@pure01fx/dsh-openai-codex-auth 0.5.0 → 0.6.1

package/lib/index.js

@@ -8,6 +8,15 @@ import { createServer } from 'node:http';
 import { createHash, randomBytes } from 'node:crypto';
 import { readFile, unlink } from 'node:fs/promises';
 import { join, resolve } from 'node:path';
+import { INVALID_CREDENTIAL_CODE, LlmError } from '@deepseek-ai/dsh-llm';
+import { CODEX_PROVIDER, NATIVE_CODEX_PROVIDER, NativeCodexAdapter, } from './native-adapter.js';
+export { CODEX_PROVIDER, NATIVE_CODEX_PROVIDER } from './native-adapter.js';
+import { NativeCodexCatalog } from './catalog.js';
+import { NativeCodexHttpTransport } from './native-http.js';
+import { NativeCodexWebSocketTransport } from './native-websocket.js';
+import { mergeDirectUsage, normalizeUsage } from './usage.js';
+export { normalizeUsage } from './usage.js';
+export { CODEX_CLIENT_VERSION, TRACKED_CODEX_COMMIT, TRACKED_CODEX_RELEASE, TRACKED_CODEX_REPOSITORY, } from './upstream.js';
 const CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann';
 const AUTH_BASE_URL = 'https://auth.openai.com';
 const AUTHORIZE_URL = `${AUTH_BASE_URL}/oauth/authorize`;
@@ -24,6 +33,7 @@ const BROWSER_LOGIN_TIMEOUT_MS = 10 * 60_000;
 const DEFAULT_DEVICE_INTERVAL_SECONDS = 5;
 const MIN_DEVICE_INTERVAL_MS = 1_000;
 const SLOW_DOWN_INCREMENT_MS = 5_000;
+const TOKEN_REFRESH_PREEMPT_MS = 5 * 60_000;
 const DEFAULT_FILENAME = 'openai-codex-auth.json';
 const TOKEN_REF = credentialRef('DSH_OPENAI_CODEX_TOKEN');
 const USAGE_URL = 'https://chatgpt.com/backend-api/wham/usage';
@@ -36,28 +46,99 @@ class LoginConflictError extends Error {
 }
 class CredentialNotWritableError extends Error {
 }
+const PERMANENT_REFRESH_CODES = new Set([
+    'refresh_token_expired',
+    'refresh_token_reused',
+    'refresh_token_invalidated',
+    'invalid_grant',
+]);
+class OAuthEndpointError extends Error {
+    status;
+    oauthCode;
+    constructor(message, status, oauthCode) {
+        super(message);
+        this.status = status;
+        this.oauthCode = oauthCode;
+        this.name = 'OAuthEndpointError';
+    }
+}
 function base64Url(value) {
     return value.toString('base64url');
 }
 function messageOf(error) {
     return error instanceof Error ? error.message : String(error);
 }
-function accountId(access) {
-    const parts = access.split('.');
+function throwIfCancelled(signal) {
+    if (!signal?.aborted)
+        return;
+    if (signal.reason instanceof LlmError)
+        throw signal.reason;
+    throw new Error('OpenAI login cancelled');
+}
+function jwtPayload(token, label) {
+    const parts = token.split('.');
     if (parts.length !== 3)
-        throw new Error('OpenAI returned an invalid access token');
-    const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
-    const id = payload['https://api.openai.com/auth']?.chatgpt_account_id;
+        throw new Error(`OpenAI returned an invalid ${label}`);
+    try {
+        const value = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
+        if (value === null || typeof value !== 'object' || Array.isArray(value))
+            throw new Error();
+        return value;
+    }
+    catch {
+        throw new Error(`OpenAI returned an invalid ${label}`);
+    }
+}
+function chatGptAccountId(token, label) {
+    const auth = jwtPayload(token, label)['https://api.openai.com/auth'];
+    const id = auth !== null && typeof auth === 'object'
+        ? auth.chatgpt_account_id
+        : undefined;
     if (typeof id !== 'string' || id.length === 0)
-        throw new Error('OpenAI token has no ChatGPT account id');
+        throw new Error(`OpenAI ${label} has no ChatGPT account id`);
     return id;
 }
+function accessTokenExpiry(access) {
+    const exp = jwtPayload(access, 'access token').exp;
+    return typeof exp === 'number' && Number.isFinite(exp) && exp > 0 ? exp * 1_000 : undefined;
+}
+function parseTokenResponse(value, previous) {
+    if (value === null || typeof value.access_token !== 'string' || value.access_token.length === 0) {
+        throw new Error('OpenAI token response has no access token');
+    }
+    const refresh = value.refresh_token === undefined ? previous?.refresh : value.refresh_token;
+    if (typeof refresh !== 'string' || refresh.length === 0) {
+        throw new Error('OpenAI token response has no refresh token');
+    }
+    const expires = typeof value.expires_in === 'number' && Number.isFinite(value.expires_in) && value.expires_in > 0
+        ? Date.now() + value.expires_in * 1_000
+        : accessTokenExpiry(value.access_token);
+    if (expires === undefined)
+        throw new Error('OpenAI token response has no usable expiry');
+    const idToken = value.id_token;
+    if (idToken !== undefined && (typeof idToken !== 'string' || idToken.length === 0)) {
+        throw new Error('OpenAI token response has an invalid ID token');
+    }
+    const resolvedAccountId = idToken === undefined
+        ? previous?.accountId
+        : chatGptAccountId(idToken, 'ID token');
+    if (resolvedAccountId === undefined)
+        throw new Error('OpenAI token response has no ID token');
+    return { access: value.access_token, refresh, expires, accountId: resolvedAccountId };
+}
+function isPermanentRefreshError(error) {
