@tokensrc/codex 1.14.7 → 1.14.9

package/README.md

@@ -127,8 +127,7 @@ const codex = await createCodexModule({
   },
   persistence: { configDirectory: applicationConfigDirectory },
   desktopApp: {
-    inspect: inspectHostDesktopApp,
-    prepare: prepareHostDesktopApp
+    inspect: inspectHostDesktopApp
   }
 });
 
@@ -138,9 +137,9 @@ const remote = await codex.status.loadRemote();
 ```
 
 The optional `desktopApp.inspect` hook adds host-provided desktop version details
-to local and `status` output. `desktopApp.prepare` runs immediately before the
-official `codex app` command, allowing an embedding host to validate or deploy an
-approved desktop build without coupling package-generic code to one installer.
+to local and `status` output. The package never downloads, installs, replaces,
+upgrades, or downgrades a desktop application; `codex app` only prepares the
+selected official credentials and launches the existing official application.
 
 Hosts may instead inject a static access token or standalone OIDC settings, and
 can customize branding and launcher behavior. Injected access tokens and provider

package/assets/shortcut-bootstrap.cjs

@@ -0,0 +1,453 @@
+#!/usr/bin/env node
+"use strict";
+
+// NUMA_CODEX_SHORTCUT_BOOTSTRAP
+// This file is copied beside managed shortcuts. Keep it dependency-free.
+
+const fs = require("node:fs");
+const path = require("node:path");
+const { spawnSync } = require("node:child_process");
+
+const STATE_SCHEMA_VERSION = 1;
+const SUCCESS_CHECK_INTERVAL_MS = 0;
+const FAILURE_CHECK_INTERVAL_MS = 5 * 60 * 1000;
+const METADATA_TIMEOUT_MS = 8_000;
+const INSTALL_TIMEOUT_MS = 120_000;
+const LOCK_STALE_MS = 5 * 60 * 1000;
+
+function fail(message) {
+  process.stderr.write(`Numa shortcut: ${message}\n`);
+  process.exitCode = 1;
+}
+
+function warn(message) {
+  process.stderr.write(`Numa shortcut update skipped: ${message}\n`);
+}
+
+function plainObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function absoluteFile(value) {
+  return typeof value === "string" && value.length > 0 && path.isAbsolute(value);
+}
+
+function safeRegistry(value) {
+  try {
+    const parsed = new URL(value);
+    if (parsed.username || parsed.password || parsed.hash || parsed.search) return false;
+    if (parsed.protocol === "https:") return true;
+    return parsed.protocol === "http:" && ["localhost", "127.0.0.1", "::1"].includes(parsed.hostname);
+  } catch {
+    return false;
+  }
+}
+
+function safePackageName(value) {
+  return typeof value === "string"
+    && /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/u.test(value);
+}
+
+function safeCommandName(value) {
+  return typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9._-]*$/u.test(value);
+}
+
+function parseVersion(value) {
+  if (typeof value !== "string") return undefined;
+  const match = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/u.exec(value);
+  if (!match) return undefined;
+  return {
+    raw: value,
+    major: Number(match[1]),
+    minor: Number(match[2]),
+    patch: Number(match[3]),
+    prerelease: match[4] ? match[4].split(".") : []
+  };
+}
+
+function comparePrerelease(left, right) {
+  if (left.length === 0 || right.length === 0) return left.length === right.length ? 0 : left.length === 0 ? 1 : -1;
+  const length = Math.max(left.length, right.length);
+  for (let index = 0; index < length; index += 1) {
+    if (left[index] === undefined) return -1;
+    if (right[index] === undefined) return 1;
+    const leftNumber = /^\d+$/u.test(left[index]) ? Number(left[index]) : undefined;
+    const rightNumber = /^\d+$/u.test(right[index]) ? Number(right[index]) : undefined;
+    if (leftNumber !== undefined && rightNumber !== undefined && leftNumber !== rightNumber) {
+      return leftNumber < rightNumber ? -1 : 1;
+    }
+    if (leftNumber !== undefined && rightNumber === undefined) return -1;
+    if (leftNumber === undefined && rightNumber !== undefined) return 1;
+    if (left[index] !== right[index]) return left[index] < right[index] ? -1 : 1;
+  }
+  return 0;
+}
+
+function compareVersions(left, right) {
+  for (const field of ["major", "minor", "patch"]) {
+    if (left[field] !== right[field]) return left[field] < right[field] ? -1 : 1;
