@tokensrc/codex 1.14.16 → 1.14.17

package/dist/commands.js

@@ -16,7 +16,7 @@ import { executeCodexTokenPoolV4Delivery, reconcilePendingManagedCodexV3Operatio
 import { resolveManagedCodexV3AssignmentTarget } from "./managed-credential-v3-assignment.js";
 import { executeCodexTokenPoolV4Login } from "./token-pool-v4-upload-flow.js";
 import { readManagedCodexV3State } from "./managed-credential-v3.js";
-import { profileAccountTokenPoolV4Enabled, profileMultiDeviceCredentialSyncEnabled } from "./profile.js";
+import { profileAccountTokenPoolV4Enabled, profileMultiDeviceCredentialSyncEnabled, profileRequestBoundDeviceCredentialsEnabled } from "./profile.js";
 import { superviseCodexV5Credentials, synchronizeCodexV5SelectionOnce } from "./multi-device-v5-flow.js";
 import { executeCodexAssignmentRetirementLocalDelete } from "./retirement-flow.js";
 import { clearCodexSelection, loadCodexSelection, rememberCodexSelectionProviderAccount, saveCodexSelection } from "./selection.js";
@@ -24,6 +24,9 @@ import { installCodexShortcuts, removeCodexShortcuts } from "./shortcuts.js";
 import { isCodexAccountAvailable, isCodexSubscriptionExpired, renderCodexAccountDashboard, selectCodexAccount } from "./tui.js";
 import { readCodexShortLivedDeliveryJournal } from "./short-lived-delivery-journal.js";
 import { superviseCodexShortLivedCredentials } from "./credential-supervisor.js";
+import { ensureCodexV6DeviceCredentials, reconcileCodexV6DeviceAccess, reportCodexV6DeviceCredentials, requireAvailableCodexV6DeviceAccess } from "./request-bound-device-v6-flow.js";
+import { getOrCreateCodexInstallationId } from "./multi-device-v5-state.js";
+import { resetCodexV6LocalState } from "./request-bound-device-v6-state.js";
 export const NO_AVAILABLE_CHATGPT_ACCOUNT_MESSAGE = "当前用户没有绑定可用的 ChatGPT 账号。请前往 OA 系统提交 IT11 工单，申请独享或共享的 ChatGPT 个人账号。";
 // The Server refreshes a user-bound lineage only inside its final 60-second
 // credential safety window. Asking for a new delivery earlier would merely
@@ -69,14 +72,25 @@ function accountTokenPoolV4Enabled(config) {
 function multiDeviceCredentialSyncEnabled(config) {
     return profileMultiDeviceCredentialSyncEnabled(config.profile);
 }
+function requestBoundDeviceCredentialsEnabled(config) {
+    return profileRequestBoundDeviceCredentialsEnabled(config.profile);
+}
+function assertRequestBoundDeviceCredentialsEnabled(config) {
+    if (requestBoundDeviceCredentialsEnabled(config))
+        return;
+    throw new CodexServiceError("平台尚未启用请求绑定的独立设备 Token Set。", "codex_request_bound_device_v6_not_enabled", 409);
+}
 function codexConfigPathForEnv(env) {
     const codexHome = env.CODEX_HOME?.trim();
     return codexHome ? join(codexHome, "config.toml") : undefined;
 }
 function assertLegacyManagementEnabled(config) {
-    if (!schemaV2LifecycleEnabled(config))
+    const requestBound = requestBoundDeviceCredentialsEnabled(config);
+    if (!schemaV2LifecycleEnabled(config) && !requestBound)
         return;
-    throw new CodexServiceError("Schema-v2 user-bound credentials are enabled; legacy refresh-token pool management is disabled.", SCHEMA_V2_LEGACY_MANAGEMENT_DISABLED, 409);
+    throw new CodexServiceError(requestBound
+        ? "Request-bound per-device credentials are enabled; legacy direct assignment management is disabled."