+    return error instanceof OAuthEndpointError
+        && (error.status === 401
+            || (error.oauthCode !== undefined && PERMANENT_REFRESH_CODES.has(error.oauthCode.toLowerCase())));
+}
 function parseCredential(text, filename) {
     const value = JSON.parse(text);
     const credential = value.credential;
     if (value.version !== 1 || credential === undefined
-        || typeof credential.access !== 'string' || typeof credential.refresh !== 'string'
-        || typeof credential.expires !== 'number' || typeof credential.accountId !== 'string') {
+        || typeof credential.access !== 'string' || credential.access.length === 0
+        || typeof credential.refresh !== 'string' || credential.refresh.length === 0
+        || typeof credential.expires !== 'number' || !Number.isFinite(credential.expires)
+        || typeof credential.accountId !== 'string' || credential.accountId.length === 0) {
         throw new Error(`openai-codex-auth: invalid credential document ${filename}`);
     }
     return credential;
@@ -119,14 +200,11 @@ function parseManualAuthorizationInput(input) {
     }
     return { code: text };
 }
-async function tokenRequest(body, signal) {
+async function tokenRequest(init, previous, signal) {
     let response;
     try {
         response = await fetch(TOKEN_URL, {
-            method: 'POST',
-            headers: { 'content-type': 'application/x-www-form-urlencoded' },
-            body,
-            ...signal === undefined ? {} : { signal },
+            method: 'POST', redirect: 'error', ...init, ...signal === undefined ? {} : { signal },
         });
     }
     catch (error) {
@@ -136,65 +214,25 @@ async function tokenRequest(body, signal) {
     }
     if (!response.ok) {
         const text = await responseText(response);
-        throw new Error(`OpenAI token request failed (HTTP ${response.status})${text ? `: ${text}` : ''}`);
+        throw new OAuthEndpointError(`OpenAI token request failed (HTTP ${response.status})${text ? `: ${text}` : ''}`, response.status, errorCodeFromText(text));
     }
-    const value = await response.json();
-    if (value === null || typeof value.access_token !== 'string' || typeof value.refresh_token !== 'string'
-        || typeof value.expires_in !== 'number')
-        throw new Error('OpenAI token response is incomplete');
-    return {
-        access: value.access_token,
-        refresh: value.refresh_token,
-        expires: Date.now() + value.expires_in * 1000,
-        accountId: accountId(value.access_token),
-    };
-}
-function optionalNumber(value) {
-    return typeof value === 'number' && Number.isFinite(value) ? value : undefined;
+    return parseTokenResponse(await response.json(), previous);
 }
-function usageWindow(value) {
-    if (value === null || typeof value !== 'object')
-        return undefined;
-    const row = value;
-    const usedPercent = optionalNumber(row.used_percent ?? row.usedPercent);
-    if (usedPercent === undefined)
-        return undefined;
-    const windowSeconds = optionalNumber(row.limit_window_seconds ?? row.windowDurationSecs);
-    const resetAt = optionalNumber(row.reset_at ?? row.resetsAt);
-    return {
-        usedPercent: Math.max(0, Math.min(100, usedPercent)),
-        ...windowSeconds === undefined ? {} : { windowSeconds },
-        ...resetAt === undefined ? {} : { resetAt },
-    };
+function exchangeToken(body, signal) {
+    return tokenRequest({
+        headers: { 'content-type': 'application/x-www-form-urlencoded' },
+        body,
+    }, undefined, signal);
 }
-/** Reduce the OpenAI response to the stable fields displayed by the Web card. */
-export function normalizeUsage(value) {
-    const root = value !== null && typeof value === 'object' ? value : {};
-    const limits = root.rate_limit !== null && typeof root.rate_limit === 'object'
-        ? root.rate_limit
-        : root.rateLimits !== null && typeof root.rateLimits === 'object'
-            ? root.rateLimits
-            : {};
-    const credits = root.rate_limit_reset_credits !== null && typeof root.rate_limit_reset_credits === 'object'
-        ? root.rate_limit_reset_credits
-        : undefined;
-    const planType = typeof root.plan_type === 'string'
-        ? root.plan_type
-        : typeof root.planType === 'string' ? root.planType : undefined;
-    const primary = usageWindow(limits.primary_window ?? limits.primary);
-    const secondary = usageWindow(limits.secondary_window ?? limits.secondary);
-    const limitReached = typeof limits.limit_reached === 'boolean'
-        ? limits.limit_reached
-        : typeof limits.limitReached === 'boolean' ? limits.limitReached : undefined;
-    const resetCredits = optionalNumber(credits?.available_count ?? credits?.availableCount);
-    return {
-        ...planType === undefined ? {} : { planType },
-        ...primary === undefined ? {} : { primary },
-        ...secondary === undefined ? {} : { secondary },
-        ...limitReached === undefined ? {} : { limitReached },
-        ...resetCredits === undefined ? {} : { resetCredits },
-        fetchedAt: Date.now(),
-    };
+function refreshToken(current, signal) {
+    return tokenRequest({
