@tokensrc/codex 1.14.21 → 1.14.23

package/dist/commands.js

@@ -1,6 +1,7 @@
 import { createHash, randomUUID } from "node:crypto";
 import { hostname } from "node:os";
 import { join } from "node:path";
+import { PACKAGE_VERSION } from "./branding.js";
 import { getStoragePath, loadAccounts, setStoragePath, setStoragePathDirect } from "codex-multi-auth/storage";
 import { normalizeCodexServiceUrl } from "./client.js";
 import { CodexServiceError } from "./errors.js";
@@ -19,7 +20,9 @@ import { clearCodexSelection, loadCodexSelection, saveCodexSelection } from "./s
 import { installCodexShortcuts, removeCodexShortcuts } from "./shortcuts.js";
 import { isCodexAccountAvailable, isCodexSubscriptionExpired, renderCodexAccountDashboard, selectCodexAccount } from "./tui.js";
 import { ensureCodexV6DeviceCredentials, reconcileCodexV6DeviceAccess, reportCodexV6DeviceCredentials, requireAvailableCodexV6DeviceAccess } from "./request-bound-device-v6-flow.js";
-import { resetCodexV6LocalState } from "./request-bound-device-v6-state.js";
+import { getOrCreateCodexInstallationId } from "./multi-device-v5-state.js";
+import { readCodexV6BindingState, resetCodexV6LocalState } from "./request-bound-device-v6-state.js";
+import { probeCodexV6OnlineCredentialHealth, reportCodexV6OnlineCredentialHealth } from "./request-bound-device-v6-health.js";
 export const NO_AVAILABLE_CHATGPT_ACCOUNT_MESSAGE = "当前用户没有绑定可用的 ChatGPT 账号。请前往 OA 系统提交 IT11 工单，申请独享或共享的 ChatGPT 个人账号。";
 const SCHEMA_V2_LEGACY_MANAGEMENT_DISABLED = "schema_v2_legacy_management_disabled";
 function findV3Assignment(input) {
@@ -36,6 +39,30 @@ async function json(command, deps) {
 function print(output, value) {
     output.write(`${JSON.stringify(value, null, 2)}\n`);
 }
+function safeDiagnostic(deps, stage, details = {}) {
+    if (!deps.safeStartupDiagnostics)
+        return;
+    const safeDetails = Object.fromEntries(Object.entries(details).filter(([, value]) => value !== undefined));
+    deps.errorOutput.write(`[numa-debug] ${JSON.stringify({ stage, ...safeDetails })}\n`);
+}
+async function withSafeDiagnostic(deps, stage, operation) {
+    const startedAt = Date.now();
+    safeDiagnostic(deps, `${stage}.started`);
+    try {
+        const result = await operation();
+        safeDiagnostic(deps, `${stage}.completed`, { elapsedMs: Date.now() - startedAt });
+        return result;
+    }
+    catch (error) {
+        const diagnostic = error;
+        safeDiagnostic(deps, `${stage}.failed`, {
+            elapsedMs: Date.now() - startedAt,
+            errorCode: typeof diagnostic?.code === "string" ? diagnostic.code : "command_failed",
+            httpStatus: typeof diagnostic?.status === "number" ? diagnostic.status : undefined
+        });
+        throw error;
+    }
+}
 function success(value) {
     return {
         schemaVersion: CODEX_DISTRIBUTION_SCHEMA_VERSION,
@@ -216,12 +243,113 @@ function formatV6UserBinding(binding) {
         + ` (${binding.installationId})  token-set=${binding.credentialLineageId ?? "WAITING"}`;
 }
 async function v6DeviceAccess(deps, options = {}, deviceLabel) {
-    return reconcileCodexV6DeviceAccess({
+    return withSafeDiagnostic(deps, "v6.device_access.reconcile", () => reconcileCodexV6DeviceAccess({
         client: deps.clientFor(serviceConnection(options)),
