeviceId(),
+  });
+
+  return {
+    direction: "pull",
+    remoteRoot: remoteSyncRootDescription(),
+    files,
+    hasVault,
+    updatedAt: manifest.updatedAt,
+  };
+}
+
+export async function readRemoteManifest(): Promise<CloudSyncManifest | null> {
+  const buf = await downloadFile(MANIFEST_FILE);
+  if (!buf) return null;
+  try {
+    return JSON.parse(buf.toString("utf8")) as CloudSyncManifest;
+  } catch {
+    return null;
+  }
+}

package/src/cloud/types.ts

@@ -0,0 +1,56 @@
+/** Local cloud-sync settings (stored in ~/.opencodex/cloud-sync.json). */
+
+/** Microsoft identity platform tenant path segment for OAuth. */
+export type MsAuthority = "common" | "consumers" | "organizations";
+
+export interface CloudSyncSettings {
+  provider: "onedrive";
+  /** Azure AD / Entra application (public client) ID. */
+  clientId?: string;
+  /**
+   * Optional client secret — only if the Azure app is a confidential (Web) client.
+   * Prefer public client: Authentication → Allow public client flows = Yes (no secret).
+   */
+  clientSecret?: string;
+  /**
+   * login.microsoftonline.com/{msAuthority}/…
+   * Personal-MSA-only apps must use "consumers" (not "common").
+   */
+  msAuthority?: MsAuthority;
+  /**
+   * Fixed loopback port for browser OAuth (default 18765).
+   * Azure redirect URI must be exactly: http://localhost:{port}
+   */
+  loopbackPort?: number;
+  /** Last successful push/pull ISO timestamp. */
+  lastSyncAt?: string;
+  lastSyncDirection?: "push" | "pull";
+  lastDeviceId?: string;
+  /** Include usage.jsonl on push/pull. Default false (can grow large). */
+  includeUsage?: boolean;
+  /** Include encrypted vault (auth + codex-accounts). Requires passphrase. Default true when pushing with --passphrase. */
+  includeVault?: boolean;
+}
+
+export interface OneDriveTokenStore {
+  accessToken: string;
+  refreshToken: string;
+  expiresAt: number;
+  scope?: string;
+  account?: string;
+  clientId: string;
+  /** Authority used when this token was issued (must match refresh). */
+  authority?: MsAuthority;
+}
+
+export interface CloudSyncManifest {
+  version: 1;
+  updatedAt: string;
+  deviceId: string;
+  deviceName: string;
+  /** Relative paths present in the remote folder. */
+  files: string[];
+  /** true if vault.enc is present and encrypted. */
+  hasVault: boolean;
+  includeUsage: boolean;
+}

