@tickernelz/paperclip-pro-adapter-codex-local 2026.925.0

package/dist/server/device-login-export.test.js

@@ -0,0 +1,245 @@
+import { chmod, lstat, mkdir, mkdtemp, readFile, rm, stat, symlink, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, describe, expect, it } from "vitest";
+import { MAX_AUTH_JSON_BYTES, deriveProofHome, installDeviceLoginCredential, removeProofHome, resolveProofHomeRoot, } from "./device-login-export.js";
+import { resolveManagedCodexHomeDir, resolveSharedCodexHomeDir } from "./codex-home.js";
+const COMPANY = "company-a";
+const RUN = "run-1234";
+const NEWER = "2026-07-09T02:00:00Z";
+const OLDER = "2026-07-09T01:00:00Z";
+const ACCOUNT = "acct-42";
+const OTHER_ACCOUNT = "acct-99";
+const TOKEN_SENTINEL = "SENTINEL_TOKEN_XYZ";
+describe("device-login credential export", () => {
+    const cleanupDirs = [];
+    afterEach(async () => {
+        while (cleanupDirs.length > 0) {
+            const dir = cleanupDirs.pop();
+            if (!dir)
+                continue;
+            await chmod(dir, 0o700).catch(() => undefined);
+            await rm(dir, { recursive: true, force: true }).catch(() => undefined);
+        }
+    });
+    async function makeInstanceRoot() {
+        const dir = await mkdtemp(path.join(os.tmpdir(), "paperclip-codex-proof-"));
+        cleanupDirs.push(dir);
+        return dir;
+    }
+    function envFor(instanceHome, extra = {}) {
+        return { PAPERCLIP_HOME: instanceHome, PAPERCLIP_INSTANCE_ID: "default", ...extra };
+    }
+    function subscriptionAuth(input) {
+        const suffix = input.marker ?? input.accountId;
+        return Buffer.from(JSON.stringify({
+            tokens: {
+                id_token: `id-token-${suffix}`,
+                access_token: `access-token-${suffix}`,
+                refresh_token: `${TOKEN_SENTINEL}-${suffix}`,
+                account_id: input.accountId,
+            },
+            ...(input.lastRefresh ? { last_refresh: input.lastRefresh } : {}),
+        }));
+    }
+    const noopLog = (_line) => { };
+    it("deriveProofHome returns a unique, run-scoped path under a company-scoped root", async () => {
+        const home = await makeInstanceRoot();
+        const env = envFor(home);
+        const root = resolveProofHomeRoot(env, COMPANY);
+        expect(root).toBe(path.resolve(home, "instances", "default", "companies", COMPANY, "codex-device-login-proof"));
+        const a = deriveProofHome({ env, companyId: COMPANY, runId: RUN });
+        const b = deriveProofHome({ env, companyId: COMPANY, runId: RUN });
+        expect(a.startsWith(root + path.sep)).toBe(true);
+        expect(a).toContain(RUN);
+        expect(a).not.toBe(b); // unique per call
+        // Never the shared or the managed home.