+  }
+  return comparePrerelease(left.prerelease, right.prerelease);
+}
+
+function readJson(file) {
+  try {
+    return JSON.parse(fs.readFileSync(file, "utf8"));
+  } catch {
+    return undefined;
+  }
+}
+
+function writeJsonAtomic(file, value) {
+  fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+  const temporary = `${file}.${process.pid}.tmp`;
+  try {
+    fs.writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+    if (process.platform === "win32") fs.rmSync(file, { force: true });
+    fs.renameSync(temporary, file);
+  } finally {
+    fs.rmSync(temporary, { force: true });
+  }
+}
+
+function loadConfig(file) {
+  const value = readJson(file);
+  if (!plainObject(value)
+    || value.schemaVersion !== 1
+    || typeof value.marker !== "string"
+    || !safePackageName(value.packageName)
+    || !safeCommandName(value.commandName)
+    || !safeRegistry(value.registryUrl)
+    || !parseVersion(value.installedVersion)
+    || !absoluteFile(value.nodeExecutable)
+    || (value.npmExecutable !== null && !absoluteFile(value.npmExecutable))
+    || (value.fallbackEntrypoint !== null && !absoluteFile(value.fallbackEntrypoint))
+    || !absoluteFile(value.cacheDirectory)) {
+    throw new Error(`invalid managed launcher configuration: ${file}`);
+  }
+  if (!fs.existsSync(value.nodeExecutable)) {
+    throw new Error("trusted Node.js runtime captured during shortcut installation is unavailable; reinstall the shortcut");
+  }
+  const configuredNode = fs.realpathSync(value.nodeExecutable);
+  const launchedNode = fs.realpathSync(process.execPath);
+  if (launchedNode !== configuredNode) {
+    throw new Error("managed shortcut was invoked by an unexpected Node.js runtime; reinstall the shortcut from a trusted terminal");
+  }
+  value.nodeExecutable = configuredNode;
+  value.npmExecutable = verifiedNpmCli(value.npmExecutable);
+  return value;
+}
+
+function verifiedNpmCli(file) {
+  if (!file || !fs.existsSync(file)) return null;
+  let actual;
+  try {
+    actual = fs.realpathSync(file);
+  } catch {
+    return null;
+  }
+  if (path.basename(actual).toLowerCase() !== "npm-cli.js") return null;
+  let current = path.dirname(actual);
+  const filesystemRoot = path.parse(current).root;
+  while (current !== filesystemRoot) {
+    const manifest = readJson(path.join(current, "package.json"));
+    if (manifest !== undefined) {
+      if (!plainObject(manifest) || manifest.name !== "npm") return null;
+      const declared = typeof manifest.bin === "string"
+        ? manifest.bin
+        : plainObject(manifest.bin) && typeof manifest.bin.npm === "string"
+          ? manifest.bin.npm
+          : undefined;
+      if (!declared || path.isAbsolute(declared)) return null;
+      try {
+        return fs.realpathSync(path.resolve(current, declared)) === actual ? actual : null;
+      } catch {
+        return null;
+      }
+    }
+    current = path.dirname(current);
+  }
+  return null;
+}
+
+function packageRoot(cacheDirectory, packageName, version) {
+  return path.join(cacheDirectory, "versions", version, "node_modules", ...packageName.split("/"));
+}
+
+function inside(parent, child) {
+  const relative = path.relative(parent, child);
+  return relative !== "" && !relative.startsWith(`..${path.sep}`) && relative !== ".." && !path.isAbsolute(relative);
+}
+
+function packageEntrypoint(root, packageName, version, commandName) {
+  const manifest = readJson(path.join(root, "package.json"));
+  if (!plainObject(manifest) || manifest.name !== packageName || manifest.version !== version) return undefined;
+  const declared = typeof manifest.bin === "string"
+    ? manifest.bin
+    : plainObject(manifest.bin) && typeof manifest.bin[commandName] === "string"
+      ? manifest.bin[commandName]
+      : undefined;
+  if (!declared || path.isAbsolute(declared)) return undefined;
+  const entrypoint = path.resolve(root, declared);
+  if (!inside(root, entrypoint) || !fs.existsSync(entrypoint)) return undefined;
+  try {
+    const realRoot = fs.realpathSync(root);
+    const realEntrypoint = fs.realpathSync(entrypoint);