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+            client_id: CLIENT_ID,
+            grant_type: 'refresh_token',
+            refresh_token: current.refresh,
+        }),
+    }, current, signal);
 }
 function header(request, name) {
     const value = request.headers[name];
@@ -361,6 +399,7 @@ async function startDeviceAuthorization(signal) {
     try {
         response = await fetch(DEVICE_USER_CODE_URL, {
             method: 'POST',
+            redirect: 'error',
             headers: { 'content-type': 'application/json' },
             body: JSON.stringify({ client_id: CLIENT_ID }),
             ...signal === undefined ? {} : { signal },
@@ -407,6 +446,7 @@ function errorCodeFromText(text) {
             const code = error.code;
             return typeof code === 'string' ? code : undefined;
         }
+        return typeof value.code === 'string' ? value.code : undefined;
     }
     catch {
         return undefined;
@@ -467,6 +507,7 @@ async function pollDeviceAuthorization(device, signal) {
         try {
             response = await fetch(DEVICE_TOKEN_URL, {
                 method: 'POST',
+                redirect: 'error',
                 headers: { 'content-type': 'application/json' },
                 body: JSON.stringify({ device_auth_id: device.deviceAuthId, user_code: device.userCode }),
                 ...signal === undefined ? {} : { signal },
@@ -491,7 +532,47 @@ async function pollDeviceAuthorization(device, signal) {
     }
     throw new Error('OpenAI device-code login timed out');
 }
+function resolveCodexRouteStatus(config, llm) {
+    let providers = [];
+    try {
+        providers = llm?.listProviders() ?? [];
+    }
+    catch {
+        // The auth/status surface must remain available while the LLM tree is settling.
+    }
+    const production = providers.find(provider => provider.id === CODEX_PROVIDER);
+    const compatibilityActive = providers.some(provider => provider.id === NATIVE_CODEX_PROVIDER);
+    if (config.nativeAdapter) {
+        return {
+            provider: CODEX_PROVIDER,
+            owner: 'native',
+            active: production !== undefined,
+            ...production === undefined ? {} : { registeredName: production.name },
+            transport: config.nativeWebSocket ? 'websocket-v2' : 'http-sse',
+            compatibilityRoute: {
+                configured: config.nativeCompatibilityRoute,
+                active: compatibilityActive,
+            },
+        };
+    }
+    if (production !== undefined) {
+        return {
+            provider: CODEX_PROVIDER,
+            owner: 'external',
+            active: true,
+            registeredName: production.name,
+            compatibilityRoute: { configured: false, active: compatibilityActive },
+        };
+    }
+    return {
+        provider: CODEX_PROVIDER,
+        owner: 'unregistered',
+        active: false,
+        compatibilityRoute: { configured: false, active: compatibilityActive },
+    };
+}
 export const internals = {
+    parseTokenResponse,
     parseAuthority,
     isLoopbackHostname,
     isTrustedHost,
@@ -501,17 +582,31 @@ export const internals = {
     startDeviceAuthorization,
     parseDevicePollResponse,
     pollDeviceAuthorization,
+    resolveCodexRouteStatus,
 };
 /** DSH service providing device-code/browser login, logout, and automatically refreshed bearer tokens. */
 export class OpenAICodexAuth extends Service {
-    static Config = z.object({ path: z.string(), dshHome: z.string() });
+    static Config = z.object({
+        path: z.string(),
+        dshHome: z.string(),
+        nativeAdapter: z.boolean().default(true),
+        nativeCompatibilityRoute: z.boolean().default(false),
+        nativeWebSocket: z.boolean().default(true),
+    });
     static inject = ['credentials', 'webServer', 'webRuntime'];
     filename;
+    routeConfig;
     csrf = base64Url(randomBytes(24));
     usageCache;
+    usageAccountId;
+    responseUsage;
+    credentialAccountId;
     usageError;
     usageRefresh;
     usageGeneration = 0;
+    directUsageSequence = 0;
+    directUsageAccountId;
+    usageHasDirectDefault = false;
     codexTurns = new Map();
     loginFlow;
     startingDevice;
@@ -520,11 +615,50 @@ export class OpenAICodexAuth extends Service {
     constructor(ctx, config) {
         super(ctx, 'openaiCodexAuth');
         this.filename = resolve(config.path ?? join(resolveDshHome(config.dshHome), DEFAULT_FILENAME));
+        this.routeConfig = {
+            nativeAdapter: config.nativeAdapter ?? true,
+            nativeCompatibilityRoute: config.nativeCompatibilityRoute ?? false,
+            nativeWebSocket: config.nativeWebSocket ?? true,
+        };
+        if (this.routeConfig.nativeAdapter) {
+            const catalog = new NativeCodexCatalog({
+                resolveCredential: signal => this.resolveNativeCredential(signal),
+                warn: message => { ctx.logger.warn(message); },
+            });
+            const transportOptions = {
+                resolveCredential: signal => this.resolveNativeCredential(signal),
+                recoverCredential: (previous, signal) => this.recoverNativeCredential(previous, signal),
+                readImage: async (attachment, signal) => {