+        expect(a).not.toBe(resolveSharedCodexHomeDir(env));
+        expect(a).not.toBe(resolveManagedCodexHomeDir(env, COMPANY));
+    });
+    it("export_creates_root_and_home_at_mode_0700", async () => {
+        const home = await makeInstanceRoot();
+        const env = envFor(home);
+        const proofHome = deriveProofHome({ env, companyId: COMPANY, runId: RUN });
+        await installDeviceLoginCredential({
+            sandboxAuthBytes: subscriptionAuth({ accountId: ACCOUNT, lastRefresh: NEWER }),
+            proofHome,
+            env,
+            companyId: COMPANY,
+            log: noopLog,
+        });
+        const root = resolveProofHomeRoot(env, COMPANY);
+        expect((await stat(root)).mode & 0o777).toBe(0o700);
+        expect((await stat(proofHome)).mode & 0o777).toBe(0o700);
+    });
+    it("export_seeds_empty_proof_home_with_mode_0600", async () => {
+        const home = await makeInstanceRoot();
+        const env = envFor(home);
+        const proofHome = deriveProofHome({ env, companyId: COMPANY, runId: RUN });
+        const outcome = await installDeviceLoginCredential({
+            sandboxAuthBytes: subscriptionAuth({ accountId: ACCOUNT, lastRefresh: NEWER }),
+            proofHome,
+            env,
+            companyId: COMPANY,
+            log: noopLog,
+        });
+        expect(outcome).toBe("seeded");
+        const authPath = path.join(proofHome, "auth.json");
+        expect((await stat(authPath)).mode & 0o777).toBe(0o600);
+        const written = JSON.parse(await readFile(authPath, "utf8"));
+        expect(written.tokens.account_id).toBe(ACCOUNT);
+    });
+    it("export_rejects_default_shared_and_managed_home", async () => {
+        const home = await makeInstanceRoot();
+        const env = envFor(home, { CODEX_HOME: path.join(home, "shared-codex") });
+        const bytes = subscriptionAuth({ accountId: ACCOUNT, lastRefresh: NEWER });
+        const shared = resolveSharedCodexHomeDir(env);
+        const managed = resolveManagedCodexHomeDir(env, COMPANY);
+        const agentManaged = path.resolve(managed, "..", "agents", "agent-1", "codex-home");
+        for (const target of [shared, managed, agentManaged]) {
+            await expect(installDeviceLoginCredential({ sandboxAuthBytes: bytes, proofHome: target, env, companyId: COMPANY, log: noopLog })).rejects.toThrow();
+        }
+    });
+    it("export_rejects_symlink_or_non_regular_path", async () => {
+        const home = await makeInstanceRoot();
+        const env = envFor(home);
+        const root = resolveProofHomeRoot(env, COMPANY);
+        await mkdir(root, { recursive: true, mode: 0o700 });
+        const bytes = subscriptionAuth({ accountId: ACCOUNT, lastRefresh: NEWER });
+        // A symlinked proof home is rejected.
+        const realDir = path.join(home, "elsewhere");
+        await mkdir(realDir, { recursive: true, mode: 0o700 });
+        const linkedHome = path.join(root, `${RUN}-linked`);
+        await symlink(realDir, linkedHome);
+        await expect(installDeviceLoginCredential({ sandboxAuthBytes: bytes, proofHome: linkedHome, env, companyId: COMPANY, log: noopLog })).rejects.toThrow();
+        // A proof home whose auth.json is a symlink is rejected.
+        const symAuthHome = path.join(root, `${RUN}-symauth`);
+        await mkdir(symAuthHome, { recursive: true, mode: 0o700 });
+        await symlink(path.join(home, "target.json"), path.join(symAuthHome, "auth.json"));
+        await expect(installDeviceLoginCredential({ sandboxAuthBytes: bytes, proofHome: symAuthHome, env, companyId: COMPANY, log: noopLog })).rejects.toThrow();
+    });
+    it("export_rejects_api_key_malformed_or_oversized_payload", async () => {
+        const home = await makeInstanceRoot();
+        const env = envFor(home);
+        const apiKey = Buffer.from(JSON.stringify({ OPENAI_API_KEY: "sk-secret-key" }));
+        const malformed = Buffer.from("this is not json {");
+        const oversized = Buffer.concat([
+            subscriptionAuth({ accountId: ACCOUNT, lastRefresh: NEWER }),
+            Buffer.alloc(MAX_AUTH_JSON_BYTES + 10, 0x20),
+        ]);
+        for (const bytes of [apiKey, malformed, oversized]) {
+            const proofHome = deriveProofHome({ env, companyId: COMPANY, runId: RUN });
+            await expect(installDeviceLoginCredential({ sandboxAuthBytes: bytes, proofHome, env, companyId: COMPANY, log: noopLog })).rejects.toThrow();
+            // No file was written on a rejected payload.
