@namzu/cli 12.1.0 → 14.0.0

package/dist/integrations/providers/codex-device-login.js

@@ -0,0 +1,195 @@
+/** Namzu-owned ChatGPT/Codex device authorization for machines without Codex installed. */
+import { writeStoredCodexCredential } from './credential-store.js';
+import { codexCredentialFromTokens } from './harness-credentials.js';
+export const CODEX_OAUTH_CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann';
+export const CODEX_AUTH_ORIGIN = 'https://auth.openai.com';
+function asRecord(value) {
+    return typeof value === 'object' && value !== null ? value : null;
+}
+async function withSignal(operation, signal) {
+    signal.throwIfAborted();
+    let rejectAbort = () => { };
+    const aborted = new Promise((_resolve, reject) => {
+        rejectAbort = reject;
+    });
+    const onAbort = () => rejectAbort(signal.reason);
+    signal.addEventListener('abort', onAbort, { once: true });
+    try {
+        return await Promise.race([operation, aborted]);
+    }
+    finally {
+        signal.removeEventListener('abort', onAbort);
+    }
+}
+async function parseJson(response, signal) {
+    const value = asRecord(await withSignal(response.json(), signal));
+    if (!value)
+        throw new Error('The sign-in service returned an invalid response.');
+    return value;
+}
+async function requestUserCode(fetchFn, origin, signal) {
+    const response = await withSignal(fetchFn(`${origin}/api/accounts/deviceauth/usercode`, {
+        method: 'POST',
+        headers: {
+            'content-type': 'application/json',
+            accept: 'application/json',
+        },
+        body: JSON.stringify({ client_id: CODEX_OAUTH_CLIENT_ID }),
+        signal,
+    }), signal);
+    if (!response.ok) {
+        throw new Error(`The Codex device sign-in service refused the request (HTTP ${response.status}).`);
+    }
+    const body = await parseJson(response, signal);
+    const deviceAuthId = body.device_auth_id;
+    const userCode = body.user_code ?? body.usercode;
+    const seconds = Number(body.interval);
+    if (typeof deviceAuthId !== 'string' ||
+        deviceAuthId.length === 0 ||
+        typeof userCode !== 'string' ||
+        userCode.length === 0 ||
+        !Number.isFinite(seconds) ||
+        seconds < 0) {
+        throw new Error('The Codex device sign-in service returned an incomplete response.');
+    }
+    return { deviceAuthId, userCode, intervalMs: Math.max(10, seconds * 1_000) };
+}
+async function delay(ms, signal) {
+    let timer;
+    try {
+        await withSignal(new Promise((resolve) => {
+            timer = setTimeout(resolve, ms);
+        }), signal);
+    }
+    finally {
+        if (timer !== undefined)
+            clearTimeout(timer);
+    }
+}
+async function complete(code, options, signal) {
+    const fetchFn = options.fetch ?? globalThis.fetch;
+    const origin = (options.authOrigin ?? CODEX_AUTH_ORIGIN).replace(/\/$/, '');
+    const deadlineAt = Date.now() + (options.pollTimeoutMs ?? 15 * 60_000);
+    let authorization = null;
+    while (Date.now() < deadlineAt) {
+        signal.throwIfAborted();
+        const response = await withSignal(fetchFn(`${origin}/api/accounts/deviceauth/token`, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/json',
+                accept: 'application/json',
+            },
+            body: JSON.stringify({
+                device_auth_id: code.deviceAuthId,
+                user_code: code.userCode,
+            }),
+            signal,
+        }), signal);
+        if (response.ok) {
+            authorization = await parseJson(response, signal);
+            break;
+        }
+        if (response.status !== 403 && response.status !== 404) {
+            return {
+                ok: false,
+                reason: `The Codex device sign-in was refused (HTTP ${response.status}). Nothing was stored.`,
+            };
+        }
+        await delay(code.intervalMs, signal);
+    }
+    if (!authorization) {