+    return inside(realRoot, realEntrypoint) ? realEntrypoint : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function cachedEntrypoint(config, version) {
+  return packageEntrypoint(
+    packageRoot(config.cacheDirectory, config.packageName, version),
+    config.packageName,
+    version,
+    config.commandName
+  );
+}
+
+function fallbackEntrypoint(config) {
+  if (!config.fallbackEntrypoint || !fs.existsSync(config.fallbackEntrypoint)) return undefined;
+  let current = path.dirname(config.fallbackEntrypoint);
+  const filesystemRoot = path.parse(current).root;
+  while (current !== filesystemRoot) {
+    const manifest = readJson(path.join(current, "package.json"));
+    if (plainObject(manifest) && manifest.name === config.packageName && manifest.version === config.installedVersion) {
+      const declared = typeof manifest.bin === "string"
+        ? manifest.bin
+        : plainObject(manifest.bin) && typeof manifest.bin[config.commandName] === "string"
+          ? manifest.bin[config.commandName]
+          : undefined;
+      if (!declared) return undefined;
+      try {
+        return fs.realpathSync(path.resolve(current, declared)) === fs.realpathSync(config.fallbackEntrypoint)
+          ? fs.realpathSync(config.fallbackEntrypoint)
+          : undefined;
+      } catch {
+        return undefined;
+      }
+    }
+    current = path.dirname(current);
+  }
+  return undefined;
+}
+
+function npmInvocation(config, args, timeout) {
+  if (!config.npmExecutable || !fs.existsSync(config.npmExecutable)) {
+    return { status: null, error: new Error("npm executable captured during shortcut installation is unavailable") };
+  }
+  const javascriptCli = /\.(?:c?js|mjs)$/iu.test(config.npmExecutable);
+  const command = javascriptCli ? config.nodeExecutable : config.npmExecutable;
+  const commandArgs = javascriptCli ? [config.npmExecutable, ...args] : args;
+  return spawnSync(command, commandArgs, {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout,
+    windowsHide: true,
+    env: {
+      ...process.env,
+      PATH: `${path.dirname(config.nodeExecutable)}${path.delimiter}${process.env.PATH ?? ""}`,
+      npm_config_audit: "false",
+      npm_config_fund: "false",
+      npm_config_update_notifier: "false"
+    }
+  });
+}
+
+function latestVersion(config) {
+  const result = npmInvocation(config, [
+    "view",
+    `${config.packageName}@latest`,
+    "version",
+    "--json",
+    `--registry=${config.registryUrl}`
+  ], METADATA_TIMEOUT_MS);
+  if (result.error || result.status !== 0) {
+    throw result.error ?? new Error((result.stderr || "npm view failed").trim());
+  }
+  const value = JSON.parse(result.stdout);
+  const parsed = parseVersion(value);
+  if (!parsed) throw new Error("registry latest tag did not resolve to an exact semantic version");
+  return parsed;
+}
+
+function installExact(config, version) {
+  const finalDirectory = path.join(config.cacheDirectory, "versions", version);
+  const existing = cachedEntrypoint(config, version);
+  if (existing) return existing;
+  const staging = path.join(config.cacheDirectory, "staging", `${version}-${process.pid}-${Date.now()}`);
+  fs.mkdirSync(staging, { recursive: true, mode: 0o700 });
+  try {
+    const result = npmInvocation(config, [
+      "install",
+      "--ignore-scripts",
+      "--no-audit",
+      "--no-fund",
+      "--omit=dev",
+      "--no-package-lock",
+      "--no-save",
+      `--prefix=${staging}`,
+      `--registry=${config.registryUrl}`,
+      `${config.packageName}@${version}`
+    ], INSTALL_TIMEOUT_MS);
+    if (result.error || result.status !== 0) {
+      throw result.error ?? new Error((result.stderr || "npm install failed").trim());
+    }
+    const stagedRoot = path.join(staging, "node_modules", ...config.packageName.split("/"));
+    if (!packageEntrypoint(stagedRoot, config.packageName, version, config.commandName)) {
+      throw new Error("downloaded package identity, version, or executable does not match the requested release");
+    }
+    fs.mkdirSync(path.dirname(finalDirectory), { recursive: true, mode: 0o700 });
+    if (fs.existsSync(finalDirectory)) fs.rmSync(finalDirectory, { recursive: true, force: true });
+    fs.renameSync(staging, finalDirectory);