+            await expect(stat(path.join(proofHome, "auth.json"))).rejects.toThrow();
+        }
+    });
+    it("export_updates_home_with_strictly_newer_same_identity", async () => {
+        const home = await makeInstanceRoot();
+        const env = envFor(home);
+        const proofHome = deriveProofHome({ env, companyId: COMPANY, runId: RUN });
+        const authPath = path.join(proofHome, "auth.json");
+        await installDeviceLoginCredential({
+            sandboxAuthBytes: subscriptionAuth({ accountId: ACCOUNT, lastRefresh: OLDER, marker: "old" }),
+            proofHome,
+            env,
+            companyId: COMPANY,
+            log: noopLog,
+        });
+        const outcome = await installDeviceLoginCredential({
+            sandboxAuthBytes: subscriptionAuth({ accountId: ACCOUNT, lastRefresh: NEWER, marker: "new" }),
+            proofHome,
+            env,
+            companyId: COMPANY,
+            log: noopLog,
+        });
+        expect(outcome).toBe("updated");
+        const written = JSON.parse(await readFile(authPath, "utf8"));
+        expect(written.last_refresh).toBe(NEWER);
+        expect(written.tokens.refresh_token).toContain("new");
+    });
+    it("export_keeps_home_on_older_or_different_identity", async () => {
+        const home = await makeInstanceRoot();
+        const env = envFor(home);
+        const proofHome = deriveProofHome({ env, companyId: COMPANY, runId: RUN });
+        const authPath = path.join(proofHome, "auth.json");
+        await installDeviceLoginCredential({
+            sandboxAuthBytes: subscriptionAuth({ accountId: ACCOUNT, lastRefresh: NEWER, marker: "keep" }),
+            proofHome,
+            env,
+            companyId: COMPANY,
+            log: noopLog,
+        });
+        // Older same identity: kept.
+        const olderOutcome = await installDeviceLoginCredential({
+            sandboxAuthBytes: subscriptionAuth({ accountId: ACCOUNT, lastRefresh: OLDER, marker: "older" }),
+            proofHome,
+            env,
+            companyId: COMPANY,
+            log: noopLog,
+        });
+        expect(olderOutcome).toBe("kept");
+        // Different identity, even newer: kept.
+        const otherOutcome = await installDeviceLoginCredential({
+            sandboxAuthBytes: subscriptionAuth({ accountId: OTHER_ACCOUNT, lastRefresh: NEWER, marker: "other" }),
+            proofHome,
+            env,
+            companyId: COMPANY,
+            log: noopLog,
+        });
+        expect(otherOutcome).toBe("kept");
+        const written = JSON.parse(await readFile(authPath, "utf8"));
+        expect(written.tokens.account_id).toBe(ACCOUNT);
+        expect(written.tokens.refresh_token).toContain("keep");
+    });
+    it("export_logs_contain_no_token_bytes", async () => {
+        const home = await makeInstanceRoot();
+        const env = envFor(home);
+        const proofHome = deriveProofHome({ env, companyId: COMPANY, runId: RUN });
+        const logs = [];
+        await installDeviceLoginCredential({
+            sandboxAuthBytes: subscriptionAuth({ accountId: ACCOUNT, lastRefresh: NEWER }),
+            proofHome,
+            env,
+            companyId: COMPANY,
+            log: (line) => {
+                logs.push(line);
+            },
+        });
+        const haystack = logs.join("\n");
+        expect(haystack).not.toContain(TOKEN_SENTINEL);
+        expect(haystack).not.toContain(ACCOUNT);
+    });
+    it("cleanup_removes_proof_home_and_leaves_default_home_unchanged", async () => {
+        const home = await makeInstanceRoot();
+        const env = envFor(home, { CODEX_HOME: path.join(home, "shared-codex") });
+        // A sentinel in a fake shared/default home must survive the cleanup.
+        const shared = resolveSharedCodexHomeDir(env);
+        await mkdir(shared, { recursive: true, mode: 0o700 });
+        const sentinel = path.join(shared, "auth.json");
+        await writeFile(sentinel, JSON.stringify({ tokens: { account_id: "host", refresh_token: "host" } }), { mode: 0o600 });
+        const proofHome = deriveProofHome({ env, companyId: COMPANY, runId: RUN });
+        await installDeviceLoginCredential({
+            sandboxAuthBytes: subscriptionAuth({ accountId: ACCOUNT, lastRefresh: NEWER }),
+            proofHome,
+            env,
+            companyId: COMPANY,
+            log: noopLog,
+        });
+        expect((await lstat(proofHome)).isDirectory()).toBe(true);
+        await removeProofHome(proofHome, { env, companyId: COMPANY });
+        await expect(lstat(proofHome)).rejects.toThrow();
+        // The fake default home is untouched.
