@juspay/neurolink 12.7.2 → 12.7.4

package/dist/cli/commands/proxy.js

@@ -24,7 +24,8 @@ import { formatUptime, isProcessRunning, StateFileManager, } from "../utils/serv
 import { configureProxyKeepAliveDispatcher } from "../../proxy/proxyDispatcher.js";
 import { ProxyRuntimeConfigStore } from "../../proxy/runtimeConfig.js";
 import { startProxyLogCleanupScheduler } from "../../proxy/logCleanupScheduler.js";
-import { anthropicAccountKeysEqual, createAccountAllowlist, ENV_ANTHROPIC_ACCOUNT_KEY, isAccountAllowed, LEGACY_ANTHROPIC_ACCOUNT_KEY, normalizeAnthropicAccountKey, shouldLoadFallbackCredential, } from "../../proxy/accountSelection.js";
+import { anthropicAccountKeysEqual, createAccountAllowlist, isAccountAllowed, LEGACY_ANTHROPIC_ACCOUNT_KEY, normalizeAnthropicAccountKey, shouldLoadFallbackCredential, } from "../../proxy/accountSelection.js";
+import { resolveProxyStatusAccountIdentity } from "../../proxy/codexAccountUsage.js";
 import { beginProxyRequest, getProxyActivitySnapshot, trackProxyResponse, } from "../../proxy/proxyActivity.js";
 import { flushProxyLifecycleEvents, getProxyLifecycleLoggerSnapshot, hashProxyLifecycleSessionId, logProxyLifecycleEvent, } from "../../proxy/proxyLifecycle.js";
 import { describeInstallFailure, getGlobalInstallArgs, isTransientInstallFailure, resolveGlobalInstaller, validateInstalledVersion, } from "../../proxy/globalInstaller.js";
@@ -65,11 +66,9 @@ const gatedShareRequests = new WeakSet();
 const PROXY_LIFECYCLE_SHUTDOWN_TIMEOUT_MS = 5_000;
 /** How long shutdown waits on the share listener before moving on. */
 const SHARE_LISTENER_CLOSE_TIMEOUT_MS = 10_000;
-const LEGACY_STATUS_ACCOUNT_CACHE_TTL_MS = 5_000;
 const PROXY_STATUS_TOKEN_READ_TIMEOUT_MS = 2_000;
 const PROXY_STATUS_RECONCILE_TIMEOUT_MS = 750;
 const PROXY_STATUS_ACCOUNT_INVENTORY_TIMEOUT_MS = 750;
-let legacyStatusAccountCache;
 // Allowed drift between a pid's OS-reported start time and the persisted
 // ProxySupervisorState.startTime before processLooksLikeProxySupervisor
 // treats it as a confident mismatch (recycled pid). Generous on purpose:
@@ -385,34 +384,6 @@ async function resolveStatusPrimaryAccount(proxyConfig) {
         source: "fallback",
     };
 }
-async function resolveLegacyStatusAccountLabel(storedAnthropicAccountCount) {
-    if (storedAnthropicAccountCount !== 0) {
-        return null;
-    }
-    const credentialsPath = join(homedir(), ".neurolink", "anthropic-credentials.json");
-    const now = Date.now();
-    if (legacyStatusAccountCache?.credentialsPath === credentialsPath &&
-        legacyStatusAccountCache.expiresAt > now) {
-        return legacyStatusAccountCache.label;
-    }
-    let label = null;
-    try {
-        const { readFile } = await import("node:fs/promises");
-        const parsed = JSON.parse(await readFile(credentialsPath, "utf8"));
-        if (parsed.oauth?.accessToken) {
-            label = parsed.email?.trim() || "legacy-default";
-        }
-    }
-    catch {
-        label = null;
-    }
-    legacyStatusAccountCache = {
-        credentialsPath,
-        expiresAt: now + LEGACY_STATUS_ACCOUNT_CACHE_TTL_MS,
-        label,
-    };
-    return label;
-}
 function deriveAccountAllowance(accountKey, now, allowlist, expirations, cooldowns) {
     const allowed = isAccountAllowed(accountKey, allowlist);
     const expiresAt = expirations.get(accountKey);
@@ -1066,6 +1037,7 @@ function redactStatusAccounts(rows, allowed) {
     return rows.map((row, index) => ({
         ...row,
         label: `account-${index + 1}`,
+        ...(row.key !== undefined ? { key: null } : {}),
         ...(row.email !== undefined ? { email: null } : {}),
     }));
 }
@@ -1685,20 +1657,28 @@ export async function createProxyStartApp(params) {
             logger.debug(`[proxy] /status using empty cooldown snapshot: ${error instanceof Error ? error.message : String(error)}`);
             return {};
         });
-        const storedAccountKeys = new Set();
+        const storedAnthropicAccountKeys = new Set();
+        const storedCodexAccountKeys = new Set();
         const storedAccountExpirations = new Map();
-        const disabledAccountKeys = new Set();
