@juspay/neurolink 11.2.0 → 11.2.2

package/dist/cli/commands/proxy.js

@@ -625,6 +625,190 @@ async function clearOpenCodeProxySettings(expectedBaseUrl) {
     fs.writeFileSync(OPENCODE_CONFIG_PATH, JSON.stringify(config, null, 2));
     return hadNeurolink;
 }
+// =============================================================================
+// CODEX (ChatGPT) AUTO-CONFIGURATION
+// =============================================================================
+//
+// Points the Codex CLI at the proxy by managing `~/.codex/config.toml`:
+//   - appends a marker-delimited `[model_providers.neurolink]` table
+//   - flips the top-level `model_provider` to "neurolink"
+// The original `model_provider` value is snapshotted to a sidecar JSON so the
+// restore works even across process crashes. All edits are guarded and wrapped
+// so a failure never aborts proxy start/stop. Codex talks the Responses API to
+// the proxy's /backend-api/codex path.
+const CODEX_CONFIG_PATH = join(homedir(), ".codex", "config.toml");
+const CODEX_SNAPSHOT_PATH = join(homedir(), ".neurolink", "codex-proxy-snapshot.json");
+const CODEX_BLOCK_BEGIN = "# >>> neurolink-proxy (managed) >>>";
+const CODEX_BLOCK_END = "# <<< neurolink-proxy (managed) <<<";
+const CODEX_PROVIDER_LINE_RE = /^[ \t]*model_provider[ \t]*=.*$/m;
+const CODEX_MODEL_LINE_RE = /^[ \t]*model[ \t]*=.*$/m;
+/** Strip any previously-managed block + our injected provider line. */
+function stripCodexManagedConfig(text) {
+    const blockRe = new RegExp(`\\n?${escapeRegExp(CODEX_BLOCK_BEGIN)}[\\s\\S]*?${escapeRegExp(CODEX_BLOCK_END)}\\n?`, "g");
+    let out = text.replace(blockRe, "\n");
+    // Remove our injected selector line (only the exact "neurolink" one).
+    out = out.replace(/^[ \t]*model_provider[ \t]*=[ \t]*"neurolink"[ \t]*$\n?/m, "");
+    return out;
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+ * Apply a top-level TOML key edit, confined to the document preamble.
+ *
+ * In TOML every key after a `[table]` header belongs to that table. A
+ * document-wide regex therefore happily rewrites `model_provider` inside
+ * `[model_providers.foo]`, which sets a table key instead of the top-level
+ * selector: Codex keeps using its original provider while the command reports
+ * success. Only the text before the first header can hold top-level keys.
+ */
+function editTomlPreamble(text, edit) {
+    const headerMatch = /^[ \t]*\[/m.exec(text);
+    const boundary = headerMatch ? headerMatch.index : text.length;
+    const preamble = text.slice(0, boundary);
+    const edited = edit(preamble);
+    return edited === null ? text : edited + text.slice(boundary);
+}
+function buildCodexProviderBlock(baseUrl) {
+    return [
+        CODEX_BLOCK_BEGIN,
+        "[model_providers.neurolink]",
+        'name = "NeuroLink Proxy"',
+        `base_url = "${baseUrl}/backend-api/codex"`,
+        'wire_api = "responses"',
+        "requires_openai_auth = true",
+        CODEX_BLOCK_END,
+        "",
+    ].join("\n");
+}
+async function setCodexProxySettings(baseUrl) {
+    try {
+        const fs = await import("fs");
+        if (!fs.existsSync(CODEX_CONFIG_PATH)) {
+            // Codex not installed / never configured — skip silently.
+            return false;
+        }
+        const original = fs.readFileSync(CODEX_CONFIG_PATH, "utf8");
+        // Snapshot the user's original selector once (survives crashes/restarts).