+        return {
+            ok: false,
+            reason: 'The Codex device code expired. Nothing was stored.',
+        };
+    }
+    const authorizationCode = authorization.authorization_code;
+    const verifier = authorization.code_verifier;
+    if (typeof authorizationCode !== 'string' ||
+        authorizationCode.length === 0 ||
+        typeof verifier !== 'string' ||
+        verifier.length === 0) {
+        return {
+            ok: false,
+            reason: 'The Codex device sign-in returned no exchange code. Nothing was stored.',
+        };
+    }
+    const redirectUri = `${origin}/deviceauth/callback`;
+    const form = new URLSearchParams({
+        grant_type: 'authorization_code',
+        code: authorizationCode,
+        redirect_uri: redirectUri,
+        client_id: CODEX_OAUTH_CLIENT_ID,
+        code_verifier: verifier,
+    });
+    const exchanged = await withSignal(fetchFn(`${origin}/oauth/token`, {
+        method: 'POST',
+        headers: {
+            'content-type': 'application/x-www-form-urlencoded',
+            accept: 'application/json',
+        },
+        body: form.toString(),
+        signal,
+    }), signal);
+    if (!exchanged.ok) {
+        return {
+            ok: false,
+            reason: `The Codex token exchange was refused (HTTP ${exchanged.status}). Nothing was stored.`,
+        };
+    }
+    const tokens = await parseJson(exchanged, signal);
+    const accessToken = tokens.access_token;
+    const refreshToken = tokens.refresh_token;
+    const credential = typeof accessToken === 'string'
+        ? codexCredentialFromTokens({
+            accessToken,
+            ...(typeof refreshToken === 'string' ? { refreshToken } : {}),
+        })
+        : null;
+    if (!credential) {
+        return {
+            ok: false,
+            reason: 'The Codex token exchange did not identify an account. Nothing was stored.',
+        };
+    }
+    signal.throwIfAborted();
+    try {
+        const storedAt = writeStoredCodexCredential(credential, options.home);
+        return { ok: true, credential, storedAt };
+    }
+    catch (error) {
+        return {
+            ok: false,
+            reason: `Signed in to Codex, but the credential could not be stored privately: ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+}
+export async function beginCodexDeviceLogin(options = {}) {
+    options.signal?.throwIfAborted();
+    const owner = new AbortController();
+    const signal = options.signal ? AbortSignal.any([options.signal, owner.signal]) : owner.signal;
+    const origin = (options.authOrigin ?? CODEX_AUTH_ORIGIN).replace(/\/$/, '');
+    const userCode = await requestUserCode(options.fetch ?? globalThis.fetch, origin, signal);
+    let completion;
+    return {
+        url: `${origin}/codex/device`,
+        userCode: userCode.userCode,
+        waitForCompletion: () => {
+            completion ??= complete(userCode, options, signal).catch((error) => {
+                if (signal.aborted) {
+                    return {
+                        ok: false,
+                        reason: 'The Codex sign-in was cancelled. Nothing was stored.',
+                    };
+                }
+                return {
+                    ok: false,
+                    reason: `Could not complete Codex sign-in: ${error instanceof Error ? error.message : String(error)}`,
+                };
+            });
+            return completion;
+        },
+        cancel: () => owner.abort(new Error('The Codex sign-in attempt was cancelled.')),
+    };
+}
+//# sourceMappingURL=codex-device-login.js.map