+        const disabledProviderAccountKeys = new Set();
         let accountInventoryLoaded = false;
         try {
             const { tokenStore } = await import("../../auth/tokenStore.js");
-            const storedKeys = await withTimeout(tokenStore.listByPrefix("anthropic:"), PROXY_STATUS_ACCOUNT_INVENTORY_TIMEOUT_MS, "[proxy] /status account enumeration timed out");
-            for (const key of storedKeys) {
-                storedAccountKeys.add(normalizeAnthropicAccountKey(key));
+            const [anthropicKeys, codexKeys] = await withTimeout(Promise.all([
+                tokenStore.listByPrefix("anthropic:"),
+                tokenStore.listByPrefix("codex:"),
+            ]), PROXY_STATUS_ACCOUNT_INVENTORY_TIMEOUT_MS, "[proxy] /status account enumeration timed out");
+            for (const key of anthropicKeys) {
+                storedAnthropicAccountKeys.add(normalizeAnthropicAccountKey(key));
+            }
+            for (const key of codexKeys) {
+                storedCodexAccountKeys.add(key);
             }
             // Once account names are known, preserve them even when optional token
             // metadata is slow. That keeps the status table useful and avoids
             // incorrectly presenting known accounts as removed.
             accountInventoryLoaded = true;
+            const storedKeys = [...anthropicKeys, ...codexKeys];
             const inventory = await withTimeout((async () => {
                 const tokenExpirations = await Promise.all(storedKeys.map(async (key) => {
                     try {
@@ -1715,19 +1695,21 @@ export async function createProxyStartApp(params) {
             })(), PROXY_STATUS_ACCOUNT_INVENTORY_TIMEOUT_MS, "[proxy] /status account metadata timed out");
             for (const expiration of inventory.tokenExpirations) {
                 if (expiration) {
-                    storedAccountExpirations.set(normalizeAnthropicAccountKey(expiration[0]), expiration[1]);
+                    const key = expiration[0].startsWith("anthropic:")
+                        ? normalizeAnthropicAccountKey(expiration[0])
+                        : expiration[0];
+                    storedAccountExpirations.set(key, expiration[1]);
                 }
             }
             for (const key of inventory.disabledKeys) {
-                disabledAccountKeys.add(normalizeAnthropicAccountKey(key));
+                disabledProviderAccountKeys.add(key.startsWith("anthropic:")
+                    ? normalizeAnthropicAccountKey(key)
+                    : key);
             }
         }
         catch (err) {
             logger.debug(`[proxy] /status: failed to resolve account cooldown labels: ${err instanceof Error ? err.message : String(err)}`);
         }
-        const legacyAccountLabel = accountInventoryLoaded
-            ? await withTimeout(resolveLegacyStatusAccountLabel(storedAccountKeys.size), PROXY_STATUS_ACCOUNT_INVENTORY_TIMEOUT_MS, "[proxy] /status legacy account inspection timed out").catch(() => null)
-            : null;
         const now = Date.now();
         const health = buildProxyHealthResponse(readiness, {
             strategy: activeStrategy,
@@ -1741,34 +1723,54 @@ export async function createProxyStartApp(params) {
             source: "fallback",
         }));
         const activeUpdaterPid = supervisorState?.updaterPid ?? runtimeState?.updaterPid;
-        const accountRows = Object.values(stats.accounts).map((account) => {
-            const normalizedKey = normalizeAnthropicAccountKey(account.label);
-            const isLegacyAccount = account.type === "oauth" && account.label === legacyAccountLabel;
-            const accountKey = storedAccountKeys.has(normalizedKey)
-                ? normalizedKey
-                : isLegacyAccount
-                    ? LEGACY_ANTHROPIC_ACCOUNT_KEY
-                    : account.label === "env"
-                        ? ENV_ANTHROPIC_ACCOUNT_KEY
-                        : normalizedKey;
-            const isStored = storedAccountKeys.has(accountKey) || isLegacyAccount;
-            const { allowed, expired, cooling } = deriveAccountAllowance(accountKey, now, activeAccountAllowlist, storedAccountExpirations, cooldowns);