+        if (!fs.existsSync(CODEX_SNAPSHOT_PATH)) {
+            // Same preamble boundary the edit paths use. Matching document-wide would
+            // capture a `model_provider` belonging to a table — a legacy
+            // `[profiles.<name>]` block, say — and the restore would then write that
+            // profile's provider back as the top-level selector.
+            let providerMatch = null;
+            editTomlPreamble(original, (preamble) => {
+                providerMatch = preamble.match(CODEX_PROVIDER_LINE_RE);
+                return null;
+            });
+            // Ignore a stale managed selector line if present in the original.
+            const originalProviderLine = providerMatch && !/"neurolink"/.test(providerMatch[0])
+                ? providerMatch[0]
+                : null;
+            fs.mkdirSync(join(homedir(), ".neurolink"), { recursive: true });
+            fs.writeFileSync(CODEX_SNAPSHOT_PATH, JSON.stringify({ originalProviderLine }, null, 2), { mode: 0o600 });
+        }
+        let text = stripCodexManagedConfig(original);
+        // Set the selector: replace an existing top-level model_provider or insert
+        // one right after the top-level `model = ...` line (stays before any table).
+        let selectorPlaced = false;
+        text = editTomlPreamble(text, (preamble) => {
+            if (CODEX_PROVIDER_LINE_RE.test(preamble)) {
+                selectorPlaced = true;
+                return preamble.replace(CODEX_PROVIDER_LINE_RE, 'model_provider = "neurolink"');
+            }
+            if (CODEX_MODEL_LINE_RE.test(preamble)) {
+                selectorPlaced = true;
+                return preamble.replace(CODEX_MODEL_LINE_RE, (line) => `${line}\nmodel_provider = "neurolink"`);
+            }
+            return null;
+        });
+        if (!selectorPlaced) {
+            text = `model_provider = "neurolink"\n${text}`;
+        }
+        const trimmed = text.replace(/\s*$/, "\n");
+        fs.writeFileSync(CODEX_CONFIG_PATH, `${trimmed}\n${buildCodexProviderBlock(baseUrl)}`);
+        return true;
+    }
+    catch (error) {
+        logger.debug(`[proxy] Codex client config not updated: ${error instanceof Error ? error.message : String(error)}`);
+        return false;
+    }
+}
+async function clearCodexProxySettings(expectedBaseUrl) {
+    try {
+        const fs = await import("fs");
+        if (!fs.existsSync(CODEX_CONFIG_PATH)) {
+            return false;
+        }
+        const original = fs.readFileSync(CODEX_CONFIG_PATH, "utf8");
+        // The managed block records its owner in `base_url`. Without this check a
+        // second proxy shutting down on another port would strip the block that the
+        // still-running proxy installed, and restore the snapshot selector on top —
+        // silently taking Codex off the live proxy. Mirrors the Claude and OpenCode
+        // clear paths.
+        if (expectedBaseUrl) {
+            const ownerMatch = original.match(new RegExp(`${escapeRegExp(CODEX_BLOCK_BEGIN)}[\\s\\S]*?base_url\\s*=\\s*"([^"]*)"`));
+            if (ownerMatch &&
+                ownerMatch[1] !== `${expectedBaseUrl}/backend-api/codex`) {
+                return false;
+            }
+        }
+        let text = stripCodexManagedConfig(original);
+        // Restore the user's original selector line if we snapshotted one.