package/dist/integrations/providers/codex-device-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-device-login.js","sourceRoot":"","sources":["../../../src/integrations/providers/codex-device-login.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAE3F,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAA;AAClE,OAAO,EAA6B,yBAAyB,EAAE,MAAM,0BAA0B,CAAA;AAE/F,MAAM,CAAC,MAAM,qBAAqB,GAAG,8BAA8B,CAAA;AACnE,MAAM,CAAC,MAAM,iBAAiB,GAAG,yBAAyB,CAAA;AA+B1D,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,IAAI,CAAA;AAC/F,CAAC;AAED,KAAK,UAAU,UAAU,CAAI,SAAyB,EAAE,MAAmB;IAC1E,MAAM,CAAC,cAAc,EAAE,CAAA;IACvB,IAAI,WAAW,GAA8B,GAAG,EAAE,GAAE,CAAC,CAAA;IACrD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;QACvD,WAAW,GAAG,MAAM,CAAA;IACrB,CAAC,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAChD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IACzD,IAAI,CAAC;QACJ,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAA;IAChD,CAAC;YAAS,CAAC;QACV,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAC7C,CAAC;AACF,CAAC;AAED,KAAK,UAAU,SAAS,CACvB,QAAkB,EAClB,MAAmB;IAEnB,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,CAAA;IACjE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;IAChF,OAAO,KAAK,CAAA;AACb,CAAC;AAED,KAAK,UAAU,eAAe,CAC7B,OAAqB,EACrB,MAAc,EACd,MAAmB;IAEnB,MAAM,QAAQ,GAAG,MAAM,UAAU,CAChC,OAAO,CAAC,GAAG,MAAM,mCAAmC,EAAE;QACrD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACR,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,kBAAkB;SAC1B;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,qBAAqB,EAAE,CAAC;QAC1D,MAAM;KACN,CAAC,EACF,MAAM,CACN,CAAA;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACd,8DAA8D,QAAQ,CAAC,MAAM,IAAI,CACjF,CAAA;IACF,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAA;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAA;IAChD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACrC,IACC,OAAO,YAAY,KAAK,QAAQ;QAChC,YAAY,CAAC,MAAM,KAAK,CAAC;QACzB,OAAO,QAAQ,KAAK,QAAQ;QAC5B,QAAQ,CAAC,MAAM,KAAK,CAAC;QACrB,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QACzB,OAAO,GAAG,CAAC,EACV,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAA;IACrF,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,GAAG,KAAK,CAAC,EAAE,CAAA;AAC7E,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,EAAU,EAAE,MAAmB;IACnD,IAAI,KAAgD,CAAA;IACpD,IAAI,CAAC;QACJ,MAAM,UAAU,CACf,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAC7B,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;QAChC,CAAC,CAAC,EACF,MAAM,CACN,CAAA;IACF,CAAC;YAAS,CAAC;QACV,IAAI,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,KAAK,CAAC,CAAA;IAC7C,CAAC;AACF,CAAC;AAED,KAAK,UAAU,QAAQ,CACtB,IAAsB,EACtB,OAAgC,EAChC,MAAmB;IAEnB,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAA;IACjD,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,iBAAiB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC3E,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,GAAG,MAAM,CAAC,CAAA;IACtE,IAAI,aAAa,GAAmC,IAAI,CAAA;IACxD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,EAAE,CAAC;QAChC,MAAM,CAAC,cAAc,EAAE,CAAA;QACvB,MAAM,QAAQ,GAAG,MAAM,UAAU,CAChC,OAAO,CAAC,GAAG,MAAM,gCAAgC,EAAE;YAClD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACR,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC1B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACpB,cAAc,EAAE,IAAI,CAAC,YAAY;gBACjC,SAAS,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC;YACF,MAAM;SACN,CAAC,EACF,MAAM,CACN,CAAA;QACD,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,aAAa,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;YACjD,MAAK;QACN,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACxD,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,8CAA8C,QAAQ,CAAC,MAAM,wBAAwB;aAC7F,CAAA;QACF,CAAC;QACD,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;IACrC,CAAC;IACD,IAAI,CAAC,aAAa,EAAE,CAAC;QACpB,OAAO;YACN,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,oDAAoD;SAC5D,CAAA;IACF,CAAC;IACD,MAAM,iBAAiB,GAAG,aAAa,CAAC,kBAAkB,CAAA;IAC1D,MAAM,QAAQ,GAAG,aAAa,CAAC,aAAa,CAAA;IAC5C,IACC,OAAO,iBAAiB,KAAK,QAAQ;QACrC,iBAAiB,CAAC,MAAM,KAAK,CAAC;QAC9B,OAAO,QAAQ,KAAK,QAAQ;QAC5B,QAAQ,CAAC,MAAM,KAAK,CAAC,EACpB,CAAC;QACF,OAAO;YACN,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,yEAAyE;SACjF,CAAA;IACF,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,MAAM,sBAAsB,CAAA;IACnD,