+        const accountRows = Object.entries(stats.accounts).map(([persistedMapKey, account]) => {
+            // Legacy snapshots used their bare map key as an inferred identity. Do
+            // not map those old rows to a provider based on an email: the same email
+            // can be present in both pools. New records carry account.key.
+            const persistedKey = account.key ?? null;
+            const identity = persistedKey
+                ? resolveProxyStatusAccountIdentity(account.label, account.type, persistedKey)
+                : { provider: "other", key: null };
+            const isLegacyUnattributed = persistedKey === null &&
+                (account.type === "oauth" ||
+                    account.type === "api_key" ||
+                    account.type === "codex-oauth");
+            const isAnthropicAccount = identity.provider === "anthropic";
+            const isCodexAccount = identity.provider === "codex";
+            const accountKey = identity.key ?? (persistedKey || persistedMapKey);
+            const isStored = (isAnthropicAccount && storedAnthropicAccountKeys.has(accountKey)) ||
+                (isCodexAccount && storedCodexAccountKeys.has(accountKey));
+            const providerState = isAnthropicAccount
+                ? deriveAccountAllowance(accountKey, now, activeAccountAllowlist, storedAccountExpirations, cooldowns)
+                : isCodexAccount
+                    ? {
+                        allowed: true,
+                        expired: (storedAccountExpirations.get(accountKey) ?? 0) > 0 &&
+                            (storedAccountExpirations.get(accountKey) ?? 0) <= now,
+                        cooling: (cooldowns[accountKey]?.coolingUntil ?? 0) > now,
+                    }
+                    : { allowed: true, expired: false, cooling: false };
+            const isDisabled = !isLegacyUnattributed && disabledProviderAccountKeys.has(accountKey);
             const accountStatus = account.type === "internal"
                 ? "internal"
-                : disabledAccountKeys.has(accountKey)
-                    ? "disabled"
-                    : expired
-                        ? "expired"
-                        : !allowed
-                            ? "excluded"
-                            : accountInventoryLoaded &&
-                                account.type === "oauth" &&
-                                !isStored
-                                ? "removed"
-                                : cooling
-                                    ? "cooling"
-                                    : "active";
+                : isLegacyUnattributed
+                    ? "unattributed"
+                    : isDisabled
+                        ? "disabled"
+                        : providerState.expired
+                            ? "expired"
+                            : isAnthropicAccount && !providerState.allowed
+                                ? "excluded"
+                                : accountInventoryLoaded &&
+                                    (isAnthropicAccount || isCodexAccount) &&
+                                    !isStored
+                                    ? "removed"
+                                    : providerState.cooling
+                                        ? "cooling"
+                                        : "active";
             return {
+                key: isLegacyUnattributed ? null : accountKey,
+                provider: isLegacyUnattributed ? "unknown" : identity.provider,
                 label: account.label,
                 type: account.type,
                 attempts: account.attemptCount,
@@ -1779,21 +1781,26 @@ export async function createProxyStartApp(params) {
                 rateLimits: account.rateLimitCount,
                 transientRateLimits: account.transientRateLimitCount,
                 quotaRateLimits: account.quotaRateLimitCount,
-                cooling,
+                cooling: providerState.cooling,
                 status: accountStatus,
-                allowed: account.type === "internal" ? undefined : allowed,
-                expired: account.type === "oauth" ? expired : undefined,