+        : "Schema-v2 user-bound credentials are enabled; legacy refresh-token pool management is disabled.", SCHEMA_V2_LEGACY_MANAGEMENT_DISABLED, 409);
 }
 function assignmentCredentialStatus(assignment) {
     if (isCodexSubscriptionExpired(assignment))
@@ -175,6 +189,61 @@ function parseSubscriptionRenewalExpiry(value) {
     }
     return expiresAt;
 }
+function parseRequestInstant(value, option) {
+    const normalized = value.trim();
+    const timestamp = Date.parse(normalized);
+    if (!/(?:Z|[+-]\d{2}:\d{2})$/iu.test(normalized) || !Number.isFinite(timestamp)) {
+        throw new CodexServiceError(`${option} 必须是带时区的 ISO-8601 时间。`, "invalid_codex_account_request");
+    }
+    return new Date(timestamp).toISOString();
+}
+function parsePositiveInteger(value, option, maximum = 32) {
+    const parsed = Number.parseInt(value, 10);
+    if (!Number.isInteger(parsed) || parsed < 1 || parsed > maximum || String(parsed) !== value.trim()) {
+        throw new CodexServiceError(`${option} 必须是 1 到 ${maximum} 之间的整数。`, "invalid_codex_account_request");
+    }
+    return parsed;
+}
+function parseNonNegativeInteger(value, option) {
+    const parsed = Number.parseInt(value, 10);
+    if (!Number.isInteger(parsed) || parsed < 0 || String(parsed) !== value.trim()) {
+        throw new CodexServiceError(`${option} 必须是非负整数。`, "invalid_codex_account_request");
+    }
+    return parsed;
+}
+function v6Platform() {
+    return ["darwin", "linux", "win32"].includes(process.platform)
+        ? process.platform : "unknown";
+}
+function formatV6Request(request) {
+    const expiresAt = Date.parse(request.validUntil ?? request.requestedValidUntil);
+    const remainingDays = Math.ceil((expiresAt - Date.now()) / 86_400_000);
+    const expiryNotice = remainingDays <= 0 ? "EXPIRED"
+        : remainingDays <= 7 ? `URGENT:${remainingDays}d`
+            : remainingDays <= 30 ? `EXPIRING:${remainingDays}d` : `${remainingDays}d`;
+    return `${request.id}  ${request.status}/${request.availability}`
+        + `  user=${request.username} (${request.userSubject})`
+        + `  devices=${request.activeBindingCount}+${request.pendingBindingCount}`
+        + `/${request.approvedDeviceLimit ?? request.requestedDeviceCount}`
+        + `  valid-until=${request.validUntil ?? request.requestedValidUntil}`
+        + `  expiry=${expiryNotice}`
+        + `  version=${request.version}`;
+}
+function formatV6Binding(binding) {
+    return `${binding.id}  ${binding.status}  device=${binding.deviceLabel}`
+        + ` (${binding.installationId})  token-set=${binding.credentialLineageId ?? "WAITING"}`
+        + `${binding.accountExpiresAt ? `  account-expires=${binding.accountExpiresAt}` : ""}`
+        + `${binding.replacementDueAt ? `  replace-before=${binding.replacementDueAt}` : ""}`
+        + `${binding.predecessorBindingId ? `  replaces=${binding.predecessorBindingId}` : ""}`;
+}
+async function v6DeviceAccess(deps, options = {}, deviceLabel) {
+    return reconcileCodexV6DeviceAccess({
+        client: deps.clientFor(serviceConnection(options)),
+        tenantId: deps.config.connection.tenantId,
+        env: deps.env,
+        deviceLabel
+    });
+}
 async function loadAccountData(deps, options = {}, allowV4Replacement = false) {
     const previous = await loadCodexSelection(deps.config.persistence.configDirectory);
     if (accountTokenPoolV4Enabled(deps.config)) {
@@ -417,6 +486,45 @@ async function installCredentials(deps, selection, service, allowV4Replacement =
     return { expiresAt: response.expiresAt, selection };
 }
 async function selectedCredentials(deps, requested, options = {}) {
+    if (requestBoundDeviceCredentialsEnabled(deps.config)) {
+        const client = deps.clientFor(serviceConnection(options));
+        const ensured = await ensureCodexV6DeviceCredentials({
+            client,
+            tenantId: deps.config.connection.tenantId,
+            env: deps.env
+        });
+        if (ensured.replacementDeferredWarningCode) {
+            deps.errorOutput.write(`新设备 Token Set 暂时无法交付 (${ensured.replacementDeferredWarningCode})；`
+                + "本次继续使用尚有效的旧 Token Set，稍后会自动重试。\n");
+        }
+        const binding = ensured.binding;
+        if (requested && ![
+            binding.id,
+            binding.requestId,
+            binding.managedAccountId,
+            binding.providerAccountId,
+            binding.credentialLineageId
+        ].includes(requested)) {