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAChC,UAAU,EAAE,oBAAoB;QAChC,IAAI,EAAE,iBAAiB;QACvB,YAAY,EAAE,WAAW;QACzB,SAAS,EAAE,qBAAqB;QAChC,aAAa,EAAE,QAAQ;KACvB,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,MAAM,UAAU,CACjC,OAAO,CAAC,GAAG,MAAM,cAAc,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACR,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;SAC1B;QACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;QACrB,MAAM;KACN,CAAC,EACF,MAAM,CACN,CAAA;IACD,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO;YACN,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,8CAA8C,SAAS,CAAC,MAAM,wBAAwB;SAC9F,CAAA;IACF,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IACjD,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAA;IACvC,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,CAAA;IACzC,MAAM,UAAU,GACf,OAAO,WAAW,KAAK,QAAQ;QAC9B,CAAC,CAAC,yBAAyB,CAAC;YAC1B,WAAW;YACX,GAAG,CAAC,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7D,CAAC;QACH,CAAC,CAAC,IAAI,CAAA;IACR,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,OAAO;YACN,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,2EAA2E;SACnF,CAAA;IACF,CAAC;IACD,MAAM,CAAC,cAAc,EAAE,CAAA;IACvB,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,0BAA0B,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QACrE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAA;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,yEAAyE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;SACzI,CAAA;IACF,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAC1C,UAAmC,EAAE;IAErC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;IAChC,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAA;IACnC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAA;IAC9F,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,iBAAiB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC3E,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;IACzF,IAAI,UAAwD,CAAA;IAC5D,OAAO;QACN,GAAG,EAAE,GAAG,MAAM,eAAe;QAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,iBAAiB,EAAE,GAAG,EAAE;YACvB,UAAU,KAAK,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBAClE,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACpB,OAAO;wBACN,EAAE,EAAE,KAAK;wBACT,MAAM,EAAE,sDAAsD;qBAC9D,CAAA;gBACF,CAAC;gBACD,OAAO;oBACN,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,qCAAqC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;iBACrG,CAAA;YACF,CAAC,CAAC,CAAA;YACF,OAAO,UAAU,CAAA;QAClB,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;KAChF,CAAA;AACF,CAAC"}

package/dist/integrations/providers/codex-oauth.d.ts

@@ -0,0 +1,10 @@
+/** Refresh for a Codex credential owned by Namzu's credential store. */
+import { type StoredCodexCredential } from './credential-store.js';
+export interface StoredCodexRefreshOptions {
+    readonly home?: string;
+    readonly fetch?: typeof fetch;
+    readonly authOrigin?: string;
+    readonly now?: number;
+}
+export declare function ensureFreshStoredCodexCredential(signal?: AbortSignal, options?: StoredCodexRefreshOptions): Promise<StoredCodexCredential>;
+//# sourceMappingURL=codex-oauth.d.ts.map

package/dist/integrations/providers/codex-oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-oauth.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/codex-oauth.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAGxE,OAAO,EACN,KAAK,qBAAqB,EAG1B,MAAM,uBAAuB,CAAA;AAM9B,MAAM,WAAW,yBAAyB;IACzC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CACrB;AAqBD,wBAAsB,gCAAgC,CACrD,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,yBAA8B,GACrC,OAAO,CAAC,qBAAqB,CAAC,CAoFhC"}

package/dist/integrations/providers/codex-oauth.js

@@ -0,0 +1,95 @@
+/** Refresh for a Codex credential owned by Namzu's credential store. */
+import { CODEX_AUTH_ORIGIN, CODEX_OAUTH_CLIENT_ID } from './codex-device-login.js';
+import { readStoredCodexCredential, replaceStoredCodexCredential, } from './credential-store.js';
+import { codexCredentialFromTokens } from './harness-credentials.js';