+        expect(await readFile(sentinel, "utf8")).toContain("host");
+    });
+    it("removeProofHome refuses a path outside the proof root", async () => {
+        const home = await makeInstanceRoot();
+        const env = envFor(home);
+        const outside = path.join(home, "not-a-proof-home");
+        await mkdir(outside, { recursive: true });
+        await expect(removeProofHome(outside, { env, companyId: COMPANY })).rejects.toThrow();
+        // The outside directory is untouched.
+        expect((await lstat(outside)).isDirectory()).toBe(true);
+    });
+});
+//# sourceMappingURL=device-login-export.test.js.map

package/dist/server/device-login-export.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-login-export.test.js","sourceRoot":"","sources":["../../src/server/device-login-export.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACxG,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAEzD,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,4BAA4B,EAC5B,eAAe,EACf,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAExF,MAAM,OAAO,GAAG,WAAW,CAAC;AAC5B,MAAM,GAAG,GAAG,UAAU,CAAC;AACvB,MAAM,KAAK,GAAG,sBAAsB,CAAC;AACrC,MAAM,KAAK,GAAG,sBAAsB,CAAC;AACrC,MAAM,OAAO,GAAG,SAAS,CAAC;AAC1B,MAAM,aAAa,GAAG,SAAS,CAAC;AAChC,MAAM,cAAc,GAAG,oBAAoB,CAAC;AAE5C,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,MAAM,WAAW,GAAa,EAAE,CAAC;IAEjC,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,OAAO,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC/C,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,KAAK,UAAU,gBAAgB;QAC7B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC,CAAC;QAC5E,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtB,OAAO,GAAG,CAAC;IACb,CAAC;IAED,SAAS,MAAM,CAAC,YAAoB,EAAE,KAAK,GAA2B,EAAE;QACtE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,qBAAqB,EAAE,SAAS,EAAE,GAAG,KAAK,EAAE,CAAC;IACtF,CAAC;IAED,SAAS,gBAAgB,CAAC,KAAmE;QAC3F,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;QAC/C,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,CAAC,SAAS,CAAC;YACb,MAAM,EAAE;gBACN,QAAQ,EAAE,YAAY,MAAM,EAAE;gBAC9B,YAAY,EAAE,gBAAgB,MAAM,EAAE;gBACtC,aAAa,EAAE,GAAG,cAAc,IAAI,MAAM,EAAE;gBAC5C,UAAU,EAAE,KAAK,CAAC,SAAS;aAC5B;YACD,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,KAAa,EAAQ,EAAE,GAAE,CAAC,CAAC;IAE5C,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC7F,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,IAAI,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CACf,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,0BAA0B,CAAC,CAC7F,CAAC;QACF,MAAM,CAAC,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACnE,MAAM,CAAC,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACnE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB;QACzC,wCAAwC;QACxC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,SAAS,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3E,MAAM,4BAA4B,CAAC;YACjC,gBAAgB,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;YAC9E,SAAS;YACT,GAAG;YACH,SAAS,EAAE,OAAO;YAClB,GAAG,EAAE,OAAO;SACb,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,SAAS,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3E,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC;YACjD,gBAAgB,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;YAC9E,SAAS;YACT,GAAG;YACH,SAAS,EAAE,OAAO;YAClB,GAAG,EAAE,OAAO;SACb,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACnD,MAAM,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7D,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC,CAAC;QAC1E,MAAM,KAAK,GAAG,gBAAgB,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,0BAA0B,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACzD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;QACpF,KAAK,MAAM,MAAM,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY,CAAC,EAAE,CAAC;YACrD,MAAM,MAAM,CACV,4BAA4B,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CACpH,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACtB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,IAAI,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,gBAAgB,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QAE3E,sCAAsC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAC7C,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,SAAS,CAAC,CAAC;QACpD,MAAM,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACnC,MAAM,MAAM,CACV,4BAA4B,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CACxH,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAEpB,yDAAyD;QACzD