         tenantId: deps.config.connection.tenantId,
         env: deps.env,
         deviceLabel
+    }));
+}
+async function loadV6DeviceCandidates(deps, options = {}, onlineHealth) {
+    const client = deps.clientFor(serviceConnection(options));
+    const installationId = await getOrCreateCodexInstallationId(deps.env);
+    const [requests, directory, localBinding] = await Promise.all([
+        client.listV6AccountRequests(),
+        client.listAccounts(),
+        readCodexV6BindingState(deps.env)
+    ]);
+    const bindingLists = await Promise.all(requests.items.map(async (request) => ({
+        request,
+        bindings: (await client.listV6DeviceBindings(request.id)).items
+    })));
+    const allBindings = bindingLists.flatMap(({ bindings }) => bindings);
+    const replaced = new Set(allBindings
+        .filter((binding) => binding.predecessorBindingId !== null
+        && ["READY", "ACTIVE"].includes(binding.status))
+        .map((binding) => binding.predecessorBindingId));
+    const now = Date.now();
+    const candidates = [];
+    for (const { request, bindings } of bindingLists) {
+        for (const binding of bindings) {
+            if (binding.installationId !== installationId
+                || replaced.has(binding.id)
+                || !["READY", "ACTIVE", "REPLACEMENT_PENDING", "NEEDS_REAUTH"].includes(binding.status)
+                || binding.managedAccountId === null || binding.providerAccountId === null
+                || binding.credentialLineageId === null)
+                continue;
+            const directoryAccount = directory.accounts.find((account) => account.id === binding.managedAccountId || account.accountId === binding.providerAccountId);
+            const credentialExpired = binding.credentialExpiresAt === null
+                || !Number.isFinite(Date.parse(binding.credentialExpiresAt))
+                || Date.parse(binding.credentialExpiresAt) <= now + 60_000;
+            const serverRejected = binding.status === "NEEDS_REAUTH"
+                || binding.accessTokenHealth === "REJECTED"
+                || binding.refreshTokenHealth === "REJECTED";
+            const currentRejected = localBinding?.bindingId === binding.id
+                && onlineHealth !== undefined
+                && ["TOKEN_REVOKED", "AUTH_REJECTED", "CONNECTOR_TOKEN_REVOKED",
+                    "CONNECTOR_AUTH_REJECTED"].includes(onlineHealth.status);
+            const requestUsable = request.status === "APPROVED"
+                && ["AVAILABLE", "PARTIALLY_AVAILABLE"].includes(request.availability)
+                && request.validUntil !== null && Date.parse(request.validUntil) > now;
+            const available = requestUsable
+                && !credentialExpired && !serverRejected && !currentRejected;
+            candidates.push({
+                request,
+                binding,
+                account: {
+                    ...(directoryAccount ?? {
+                        id: binding.managedAccountId,
+                        accountId: binding.providerAccountId,
+                        label: binding.providerAccountId,
+                        isDefault: false
+                    }),
+                    // A binding is the selectable identity. The same managed account may
+                    // legitimately appear under more than one active Request.