package/src/cloud/vault.ts

@@ -0,0 +1,89 @@
+/**
+ * Passphrase-encrypted vault for sensitive OpenCodex state (auth / account pools).
+ * Format: base64(JSON header) + "." + base64(iv||ciphertext||tag) is avoided —
+ * single binary envelope: magic | version | salt | iv | tag | ciphertext
+ */
+import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from "node:crypto";
+
+const MAGIC = Buffer.from("OCXV1", "utf8");
+const VERSION = 1;
+const SALT_LEN = 16;
+const IV_LEN = 12;
+const TAG_LEN = 16;
+const KEY_LEN = 32;
+const SCRYPT_N = 16384;
+const SCRYPT_R = 8;
+const SCRYPT_P = 1;
+
+function deriveKey(passphrase: string, salt: Buffer): Buffer {
+  return scryptSync(passphrase, salt, KEY_LEN, { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P, maxmem: 64 * 1024 * 1024 });
+}
+
+export function encryptVault(plaintext: string | Buffer, passphrase: string): Buffer {
+  if (!passphrase || passphrase.length < 8) {
+    throw new Error("vault passphrase must be at least 8 characters");
+  }
+  const salt = randomBytes(SALT_LEN);
+  const iv = randomBytes(IV_LEN);
+  const key = deriveKey(passphrase, salt);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const data = typeof plaintext === "string" ? Buffer.from(plaintext, "utf8") : plaintext;
+  const encrypted = Buffer.concat([cipher.update(data), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return Buffer.concat([
+    MAGIC,
+    Buffer.from([VERSION]),
+    salt,
+    iv,
+    tag,
+    encrypted,
+  ]);
+}
+
+export function decryptVault(blob: Buffer, passphrase: string): Buffer {
+  if (blob.length < MAGIC.length + 1 + SALT_LEN + IV_LEN + TAG_LEN + 1) {
+    throw new Error("vault blob is too short or corrupt");
+  }
+  if (!blob.subarray(0, MAGIC.length).equals(MAGIC)) {
+    throw new Error("vault blob has invalid magic (not an OpenCodex vault)");
+  }
+  const version = blob[MAGIC.length];
+  if (version !== VERSION) throw new Error(`unsupported vault version ${version}`);
+  let offset = MAGIC.length + 1;
+  const salt = blob.subarray(offset, offset + SALT_LEN); offset += SALT_LEN;
+  const iv = blob.subarray(offset, offset + IV_LEN); offset += IV_LEN;
+  const tag = blob.subarray(offset, offset + TAG_LEN); offset += TAG_LEN;
+  const encrypted = blob.subarray(offset);
+  const key = deriveKey(passphrase, salt);
+  const decipher = createDecipheriv("aes-256-gcm", key, iv);
+  decipher.setAuthTag(tag);
+  try {
+    return Buffer.concat([decipher.update(encrypted), decipher.final()]);
+  } catch {
+    throw new Error("vault decrypt failed — wrong passphrase or corrupt file");
+  }
+}
+
+export interface VaultPayload {
+  version: 1;
+  createdAt: string;
+  /** Filename → utf8 content */
+  files: Record<string, string>;
+}
+
+export function packVaultFiles(files: Record<string, string>): string {
+  const payload: VaultPayload = {
+    version: 1,
+    createdAt: new Date().toISOString(),
+    files,
+  };
+  return JSON.stringify(payload);
+}
+
+export function unpackVaultFiles(plaintext: Buffer): VaultPayload {
+  const parsed = JSON.parse(plaintext.toString("utf8")) as VaultPayload;
+  if (parsed?.version !== 1 || !parsed.files || typeof parsed.files !== "object") {
+    throw new Error("vault payload schema invalid");
+  }
+  return parsed;
+}

package/src/codex/account-id.ts

@@ -0,0 +1,34 @@
+/** Canonical persisted Codex pool-account id format. */
+export const CODEX_ACCOUNT_ID_RE = /^[A-Za-z0-9._-]{1,64}$/;
+
+// Account credentials are persisted in JSON object maps. These names have
+// special meaning on ordinary JavaScript objects and must never be admitted as
+// user-controlled keys.
+const RESERVED_CODEX_ACCOUNT_IDS = new Set(["__proto__", "prototype", "constructor"]);
+
+/**
+ * Stable internal id under which the Codex Desktop login participates in account rotation.
+ * It is reserved and must never be used as a public namespace target or pool-account id.
+ */
+export const MAIN_CODEX_ACCOUNT_ID = "__main__";
+
+export function isValidCodexAccountId(accountId: unknown): accountId is string {
+  return typeof accountId === "string"
+    && accountId !== MAIN_CODEX_ACCOUNT_ID
+    && CODEX_ACCOUNT_ID_RE.test(accountId)
+    && !RESERVED_CODEX_ACCOUNT_IDS.has(accountId.toLowerCase());
+}
+
+type CodexAccountIdentityRow = { id: string; isMain: boolean };
+
+/** Legacy invalid rows remain loadable for cleanup, but never participate in routing. */
+export function isSelectableCodexPoolAccount(account: CodexAccountIdentityRow): boolean {
+  return !account.isMain && isValidCodexAccountId(account.id);
+}
+
+/** A pre-validation pool row that collides with the internal Desktop-account sentinel. */
+export function hasLegacyMainCodexPoolAccount(
+  accounts: readonly CodexAccountIdentityRow[] | undefined,
+): boolean {
+  return accounts?.some(account => !account.isMain && account.id === MAIN_CODEX_ACCOUNT_ID) ?? false;
+}