+                    const store = ctx.get('attachments');
+                    if (store === undefined) {
+                        throw new LlmError('native Codex image input requires the attachment service', 'UNSUPPORTED');
+                    }
+                    return store.readImage(attachment, signal);
+                },
+                onRateLimits: observation => {
+                    this.acceptRateLimits(observation.accountId, observation.updates);
+                },
+                onResponseUsage: observation => {
+                    this.acceptResponseUsage(observation);
+                },
+                warn: message => { ctx.logger.warn(message); },
+            };
+            const transport = this.routeConfig.nativeWebSocket
+                ? new NativeCodexWebSocketTransport(transportOptions)
+                : new NativeCodexHttpTransport(transportOptions);
+            if (transport instanceof NativeCodexWebSocketTransport) {
+                ctx.effect(() => () => { transport.dispose(); }, 'openai-codex-auth: dispose native WebSockets');
+            }
+            ctx.inject(['llm'], (llmCtx) => {
+                llmCtx.llm.registerAdapter([
+                    CODEX_PROVIDER,
+                    ...(this.routeConfig.nativeCompatibilityRoute ? [NATIVE_CODEX_PROVIDER] : []),
+                ], new NativeCodexAdapter(catalog, transport));
+            });
+        }
         ctx.effect(async () => {
             try {
-                const token = await this.bearerToken();
-                if (token !== undefined)
-                    await this.storeCredentialToken(token);
+                await this.bearerToken();
             }
             catch (error) {
                 this.lastLoginError = messageOf(error);
@@ -534,12 +668,16 @@ export class OpenAICodexAuth extends Service {
         }, 'openai-codex-auth: bootstrap credential');
         ctx.on('agent/request', async ({ agent, turn }, next) => {
             const request = await next();
-            if (request.provider === 'openai-codex')
+            if (request.provider === CODEX_PROVIDER || request.provider === NATIVE_CODEX_PROVIDER) {
                 this.markCodexTurn(String(agent.id), turn);
+            }
             return request;
         }, { global: true, prepend: true });
         ctx.on('session/event', (session, event) => {
-            if (event.type !== 'turn/end' || !this.consumeCodexTurn(String(session.id), event.data.turn))
+            if (event.type !== 'turn/end')
+                return;
+            const turn = this.consumeCodexTurn(String(session.id), event.data.turn);
+            if (turn === undefined || turn.receivedDirectUsage)
                 return;
             void this.refreshUsage(true);
         }, { global: true });
@@ -549,7 +687,6 @@ export class OpenAICodexAuth extends Service {
         ctx.effect(() => {
             const timer = setInterval(() => {
                 void this.bearerToken()
-                    .then(token => token === undefined ? undefined : this.storeCredentialToken(token))
                     .catch((error) => { this.usageError = messageOf(error); });
             }, 60_000);
             return () => { clearInterval(timer); };
@@ -596,18 +733,72 @@ export class OpenAICodexAuth extends Service {
             };
         }, 'openai-codex-auth: Web routes');
     }
+    setCredentialAccount(accountId) {
+        if (this.credentialAccountId !== accountId) {
+            this.directUsageAccountId = undefined;
+            this.usageHasDirectDefault = false;
+            this.responseUsage = undefined;
+        }
+        this.credentialAccountId = accountId;
+    }
+    acceptResponseUsage(observation) {
+        if (this.credentialAccountId !== undefined
+            && observation.accountId !== this.credentialAccountId)
+            return;
+        this.responseUsage = {
+            accountId: observation.accountId,
+            amount: observation.metadata.amount,
+            observedAt: Date.now(),
+        };
+    }
+    acceptRateLimits(accountId, updates) {
+        if (this.credentialAccountId !== undefined && accountId !== this.credentialAccountId)
+            return;
+        const accepted = updates.slice(0, 32);
+        if (accepted.length === 0)
+            return;
+        const defaultUpdate = accepted.find(candidate => candidate.limitId === 'codex');
+        const hasDefaultQuota = defaultUpdate !== undefined
+            && (defaultUpdate.primary !== undefined || defaultUpdate.secondary !== undefined);
+        const hasData = accepted.some(update => update.primary !== undefined
+            || update.secondary !== undefined || update.limitReached !== undefined
+            || update.planType !== undefined || update.credits !== undefined);
+        if (!hasData)
+            return;
+        const sameUsageAccount = this.usageAccountId === accountId;
+        if (!sameUsageAccount)
+            this.usageHasDirectDefault = false;
+        if (hasDefaultQuota)
+            this.usageGeneration += 1;
+        this.usageCache = mergeDirectUsage(sameUsageAccount ? this.usageCache : undefined, accepted);
+        this.usageAccountId = accountId;