+                allowed: account.type === "internal" ? undefined : providerState.allowed,
+                expired: isAnthropicAccount || isCodexAccount
+                    ? providerState.expired
+                    : undefined,
             };
         });
-        const representedAccountKeys = new Set(accountRows
-            .filter((account) => account.type === "oauth")
-            .map((account) => normalizeAnthropicAccountKey(account.label)));
-        for (const accountKey of storedAccountKeys) {
+        const representedAccountKeys = new Set(accountRows.flatMap((account) => account.key &&
+            (account.provider === "anthropic" || account.provider === "codex")
+            ? [account.key]
+            : []));
+        for (const accountKey of storedAnthropicAccountKeys) {
             if (representedAccountKeys.has(accountKey)) {
                 continue;
             }
             const { allowed, expired, cooling } = deriveAccountAllowance(accountKey, now, activeAccountAllowlist, storedAccountExpirations, cooldowns);
             accountRows.push({
+                key: accountKey,
+                provider: "anthropic",
                 label: accountKey.slice("anthropic:".length),
                 type: "oauth",
                 attempts: 0,
@@ -1805,7 +1812,7 @@ export async function createProxyStartApp(params) {
                 transientRateLimits: 0,
                 quotaRateLimits: 0,
                 cooling,
-                status: disabledAccountKeys.has(accountKey)
+                status: disabledProviderAccountKeys.has(accountKey)
                     ? "disabled"
                     : expired
                         ? "expired"
@@ -1818,6 +1825,38 @@ export async function createProxyStartApp(params) {
                 expired,
             });
         }
+        for (const accountKey of storedCodexAccountKeys) {
+            if (representedAccountKeys.has(accountKey)) {
+                continue;
+            }
+            const expiresAt = storedAccountExpirations.get(accountKey);
+            const expired = expiresAt !== undefined && expiresAt > 0 && expiresAt <= now;
+            const cooling = (cooldowns[accountKey]?.coolingUntil ?? 0) > now;
+            accountRows.push({
+                key: accountKey,
+                provider: "codex",
+                label: accountKey.slice("codex:".length),
+                type: "codex-oauth",
+                attempts: 0,
+                requests: 0,
+                success: 0,
+                errors: 0,
+                attemptErrors: 0,
+                rateLimits: 0,
+                transientRateLimits: 0,
+                quotaRateLimits: 0,
+                cooling,
+                status: disabledProviderAccountKeys.has(accountKey)
+                    ? "disabled"
+                    : expired
+                        ? "expired"
+                        : cooling
+                            ? "cooling"
+                            : "active",
+                allowed: true,
+                expired,
+            });
+        }
         const attributed = accountRows.reduce((total, account) => ({
             attempts: total.attempts + (account.attempts ?? 0),
             requests: total.requests + (account.requests ?? 0),
@@ -3010,7 +3049,8 @@ function printStatusStats(stats) {
         if (lastError) {
             const cause = lastError.errorType ?? lastError.category;
             const code = lastError.errorCode ? `/${lastError.errorCode}` : "";
-            const account = lastError.account ? ` account=${lastError.account}` : "";
+            const accountIdentity = lastError.accountKey ?? lastError.account;
+            const account = accountIdentity ? ` account=${accountIdentity}` : "";
             console.info(`    Last error:  ${new Date(lastError.at).toISOString()} ${cause}${code} status=${lastError.status}${account}`);
             if (lastError.message) {
                 console.info(`    Last cause:  ${sanitizeProxyStatusTerminalErrorMessage(lastError.message)}`);

package/dist/cli/factories/authCommandFactory.js

@@ -6,10 +6,8 @@