+            throw new CodexServiceError("当前设备只能使用管理员为它绑定的独立 Token Set。", "codex_device_binding_not_found", 404);
+        }
+        const selection = await saveCodexSelection(deps.config.persistence.configDirectory, {
+            serviceUrl: options.server ?? deps.config.connection.serverUrl,
+            allowInsecurePoc: Boolean(options.insecurePoc || options.insecureHttp || deps.config.connection.allowInsecureHttp),
+            account: {
+                id: binding.managedAccountId,
+                accountId: binding.providerAccountId,
+                label: `${binding.deviceLabel} / ${binding.requestId}`,
+                distributionMode: "REQUEST_BOUND_DEVICE_V6",
+                managedAccountId: binding.managedAccountId,
+                providerAccountId: binding.providerAccountId,
+                requestId: binding.requestId,
+                bindingId: binding.id,
+                installationId: binding.installationId,
+                credentialLineageId: binding.credentialLineageId
+            }
+        });
+        return { selection, expiresAt: Date.parse(ensured.credentialExpiresAt) };
+    }
     if (accountTokenPoolV4Enabled(deps.config)) {
         const client = deps.clientFor(serviceConnection(options));
         const recovered = await reconcilePendingManagedCodexV3Operation({
@@ -592,6 +700,24 @@ async function selectedCredentials(deps, requested, options = {}) {
     return { selection, expiresAt: local.expiresAt };
 }
 async function launchWithSelectedCredentials(deps, selected, launch) {
+    if (requestBoundDeviceCredentialsEnabled(deps.config)) {
+        try {
+            return await launch();
+        }
+        finally {
+            const report = await reportCodexV6DeviceCredentials({
+                client: deps.clientFor({
+                    serverUrl: selected.selection.serviceUrl,
+                    allowInsecureHttp: selected.selection.allowInsecurePoc
+                }),
+                tenantId: deps.config.connection.tenantId,
+                env: deps.env
+            });
+            if (!report.reported && report.warningCode) {
+                deps.errorOutput.write(`Codex 独立设备 Token 代际上报暂缓 (${report.warningCode})；其他设备不会受影响。\n`);
+            }
+        }
+    }
     if (multiDeviceCredentialSyncEnabled(deps.config)) {
         const client = deps.clientFor({
             serverUrl: selected.selection.serviceUrl,
@@ -677,18 +803,25 @@ export function registerCodexCommands(program, deps, options = {}) {
             else
                 deps.output.write("Logged out.\n");
         });
-    if (!includeAuthCommands && accountTokenPoolV4Enabled(deps.config))
-        serviceOptions(codex.command("login")
-            .description("Run an isolated official Codex login and enroll an unbound or explicitly assigned credential"))
-            .option("--device-auth", "use the official Codex device authorization flow")
-            .option("--assign-to <username-or-email>", "assign by exact username or email instead of adding to the unbound pool")
-            .option("--assign-to-subject <uuid>", "assign directly to a canonical Keycloak subject UUID")
-            .option("--yes", "confirm direct subject assignment")
-            .action(async (opts, command) => {
+    if (!includeAuthCommands && accountTokenPoolV4Enabled(deps.config)) {
+        let managedLogin = serviceOptions(codex.command("login")
+            .description(requestBoundDeviceCredentialsEnabled(deps.config)
+            ? "Run an isolated official Codex login and add one complete token set to the unbound pool"
+            : "Run an isolated official Codex login and enroll an unbound or explicitly assigned credential"))
+            .option("--device-auth", "use the official Codex device authorization flow");
+        if (!requestBoundDeviceCredentialsEnabled(deps.config)) {
+            managedLogin = managedLogin
+                .option("--assign-to <username-or-email>", "assign by exact username or email instead of adding to the unbound pool")
+                .option("--assign-to-subject <uuid>", "assign directly to a canonical Keycloak subject UUID")
+                .option("--yes", "confirm direct subject assignment");
+        }
+        managedLogin.action(async (opts, command) => {
             if (!accountTokenPoolV4Enabled(deps.config)) {
                 throw new CodexServiceError("The Codex v4 account token pool is not enabled by the verified platform profile.", "codex_token_pool_v4_not_enabled", 409);