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,UAAU,CAAC,CAAC;QACtD,MAAM,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;QACnF,MAAM,MAAM,CACV,4BAA4B,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CACzH,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;QAChF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,gBAAgB,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;YAC5D,MAAM,CAAC,KAAK,CAAC,mBAAmB,GAAG,EAAE,EAAE,IAAI,CAAC;SAC7C,CAAC,CAAC;QACH,KAAK,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;YACnD,MAAM,SAAS,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3E,MAAM,MAAM,CACV,4BAA4B,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAC5G,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,6CAA6C;YAC7C,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,SAAS,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACnD,MAAM,4BAA4B,CAAC;YACjC,gBAAgB,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAC7F,SAAS;YACT,GAAG;YACH,SAAS,EAAE,OAAO;YAClB,GAAG,EAAE,OAAO;SACb,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC;YACjD,gBAAgB,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAC7F,SAAS;YACT,GAAG;YACH,SAAS,EAAE,OAAO;YAClB,GAAG,EAAE,OAAO;SACb,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7D,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,SAAS,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACnD,MAAM,4BAA4B,CAAC;YACjC,gBAAgB,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YAC9F,SAAS;YACT,GAAG;YACH,SAAS,EAAE,OAAO;YAClB,GAAG,EAAE,OAAO;SACb,CAAC,CAAC;QACH,6BAA6B;QAC7B,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC;YACtD,gBAAgB,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC/F,SAAS;YACT,GAAG;YACH,SAAS,EAAE,OAAO;YAClB,GAAG,EAAE,OAAO;SACb,CAAC,CAAC;QACH,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClC,wCAAwC;QACxC,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC;YACtD,gBAAgB,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YACrG,SAAS;YACT,GAAG;YACH,SAAS,EAAE,OAAO;YAClB,GAAG,EAAE,OAAO;SACb,CAAC,CAAC;QACH,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7D,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,SAAS,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,MAAM,4BAA4B,CAAC;YACjC,gBAAgB,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;YAC9E,SAAS;YACT,GAAG;YACH,SAAS,EAAE,OAAO;YAClB,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE;gBACZ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC;SACF,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAC/C,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC,CAAC;QAC1E,qEAAqE;QACrE,MAAM,MAAM,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAChD,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAEtH,MAAM,SAAS,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3E,MAAM,4BAA4B,CAAC;YACjC,gBAAgB,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;YAC9E,SAAS;YACT,GAAG;YACH,SAAS,EAAE,OAAO;YAClB,GAAG,EAAE,OAAO;SACb,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE1D,MAAM,eAAe,CAAC,SAAS,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9D,MAAM,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACjD,sCAAsC;QACtC,MAAM,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;QACpD,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,MAAM,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACtF,sCAAsC;QACtC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/server/device-login-parse.d.ts

@@ -0,0 +1,20 @@
+export interface DeviceLoginPrompt {
+    url: string;
+    code: string;
+}
+export declare const DEVICE_LOGIN_URL = "https://auth.openai.com/codex/device";
+/**
+ * Parses Codex device-login output. Removes ANSI color sequences first, so
+ * colored output from Codex CLI 0.128.0 and later reads the same as plain
+ * output. The parser reads the URL first, then finds the "one-time code"
+ * preamble after the URL, then reads the code from the dedicated code line right
+ * after the preamble line. So the code binds to the prompt line that introduces
+ * it, and a code-shaped token between the URL and the preamble, on the preamble
+ * line, or mixed with other text on a later line, cannot form a prompt. Returns
+ * the login URL and the one-time code when both are present and valid. Returns
+ * null for any other input, including a non-string input, an absent prompt, a URL
+ * with a query or a fragment, a wrong origin or path, and a malformed short code.
+ * Never throws on input, and never puts the URL or the code into a log or an error.