+import { CredentialPublicationError, CredentialWithdrawnError } from './oauth.js';
+const REFRESH_WINDOW_MS = 5 * 60_000;
+function asRecord(value) {
+    return typeof value === 'object' && value !== null ? value : null;
+}
+async function withSignal(operation, signal) {
+    signal.throwIfAborted();
+    let rejectAbort = () => { };
+    const aborted = new Promise((_resolve, reject) => {
+        rejectAbort = reject;
+    });
+    const onAbort = () => rejectAbort(signal.reason);
+    signal.addEventListener('abort', onAbort, { once: true });
+    try {
+        return await Promise.race([operation, aborted]);
+    }
+    finally {
+        signal.removeEventListener('abort', onAbort);
+    }
+}
+export async function ensureFreshStoredCodexCredential(signal, options = {}) {
+    signal?.throwIfAborted();
+    const current = readStoredCodexCredential(options.home);
+    if (!current) {
+        throw new CredentialWithdrawnError('The Codex subscription Namzu stored was removed. Sign in again or choose another provider.');
+    }
+    if (current.expiresAt === undefined ||
+        current.expiresAt - (options.now ?? Date.now()) > REFRESH_WINDOW_MS) {
+        return current;
+    }
+    if (!current.refreshToken) {
+        throw new CredentialWithdrawnError('The Codex subscription expired without a refresh grant. Sign in again.');
+    }
+    const deadline = AbortSignal.timeout(30_000);
+    const requestSignal = signal ? AbortSignal.any([signal, deadline]) : deadline;
+    let response;
+    try {
+        response = await withSignal((options.fetch ?? globalThis.fetch)(`${(options.authOrigin ?? CODEX_AUTH_ORIGIN).replace(/\/$/, '')}/oauth/token`, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/json',
+                accept: 'application/json',
+            },
+            body: JSON.stringify({
+                client_id: CODEX_OAUTH_CLIENT_ID,
+                grant_type: 'refresh_token',
+                refresh_token: current.refreshToken,
+            }),
+            signal: requestSignal,
+        }), requestSignal);
+    }
+    catch (error) {
+        if (signal?.aborted)
+            throw signal.reason;
+        throw new CredentialPublicationError({ cause: error });
+    }
+    if (!response.ok) {
+        throw new CredentialWithdrawnError(`The Codex subscription could not be refreshed (HTTP ${response.status}). Sign in again.`);
+    }
+    const body = asRecord(await withSignal(response.json(), requestSignal));
+    if (!body) {
+        throw new CredentialWithdrawnError('The Codex refresh service returned an invalid credential. Sign in again.');
+    }
+    const accessToken = body.access_token;
+    const refreshToken = body.refresh_token;
+    const refreshed = typeof accessToken === 'string'
+        ? codexCredentialFromTokens({
+            accessToken,
+            refreshToken: typeof refreshToken === 'string' ? refreshToken : current.refreshToken,
+            accountId: current.accountId,
+        })
+        : null;
+    if (!refreshed || refreshed.accountId !== current.accountId) {
+        throw new CredentialWithdrawnError('The refreshed Codex credential did not belong to the signed-in account. Sign in again.');
+    }
+    signal?.throwIfAborted();
+    let result;
+    try {
+        result = replaceStoredCodexCredential(current, refreshed, options.home);
+    }
+    catch (error) {
+        throw new CredentialPublicationError({ cause: error });
+    }
+    if (!result.replaced) {
+        if (!result.current)
+            throw new CredentialWithdrawnError();
+        return result.current;
+    }
+    return refreshed;
+}
+//# sourceMappingURL=codex-oauth.js.map