+        let restored = null;
+        if (fs.existsSync(CODEX_SNAPSHOT_PATH)) {
+            try {
+                const snap = JSON.parse(fs.readFileSync(CODEX_SNAPSHOT_PATH, "utf8"));
+                restored = snap.originalProviderLine ?? null;
+            }
+            catch {
+                restored = null;
+            }
+        }
+        if (restored) {
+            const restoredLine = restored;
+            let restorePlaced = false;
+            text = editTomlPreamble(text, (preamble) => {
+                if (CODEX_PROVIDER_LINE_RE.test(preamble)) {
+                    restorePlaced = true;
+                    return preamble.replace(CODEX_PROVIDER_LINE_RE, restoredLine);
+                }
+                if (CODEX_MODEL_LINE_RE.test(preamble)) {
+                    restorePlaced = true;
+                    return preamble.replace(CODEX_MODEL_LINE_RE, (line) => `${line}\n${restoredLine}`);
+                }
+                return null;
+            });
+            if (!restorePlaced) {
+                text = `${restoredLine}\n${text}`;
+            }
+        }
+        if (text === original) {
+            // Nothing managed remains, so the snapshot can no longer describe the
+            // user's current selector. Keeping it would let a later clear restore a
+            // value the user has since changed by hand.
+            try {
+                fs.rmSync(CODEX_SNAPSHOT_PATH, { force: true });
+            }
+            catch {
+                // best-effort
+            }
+            return false;
+        }
+        fs.writeFileSync(CODEX_CONFIG_PATH, text.replace(/\s*$/, "\n"));
+        try {
+            fs.rmSync(CODEX_SNAPSHOT_PATH, { force: true });
+        }
+        catch {
+            // best-effort
+        }
+        return true;
+    }
+    catch (error) {
+        logger.debug(`[proxy] Codex client config not cleared: ${error instanceof Error ? error.message : String(error)}`);
+        return false;
+    }
+}
 export async function probeProxyHealth(host, port, timeoutMs) {
     const startedAt = Date.now();
     try {
@@ -1217,7 +1401,7 @@ async function createProxyNeurolinkRuntime(logsDir) {
     };
 }
 function registerProxyRequestTracking(app, requestMetadata, readiness) {
-    app.use("/v1/*", async (c, next) => {
+    const trackingHandler = async (c, next) => {
         const startedMonotonicMs = performance.now();
         const contentLengthHeader = c.req.raw.headers.get("content-length");
         const rawContentLength = contentLengthHeader === null ? Number.NaN : Number(contentLengthHeader);
@@ -1336,11 +1520,16 @@ function registerProxyRequestTracking(app, requestMetadata, readiness) {
             });
             throw error;
         }
-    });
+    };
+    // Cover both the Anthropic (/v1/*) and Codex (/backend-api/*) inbound paths so
+    // drain/reject, lifecycle logging, and concurrency accounting apply to both.
+    app.use("/v1/*", trackingHandler);
+    app.use("/backend-api/*", trackingHandler);
 }
 export async function createProxyStartApp(params) {
     const { createClaudeProxyRoutes } = await import("../../lib/server/routes/claudeProxyRoutes.js");
     const { createOpenAIProxyRoutes } = await import("../../lib/server/routes/openaiProxyRoutes.js");
+    const { createCodexProxyRoutes } = await import("../../lib/server/routes/codexProxyRoutes.js");
     const { logBodyCapture, logRequest } = await import("../../lib/proxy/requestLogger.js");
     const { recordFinalError } = await import("../../lib/proxy/usageStats.js");
     const { Hono } = await import("hono");
@@ -1461,7 +1650,12 @@ export async function createProxyStartApp(params) {
         }
         : params.accountAllowlist);
     const openaiRouteGroup = createOpenAIProxyRoutes(params.modelRouter, "", params.port, runtimeConfigProvider);
-    const allProxyRoutes = [...routeGroup.routes, ...openaiRouteGroup.routes];
+    const codexRouteGroup = createCodexProxyRoutes("");
+    const allProxyRoutes = [
+        ...routeGroup.routes,
+        ...openaiRouteGroup.routes,
+        ...codexRouteGroup.routes,
+    ];
     for (const route of allProxyRoutes) {
         const method = route.method.toLowerCase();
         app[method](route.path, async (c) => {