             }
-            const target = resolveManagedCodexV3AssignmentTarget(opts);
+            const target = requestBoundDeviceCredentialsEnabled(deps.config)
+                ? { mode: "UNBOUND_POOL" }
+                : resolveManagedCodexV3AssignmentTarget(opts);
             const result = await executeCodexTokenPoolV4Login({
                 client: deps.clientFor(serviceConnection(opts)),
                 tenantId: deps.config.connection.tenantId,
@@ -715,8 +848,131 @@ export function registerCodexCommands(program, deps, options = {}) {
             else
                 deps.output.write(`Codex credential uploaded to token pool; status=${result.status}, placement=${result.placement}.\n`);
         });
+    }
+    const requests = codex.command("request")
+        .description("Apply for Codex access and manage request-bound device token sets");
+    serviceOptions(requests.command("create")
+        .description("Submit an account request and identify this device as the initial binding candidate")
+        .requiredOption("--reason <text>", "申请原因，至少 5 个字符")
+        .requiredOption("--until <timestamp>", "申请有效期结束时间，必须包含时区")
+        .option("--devices <count>", "申请的设备数量", "1")
+        .option("--device-label <label>", "当前设备名称")
+        .option("--idempotency-key <key>", "重试时复用同一个幂等键"))
+        .action(async (opts, command) => {
+        assertRequestBoundDeviceCredentialsEnabled(deps.config);
+        const requestedValidUntil = parseRequestInstant(opts.until, "--until");
+        if (Date.parse(requestedValidUntil) <= Date.now())
+            throw new CodexServiceError("--until 必须晚于当前时间。", "invalid_codex_account_request");
+        const installationId = await getOrCreateCodexInstallationId(deps.env);
+        const clientRequestId = randomUUID();
+        const result = await deps.clientFor(serviceConnection(opts)).createV6AccountRequest({
+            schemaVersion: 6,
+            clientRequestId,
+            reason: opts.reason,
+            requestedDeviceCount: parsePositiveInteger(opts.devices, "--devices"),
+            requestedValidUntil,
+            initialDevice: {
+                installationId,
+                label: (opts.deviceLabel?.trim() || hostname() || "Codex device").slice(0, 128),
+                platform: v6Platform()
+            }
+        }, opts.idempotencyKey?.trim() || clientRequestId);
+        if (await json(command, deps))
+            print(deps.output, success({
+                ...result, installationId
+            }));
+        else
+            deps.output.write(`申请已提交：${formatV6Request(result.request)}\n`
+                + `首台设备候选：${installationId}。审批后每个设备将获得独立完整 Token Set。\n`);
+    });
+    serviceOptions(requests.command("list").description("List the current user's Codex account requests"))
+        .action(async (opts, command) => {
+        assertRequestBoundDeviceCredentialsEnabled(deps.config);
+        const result = await deps.clientFor(serviceConnection(opts)).listV6AccountRequests();
+        if (await json(command, deps))
+            print(deps.output, success(result));
+        else if (result.items.length === 0)
+            deps.output.write("当前用户没有 ChatGPT/Codex 账号申请。\n");
+        else
+            for (const item of result.items)
+                deps.output.write(`${formatV6Request(item)}\n`);
+    });
+    serviceOptions(requests.command("show <requestId>").description("Show one account request"))
+        .action(async (requestId, opts, command) => {
+        assertRequestBoundDeviceCredentialsEnabled(deps.config);
+        const result = await deps.clientFor(serviceConnection(opts)).getV6AccountRequest(requestId);
+        if (await json(command, deps))
+            print(deps.output, success(result));
+        else
+            deps.output.write(`${formatV6Request(result.request)}\n`);
+    });
+    serviceOptions(requests.command("bindings <requestId>")
+        .description("List independent device token-set bindings under one request"))
+        .action(async (requestId, opts, command) => {
+        assertRequestBoundDeviceCredentialsEnabled(deps.config);
+        const result = await deps.clientFor(serviceConnection(opts)).listV6DeviceBindings(requestId);
+        if (await json(command, deps))
+            print(deps.output, success(result));
+        else if (result.items.length === 0)
+            deps.output.write("该申请尚无设备绑定。\n");
+        else
+            for (const binding of result.items)