package/dist/integrations/providers/codex-oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-oauth.js","sourceRoot":"","sources":["../../../src/integrations/providers/codex-oauth.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAExE,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AAClF,OAAO,EAEN,yBAAyB,EACzB,4BAA4B,GAC5B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAA;AACpE,OAAO,EAAE,0BAA0B,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAEjF,MAAM,iBAAiB,GAAG,CAAC,GAAG,MAAM,CAAA;AASpC,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,IAAI,CAAA;AAC/F,CAAC;AAED,KAAK,UAAU,UAAU,CAAI,SAAyB,EAAE,MAAmB;IAC1E,MAAM,CAAC,cAAc,EAAE,CAAA;IACvB,IAAI,WAAW,GAA8B,GAAG,EAAE,GAAE,CAAC,CAAA;IACrD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;QACvD,WAAW,GAAG,MAAM,CAAA;IACrB,CAAC,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAChD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IACzD,IAAI,CAAC;QACJ,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAA;IAChD,CAAC;YAAS,CAAC;QACV,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAC7C,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACrD,MAAoB,EACpB,UAAqC,EAAE;IAEvC,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,MAAM,OAAO,GAAG,yBAAyB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACvD,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,IAAI,wBAAwB,CACjC,4FAA4F,CAC5F,CAAA;IACF,CAAC;IACD,IACC,OAAO,CAAC,SAAS,KAAK,SAAS;QAC/B,OAAO,CAAC,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,iBAAiB,EAClE,CAAC;QACF,OAAO,OAAO,CAAA;IACf,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QAC3B,MAAM,IAAI,wBAAwB,CACjC,wEAAwE,CACxE,CAAA;IACF,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAC5C,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;IAC7E,IAAI,QAAkB,CAAA;IACtB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,UAAU,CAC1B,CAAC,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,CAClC,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,iBAAiB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,EAC7E;YACC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACR,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC1B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACpB,SAAS,EAAE,qBAAqB;gBAChC,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,OAAO,CAAC,YAAY;aACnC,CAAC;YACF,MAAM,EAAE,aAAa;SACrB,CACD,EACD,aAAa,CACb,CAAA;IACF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,MAAM,CAAC,MAAM,CAAA;QACxC,MAAM,IAAI,0BAA0B,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IACvD,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,wBAAwB,CACjC,uDAAuD,QAAQ,CAAC,MAAM,mBAAmB,CACzF,CAAA;IACF,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,aAAa,CAAC,CAAC,CAAA;IACvE,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,wBAAwB,CACjC,0EAA0E,CAC1E,CAAA;IACF,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAA;IACrC,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAA;IACvC,MAAM,SAAS,GACd,OAAO,WAAW,KAAK,QAAQ;QAC9B,CAAC,CAAC,yBAAyB,CAAC;YAC1B,WAAW;YACX,YAAY,EAAE,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY;YACpF,SAAS,EAAE,OAAO,CAAC,SAAS;SAC5B,CAAC;QACH,CAAC,CAAC,IAAI,CAAA;IACR,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;QAC7D,MAAM,IAAI,wBAAwB,CACjC,wFAAwF,CACxF,CAAA;IACF,CAAC;IACD,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,IAAI,MAAuD,CAAA;IAC3D,IAAI,CAAC;QACJ,MAAM,GAAG,4BAA4B,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IACxE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,0BAA0B,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IACvD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,wBAAwB,EAAE,CAAA;QACzD,OAAO,MAAM,CAAC,OAAO,CAAA;IACtB,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC"}

package/dist/integrations/providers/credential-store.d.ts

@@ -35,11 +35,12 @@
  * ## What is in the file
  *
  *   { "version": 1,
- *     "subscription": { "accessToken", "refreshToken", "expiresAt", "scopes" } }
+ *     "subscription": { "accessToken", "refreshToken", "expiresAt", "scopes" },
+ *     "codexSubscription": { "accessToken", "refreshToken", "expiresAt", "accountId" } }
  *
- * `subscription` is the credential a person's plan grants, obtained by the
- * login flow in `subscription-login.ts` and refreshed in place by `oauth.ts`.