@@ -2265,9 +2459,16 @@ function registerProxyShutdownHandlers(params) {
             catch {
                 // non-fatal
             }
+            const shutdownHost = params.host === "0.0.0.0" ? "localhost" : params.host;
+            const shutdownBaseUrl = `http://${shutdownHost}:${params.port}`;
             try {
-                const shutdownHost = params.host === "0.0.0.0" ? "localhost" : params.host;
-                await clearOpenCodeProxySettings(`http://${shutdownHost}:${params.port}/v1`);
+                await clearOpenCodeProxySettings(`${shutdownBaseUrl}/v1`);
+            }
+            catch {
+                // non-fatal
+            }
+            try {
+                await clearCodexProxySettings(shutdownBaseUrl);
             }
             catch {
                 // non-fatal
@@ -2516,6 +2717,16 @@ async function startProxyRuntime(params) {
             logger.debug("[proxy] Failed to auto-configure OpenCode: " +
                 (error instanceof Error ? error.message : String(error)));
         }
+        try {
+            if (await setCodexProxySettings(url)) {
+                logger.always(chalk.green("  ✓ Auto-configured Codex settings"));
+                logger.always(chalk.dim("    Restart Codex to connect through proxy"));
+            }
+        }
+        catch (error) {
+            logger.debug("[proxy] Failed to auto-configure Codex: " +
+                (error instanceof Error ? error.message : String(error)));
+        }
     }
     else {
         logger.always(chalk.dim("  ⊘ Dev mode: skipping client auto-configuration"));
@@ -3826,6 +4037,12 @@ export const proxyGuardCommand = {
         catch {
             // non-fatal
         }
+        try {
+            await clearCodexProxySettings(expectedBaseUrl);
+        }
+        catch {
+            // non-fatal
+        }
         const state = loadProxyState();
         if (state &&
             state.host === host &&
@@ -3944,6 +4161,14 @@ export const proxySetupCommand = {
             catch (e) {
                 console.info(chalk.yellow(`  ⚠ Could not auto-configure OpenCode: ${e instanceof Error ? e.message : String(e)}`));
             }
+            try {
+                if (await setCodexProxySettings(url)) {
+                    console.info(chalk.green("  ✓ Codex configured"));
+                }
+            }
+            catch (e) {
+                console.info(chalk.yellow(`  ⚠ Could not auto-configure Codex: ${e instanceof Error ? e.message : String(e)}`));
+            }
             // Done!
             console.info("");
             console.info(chalk.bold.green("Setup complete!"));

package/dist/cli/factories/authCommandFactory.d.ts

@@ -56,6 +56,14 @@ export declare class AuthCommandFactory {
      * Build options for enable subcommand
      */
     private static buildEnableOptions;
+    /**
+     * Build options for disable subcommand
+     */
+    private static buildDisableOptions;
+    /**
+     * Build options for the cooldown subcommands
+     */
+    private static buildCooldownClearOptions;
     /**
      * Build options for set-primary subcommand
      */

package/dist/cli/factories/authCommandFactory.js

@@ -9,7 +9,7 @@
 /**
  * Supported providers for authentication
  */
-const SUPPORTED_PROVIDERS = ["anthropic"];
+const SUPPORTED_PROVIDERS = ["anthropic", "codex"];
 /**
  * Auth Command Factory
  *
@@ -63,6 +63,33 @@ export class AuthCommandFactory {
                     .command("enable <account>", "Re-enable a previously disabled account", (yargs) => this.buildEnableOptions(yargs), async (argv) => {
                     const { handleEnable } = await import("../commands/auth.js");
                     await handleEnable(argv);
+                })
+                    .command("disable <account>", "Take an account out of the proxy pool until re-enabled", (yargs) => this.buildDisableOptions(yargs), async (argv) => {
+                    const { handleDisable } = await import("../commands/auth.js");
+                    await handleDisable(argv);
+                })
+                    .command("cooldown <action> [account]", "Inspect or clear per-account rate-limit cooldowns", (yargs) => this.buildCooldownClearOptions(yargs.positional("action", {