+        this.usageError = undefined;
+        if (hasDefaultQuota) {
+            this.directUsageSequence += 1;
+            this.directUsageAccountId = accountId;
+            this.usageHasDirectDefault = true;
+        }
+    }
     markCodexTurn(sessionId, turn) {
-        const turns = this.codexTurns.get(sessionId) ?? new Set();
-        turns.add(turn);
+        const turns = this.codexTurns.get(sessionId) ?? new Map();
+        turns.set(turn, this.directUsageSequence);
         this.codexTurns.set(sessionId, turns);
     }
     consumeCodexTurn(sessionId, turn) {
         const turns = this.codexTurns.get(sessionId);
-        if (turns === undefined || !turns.delete(turn))
-            return false;
+        const directUsageAtStart = turns?.get(turn);
+        if (turns === undefined || directUsageAtStart === undefined)
+            return undefined;
+        turns.delete(turn);
         if (turns.size === 0)
             this.codexTurns.delete(sessionId);
-        return true;
+        return {
+            receivedDirectUsage: this.directUsageSequence > directUsageAtStart
+                && this.usageHasDirectDefault
+                && this.directUsageAccountId !== undefined
+                && this.directUsageAccountId === this.credentialAccountId
+                && this.directUsageAccountId === this.usageAccountId,
+        };
     }
     async performUsageRefresh(generation) {
         try {
@@ -615,6 +806,8 @@ export class OpenAICodexAuth extends Service {
             if (credential === undefined) {
                 if (this.usageGeneration === generation) {
                     this.usageCache = undefined;
+                    this.usageAccountId = undefined;
+                    this.usageHasDirectDefault = false;
                     this.usageError = undefined;
                 }
                 return;
@@ -622,6 +815,8 @@ export class OpenAICodexAuth extends Service {
             const usage = await this.fetchUsage(credential);
             if (this.usageGeneration === generation) {
                 this.usageCache = usage;
+                this.usageAccountId = credential.accountId;
+                this.usageHasDirectDefault = false;
                 this.usageError = undefined;
             }
         }
@@ -640,16 +835,20 @@ export class OpenAICodexAuth extends Service {
         const cycle = {
             promise: Promise.resolve(),
             queued: false,
+            generation: undefined,
         };
         this.usageRefresh = cycle;
         cycle.promise = (async () => {
             try {
                 do {
                     cycle.queued = false;
-                    await this.performUsageRefresh(this.usageGeneration);
+                    cycle.generation = this.usageGeneration;
+                    await this.performUsageRefresh(cycle.generation);
+                    cycle.generation = undefined;
                 } while (cycle.queued);
             }
             finally {
+                cycle.generation = undefined;
                 if (this.usageRefresh === cycle)
                     this.usageRefresh = undefined;
             }
@@ -662,52 +861,230 @@ export class OpenAICodexAuth extends Service {
             throw new CredentialNotWritableError(`DSH_OPENAI_CODEX_TOKEN is supplied by read-only source ${info.source ?? 'unknown'}; remove that override before logging in`);
         }
     }
-    async storeCredentialToken(token) {
-        await this.assertCredentialWritable();
+    async publishCredentialToken(token, signal) {
+        const resolved = await this.ctx.credentials.resolve(TOKEN_REF);
+        throwIfCancelled(signal);
+        if (resolved?.value === token)
+            return;
+        const info = await this.ctx.credentials.describe(TOKEN_REF);
+        throwIfCancelled(signal);
+        if (!info.writable) {
+            throw new CredentialNotWritableError(`DSH_OPENAI_CODEX_TOKEN is supplied by read-only source ${info.source ?? 'unknown'} and does not match the managed OpenAI credential`);
+        }
         await this.ctx.credentials.set(TOKEN_REF, token);
     }
-    /** Return a valid bearer token, refreshing and persisting it when near expiry. */
+    async restorePublishedCredential(previous) {
+        if (previous === undefined)
+            await this.ctx.credentials.unset(TOKEN_REF);
+        else
+            await this.ctx.credentials.set(TOKEN_REF, previous.value);
+    }
+    publicationChangedError(failure) {
+        return new AggregateError([failure, new Error('DSH_OPENAI_CODEX_TOKEN changed concurrently; rollback was skipped')], 'OpenAI credential publication failed after its DSH credential authority changed');
+    }
+    async failAfterPublicationRollback(previous, expectedCurrent, failure) {
+        let current;
+        try {
+            current = await this.ctx.credentials.resolve(TOKEN_REF);
+        }
+        catch (resolveError) {
+            throw new AggregateError([failure, resolveError], 'OpenAI credential publication failed and rollback safety could not be verified');
+        }
+        if (current?.value !== expectedCurrent)
+            throw this.publicationChangedError(failure);
+        try {