+                    id: binding.id,
+                    accountId: binding.providerAccountId,
+                    isDefault: localBinding?.bindingId === binding.id,
+                    credentialStatus: available ? "AVAILABLE"
+                        : credentialExpired || serverRejected || currentRejected
+                            ? "NEEDS_REAUTH" : "TEMPORARILY_UNAVAILABLE",
+                    lineageStatus: available ? "ACTIVE" : "NEEDS_REAUTH"
+                }
+            });
+        }
+    }
+    return {
+        installationId,
+        candidates,
+        ...(localBinding ? { currentBindingId: localBinding.bindingId } : {})
+    };
+}
+async function selectV6DeviceCandidate(deps, requested, options = {}) {
+    const inventory = await loadV6DeviceCandidates(deps, options);
+    let resolvedRequest = requested;
+    if (requested) {
+        const matches = inventory.candidates.filter(({ request, binding, account }) => [
+            request.id,
+            binding.id,
+            binding.managedAccountId,
+            binding.providerAccountId,
+            binding.credentialLineageId,
+            account.label
+        ].includes(requested));
+        if (matches.length > 1)
+            throw new CodexServiceError(`账号选择 ${requested} 不唯一，请使用 Request ID 或 Binding ID。`, "codex_account_reference_ambiguous", 409);
+        if (matches.length === 1)
+            resolvedRequest = matches[0].binding.id;
+    }
+    const chosen = await selectCodexAccount(inventory.candidates.map(({ account }) => account), {
+        requested: resolvedRequest,
+        selectedAccountId: inventory.currentBindingId,
+        nonInteractiveCommand: "numa codex use",
+        noAvailableMessage: "当前设备没有可领取或可用的独立 Token Set。",
+        output: deps.errorOutput
     });
+    const candidate = inventory.candidates.find(({ binding }) => binding.id === chosen.id);
+    if (!candidate)
+        throw new CodexServiceError("选择的 Request/设备 Binding 已不在候选列表中。", "codex_device_binding_not_found", 404);
+    return candidate;
 }
 async function loadAccountData(deps, options = {}, allowV4Replacement = false) {
     const previous = await loadCodexSelection(deps.config.persistence.configDirectory);
@@ -409,32 +537,78 @@ async function installCredentials(deps, selection, service, allowV4Replacement =
 async function selectedCredentials(deps, requested, options = {}) {
     if (requestBoundDeviceCredentialsEnabled(deps.config)) {
         const client = deps.clientFor(serviceConnection(options));
-        const ensured = await ensureCodexV6DeviceCredentials({
+        const candidate = requested
+            ? await selectV6DeviceCandidate(deps, requested, options)
+            : undefined;
+        let ensured = await withSafeDiagnostic(deps, "v6.device_credentials.ensure", () => ensureCodexV6DeviceCredentials({
             client,
             tenantId: deps.config.connection.tenantId,
-            env: deps.env
-        });
+            env: deps.env,
+            ...(candidate ? { target: { request: candidate.request, binding: candidate.binding } } : {})
+        }));
         if (ensured.replacementDeferredWarningCode) {
             deps.errorOutput.write(`新设备 Token Set 暂时无法交付 (${ensured.replacementDeferredWarningCode})；`
                 + "本次继续使用尚有效的旧 Token Set，稍后会自动重试。\n");
         }
-        const binding = ensured.binding;
-        if (requested && ![
-            binding.id,
-            binding.requestId,
-            binding.managedAccountId,
-            binding.providerAccountId,
-            binding.credentialLineageId
-        ].includes(requested)) {
-            throw new CodexServiceError("当前设备只能使用管理员为它绑定的独立 Token Set。", "codex_device_binding_not_found", 404);
+        let binding = ensured.binding;
+        let health = await withSafeDiagnostic(deps, "v6.online_health.probe", () => probeCodexV6OnlineCredentialHealth({
+            env: deps.env,
+            fetch: deps.fetch
+        }));
+        const healthRejected = () => ["TOKEN_REVOKED", "AUTH_REJECTED", "CONNECTOR_TOKEN_REVOKED",
+            "CONNECTOR_AUTH_REJECTED"].includes(health.status);
+        let report;
+        if (healthRejected()) {
+            report = await reportCodexV6OnlineCredentialHealth({ client, health, env: deps.env });
+            if (report.replacementBinding) {
+                const replacementBinding = report.replacementBinding;