+                    type: "string",
+                    choices: ["list", "clear"],
+                    description: "list cooldowns, or clear one/all",
+                    demandOption: true,
+                })), async (argv) => {
+                    const { handleCooldown } = await import("../commands/auth.js");
+                    await handleCooldown(argv);
+                })
+                    .command("overage [action]", "Show or set whether the pool may spend paid extra usage", (yargs) => yargs
+                    .positional("action", {
+                    type: "string",
+                    choices: ["status", "auto", "always", "never"],
+                    default: "status",
+                    description: "Policy to apply, or 'status' to show it",
+                })
+                    .option("config", {
+                    type: "string",
+                    description: "Path to the proxy config YAML",
+                }), async (argv) => {
+                    const { handleOverage } = await import("../commands/auth.js");
+                    await handleOverage(argv);
                 })
                     .command("set-primary <email>", "Set the proxy's primary (home) Anthropic account", (yargs) => this.buildSetPrimaryOptions(yargs), async (argv) => {
                     const { handleSetPrimary } = await import("../commands/auth.js");
@@ -278,6 +305,52 @@ export class AuthCommandFactory {
         })
             .example("$0 auth enable anthropic:1-VjRIq", "Re-enable a disabled account");
     }
+    /**
+     * Build options for disable subcommand
+     */
+    static buildDisableOptions(yargs) {
+        return yargs
+            .positional("account", {
+            type: "string",
+            description: "Account key to disable (e.g., anthropic:1-VjRIq)",
+            demandOption: true,
+        })
+            .option("reason", {
+            type: "string",
+            description: "Why the account is being disabled (shown in auth list)",
+        })
+            .example("$0 auth disable anthropic:1-VjRIq", "Take an account out of the proxy pool");
+    }
+    /**
+     * Build options for the cooldown subcommands
+     */
+    static buildCooldownClearOptions(yargs) {
+        return (yargs
+            .positional("account", {
+            type: "string",
+            description: "Account key whose cooldown should be cleared",
+        })
+            .option("all", {
+            type: "boolean",
+            default: false,
+            description: "Clear cooldowns for every account",
+        })
+            .example("$0 auth cooldown clear anthropic:1-VjRIq", "Return a parked account to the pool immediately")
+            // Reject a scope the handler cannot honour rather than silently picking
+            // one. `--all` beats a named account there, so `clear <account> --all`
+            // would wipe every cooldown while reading as a single-account command.
+            .check((argv) => {
+            const action = String(argv.action ?? "");
+            const account = argv.account ? String(argv.account) : undefined;
+            if (action === "clear" && account && argv.all === true) {
+                throw new Error("Pass an account or --all, not both: --all clears every cooldown.");
+            }
+            if (action === "list" && (account || argv.all === true)) {
+                throw new Error("`auth cooldown list` takes no account and no --all; it lists every cooling account.");
+            }
+            return true;
+        }));
+    }
     /**
      * Build options for set-primary subcommand
      */

package/dist/lib/auth/codexOAuth.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Codex (OpenAI ChatGPT) OAuth + identity helpers.
+ *
+ * Mirrors the role of `anthropicOAuth.ts` for the Codex pool engine. Codex signs
+ * in with a ChatGPT account (PKCE OAuth against auth.openai.com) and talks to the
+ * ChatGPT backend Responses API. The proxy pools multiple ChatGPT accounts, so it
+ * needs to: import an existing `~/.codex/auth.json`, refresh access tokens, and
+ * derive the per-account `chatgpt-account-id` the backend requires.
+ *
+ * Constants verified against Codex CLI 0.144.4.