  * - login, logout, status, refresh: Anthropic OAuth (API key + OAuth)
  * - providers, validate, health: Multi-provider auth management
  */
-/**
- * Supported providers for authentication
- */
-const SUPPORTED_PROVIDERS = ["anthropic", "codex"];
+/** Providers with first-class credential flows in `neurolink auth`. */
+const AUTH_LOGIN_PROVIDERS = ["anthropic", "codex"];
 /**
  * Auth Command Factory
  *
@@ -167,7 +165,7 @@ export class AuthCommandFactory {
             .positional("provider", {
             type: "string",
             description: "AI provider to authenticate with",
-            choices: SUPPORTED_PROVIDERS,
+            choices: AUTH_LOGIN_PROVIDERS,
             demandOption: true,
         })
             .option("method", {
@@ -204,7 +202,7 @@ export class AuthCommandFactory {
             .positional("provider", {
             type: "string",
             description: "AI provider to log out from",
-            choices: SUPPORTED_PROVIDERS,
+            choices: AUTH_LOGIN_PROVIDERS,
             demandOption: true,
         })
             .example("$0 auth logout anthropic", "Clear all Anthropic credentials");
@@ -217,7 +215,7 @@ export class AuthCommandFactory {
             .positional("provider", {
             type: "string",
             description: "AI provider to check (optional, shows all if not specified)",
-            choices: SUPPORTED_PROVIDERS,
+            choices: AUTH_LOGIN_PROVIDERS,
         })
             .example("$0 auth status", "Show status for all configured providers")
             .example("$0 auth status anthropic", "Show Anthropic authentication status")
@@ -231,7 +229,7 @@ export class AuthCommandFactory {
             .positional("provider", {
             type: "string",
             description: "AI provider to refresh tokens for",
-            choices: SUPPORTED_PROVIDERS,
+            choices: AUTH_LOGIN_PROVIDERS,
             demandOption: true,
         })
             .example("$0 auth refresh anthropic", "Refresh Anthropic OAuth tokens");
@@ -244,7 +242,7 @@ export class AuthCommandFactory {
             .option("refresh", {
             type: "boolean",
             default: false,
-            description: "Fetch fresh limits from Anthropic for all OAuth accounts before listing (via the running proxy when available)",
+            description: "Refresh available provider limits for authenticated accounts; show unsupported providers explicitly",
         })
             .example("$0 auth list", "List all authenticated accounts")
             .example("$0 auth list --format json", "List accounts in JSON format")
@@ -257,8 +255,7 @@ export class AuthCommandFactory {
         return yargs
             .positional("provider", {
             type: "string",
-            description: "AI provider to remove account from",
-            choices: SUPPORTED_PROVIDERS,
+            description: "Provider namespace to remove an account from",
             demandOption: true,
         })
             .option("label", {

package/dist/proxy/codexAccountUsage.d.ts

@@ -6,8 +6,13 @@
  * map onto the shared AccountQuota session/weekly fields so the same routing,
  * cooldown, and display code works for both providers.
  */
+import type { CodexProxyStatusAccountIdentity } from "../types/index.js";
 import type { AccountQuota, CodexRateLimits, CodexUsageFetchResult, ProxyPassthroughAccount } from "../types/index.js";
 export declare const CODEX_ACCOUNT_PREFIX = "codex:";
+/** Keep an account label in the Codex namespace used by its token store. */
+export declare function normalizeCodexAccountKey(value: string): string;
+/** Resolve the provider-qualified key used to render a proxy status row. */
+export declare function resolveProxyStatusAccountIdentity(label: string, type: string, persistedKey?: string): CodexProxyStatusAccountIdentity;
 /** Enumerate Codex OAuth accounts from the token store for usage refresh. */
 export declare function listCodexAccountsForUsage(): Promise<ProxyPassthroughAccount[]>;
 /** Normalise a Codex rate-limit block into the shared AccountQuota shape. */

package/dist/proxy/codexAccountUsage.js

@@ -7,9 +7,39 @@
  * cooldown, and display code works for both providers.