+ */
+export declare function parseDeviceLoginPrompt(text: string): DeviceLoginPrompt | null;
+//# sourceMappingURL=device-login-parse.d.ts.map

package/dist/server/device-login-parse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-login-parse.d.ts","sourceRoot":"","sources":["../../src/server/device-login-parse.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd;AAID,eAAO,MAAM,gBAAgB,yCAAyC,CAAC;AAgIvE;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAQ7E"}

package/dist/server/device-login-parse.js

@@ -0,0 +1,155 @@
+// The device-login output parser. It reads the Codex `login --device-auth`
+// output and returns the login URL and the one-time code, or null.
+//
+// Security (Control 1 — strict validation): the parser accepts only the exact
+// origin and path of the device-login URL. It rejects any query, any fragment, a
+// different origin, and a different path. It accepts only the short-code
+// structure `XXXX-XXXXX` (four characters, a hyphen, then five characters). The
+// parser never logs the URL, the code, or any input byte, and it keeps them out
+// of every thrown error. The parser is a pure function.
+//
+// The parser returns the printed URL after the platform `URL` parser validates
+// and normalizes it. It never returns the raw matched token: the accepting
+// rules above already bound the token to the exact origin, path, and empty
+// query and fragment, so the normalized form carries no unvalidated byte.
+// The one and only accepted device-login origin and path. `findExactDeviceUrl`
+// checks a candidate token against these exact values before it accepts it.
+export const DEVICE_LOGIN_URL = "https://auth.openai.com/codex/device";
+// Codex CLI 0.128.0 and later wrap the login URL and the one-time code in ANSI
+// color sequences. A color sequence is a Control Sequence Introducer (CSI): the
+// ESC control byte, a `[`, zero or more parameter bytes (0x30-0x3F), zero or
+// more intermediate bytes (0x20-0x2F), and one final byte (0x40-0x7E). The
+// parser removes every CSI sequence first, so a colored URL or code reads the
+// same as a plain one. The strip only normalizes the input; the URL and the
+// code still pass the strict validation below.
+// eslint-disable-next-line no-control-regex
+const ANSI_CSI_RE = /\x1b\[[0-?]*[ -/]*[@-~]/g;
+// A candidate URL token is a run of non-space characters that starts with an
+// http or https scheme. The parser validates each candidate with the `URL`
+// class; the regular expression only splits tokens out of the text.
+const URL_TOKEN_RE = /https?:\/\/\S+/g;
+// Trailing punctuation that prose commonly puts right after a URL. The parser
+// strips only these characters. It never strips `?` or `#`, so a URL with a
+// query or a fragment stays malformed and the parser rejects it.
+const TRAILING_PUNCTUATION_RE = /[)\].,;:!]+$/;
+// The one-time code structure on a dedicated line: four characters, a hyphen,
+// then five characters, and nothing else on the line. The Codex prompt prints
+// the code alone on the line that comes right after the preamble line. So the
+// pattern matches the whole line. A code-shaped token that shares a line with
+// other text cannot match. The real code alphabet is a Codex detail that the
+// grounded capture did not keep (the capture redacted the code to `?`). So the
+// parser binds the token class to alphanumerics and the redaction sentinel `?`.
+const CODE_LINE_RE = /^([A-Za-z0-9?]{4}-[A-Za-z0-9?]{5})$/;
+// The prompt line that introduces the one-time code. The Codex prompt prints
+// the phrase "one-time code" on the line right before the code. The parser
+// anchors the code search on this phrase. So the code binds to the prompt line
+// that introduces it. A code-shaped token that sits between the URL and this
+// phrase cannot bind, because the parser reads the code only after the phrase.
+const CODE_PREAMBLE_RE = /one-time code/i;
+// The maximum number of characters between the end of the URL and the start of
+// the code preamble. The Codex prompt prints the preamble about one line after
+// the URL. The parser looks for the preamble only inside this window after the
+// URL. So a preamble far away in the output cannot bind to the URL.
+const MAX_URL_TO_PREAMBLE_GAP = 256;
+// The maximum number of characters after the end of the preamble line that the
+// parser reads for the code. The Codex prompt prints the code on the line right
+// after the preamble line. The parser looks for the code only inside this window
+// after the preamble line. The window is large enough for the real code line and
+// small enough to reject distant noise.