+ */
+import type { CodexImportedCredential } from "../types/index.js";
+export declare const CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+export declare const CODEX_AUTH_URL = "https://auth.openai.com/oauth/authorize";
+export declare const CODEX_TOKEN_URL = "https://auth.openai.com/oauth/token";
+export declare const CODEX_REVOKE_URL = "https://auth.openai.com/oauth/revoke";
+export declare const CODEX_REDIRECT_URI = "http://localhost:1455/auth/callback";
+export declare const CODEX_DEFAULT_SCOPES: readonly ["openid", "profile", "email", "offline_access"];
+export declare const CODEX_BACKEND_BASE_URL = "https://chatgpt.com/backend-api/codex";
+export declare const CODEX_RESPONSES_URL = "https://chatgpt.com/backend-api/codex/responses";
+export declare const CODEX_USAGE_URL = "https://chatgpt.com/backend-api/codex/usage";
+export declare const CODEX_VERSION = "0.144.4";
+export declare const CODEX_USER_AGENT = "codex_cli_rs/0.144.4 (external; neurolink-proxy)";
+export declare const CODEX_ORIGINATOR = "codex_cli_rs";
+/** Decode the ChatGPT account id, plan type, and expiry from an access token. */
+export declare function decodeCodexAccessToken(accessToken: string): {
+    accountId?: string;
+    planType?: string;
+    expiresAt?: number;
+};
+/** Decode the account email from an id token (best-effort, for the label). */
+export declare function decodeCodexEmail(idToken?: string): string | undefined;
+/**
+ * The chatgpt-account-id the backend requires for a given access token.
+ * Prefer the value stored on the account; fall back to decoding the JWT so a
+ * rotated token always carries a coherent account id.
+ */
+export declare function resolveCodexAccountId(accessToken: string, storedAccountId?: string): string | undefined;
+/**
+ * Import an existing Codex credential from `~/.codex/auth.json` (or a custom
+ * path). This is the verified, robust login path: the user logs into Codex
+ * normally, then imports the current account into the proxy pool.
+ */
+export declare function importCodexAuthFile(authFilePath?: string): Promise<CodexImportedCredential>;
+/**
+ * Refresh a Codex access token. Verified: POST form-urlencoded to
+ * auth.openai.com/oauth/token with grant_type=refresh_token and the Codex
+ * client id. Returns a fresh credential (access + rotated refresh token).
+ */
+export declare function refreshCodexToken(refreshToken: string, options?: {
+    timeoutMs?: number;
+}): Promise<CodexImportedCredential>;
+/**
+ * Whether a {@link refreshCodexToken} failure means the refresh token itself is
+ * no longer usable, as opposed to the request never getting a verdict.
+ *
+ * Only the authorization server rejecting the grant is permanent. A 5xx, a
+ * timeout, or a DNS failure says nothing about the credential, and treating
+ * those as permanent disables a working account — which `auth cleanup` then
+ * deletes.
+ */
+export declare function isPermanentCodexRefreshFailure(error: unknown): boolean;
+/**
+ * Whether an imported credential's access token is expired (or within the
+ * buffer window) and should be refreshed before use.
+ */
+export declare function codexTokenNeedsRefresh(expiresAt: number | undefined, bufferMs?: number): boolean;

package/dist/lib/auth/codexOAuth.js

@@ -0,0 +1,203 @@
+/**
+ * Codex (OpenAI ChatGPT) OAuth + identity helpers.
+ *
+ * Mirrors the role of `anthropicOAuth.ts` for the Codex pool engine. Codex signs
+ * in with a ChatGPT account (PKCE OAuth against auth.openai.com) and talks to the
+ * ChatGPT backend Responses API. The proxy pools multiple ChatGPT accounts, so it
+ * needs to: import an existing `~/.codex/auth.json`, refresh access tokens, and
+ * derive the per-account `chatgpt-account-id` the backend requires.
+ *
+ * Constants verified against Codex CLI 0.144.4.
+ */
+import { readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { logger } from "../utils/logger.js";
+// OAuth client + endpoints (Codex CLI values).