+                deps.output.write(`${formatV6Binding(binding)}\n`);
+    });
+    serviceOptions(requests.command("reconcile")
+        .description("Reconcile this installation and automatically adopt one legacy distributed token set")
+        .option("--device-label <label>", "当前设备名称"))
+        .action(async (opts, command) => {
+        assertRequestBoundDeviceCredentialsEnabled(deps.config);
+        const access = await v6DeviceAccess(deps, opts, opts.deviceLabel);
+        if (await json(command, deps))
+            print(deps.output, success({
+                installationId: access.installationId, ...access.response
+            }));
+        else if (access.response.accessStatus === "AVAILABLE") {
+            const { request, binding } = requireAvailableCodexV6DeviceAccess(access);
+            deps.output.write(`${formatV6Request(request)}\n设备绑定：${binding.id} (${binding.installationId})`
+                + `，迁移结果=${access.response.migration}。\n`);
+        }
+        else
+            requireAvailableCodexV6DeviceAccess(access);
+    });
+    serviceOptions(requests.command("cancel <requestId>")
+        .description("Cancel a still-submitted account request")
+        .requiredOption("--version <number>", "当前请求版本")
+        .option("--idempotency-key <key>", "重试时复用同一个幂等键"))
+        .action(async (requestId, opts, command) => {
+        assertRequestBoundDeviceCredentialsEnabled(deps.config);
+        const result = await deps.clientFor(serviceConnection(opts)).cancelV6AccountRequest(requestId, { schemaVersion: 6, expectedRequestVersion: parseNonNegativeInteger(opts.version, "--version") }, opts.idempotencyKey?.trim() || randomUUID());
+        if (await json(command, deps))
+            print(deps.output, success(result));
+        else
+            deps.output.write(`申请已取消：${formatV6Request(result.request)}\n`);
+    });
     serviceOptions(codex.command("list").description("List available Codex accounts without downloading credentials"))
         .action(async (opts, command) => {
+        if (requestBoundDeviceCredentialsEnabled(deps.config)) {
+            const access = await v6DeviceAccess(deps, opts);
+            if (await json(command, deps)) {
+                print(deps.output, success({
+                    credentialModel: "REQUEST_BOUND_DEVICE_V6",
+                    installationId: access.installationId,
+                    ...access.response
+                }));
+                return;
+            }
+            if (access.response.accessStatus !== "AVAILABLE") {
+                requireAvailableCodexV6DeviceAccess(access);
+            }
+            const { request, binding } = requireAvailableCodexV6DeviceAccess(access);
+            deps.output.write(`${formatV6Request(request)}\n`
+                + `${binding.id}  device=${binding.deviceLabel} (${binding.installationId})`
+                + `  token-set=${binding.credentialLineageId}  ${binding.status}\n`);
+            if (access.response.migration === "AUTO_MIGRATED") {
+                deps.output.write("既有本机凭据已自动转换为该申请下的第一个独立设备绑定。\n");
+            }
+            return;
+        }
         const { response: result, selectedAccountId, assignments, v3Assignments } = await loadAccountData(deps, opts);
         const hasAvailableAccount = result.accounts.some(isCodexAccountAvailable);
         const shouldRequestAccount = result.accounts.length === 0
@@ -739,6 +995,21 @@ export function registerCodexCommands(program, deps, options = {}) {
     serviceOptions(codex.command("use [account]").description("Select an account and update the official Codex auth.json"))
         .option("--takeover", "explicitly replace a v4 credential active on another host")
         .action(async (account, opts, command) => {
+        if (requestBoundDeviceCredentialsEnabled(deps.config)) {
+            if (opts.takeover)
+                throw new CodexServiceError("v6 每台设备使用独立 Token Set，不支持接管其他设备的凭据。", "codex_device_takeover_not_allowed", 409);
+            const selected = await selectedCredentials(deps, account, opts);
+            if (await json(command, deps))
+                print(deps.output, success({
+                    account: selected.selection.account,
+                    auth_mode: "chatgpt",
+                    credential_model: "REQUEST_BOUND_DEVICE_V6"
+                }));
+            else
+                deps.output.write(`已安装当前设备的独立 Token Set：${selected.selection.account.label}`