- * Nothing else writes here.
+ * Each sibling is owned by Namzu's corresponding login flow and conditionally
+ * refreshed in place. Credentials borrowed from Claude or Codex remain in
+ * their owners' files/keychain and are never copied here.
  */
 import type { AgentOAuthCredential } from './keychain.js';
 export declare const CREDENTIALS_FILE_VERSION: 1;
@@ -47,6 +48,23 @@ export declare const CREDENTIALS_FILE_VERSION: 1;
 export declare class CredentialStoreError extends Error {
     readonly name = "CredentialStoreError";
 }
+export type ConditionalCredentialWrite = {
+    readonly replaced: true;
+    readonly current: AgentOAuthCredential;
+} | {
+    readonly replaced: false;
+    readonly current: AgentOAuthCredential | null;
+};
+export interface StoredCodexCredential extends AgentOAuthCredential {
+    readonly accountId: string;
+}
+export type ConditionalCodexCredentialWrite = {
+    readonly replaced: true;
+    readonly current: StoredCodexCredential;
+} | {
+    readonly replaced: false;
+    readonly current: StoredCodexCredential | null;
+};
 export declare function credentialsPath(home?: string): string;
 /**
  * The stored subscription credential, or `null` when there is none.
@@ -58,6 +76,8 @@ export declare function credentialsPath(home?: string): string;
  * the operator to try again.
  */
 export declare function readStoredSubscriptionCredential(home?: string): AgentOAuthCredential | null;
+/** The Namzu-owned ChatGPT/Codex subscription, if one was obtained here. */
+export declare function readStoredCodexCredential(home?: string): StoredCodexCredential | null;
 /**
  * Write the credential, privately, or throw having written nothing that lasts.
  *
@@ -68,8 +88,24 @@ export declare function readStoredSubscriptionCredential(home?: string): AgentOA
  * removes.
  */
 export declare function writeStoredSubscriptionCredential(cred: AgentOAuthCredential, home?: string): string;
+export declare function writeStoredCodexCredential(cred: StoredCodexCredential, home?: string): string;
+export declare function replaceStoredCodexCredential(expected: StoredCodexCredential, replacement: StoredCodexCredential, home?: string): ConditionalCodexCredentialWrite;
+/**
+ * Replace exactly the credential a refresh was derived from.
+ *
+ * Comparison and rename happen under the same store-owned cross-process lock.
+ * A changed record is returned to the caller and is never overwritten. This is
+ * the durable authority boundary a post-network plain reread cannot provide:
+ * without the lock, another writer can still rotate the credential between
+ * the comparison and the rename.
+ */
+export declare function replaceStoredSubscriptionCredential(expected: AgentOAuthCredential, replacement: AgentOAuthCredential, home?: string): ConditionalCredentialWrite;
 /** Remove the stored credential. Absence is success. */
 export declare function clearStoredSubscriptionCredential(home?: string): void;
+/** Remove only the Namzu-owned Codex subscription; borrowed harness auth is untouched. */
+export declare function clearStoredCodexCredential(home?: string): void;
+/** Remove every credential Namzu owns in one store mutation. */
+export declare function clearAllStoredCredentials(home?: string): void;
 /**
  * Make `path` readable and writable by its owner and by nobody else, and
  * PROVE it. Throws `CredentialStoreError` when the proof cannot be produced.