+                const request = (await client.getV6AccountRequest(replacementBinding.requestId)).request;
+                ensured = await withSafeDiagnostic(deps, "v6.device_credentials.replace", () => ensureCodexV6DeviceCredentials({
+                    client,
+                    tenantId: deps.config.connection.tenantId,
+                    env: deps.env,
+                    target: { request, binding: replacementBinding }
+                }));
+                binding = ensured.binding;
+                health = await withSafeDiagnostic(deps, "v6.online_health.replacement_probe", () => probeCodexV6OnlineCredentialHealth({ env: deps.env, fetch: deps.fetch }));
+                if (!healthRejected()) {
+                    deps.errorOutput.write(health.status === "HEALTHY"
+                        ? "已自动安装并验证服务端换发的新设备 Token Set。\n"
+                        : "已自动安装服务端换发的新设备 Token Set；在线探知结果暂不确定。\n");
+                }
+                else {
+                    report = await reportCodexV6OnlineCredentialHealth({ client, health, env: deps.env });
+                }
+            }
+        }
+        if (healthRejected()) {
+            const connectorOnly = health.status.startsWith("CONNECTOR_");
+            throw new CodexServiceError(`当前设备 Token Set 的${connectorOnly ? "关键 ChatGPT/connector 授权" : "主 Codex 授权"}`
+                + `已被上游拒绝${health.safeErrorCode ? ` (${health.safeErrorCode})` : ""}；`
+                + (report?.reported
+                    ? "失效状态已安全上报，系统将进入换发流程。"
+                    : `状态上报未完成${report?.warningCode ? ` (${report.warningCode}`
+                        + `${report.warningStatus ? `/HTTP-${report.warningStatus}` : ""})` : ""}；`)
+                + "服务器上的“已交付”不代表实时可用，请由管理员换发 Token Set。", ["TOKEN_REVOKED", "CONNECTOR_TOKEN_REVOKED"].includes(health.status)
+                ? "codex_device_token_revoked" : "codex_device_credential_rejected", (connectorOnly ? health.connectorHttpStatus : health.codexApiHttpStatus) ?? 401);
         }
+        if (["FORBIDDEN", "UNREACHABLE"].includes(health.status)) {
+            deps.errorOutput.write(`Codex 在线凭据探知暂不可用 (${health.status.toLowerCase()}`
+                + `${health.codexApiHttpStatus ? `, HTTP ${health.codexApiHttpStatus}` : ""})；本次仅依据本地与服务端证据继续。\n`);
+        }
+        const previous = await loadCodexSelection(deps.config.persistence.configDirectory);
+        const directoryAccount = candidate?.binding.id === binding.id ? candidate.account
+            : (await client.listAccounts()).accounts.find((account) => account.id === binding.managedAccountId || account.accountId === binding.providerAccountId);
+        const label = directoryAccount?.label
+            ?? (previous?.account.bindingId === binding.id ? previous.account.label : undefined)
+            ?? binding.providerAccountId;
         const selection = await saveCodexSelection(deps.config.persistence.configDirectory, {
             serviceUrl: options.server ?? deps.config.connection.serverUrl,
             allowInsecurePoc: Boolean(options.insecurePoc || options.insecureHttp || deps.config.connection.allowInsecureHttp),
             account: {
                 id: binding.managedAccountId,
                 accountId: binding.providerAccountId,
-                label: `${binding.deviceLabel} / ${binding.requestId}`,
+                label,
                 distributionMode: "REQUEST_BOUND_DEVICE_V6",
                 managedAccountId: binding.managedAccountId,
                 providerAccountId: binding.providerAccountId,
@@ -598,7 +772,11 @@ async function launchWithSelectedCredentials(deps, selected, launch) {
                 env: deps.env
             });
             if (!report.reported && report.warningCode) {
-                deps.errorOutput.write(`Codex 独立设备 Token 代际上报暂缓 (${report.warningCode})；其他设备不会受影响。\n`);
+                deps.errorOutput.write(`Codex 独立设备 Token 代际上报失败：stage=${report.warningStage ?? "UNKNOWN"}`
+                    + `${report.warningStatus ? `, HTTP ${report.warningStatus}` : ""}`
+                    + `, code=${report.warningCode}。`
+                    + `${report.pendingCredentialChange ? "已检测到本地代际变化，状态与重试证据均已保留；" : ""}`
+                    + "其他设备不会受影响。\n");
             }
         }
     }
@@ -653,6 +831,27 @@ export function registerCodexCommands(program, deps, options = {}) {
         ? program
         : program.command("codex").description("Select an account and launch the official Codex client");