+                    + ` (${selected.selection.account.bindingId})\n`);
+            return;
+        }
         const v4 = accountTokenPoolV4Enabled(deps.config);
         if (opts.takeover && !v4)
             throw new CodexServiceError("Credential takeover requires the v4 token-pool capability.", "codex_token_pool_v4_not_enabled", 409);
@@ -825,6 +1096,7 @@ export function registerCodexCommands(program, deps, options = {}) {
         if (schemaV2LifecycleEnabled(deps.config))
             await discardCodexFileCredentialBackup(deps.env);
         const auth = await resetManagedCodexFileCredentials(selection?.account.providerAccountId ?? selection?.account.accountId, deps.env);
+        await resetCodexV6LocalState(deps.env);
         await clearCodexSelection(deps.config.persistence.configDirectory);
         if (await json(command, deps))
             print(deps.output, success({ reset: true, auth_action: auth.action, legacy_provider_removed: cleanup.changed }));
@@ -852,6 +1124,40 @@ export function registerCodexCommands(program, deps, options = {}) {
             throw new Error("auth-agent replaces the current login; add --replace-login to confirm.");
         if (opts.credentialStore !== "file")
             throw new Error("ChatGPT auth.json 同步目前仅支持 --credential-store file。");
+        if (requestBoundDeviceCredentialsEnabled(deps.config)) {
+            const interval = Number(opts.interval) * 1_000;
+            if (!Number.isFinite(interval) || interval <= 0)
+                throw new Error("--interval must be positive.");
+            do {
+                await ensureCodexV6DeviceCredentials({
+                    client: deps.clientFor(serviceConnection(opts)),
+                    tenantId: deps.config.connection.tenantId,
+                    env: deps.env
+                });
+                const result = await reportCodexV6DeviceCredentials({
+                    client: deps.clientFor(serviceConnection(opts)),
+                    tenantId: deps.config.connection.tenantId,
+                    env: deps.env
+                });
+                const event = {
+                    level: result.warningCode ? "WARN" : "INFO",
+                    event: result.reported
+                        ? "device_token_set.generation_reported"
+                        : "device_token_set.current",
+                    at: new Date().toISOString(),
+                    ...(result.warningCode ? { warningCode: result.warningCode } : {})
+                };
+                if (await json(command, deps))
+                    print(deps.output, success(event));
+                else
+                    deps.output.write(`${event.at} ${event.level} ${event.event}`
+                        + `${result.warningCode ? ` (${result.warningCode})` : ""}; other devices unaffected\n`);
+                if (opts.once)
+                    break;
+                await new Promise((resolve) => setTimeout(resolve, interval));
+            } while (true);
+            return;
+        }
         if (accountTokenPoolV4Enabled(deps.config)) {
             const interval = Number(opts.interval) * 1_000;
             if (!Number.isFinite(interval) || interval <= 0)
@@ -1112,6 +1418,166 @@ export function registerCodexCommands(program, deps, options = {}) {
     }
     const admin = codex.command("admin")
         .description("Administer server-managed Codex accounts and assignments");
+    const adminRequests = admin.command("requests")
+        .description("Review account requests and create independent device token-set bindings");
+    serviceOptions(adminRequests.command("list").description("List tenant requests, ordered by nearest expiry")
+        .option("--expiring-within <days>", "只显示指定天数内到期的非终态申请"))
+        .action(async (opts, command) => {
+        assertRequestBoundDeviceCredentialsEnabled(deps.config);
+        const expiresBefore = opts.expiringWithin
+            ? new Date(Date.now() + parsePositiveInteger(opts.expiringWithin, "--expiring-within", 3_650) * 86_400_000).toISOString()
+            : undefined;
+        const result = await deps.clientFor(serviceConnection(opts)).listV6AdminAccountRequests(expiresBefore ? { expiresBefore, includeTerminal: false } : {});
+        const items = [...result.items].sort((left, right) => Date.parse(left.validUntil ?? left.requestedValidUntil) - Date.parse(right.validUntil ?? right.requestedValidUntil));
+        if (await json(command, deps))