+export const CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+export const CODEX_AUTH_URL = "https://auth.openai.com/oauth/authorize";
+export const CODEX_TOKEN_URL = "https://auth.openai.com/oauth/token";
+export const CODEX_REVOKE_URL = "https://auth.openai.com/oauth/revoke";
+export const CODEX_REDIRECT_URI = "http://localhost:1455/auth/callback";
+export const CODEX_DEFAULT_SCOPES = [
+    "openid",
+    "profile",
+    "email",
+    "offline_access",
+];
+// Upstream backend (ChatGPT subscription path).
+export const CODEX_BACKEND_BASE_URL = "https://chatgpt.com/backend-api/codex";
+export const CODEX_RESPONSES_URL = `${CODEX_BACKEND_BASE_URL}/responses`;
+export const CODEX_USAGE_URL = `${CODEX_BACKEND_BASE_URL}/usage`;
+// Client fingerprint. The real Codex CLI sends these; the proxy defaults them
+// only when a non-Codex client omits them.
+export const CODEX_VERSION = "0.144.4";
+export const CODEX_USER_AGENT = `codex_cli_rs/${CODEX_VERSION} (external; neurolink-proxy)`;
+export const CODEX_ORIGINATOR = "codex_cli_rs";
+const CODEX_AUTH_FILE = join(homedir(), ".codex", "auth.json");
+/** Base64url-decode a JWT segment into a JSON object (claims only, no verify). */
+function decodeJwtSegment(segment) {
+    try {
+        const padded = segment + "=".repeat((4 - (segment.length % 4)) % 4);
+        const json = Buffer.from(padded.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8");
+        const parsed = JSON.parse(json);
+        return parsed && typeof parsed === "object"
+            ? parsed
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+function getOpenAiAuthClaim(claims) {
+    if (!claims) {
+        return null;
+    }
+    const auth = claims["https://api.openai.com/auth"];
+    return auth && typeof auth === "object"
+        ? auth
+        : null;
+}
+/** Decode the ChatGPT account id, plan type, and expiry from an access token. */
+export function decodeCodexAccessToken(accessToken) {
+    const parts = accessToken.split(".");
+    if (parts.length !== 3) {
+        return {};
+    }
+    const claims = decodeJwtSegment(parts[1]);
+    const authClaim = getOpenAiAuthClaim(claims);
+    const accountId = typeof authClaim?.chatgpt_account_id === "string"
+        ? authClaim.chatgpt_account_id
+        : undefined;
+    const planType = typeof authClaim?.chatgpt_plan_type === "string"
+        ? authClaim.chatgpt_plan_type
+        : undefined;
+    const exp = typeof claims?.exp === "number" ? claims.exp * 1000 : undefined;
+    return { accountId, planType, expiresAt: exp };
+}
+/** Decode the account email from an id token (best-effort, for the label). */
+export function decodeCodexEmail(idToken) {
+    if (!idToken) {
+        return undefined;
+    }
+    const parts = idToken.split(".");
+    if (parts.length !== 3) {
+        return undefined;
+    }
+    const claims = decodeJwtSegment(parts[1]);
+    return typeof claims?.email === "string" ? claims.email : undefined;
+}
+/**
+ * The chatgpt-account-id the backend requires for a given access token.
+ * Prefer the value stored on the account; fall back to decoding the JWT so a
+ * rotated token always carries a coherent account id.
+ */
+export function resolveCodexAccountId(accessToken, storedAccountId) {
+    if (storedAccountId && storedAccountId.length > 0) {
+        return storedAccountId;
+    }
+    return decodeCodexAccessToken(accessToken).accountId;
+}
+/** Build a CodexImportedCredential from raw token material. */
+function buildImportedCredential(tokens) {
+    const decoded = decodeCodexAccessToken(tokens.access_token);
+    return {
+        accessToken: tokens.access_token,
+        refreshToken: tokens.refresh_token,
+        idToken: tokens.id_token,
+        accountId: tokens.account_id ?? decoded.accountId,
+        expiresAt: decoded.expiresAt,
+        planType: decoded.planType,
+        email: decodeCodexEmail(tokens.id_token),
+    };
+}
+/**
+ * Import an existing Codex credential from `~/.codex/auth.json` (or a custom
+ * path). This is the verified, robust login path: the user logs into Codex
+ * normally, then imports the current account into the proxy pool.