package/dist/integrations/providers/credential-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-store.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAiBH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AAKzD,eAAO,MAAM,wBAAwB,EAAG,CAAU,CAAA;AAElD,wFAAwF;AACxF,qBAAa,oBAAqB,SAAQ,KAAK;IAC9C,SAAkB,IAAI,0BAAyB;CAC/C;AAED,wBAAgB,eAAe,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAEhE;AAED;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAC/C,IAAI,GAAE,MAAkB,GACtB,oBAAoB,GAAG,IAAI,CA2B7B;AAED;;;;;;;;GAQG;AACH,wBAAgB,iCAAiC,CAChD,IAAI,EAAE,oBAAoB,EAC1B,IAAI,GAAE,MAAkB,GACtB,MAAM,CAiDR;AAED,wDAAwD;AACxD,wBAAgB,iCAAiC,CAAC,IAAI,GAAE,MAAkB,GAAG,IAAI,CAEhF;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAiBlD;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAMpE;AAgDD;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiBvD;AAED,qFAAqF;AACrF,wBAAgB,cAAc,IAAI,MAAM,GAAG,IAAI,CAc9C;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAoCjF"}
+{"version":3,"file":"credential-store.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAoBH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AAKzD,eAAO,MAAM,wBAAwB,EAAG,CAAU,CAAA;AAElD,wFAAwF;AACxF,qBAAa,oBAAqB,SAAQ,KAAK;IAC9C,SAAkB,IAAI,0BAAyB;CAC/C;AAED,MAAM,MAAM,0BAA0B,GACnC;IAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,GACnE;IAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,GAAG,IAAI,CAAA;CAAE,CAAA;AAE9E,MAAM,WAAW,qBAAsB,SAAQ,oBAAoB;IAClE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,MAAM,+BAA+B,GACxC;IAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAA;CAAE,GACpE;IACA,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAAA;CAC7C,CAAA;AAQJ,wBAAgB,eAAe,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAEhE;AAED;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAC/C,IAAI,GAAE,MAAkB,GACtB,oBAAoB,GAAG,IAAI,CAE7B;AAED,4EAA4E;AAC5E,wBAAgB,yBAAyB,CAAC,IAAI,GAAE,MAAkB,GAAG,qBAAqB,GAAG,IAAI,CAEhG;AAsDD;;;;;;;;GAQG;AACH,wBAAgB,iCAAiC,CAChD,IAAI,EAAE,oBAAoB,EAC1B,IAAI,GAAE,MAAkB,GACtB,MAAM,CAUR;AAED,wBAAgB,0BAA0B,CACzC,IAAI,EAAE,qBAAqB,EAC3B,IAAI,GAAE,MAAkB,GACtB,MAAM,CAcR;AAED,wBAAgB,4BAA4B,CAC3C,QAAQ,EAAE,qBAAqB,EAC/B,WAAW,EAAE,qBAAqB,EAClC,IAAI,GAAE,MAAkB,GACtB,+BAA+B,CAiBjC;AAED;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CAClD,QAAQ,EAAE,oBAAoB,EAC9B,WAAW,EAAE,oBAAoB,EACjC,IAAI,GAAE,MAAkB,GACtB,0BAA0B,CAiB5B;AA4DD,wDAAwD;AACxD,wBAAgB,iCAAiC,CAAC,IAAI,GAAE,MAAkB,GAAG,IAAI,CAiBhF;AAED,0FAA0F;AAC1F,wBAAgB,0BAA0B,CAAC,IAAI,GAAE,MAAkB,GAAG,IAAI,CAczE;AAED,gEAAgE;AAChE,wBAAgB,yBAAyB,CAAC,IAAI,GAAE,MAAkB,GAAG,IAAI,CAIxE;AAsGD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAiBlD;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAMpE;AAgDD;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiBvD;AAED,qFAAqF;AACrF,wBAAgB,cAAc,IAAI,MAAM,GAAG,IAAI,CAc9C;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAoCjF"}