+            print(deps.output, success({ ...result, items }));
+        else if (items.length === 0)
+            deps.output.write(opts.expiringWithin
+                ? `未来 ${opts.expiringWithin} 天内没有即将到期的 ChatGPT/Codex 申请。\n`
+                : "当前租户没有 ChatGPT/Codex 账号申请。\n");
+        else
+            for (const item of items)
+                deps.output.write(`${formatV6Request(item)}\n`);
+    });
+    serviceOptions(adminRequests.command("replacement-candidates")
+        .description("List device bindings whose ChatGPT account needs pre-expiry replacement")
+        .option("--within <days>", "替换观察窗口天数", "30"))
+        .action(async (opts, command) => {
+        assertRequestBoundDeviceCredentialsEnabled(deps.config);
+        const replaceBefore = new Date(Date.now() + parsePositiveInteger(opts.within, "--within", 3_650) * 86_400_000).toISOString();
+        const result = await deps.clientFor(serviceConnection(opts))
+            .listV6AdminReplacementCandidates({ replaceBefore });
+        const items = [...result.items].sort((left, right) => Date.parse(left.replaceBefore) - Date.parse(right.replaceBefore));
+        if (await json(command, deps))
+            print(deps.output, success({ ...result, items }));
+        else if (items.length === 0) {
+            deps.output.write(`未来 ${opts.within} 天没有需要提前替换的设备账号。\n`);
+        }
+        else
+            for (const item of items) {
+                deps.output.write(`${item.recommendedReason}  replace-before=${item.replaceBefore}  `
+                    + `request=${item.request.id}  ${formatV6Binding(item.binding)}\n`);
+            }
+    });
+    serviceOptions(adminRequests.command("show <requestId>").description("Show one tenant account request"))
+        .action(async (requestId, opts, command) => {
+        assertRequestBoundDeviceCredentialsEnabled(deps.config);
+        const client = deps.clientFor(serviceConnection(opts));
+        const [requestResult, bindingResult] = await Promise.all([
+            client.getV6AdminAccountRequest(requestId),
+            client.listV6AdminDeviceBindings(requestId)
+        ]);
+        if (await json(command, deps))
+            print(deps.output, success({
+                request: requestResult.request, bindings: bindingResult.items
+            }));
+        else {
+            deps.output.write(`${formatV6Request(requestResult.request)}\n`);
+            for (const binding of bindingResult.items) {
+                deps.output.write(`- ${formatV6Binding(binding)}\n`);
+            }
+        }
+    });
+    serviceOptions(adminRequests.command("review <requestId>")
+        .description("Approve or reject an account request")
+        .requiredOption("--decision <decision>", "APPROVE 或 REJECT")
+        .requiredOption("--reason <text>", "审批原因，至少 5 个字符")
+        .requiredOption("--version <number>", "当前请求版本")
+        .option("--device-limit <count>", "批准的设备数量")
+        .option("--valid-from <timestamp>", "批准生效时间，必须包含时区")
+        .option("--valid-until <timestamp>", "批准到期时间，必须包含时区")
+        .option("--idempotency-key <key>", "重试时复用同一个幂等键"))
+        .action(async (requestId, opts, command) => {
+        assertRequestBoundDeviceCredentialsEnabled(deps.config);
+        const decision = opts.decision.trim().toUpperCase();
+        if (!["APPROVE", "REJECT"].includes(decision)) {
+            throw new CodexServiceError("--decision 必须是 APPROVE 或 REJECT。", "invalid_codex_account_request_review");
+        }
+        const approve = decision === "APPROVE";
+        if (approve && (!opts.deviceLimit || !opts.validFrom || !opts.validUntil)) {
+            throw new CodexServiceError("批准申请必须同时提供 --device-limit、--valid-from 和 --valid-until。", "invalid_codex_account_request_review");
+        }
+        const validFrom = approve ? parseRequestInstant(opts.validFrom, "--valid-from") : null;
+        const validUntil = approve ? parseRequestInstant(opts.validUntil, "--valid-until") : null;
+        if (validFrom && validUntil && Date.parse(validUntil) <= Date.parse(validFrom)) {
+            throw new CodexServiceError("--valid-until 必须晚于 --valid-from。", "invalid_codex_account_request_review");
+        }
+        const result = await deps.clientFor(serviceConnection(opts)).reviewV6AdminAccountRequest(requestId, {
+            schemaVersion: 6,
+            expectedRequestVersion: parseNonNegativeInteger(opts.version, "--version"),
+            decision: decision,
+            reason: opts.reason,