+const MAX_PREAMBLE_TO_CODE_GAP = 128;
+/**
+ * Returns the validated device-login URL and its end index when `text` holds it
+ * as a standalone token with the exact origin `https://auth.openai.com` and the
+ * exact path `/codex/device` and no query, fragment, or credentials. Returns
+ * null otherwise. Returns the platform `URL` parser's normalized form of the
+ * matched token, so the accepting rules bound the output even though it is not a
+ * fixed constant. The `end` index is the position of the first character after
+ * the matched token in `text`.
+ */
+function findExactDeviceUrl(text) {
+    for (const match of text.matchAll(URL_TOKEN_RE)) {
+        const token = match[0];
+        const cleaned = token.replace(TRAILING_PUNCTUATION_RE, "");
+        let parsed;
+        try {
+            parsed = new URL(cleaned);
+        }
+        catch {
+            continue;
+        }
+        if (parsed.protocol === "https:" &&
+            parsed.host === "auth.openai.com" &&
+            parsed.pathname === "/codex/device" &&
+            parsed.search === "" &&
+            parsed.hash === "" &&
+            parsed.username === "" &&
+            parsed.password === "") {
+            return { url: parsed.toString(), end: (match.index ?? 0) + token.length };
+        }
+    }
+    return null;
+}
+/**
+ * Returns the one-time code when `text` holds the code preamble after
+ * `fromIndex` and a dedicated code line after that preamble line. The parser
+ * first finds the "one-time code" preamble in a window after the URL. It then
+ * advances past the end of the preamble line and reads the first non-blank line
+ * after it. That line must hold only the `XXXX-XXXXX` code. So the code binds to
+ * the dedicated code line that the prompt prints right after the preamble line.
+ * A code-shaped token between the URL and the preamble cannot bind. A code-shaped
+ * token that shares the preamble line cannot bind. A code-shaped token inside a
+ * line that also holds other text cannot bind. Returns null when the preamble is
+ * absent, when the preamble has no line break after it, or when the first
+ * non-blank line after the preamble line is not a code line.
+ */
+function findShortCode(text, fromIndex) {
+    const preambleWindow = text.slice(fromIndex, fromIndex + MAX_URL_TO_PREAMBLE_GAP);
+    const preambleMatch = CODE_PREAMBLE_RE.exec(preambleWindow);
+    if (!preambleMatch)
+        return null;
+    // Advance to the end of the preamble line. The code sits on the next line, so
+    // the parser reads the code only after the preamble line ends. A code-shaped
+    // token on the preamble line cannot bind.
+    const preambleEnd = fromIndex + preambleMatch.index + preambleMatch[0].length;
+    const lineBreak = text.indexOf("\n", preambleEnd);
+    if (lineBreak === -1)
+        return null;
+    const codeWindow = text.slice(lineBreak + 1, lineBreak + 1 + MAX_PREAMBLE_TO_CODE_GAP);
+    // Read the first non-blank line after the preamble line. It must hold only the
+    // code. So the parser binds the code to the dedicated code line, and it rejects
+    // a line that mixes the code with other text.
+    for (const line of codeWindow.split("\n")) {
+        const trimmed = line.trim();
+        if (trimmed.length === 0)
+            continue;
+        const match = CODE_LINE_RE.exec(trimmed);
+        return match ? match[1] : null;
+    }
+    return null;
+}
+/**
+ * Parses Codex device-login output. Removes ANSI color sequences first, so
+ * colored output from Codex CLI 0.128.0 and later reads the same as plain
+ * output. The parser reads the URL first, then finds the "one-time code"
+ * preamble after the URL, then reads the code from the dedicated code line right
+ * after the preamble line. So the code binds to the prompt line that introduces
+ * it, and a code-shaped token between the URL and the preamble, on the preamble
+ * line, or mixed with other text on a later line, cannot form a prompt. Returns
+ * the login URL and the one-time code when both are present and valid. Returns
+ * null for any other input, including a non-string input, an absent prompt, a URL
+ * with a query or a fragment, a wrong origin or path, and a malformed short code.
+ * Never throws on input, and never puts the URL or the code into a log or an error.