+    const verified = cachedEntrypoint(config, version);
+    if (!verified) throw new Error("installed release failed exact readback verification");
+    return verified;
+  } finally {
+    fs.rmSync(staging, { recursive: true, force: true });
+  }
+}
+
+function readState(config) {
+  const value = readJson(path.join(config.cacheDirectory, "state.json"));
+  if (!plainObject(value)
+    || value.schemaVersion !== STATE_SCHEMA_VERSION
+    || value.packageName !== config.packageName
+    || value.registryUrl !== config.registryUrl
+    || (value.knownGoodVersion !== null && !parseVersion(value.knownGoodVersion))
+    || !Number.isSafeInteger(value.nextCheckAt)
+    || value.nextCheckAt < 0) {
+    return {
+      schemaVersion: STATE_SCHEMA_VERSION,
+      packageName: config.packageName,
+      registryUrl: config.registryUrl,
+      knownGoodVersion: null,
+      nextCheckAt: 0
+    };
+  }
+  return value;
+}
+
+function writeState(config, state) {
+  writeJsonAtomic(path.join(config.cacheDirectory, "state.json"), state);
+}
+
+function acquireLock(config) {
+  const lock = path.join(config.cacheDirectory, "update.lock");
+  fs.mkdirSync(config.cacheDirectory, { recursive: true, mode: 0o700 });
+  try {
+    const descriptor = fs.openSync(lock, "wx", 0o600);
+    fs.writeFileSync(descriptor, `${process.pid}\n`);
+    return () => {
+      try { fs.closeSync(descriptor); } catch { /* already closed */ }
+      fs.rmSync(lock, { force: true });
+    };
+  } catch (error) {
+    if (error && error.code === "EEXIST") {
+      try {
+        if (Date.now() - fs.statSync(lock).mtimeMs > LOCK_STALE_MS) {
+          fs.rmSync(lock, { force: true });
+          return acquireLock(config);
+        }
+      } catch { /* another launcher owns or removed the lock */ }
+      return undefined;
+    }
+    throw error;
+  }
+}
+
+function refreshKnownGood(config, state) {
+  const release = acquireLock(config);
+  if (!release) return state;
+  try {
+    const current = readState(config);
+    if (Date.now() < current.nextCheckAt) return current;
+    const installed = parseVersion(config.installedVersion);
+    const known = current.knownGoodVersion ? parseVersion(current.knownGoodVersion) : undefined;
+    const floor = known && compareVersions(known, installed) > 0 ? known : installed;
+    try {
+      const latest = latestVersion(config);
+      if (compareVersions(latest, floor) < 0) {
+        warn(`registry latest ${latest.raw} is older than trusted ${floor.raw}; keeping the trusted release`);
+        const next = { ...current, nextCheckAt: Date.now() + SUCCESS_CHECK_INTERVAL_MS };
+        writeState(config, next);
+        return next;
+      }
+      installExact(config, latest.raw);
+      const next = {
+        ...current,
+        knownGoodVersion: latest.raw,
+        nextCheckAt: Date.now() + SUCCESS_CHECK_INTERVAL_MS
+      };
+      writeState(config, next);
+      return next;
+    } catch (error) {
+      warn(`${error instanceof Error ? error.message : String(error)}; using the last known-good local release`);
+      const next = { ...current, nextCheckAt: Date.now() + FAILURE_CHECK_INTERVAL_MS };
+      writeState(config, next);
+      return next;
+    }
+  } finally {
+    release();
+  }
+}
+
+function run(config, args) {
+  const state = refreshKnownGood(config, readState(config));
+  const installed = parseVersion(config.installedVersion);
+  const known = state.knownGoodVersion ? parseVersion(state.knownGoodVersion) : undefined;
+  const entrypoint = known && compareVersions(known, installed) >= 0
+    ? cachedEntrypoint(config, state.knownGoodVersion)
+    : undefined;
+  const fallbackAllowed = !known || compareVersions(known, installed) <= 0;
+  const selected = entrypoint ?? (fallbackAllowed ? fallbackEntrypoint(config) : undefined);
+  if (!selected) {
+    fail(known && compareVersions(known, installed) > 0
+      ? `trusted Numa ${known.raw} is unavailable or corrupt; refusing to downgrade to ${installed.raw}. Restore network access or reinstall the shortcut from a trusted terminal.`
+      : "no verified local Numa release is available. Re-run `npx -y --prefer-online @numa-tech/numa@latest codex shortcut install` from a terminal with Node and npm.");