+ */
+export async function importCodexAuthFile(authFilePath = CODEX_AUTH_FILE) {
+    const raw = await readFile(authFilePath, "utf8");
+    const parsed = JSON.parse(raw);
+    const tokens = parsed.tokens;
+    if (!tokens || typeof tokens.access_token !== "string") {
+        throw new Error(`No ChatGPT OAuth tokens found in ${authFilePath}. Run \`codex login\` first.`);
+    }
+    if (parsed.auth_mode && parsed.auth_mode !== "chatgpt") {
+        throw new Error(`Codex auth mode is "${parsed.auth_mode}", expected "chatgpt". Only ChatGPT subscription login can be pooled.`);
+    }
+    return buildImportedCredential({
+        access_token: tokens.access_token,
+        refresh_token: tokens.refresh_token,
+        id_token: tokens.id_token,
+        account_id: tokens.account_id,
+    });
+}
+/**
+ * Refresh a Codex access token. Verified: POST form-urlencoded to
+ * auth.openai.com/oauth/token with grant_type=refresh_token and the Codex
+ * client id. Returns a fresh credential (access + rotated refresh token).
+ */
+export async function refreshCodexToken(refreshToken, options = {}) {
+    const body = new URLSearchParams({
+        grant_type: "refresh_token",
+        refresh_token: refreshToken,
+        client_id: CODEX_CLIENT_ID,
+        scope: CODEX_DEFAULT_SCOPES.join(" "),
+    });
+    const response = await fetch(CODEX_TOKEN_URL, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/x-www-form-urlencoded",
+            Accept: "application/json",
+            "User-Agent": CODEX_USER_AGENT,
+        },
+        body: body.toString(),
+        signal: AbortSignal.timeout(options.timeoutMs ?? 10_000),
+    });
+    if (!response.ok) {
+        const text = await response.text().catch(() => "");
+        throw Object.assign(new Error(`Codex token refresh failed: ${response.status} ${text.slice(0, 200)}`), { status: response.status });
+    }
+    const data = (await response.json());
+    if (!data.access_token) {
+        throw new Error("Codex token refresh returned no access_token");
+    }
+    logger.debug("Codex token refreshed");
+    return buildImportedCredential({
+        access_token: data.access_token,
+        // OpenAI rotates the refresh token; fall back to the old one if omitted.
+        refresh_token: data.refresh_token ?? refreshToken,
+        id_token: data.id_token,
+    });
+}
+/**
+ * Whether a {@link refreshCodexToken} failure means the refresh token itself is
+ * no longer usable, as opposed to the request never getting a verdict.
+ *
+ * Only the authorization server rejecting the grant is permanent. A 5xx, a
+ * timeout, or a DNS failure says nothing about the credential, and treating
+ * those as permanent disables a working account — which `auth cleanup` then
+ * deletes.
+ */
+export function isPermanentCodexRefreshFailure(error) {
+    const status = error?.status;
+    if (typeof status !== "number" || status < 400 || status >= 500) {
+        return false;
+    }
+    // 408 and 429 are a timeout and a throttle. Neither is the grant being
+    // rejected, and treating them as permanent disables the account — which
+    // `auth cleanup` then deletes.
+    return status !== 408 && status !== 429;
+}
+/**
+ * Whether an imported credential's access token is expired (or within the
+ * buffer window) and should be refreshed before use.
+ */
+export function codexTokenNeedsRefresh(expiresAt, bufferMs = 5 * 60 * 1000) {
+    if (!expiresAt) {
+        return false;
+    }
+    return expiresAt - bufferMs <= Date.now();
+}
+//# sourceMappingURL=codexOAuth.js.map