  */
 import { tokenStore } from "../auth/tokenStore.js";
+import { normalizeAnthropicAccountKey } from "./accountSelection.js";
 import { CODEX_ORIGINATOR, CODEX_USAGE_URL, CODEX_USER_AGENT, decodeCodexAccessToken, resolveCodexAccountId, } from "../auth/codexOAuth.js";
 import { logger } from "../utils/logger.js";
 export const CODEX_ACCOUNT_PREFIX = "codex:";
+/** Keep an account label in the Codex namespace used by its token store. */
+export function normalizeCodexAccountKey(value) {
+    const trimmed = value.trim();
+    return trimmed.startsWith(CODEX_ACCOUNT_PREFIX)
+        ? trimmed
+        : `${CODEX_ACCOUNT_PREFIX}${trimmed}`;
+}
+/** Resolve the provider-qualified key used to render a proxy status row. */
+export function resolveProxyStatusAccountIdentity(label, type, persistedKey) {
+    // Current counter snapshots persist the provider-qualified key. Prefer it
+    // over the display type so a future type rename cannot move an account into
+    // the wrong cooldown/disabled namespace.
+    if (persistedKey?.toLowerCase().startsWith("anthropic:")) {
+        return {
+            provider: "anthropic",
+            key: normalizeAnthropicAccountKey(persistedKey),
+        };
+    }
+    if (persistedKey?.startsWith(CODEX_ACCOUNT_PREFIX)) {
+        return { provider: "codex", key: persistedKey };
+    }
+    if (type === "oauth" || type === "api_key") {
+        return { provider: "anthropic", key: normalizeAnthropicAccountKey(label) };
+    }
+    if (type === "codex-oauth") {
+        return { provider: "codex", key: normalizeCodexAccountKey(label) };
+    }
+    return { provider: "other", key: null };
+}
 /** Enumerate Codex OAuth accounts from the token store for usage refresh. */
 export async function listCodexAccountsForUsage() {
     const keys = await tokenStore.listByPrefix(CODEX_ACCOUNT_PREFIX);

package/dist/proxy/codexFallback.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Anthropic Messages API fallback over the pooled Codex Responses transport.
+ *
+ * This module deliberately contains only wire-format conversion and buffered
+ * SSE parsing. Account selection, OAuth, cooldowns, and quota persistence stay
+ * in the native Codex proxy handler so fallback traffic follows the same pool
+ * rules as a native Codex request.
+ */
+import type { ClaudeRequest, CodexFallbackResult, CodexResponsesRequest } from "../types/index.js";
+export declare class CodexFallbackResponseError extends Error {
+    readonly status: number;
+    readonly responseBody: string;
+    constructor(status: number, responseBody: string);
+}
+/** Convert a Claude Messages request into the ChatGPT Codex Responses shape. */
+export declare function convertClaudeRequestToCodex(body: ClaudeRequest, model: string): CodexResponsesRequest;
+/**
+ * Parse a complete Codex Responses SSE stream before emitting Claude output.
+ *
+ * A missing terminal event, malformed JSON, terminal error, or empty response
+ * is rejected. That makes it safe for the caller to try the next configured
+ * fallback without ever replaying output already sent to a client.
+ */
+export declare function parseCodexFallbackSSE(sse: string): CodexFallbackResult;
+/** Consume and validate a native Codex response before producing Claude output. */
+export declare function consumeCodexFallbackResponse(response: Response): Promise<CodexFallbackResult>;