package/src/codex/account-label.ts

@@ -0,0 +1,34 @@
+import { createHash, randomBytes } from "node:crypto";
+import type { CodexAccount } from "../types";
+
+export const CODEX_ACCOUNT_LOG_LABEL_RE = /^p[a-f0-9]{6}$/;
+
+export function createCodexAccountLogLabel(existingLabels: Iterable<string | undefined | null> = []): string {
+  const used = new Set([...existingLabels].filter((value): value is string => !!value));
+  for (let i = 0; i < 16; i++) {
+    const label = `p${randomBytes(3).toString("hex")}`;
+    if (!used.has(label)) return label;
+  }
+  return `p${randomBytes(6).toString("hex").slice(0, 6)}`;
+}
+
+export function fallbackCodexAccountLogLabel(accountId: string): string {
+  return `p${createHash("sha256").update(accountId).digest("hex").slice(0, 6)}`;
+}
+
+export function codexAccountLogLabel(account: CodexAccount): string {
+  return CODEX_ACCOUNT_LOG_LABEL_RE.test(account.logLabel ?? "")
+    ? account.logLabel!
+    : fallbackCodexAccountLogLabel(account.id);
+}
+
+export function withCodexAccountLogLabel(
+  account: Omit<CodexAccount, "logLabel"> & Partial<Pick<CodexAccount, "logLabel">>,
+  existingAccounts: readonly CodexAccount[],
+): CodexAccount {
+  if (account.logLabel && CODEX_ACCOUNT_LOG_LABEL_RE.test(account.logLabel)) return account as CodexAccount;
+  return {
+    ...account,
+    logLabel: createCodexAccountLogLabel(existingAccounts.map(existing => existing.logLabel)),
+  };
+}

package/src/codex/account-lifecycle.ts

@@ -0,0 +1,55 @@
+import { removeCodexAccountCredential } from "./account-store";
+import { clearAccountNeedsReauth } from "./account-runtime-state";
+import { getMainChatgptAccountId } from "./auth-collision";
+import { MAIN_CODEX_ACCOUNT_ID, setMainAccountPlan } from "./main-account";
+import { clearAccountQuota } from "./quota";
+import { clearCodexUpstreamHealthForAccount, clearThreadAccountMapForAccount } from "./routing";
+import { invalidateCodexWebSocketsForAccount } from "./websocket-registry";
+import { clearMainAccountInfoCache } from "./main-account-cache";
+import { forgetCodexAccountPause } from "./account-pause";
+import type { OcxConfig } from "../types";
+
+let observedMainChatgptAccountId: string | undefined;
+
+export function purgeCodexAccountRuntimeState(accountId: string): void {
+  clearAccountNeedsReauth(accountId);
+  clearAccountQuota(accountId);
+  clearThreadAccountMapForAccount(accountId);
+  clearCodexUpstreamHealthForAccount(accountId);
+  if (accountId === MAIN_CODEX_ACCOUNT_ID) clearMainAccountInfoCache();
+}
+
+/**
+ * The main Codex login is stored under the stable `__main__` alias, while
+ * `~/.codex/auth.json` can be replaced with credentials for another physical
+ * ChatGPT account. Drop alias-keyed runtime state when that identity changes so
+ * cooldown, quota, reauth, and thread affinity do not leak across accounts.
+ */
+export function reconcileMainCodexAccountRuntimeState(): boolean {
+  const currentAccountId = getMainChatgptAccountId();
+  // A missing/malformed auth.json is an unknown identity, not a confirmed account switch. Keep the
+  // prior observation and its safety state until a real account id can be read again.
+  if (currentAccountId === null) return false;
+  const previousAccountId = observedMainChatgptAccountId;
+  observedMainChatgptAccountId = currentAccountId;
+  if (previousAccountId === undefined || previousAccountId === currentAccountId) return false;
+
+  purgeCodexAccountRuntimeState(MAIN_CODEX_ACCOUNT_ID);
+  setMainAccountPlan(null);
+  invalidateCodexWebSocketsForAccount(MAIN_CODEX_ACCOUNT_ID);
+  return true;
+}
+
+export function resetMainCodexAccountIdentityTrackingForTests(): void {
+  observedMainChatgptAccountId = undefined;
+}
+
+export function deleteCodexAccount(runtimeConfig: OcxConfig, accountId: string): void {
+  removeCodexAccountCredential(accountId);
+  runtimeConfig.codexAccounts = (runtimeConfig.codexAccounts ?? [])
+    .filter(account => account.isMain || account.id !== accountId);
+  forgetCodexAccountPause(runtimeConfig, accountId);
+  if (runtimeConfig.activeCodexAccountId === accountId) runtimeConfig.activeCodexAccountId = undefined;
+  purgeCodexAccountRuntimeState(accountId);
+  invalidateCodexWebSocketsForAccount(accountId);
+}