     const includeAuthCommands = options.includeAuthCommands ?? options.nested === false;
+    codex.hook("preAction", (_command, actionCommand) => {
+        let serviceOrigin = deps.config.connection.serverUrl;
+        try {
+            serviceOrigin = new URL(serviceOrigin).origin;
+        }
+        catch {
+            serviceOrigin = "invalid";
+        }
+        safeDiagnostic(deps, "startup", {
+            cliVersion: PACKAGE_VERSION,
+            command: actionCommand.name(),
+            credentialModel: requestBoundDeviceCredentialsEnabled(deps.config)
+                ? "REQUEST_BOUND_DEVICE_V6"
+                : "LEGACY",
+            profileId: deps.config.profile?.profileId,
+            profileRevision: deps.config.profile?.revision,
+            environment: deps.config.profile?.environment,
+            profileStale: deps.config.profile?.stale,
+            serviceOrigin
+        });
+    });
     if (includeAuthCommands)
         codex.command("login").description("Log in with OIDC").action(async (_options, command) => {
             if (!deps.auth.login)
@@ -776,31 +975,45 @@ export function registerCodexCommands(program, deps, options = {}) {
     serviceOptions(codex.command("list").description("List available Codex accounts without downloading credentials"))
         .action(async (opts, command) => {
         if (requestBoundDeviceCredentialsEnabled(deps.config)) {
-            const client = deps.clientFor(serviceConnection(opts));
             const access = await v6DeviceAccess(deps, opts);
+            const localHealth = await probeCodexV6OnlineCredentialHealth({
+                env: deps.env,
+                fetch: deps.fetch
+            });
+            const rejected = ["TOKEN_REVOKED", "AUTH_REJECTED", "CONNECTOR_TOKEN_REVOKED",
+                "CONNECTOR_AUTH_REJECTED"].includes(localHealth.status);
+            const healthReport = rejected
+                ? await reportCodexV6OnlineCredentialHealth({
+                    client: deps.clientFor(serviceConnection(opts)),
+                    health: localHealth,
+                    env: deps.env
+                })
+                : undefined;
+            const inventory = await loadV6DeviceCandidates(deps, opts, localHealth);
             if (await json(command, deps)) {
                 print(deps.output, success({
                     credentialModel: "REQUEST_BOUND_DEVICE_V6",
                     installationId: access.installationId,
-                    ...access.response
+                    ...access.response,
+                    candidates: inventory.candidates.map(({ request, binding, account }) => ({
+                        request,
+                        binding,
+                        account
+                    })),
+                    localCredentialHealth: localHealth,
+                    ...(healthReport ? { localCredentialHealthReport: healthReport } : {})
                 }));
                 return;
             }
-            if (access.response.accessStatus !== "AVAILABLE") {
+            if (inventory.candidates.length === 0 && access.response.accessStatus !== "AVAILABLE") {
                 requireAvailableCodexV6DeviceAccess(access);
             }
-            const { binding } = requireAvailableCodexV6DeviceAccess(access);
-            const accountResult = await client.listAccounts();
-            const currentAccount = accountResult.accounts.find((account) => account.id === binding.managedAccountId || account.accountId === binding.providerAccountId);
-            if (!currentAccount)
-                throw new CodexServiceError("The request-bound ChatGPT account is absent from the user account directory.", "invalid_codex_service_response");
-            const availableAccount = {
-                ...currentAccount,
-                credentialStatus: "AVAILABLE",
-                lineageStatus: "ACTIVE"
-            };
-            deps.output.write(renderCodexAccountDashboard([availableAccount], availableAccount.id));
-            deps.output.write(`设备凭据  ${binding.status === "ACTIVE" || binding.status === "READY" ? "可用" : binding.status}\n`);
+            deps.output.write(renderCodexAccountDashboard(inventory.candidates.map(({ account }) => account), inventory.currentBindingId ?? access.response.binding?.id ?? undefined));