+ */
+export function parseDeviceLoginPrompt(text) {
+    if (typeof text !== "string" || text.length === 0)
+        return null;
+    const clean = text.replace(ANSI_CSI_RE, "");
+    const urlMatch = findExactDeviceUrl(clean);
+    if (!urlMatch)
+        return null;
+    const code = findShortCode(clean, urlMatch.end);
+    if (!code)
+        return null;
+    return { url: urlMatch.url, code };
+}
+//# sourceMappingURL=device-login-parse.js.map

package/dist/server/device-login-parse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-login-parse.js","sourceRoot":"","sources":["../../src/server/device-login-parse.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,mEAAmE;AACnE,EAAE;AACF,8EAA8E;AAC9E,iFAAiF;AACjF,yEAAyE;AACzE,gFAAgF;AAChF,gFAAgF;AAChF,wDAAwD;AACxD,EAAE;AACF,+EAA+E;AAC/E,2EAA2E;AAC3E,2EAA2E;AAC3E,0EAA0E;AAO1E,+EAA+E;AAC/E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,gBAAgB,GAAG,sCAAsC,CAAC;AAEvE,+EAA+E;AAC/E,gFAAgF;AAChF,6EAA6E;AAC7E,2EAA2E;AAC3E,8EAA8E;AAC9E,4EAA4E;AAC5E,+CAA+C;AAC/C,4CAA4C;AAC5C,MAAM,WAAW,GAAG,0BAA0B,CAAC;AAE/C,6EAA6E;AAC7E,2EAA2E;AAC3E,oEAAoE;AACpE,MAAM,YAAY,GAAG,iBAAiB,CAAC;AAEvC,8EAA8E;AAC9E,4EAA4E;AAC5E,iEAAiE;AACjE,MAAM,uBAAuB,GAAG,cAAc,CAAC;AAE/C,8EAA8E;AAC9E,8EAA8E;AAC9E,8EAA8E;AAC9E,8EAA8E;AAC9E,6EAA6E;AAC7E,+EAA+E;AAC/E,gFAAgF;AAChF,MAAM,YAAY,GAAG,qCAAqC,CAAC;AAE3D,6EAA6E;AAC7E,2EAA2E;AAC3E,+EAA+E;AAC/E,6EAA6E;AAC7E,+EAA+E;AAC/E,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAE1C,+EAA+E;AAC/E,+EAA+E;AAC/E,+EAA+E;AAC/E,oEAAoE;AACpE,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAEpC,+EAA+E;AAC/E,gFAAgF;AAChF,iFAAiF;AACjF,iFAAiF;AACjF,wCAAwC;AACxC,MAAM,wBAAwB,GAAG,GAAG,CAAC;AASrC;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IACE,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAC5B,MAAM,CAAC,IAAI,KAAK,iBAAiB;YACjC,MAAM,CAAC,QAAQ,KAAK,eAAe;YACnC,MAAM,CAAC,MAAM,KAAK,EAAE;YACpB,MAAM,CAAC,IAAI,KAAK,EAAE;YAClB,MAAM,CAAC,QAAQ,KAAK,EAAE;YACtB,MAAM,CAAC,QAAQ,KAAK,EAAE,EACtB,CAAC;YACD,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QAC5E,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,aAAa,CAAC,IAAY,EAAE,SAAiB;IACpD,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,GAAG,uBAAuB,CAAC,CAAC;IAClF,MAAM,aAAa,GAAG,gBAAgB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC5D,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAChC,8EAA8E;IAC9E,6EAA6E;IAC7E,0CAA0C;IAC1C,MAAM,WAAW,GAAG,SAAS,GAAG,aAAa,CAAC,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC9E,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAClD,IAAI,SAAS,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,EAAE,SAAS,GAAG,CAAC,GAAG,wBAAwB,CAAC,CAAC;IACvF,+EAA+E;IAC/E,gFAAgF;IAChF,8CAA8C;IAC9C,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACnC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;AACrC,CAAC"}

package/dist/server/device-login-parse.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=device-login-parse.test.d.ts.map

package/dist/server/device-login-parse.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-login-parse.test.d.ts","sourceRoot":"","sources":["../../src/server/device-login-parse.test.ts"],"names":[],"mappings":""}