+            approvedDeviceLimit: approve
+                ? parsePositiveInteger(opts.deviceLimit, "--device-limit") : null,
+            validFrom,
+            validUntil
+        }, opts.idempotencyKey?.trim() || randomUUID());
+        if (await json(command, deps))
+            print(deps.output, success(result));
+        else
+            deps.output.write(`审批完成：${formatV6Request(result.request)}\n`);
+    });
+    serviceOptions(adminRequests.command("bind-device <requestId>")
+        .description("Bind another installation with its own independent complete token set")
+        .requiredOption("--installation <id>", "用户设备上显示的 installationId")
+        .requiredOption("--device-label <label>", "设备名称")
+        .requiredOption("--version <number>", "当前请求版本")
+        .option("--platform <platform>", "darwin|linux|win32|unknown", "unknown")
+        .option("--pool-entry <id>", "立即预留的独立 Token Pool entry；省略则进入等待")
+        .option("--idempotency-key <key>", "重试时复用同一个幂等键"))
+        .action(async (requestId, opts, command) => {
+        assertRequestBoundDeviceCredentialsEnabled(deps.config);
+        const platform = opts.platform.trim().toLowerCase();
+        if (!["darwin", "linux", "win32", "unknown"]
+            .includes(platform)) {
+            throw new CodexServiceError("--platform 必须是 darwin、linux、win32 或 unknown。", "invalid_codex_device_binding");
+        }
+        const result = await deps.clientFor(serviceConnection(opts)).createV6AdminDeviceBinding(requestId, {
+            schemaVersion: 6,
+            expectedRequestVersion: parseNonNegativeInteger(opts.version, "--version"),
+            device: {
+                installationId: opts.installation,
+                label: opts.deviceLabel,
+                platform: platform
+            },
+            poolEntryId: opts.poolEntry?.trim() || null
+        }, opts.idempotencyKey?.trim() || randomUUID());
+        if (await json(command, deps))
+            print(deps.output, success(result));
+        else
+            deps.output.write(`设备已绑定：${result.binding.id}  installation=${result.binding.installationId}`
+                + `  token-set=${result.binding.credentialLineageId ?? "WAITING_FOR_TOKEN"}\n`);
+    });
+    serviceOptions(adminRequests.command("replace-device-token <requestId> <bindingId>")
+        .description("Prepare an independent successor token set and switch only after device ACK")
+        .requiredOption("--version <number>", "当前请求版本")
+        .requiredOption("--reason <reason>", "SUBSCRIPTION_EXPIRING、CREDENTIAL_UNHEALTHY 或 ADMIN_REQUESTED")
+        .requiredOption("--replace-before <timestamp>", "最迟替换时间，必须包含时区")
+        .option("--pool-entry <id>", "立即预留的新独立 Token Pool entry；省略则进入等待")
+        .option("--idempotency-key <key>", "重试时复用同一个幂等键"))
+        .action(async (requestId, bindingId, opts, command) => {
+        assertRequestBoundDeviceCredentialsEnabled(deps.config);
+        const reason = opts.reason.trim().toUpperCase();
+        if (!["SUBSCRIPTION_EXPIRING", "CREDENTIAL_UNHEALTHY", "ADMIN_REQUESTED"]
+            .includes(reason)) {
+            throw new CodexServiceError("--reason 必须是 SUBSCRIPTION_EXPIRING、CREDENTIAL_UNHEALTHY 或 ADMIN_REQUESTED。", "invalid_codex_device_replacement");
+        }
+        const result = await deps.clientFor(serviceConnection(opts)).replaceV6AdminDeviceToken(requestId, bindingId, {
+            schemaVersion: 6,
+            expectedRequestVersion: parseNonNegativeInteger(opts.version, "--version"),
+            reason: reason,
+            replaceBefore: parseRequestInstant(opts.replaceBefore, "--replace-before"),
+            poolEntryId: opts.poolEntry?.trim() || null
+        }, opts.idempotencyKey?.trim() || randomUUID());
+        if (await json(command, deps))
+            print(deps.output, success(result));
+        else
+            deps.output.write("已准备设备 Token 替换：current=" + result.currentBinding.id
+                + " successor=" + result.replacementBinding.id
+                + " status=" + result.replacementBinding.status
+                + " token-set=" + (result.replacementBinding.credentialLineageId ?? "WAITING_FOR_TOKEN")
+                + "。\n旧 Token Set 会保持有效，直到该设备安装并 ACK 新 Token Set。\n");
+    });
     const adminAccounts = admin.command("accounts")
         .description("Inspect accounts, credential history, and refresh state");
     serviceOptions(adminAccounts.command("list").description("List all tenant Codex accounts"))