+            deps.output.write(`设备凭据  ${rejected ? "已失效，需换发" : "可用"}\n`);
+            if (healthReport?.reported)
+                deps.output.write(healthReport.replacementPending
+                    ? "失效状态已上报；同账号 Token Set 暂无库存，正在等待换发。\n"
+                    : "失效状态已上报；新的设备 Token Set 将在使用时自动换发。\n");
             if (access.response.migration === "AUTO_MIGRATED") {
                 deps.output.write("既有本机凭据已自动转换为该申请下的第一个独立设备绑定。\n");
             }
@@ -831,7 +1044,8 @@ export function registerCodexCommands(program, deps, options = {}) {
         if (requestBoundDeviceCredentialsEnabled(deps.config)) {
             if (opts.takeover)
                 throw new CodexServiceError("v6 每台设备使用独立 Token Set，不支持接管其他设备的凭据。", "codex_device_takeover_not_allowed", 409);
-            const selected = await selectedCredentials(deps, account, opts);
+            const target = account ?? (await selectV6DeviceCandidate(deps, undefined, opts)).binding.id;
+            const selected = await selectedCredentials(deps, target, opts);
             if (await json(command, deps))
                 print(deps.output, success({
                     account: selected.selection.account,
@@ -862,7 +1076,10 @@ export function registerCodexCommands(program, deps, options = {}) {
         .action(async (args, opts) => {
         if (opts.selectAccount)
             await clearCodexSelection(deps.config.persistence.configDirectory);
-        const selected = await selectedCredentials(deps, opts.account, opts);
+        const target = requestBoundDeviceCredentialsEnabled(deps.config) && opts.selectAccount
+            ? (await selectV6DeviceCandidate(deps, opts.account, opts)).binding.id
+            : opts.account;
+        const selected = await selectedCredentials(deps, target, opts);
         deps.errorOutput.write(`Using ChatGPT account: ${selected.selection.account.label} (${selected.selection.account.id})\n`);
         process.exitCode = await launchWithSelectedCredentials(deps, selected, (signal) => deps.run(args, { signal }));
     });
@@ -874,7 +1091,10 @@ export function registerCodexCommands(program, deps, options = {}) {
             throw new Error("官方 Codex 桌面 App 仅支持 macOS 和 Windows。");
         if (opts.selectAccount)
             await clearCodexSelection(deps.config.persistence.configDirectory);
-        const selected = await selectedCredentials(deps, opts.account, opts);
+        const target = requestBoundDeviceCredentialsEnabled(deps.config) && opts.selectAccount
+            ? (await selectV6DeviceCandidate(deps, opts.account, opts)).binding.id
+            : opts.account;
+        const selected = await selectedCredentials(deps, target, opts);
         deps.errorOutput.write(`Using ChatGPT account: ${selected.selection.account.label} (${selected.selection.account.id})\n`);
         process.exitCode = await launchWithSelectedCredentials(deps, selected, (signal) => deps.app(workspace, { signal }));
     });
@@ -976,13 +1196,18 @@ export function registerCodexCommands(program, deps, options = {}) {
                         ? "device_token_set.generation_reported"
                         : "device_token_set.current",
                     at: new Date().toISOString(),
-                    ...(result.warningCode ? { warningCode: result.warningCode } : {})
+                    ...(result.warningCode ? { warningCode: result.warningCode } : {}),
+                    ...(result.warningStage ? { warningStage: result.warningStage } : {}),
+                    ...(result.warningStatus ? { warningStatus: result.warningStatus } : {}),
+                    ...(result.pendingCredentialChange ? { pendingCredentialChange: true } : {})
                 };
                 if (await json(command, deps))
                     print(deps.output, success(event));
                 else
                     deps.output.write(`${event.at} ${event.level} ${event.event}`
-                        + `${result.warningCode ? ` (${result.warningCode})` : ""}; other devices unaffected\n`);
+                        + `${result.warningCode ? ` (${result.warningStage ?? "UNKNOWN"}`
+                            + `${result.warningStatus ? `/HTTP-${result.warningStatus}` : ""}`
+                            + `/${result.warningCode})` : ""}; other devices unaffected\n`);
                 if (opts.once)
                     break;
                 await new Promise((resolve) => setTimeout(resolve, interval));