+            await this.restorePublishedCredential(previous);
+        }
+        catch (rollbackError) {
+            throw new AggregateError([failure, rollbackError], 'OpenAI credential publication failed and its prior DSH credential could not be restored');
+        }
+        throw failure;
+    }
+    async commitCredential(credential) {
+        const previous = await this.ctx.credentials.resolve(TOKEN_REF);
+        try {
+            await this.ctx.credentials.set(TOKEN_REF, credential.access);
+        }
+        catch (error) {
+            let current;
+            try {
+                current = await this.ctx.credentials.resolve(TOKEN_REF);
+            }
+            catch {
+                return this.failAfterPublicationRollback(previous, credential.access, error);
+            }
+            if (current?.value === credential.access) {
+                return this.failAfterPublicationRollback(previous, credential.access, error);
+            }
+            if (current?.value !== previous?.value)
+                throw this.publicationChangedError(error);
+            throw error;
+        }
+        try {
+            await this.write(credential);
+        }
+        catch (error) {
+            return this.failAfterPublicationRollback(previous, credential.access, error);
+        }
+    }
+    async resolveManagedCredentialLocked(signal) {
+        throwIfCancelled(signal);
+        const current = await readCredential(this.filename);
+        throwIfCancelled(signal);
+        if (current === undefined) {
+            this.setCredentialAccount(undefined);
+            return undefined;
+        }
+        if (current.expires > Date.now() + TOKEN_REFRESH_PREEMPT_MS) {
+            await this.publishCredentialToken(current.access, signal);
+            this.setCredentialAccount(current.accountId);
+            return current;
+        }
+        await this.assertCredentialWritable();
+        let next;
+        try {
+            next = await refreshToken(current, signal);
+        }
+        catch (error) {
+            throwIfCancelled(signal);
+            if (!isPermanentRefreshError(error) && current.expires > Date.now()) {
+                await this.publishCredentialToken(current.access, signal);
+                this.setCredentialAccount(current.accountId);
+                return current;
+            }
+            throw error;
+        }
+        throwIfCancelled(signal);
+        await this.commitCredential(next);
+        this.setCredentialAccount(next.accountId);
+        return next;
+    }
+    /** Return a valid managed bearer token, refreshing and persisting it when near expiry. */
     async bearerToken(signal) {
+        throwIfCancelled(signal);
         return withFileLock(this.filename, async () => {
-            const current = await readCredential(this.filename);
-            if (current === undefined)
-                return undefined;
-            if (current.expires > Date.now() + 60_000)
-                return current.access;
-            await this.assertCredentialWritable();
-            const next = await tokenRequest(new URLSearchParams({
-                grant_type: 'refresh_token', refresh_token: current.refresh, client_id: CLIENT_ID,
-            }), signal);
-            if (signal?.aborted)
-                throw new Error('OpenAI login cancelled');
-            await this.write(next);
-            if (signal?.aborted)
-                throw new Error('OpenAI login cancelled');
-            await this.ctx.credentials.set(TOKEN_REF, next.access);
-            return next.access;
+            const credential = await this.resolveManagedCredentialLocked(signal);
+            return credential?.access;
         });
     }
+    externalNativeCredential(accessToken) {
+        let accountId;
+        let expires;
+        try {
+            accountId = chatGptAccountId(accessToken, 'access token');
+            expires = accessTokenExpiry(accessToken);
+        }
+        catch (error) {
+            throw new LlmError('native Codex credential is not a valid ChatGPT access token', INVALID_CREDENTIAL_CODE, { cause: error });
+        }
+        if (expires !== undefined && expires <= Date.now()) {
+            throw new LlmError('native Codex ChatGPT access token has expired', INVALID_CREDENTIAL_CODE);
+        }
+        return { accessToken, accountId };
+    }
+    async resolveNativeCredential(signal) {
+        try {
+            throwIfCancelled(signal);
+            return await withFileLock(this.filename, async () => {
+                throwIfCancelled(signal);
+                const managed = await this.resolveManagedCredentialLocked(signal);
+                if (managed !== undefined) {
+                    throwIfCancelled(signal);
+                    return { accessToken: managed.access, accountId: managed.accountId };
+                }
+                const external = await this.ctx.credentials.resolve(TOKEN_REF);
+                throwIfCancelled(signal);
+                if (external === undefined) {
+                    throw new LlmError('native Codex credential is not configured', 'MISSING_CREDENTIAL');
+                }
+                const credential = this.externalNativeCredential(external.value);
+                throwIfCancelled(signal);
+                this.setCredentialAccount(credential.accountId);
+                return credential;
+            });
+        }
+        catch (error) {
+            if (error instanceof LlmError)
+                throw error;
+            if (signal?.aborted) {
+                throw new LlmError('native Codex credential resolution was aborted', 'ABORTED', { cause: error });
+            }
+            throw new LlmError('native Codex managed credential could not be resolved', INVALID_CREDENTIAL_CODE, { cause: error });
+        }
+    }
+    nativeRecoveryError(error) {
+        const options = {
+            cause: error,
+            ...(error instanceof OAuthEndpointError ? { status: error.status } : {}),
+        };
+        if (error instanceof CredentialNotWritableError || isPermanentRefreshError(error)) {
+            return new LlmError('native Codex managed credential cannot be refreshed', INVALID_CREDENTIAL_CODE, options);
+        }
+        return new LlmError('native Codex managed credential recovery failed', 'AUTH', options);
+    }
+    async recoverNativeCredential(previous, signal) {
+        try {
+            throwIfCancelled(signal);
+            return await withFileLock(this.filename, async () => {
+                throwIfCancelled(signal);
+                const current = await readCredential(this.filename);
+                throwIfCancelled(signal);
+                if (current === undefined) {
+                    const external = await this.ctx.credentials.resolve(TOKEN_REF);
+                    throwIfCancelled(signal);
+                    if (external === undefined)
+                        return false;
+                    const credential = this.externalNativeCredential(external.value);
+                    throwIfCancelled(signal);
+                    this.setCredentialAccount(credential.accountId);
+                    return credential.accessToken !== previous.accessToken
+                        || credential.accountId !== previous.accountId;
+                }
+                if (current.access !== previous.accessToken || current.accountId !== previous.accountId) {
+                    await this.publishCredentialToken(current.access, signal);
+                    throwIfCancelled(signal);
+                    this.setCredentialAccount(current.accountId);
+                    return true;
+                }
+                await this.assertCredentialWritable();
+                throwIfCancelled(signal);
+                const next = await refreshToken(current, signal);
+                throwIfCancelled(signal);
+                await this.commitCredential(next);
+                throwIfCancelled(signal);
+                this.setCredentialAccount(next.accountId);
+                return next.access !== previous.accessToken || next.accountId !== previous.accountId;
+            });
+        }
+        catch (error) {
+            if (error instanceof LlmError)
+                throw error;
+            if (signal?.aborted) {
+                throw new LlmError('native Codex credential recovery was aborted', 'ABORTED');
+            }
+            throw this.nativeRecoveryError(error);
+        }
+    }
     async finishCredential(credential, signal) {
         await this.assertCredentialWritable();
-        if (signal.aborted)
-            throw new Error('OpenAI login cancelled');
+        throwIfCancelled(signal);
         await withFileLock(this.filename, async () => {
-            if (signal.aborted)
-                throw new Error('OpenAI login cancelled');
-            await this.write(credential);
+            throwIfCancelled(signal);
+            await this.commitCredential(credential);
+            this.setCredentialAccount(credential.accountId);
+            this.usageGeneration += 1;
+            if (this.usageRefresh !== undefined)
+                this.usageRefresh.queued = true;
+            this.usageCache = undefined;
+            this.usageAccountId = undefined;
+            this.directUsageAccountId = undefined;
+            this.usageHasDirectDefault = false;
+            this.usageError = undefined;
         });
-        this.usageGeneration += 1;
-        if (this.usageRefresh !== undefined)
-            this.usageRefresh.queued = true;
-        this.usageCache = undefined;
-        this.usageError = undefined;
-        if (signal.aborted)
-            throw new Error('OpenAI login cancelled');
-        await this.ctx.credentials.set(TOKEN_REF, credential.access);
         this.lastLoginError = undefined;
     }
     async finishAuthorizationCode(code, verifier, redirectUri, signal) {
-        const credential = await tokenRequest(new URLSearchParams({
+        const credential = await exchangeToken(new URLSearchParams({
             grant_type: 'authorization_code', client_id: CLIENT_ID, code,
             code_verifier: verifier, redirect_uri: redirectUri,
         }), signal);
@@ -857,7 +1234,7 @@ export class OpenAICodexAuth extends Service {
         const url = new URL(AUTHORIZE_URL);
         for (const [key, value] of Object.entries({
             response_type: 'code', client_id: CLIENT_ID, redirect_uri: redirectUri,
-            scope: 'openid profile email offline_access', code_challenge: challenge,
+            scope: 'openid profile email offline_access api.connectors.read api.connectors.invoke', code_challenge: challenge,
             code_challenge_method: 'S256', state, id_token_add_organizations: 'true',
             codex_cli_simplified_flow: 'true', originator: 'deepseek-harness',
         }))
@@ -922,30 +1299,44 @@ export class OpenAICodexAuth extends Service {
     async logout() {
         await this.cancelLogin(true);
         await withFileLock(this.filename, async () => {
+            const previous = await this.ctx.credentials.resolve(TOKEN_REF);
+            try {
+                await this.ctx.credentials.unset(TOKEN_REF);
+            }
+            catch (error) {
+                let current;
+                try {
+                    current = await this.ctx.credentials.resolve(TOKEN_REF);
+                }
+                catch {
+                    return this.failAfterPublicationRollback(previous, undefined, error);
+                }
+                if (current === undefined) {
+                    return this.failAfterPublicationRollback(previous, undefined, error);
+                }
+                if (current.value !== previous?.value)
+                    throw this.publicationChangedError(error);
+                throw error;
+            }
             try {
                 await unlink(this.filename);
             }
             catch (error) {
-                if (error.code !== 'ENOENT')
-                    throw error;
+                if (error.code !== 'ENOENT') {
+                    return this.failAfterPublicationRollback(previous, undefined, error);
+                }
             }
         });
-        let unsetError;
-        try {
-            await this.ctx.credentials.unset(TOKEN_REF);
-        }
-        catch (error) {
-            unsetError = error;
-        }
+        this.setCredentialAccount(undefined);
         this.usageGeneration += 1;
         if (this.usageRefresh !== undefined)
             this.usageRefresh.queued = false;
         this.usageCache = undefined;
+        this.usageAccountId = undefined;
+        this.directUsageAccountId = undefined;
+        this.usageHasDirectDefault = false;
         this.usageError = undefined;
         this.lastLoginError = undefined;
-        if (unsetError !== undefined) {
-            throw new Error(`Local OpenAI credential was removed, but DSH_OPENAI_CODEX_TOKEN could not be unset: ${messageOf(unsetError)}`);
-        }
     }
     async status(refresh, callbackUrl) {
         let credential;
@@ -966,7 +1357,13 @@ export class OpenAICodexAuth extends Service {
             }
             if (refresh)
                 await this.refreshUsage(true);
-            else if (this.usageRefresh !== undefined)
+            else if (this.usageRefresh !== undefined
+                && !(this.usageRefresh.generation !== undefined
+                    && this.usageRefresh.generation !== this.usageGeneration
+                    && this.usageCache?.source === 'response'
+                    && this.usageHasDirectDefault
+                    && this.usageAccountId === credential.accountId
+                    && this.directUsageAccountId === credential.accountId))
                 await this.usageRefresh.promise;
         }
         const flow = this.loginFlow;
@@ -980,6 +1377,7 @@ export class OpenAICodexAuth extends Service {
             ? { authorizationUrl: flow.url, probeUrl: flow.probeUrl, expiresAt: flow.expiresAt }
             : undefined;
         return {
+            route: resolveCodexRouteStatus(this.routeConfig, this.ctx.get('llm')),
             loggedIn: credential !== undefined,
             loginPending: startingMethod !== undefined || flow !== undefined,
             ...startingMethod !== undefined ? { loginMethod: startingMethod } : flow === undefined ? {} : { loginMethod: flow.kind },
@@ -991,7 +1389,13 @@ export class OpenAICodexAuth extends Service {
             ...credential === undefined ? {} : {
                 accountId: credential.accountId,
                 expiresAt: credential.expires,
-                ...this.usageCache === undefined ? {} : { usage: this.usageCache },
+                ...this.usageCache === undefined || this.usageAccountId !== credential.accountId
+                    ? {} : { usage: this.usageCache },
+                ...this.responseUsage === undefined || this.responseUsage.accountId !== credential.accountId
+                    ? {} : { responseUsage: {
+                        amount: this.responseUsage.amount,
+                        observedAt: this.responseUsage.observedAt,
+                    } },
                 ...this.usageError === undefined ? {} : { usageError: this.usageError },
             },
             csrf: this.csrf,
@@ -1002,6 +1406,7 @@ export class OpenAICodexAuth extends Service {
         if (access === undefined)
             throw new Error('OpenAI login is missing');
         const response = await fetch(USAGE_URL, {
+            redirect: 'error',
             headers: {
                 accept: 'application/json',
                 authorization: `Bearer ${access}`,