+    return;
+  }
+  const child = spawnSync(config.nodeExecutable, [selected, ...args], {
+    stdio: "inherit",
+    windowsHide: false,
+    env: {
+      ...process.env,
+      PATH: `${path.dirname(config.nodeExecutable)}${path.delimiter}${process.env.PATH ?? ""}`
+    }
+  });
+  if (child.error) {
+    fail(`failed to start verified Numa release: ${child.error.message}`);
+    return;
+  }
+  process.exitCode = child.status === null ? 1 : child.status;
+}
+
+function main(argv = process.argv.slice(2)) {
+  const nodeVersion = /^(\d+)\.(\d+)\./u.exec(process.versions.node);
+  if (!nodeVersion || Number(nodeVersion[1]) < 20
+    || (Number(nodeVersion[1]) === 20 && Number(nodeVersion[2]) < 12)) {
+    fail(`Node.js 20.12 or newer is required; detected ${process.versions.node}`);
+    return;
+  }
+  if (argv.length < 1 || !absoluteFile(argv[0])) {
+    fail("managed launcher configuration path is missing or not absolute");
+    return;
+  }
+  try {
+    run(loadConfig(argv[0]), argv.slice(1));
+  } catch (error) {
+    fail(error instanceof Error ? error.message : String(error));
+  }
+}
+
+if (require.main === module) main();
+
+module.exports = {
+  compareVersions,
+  loadConfig,
+  main,
+  parseVersion,
+  safeRegistry
+};

package/dist/command-directory.js

@@ -6,8 +6,8 @@ const definitions = [
     { name: "upload", description: "Upload the legacy v1 local account pool", command: "codex upload [-u|--server <url>]", summary: "仅用于 v1 兼容账号批量导入；新账号统一运行 numa codex login 进入 v4 RT 池", access: "authenticated", examples: ["numa codex upload --storage ~/.codex/multi-auth/openai-codex-accounts.json"] },
     { name: "use", description: "Select an account and install official Codex credentials", command: "codex use [account]", summary: "选择服务端账号并写入官方 ChatGPT auth.json", access: "authenticated", examples: ["numa codex use acct_xxx"] },
     { name: "run", description: "Launch the official Codex CLI", command: "codex run [-s|--select-account|-a|--account <id>] [-u|--server <url>] [--] [codexArgs...]", summary: "选择或复用 ChatGPT 账号后启动官方 Codex；模型流量不经过宿主", access: "authenticated", examples: ["numa codex run -s", "numa codex run --account acct_xxx", "numa codex run -- exec \"完成长任务\""] },
-    { name: "app", description: "Launch the official Codex desktop app", command: "codex app [workspace] [-s|--select-account|-a|--account <id>] [-u|--server <url>]", summary: "检查批准版本并使用官方 ChatGPT 登录启动 macOS/Windows Codex 桌面 App", access: "authenticated", examples: ["numa codex app . -s", "numa codex app . --account acct_xxx"] },
-    { name: "shortcut", description: "Install or remove launcher shortcuts", command: "codex shortcut [install|remove] [-t|--target run|app|both] [-s|--select-account] [--no-cli-wrapper]", summary: "安装或删除 macOS/Windows 的自动更新 Numa launcher、Codex 快捷命令与桌面入口", access: "public", examples: ["numa codex shortcut install", "numa codex shortcut install --target app --workspace .", "numa codex shortcut remove"] },
+    { name: "app", description: "Launch the official Codex desktop app", command: "codex app [workspace] [-s|--select-account|-a|--account <id>] [-u|--server <url>]", summary: "准备官方 ChatGPT 登录并启动现有 macOS/Windows Codex 桌面 App；不安装或改动App版本", access: "authenticated", examples: ["numa codex app . -s", "numa codex app . --account acct_xxx"] },
+    { name: "shortcut", description: "Install or remove launcher shortcuts", command: "codex shortcut [install|remove] [-t|--target run|app|both] [-s|--select-account] [--no-cli-wrapper]", summary: "安装或删除macOS/Windows/Linux的原子自更新Numa launcher、Codex快捷命令与桌面入口", access: "public", examples: ["numa codex shortcut install", "numa codex shortcut install --target app --workspace .", "numa codex shortcut remove"] },
     { name: "auth-agent", description: "Continuously renew official Codex credentials", command: "codex auth-agent [account]", summary: "前台刷新短效 token 到官方 Codex 登录并输出完整状态日志", access: "authenticated", examples: ["numa codex auth-agent acct_xxx --replace-login", "numa codex auth-agent --replace-login --once"] },
     { name: "admin", description: "Manage server-side Codex accounts and assignments", command: "codex admin <accounts|assignments>", summary: "管理员查看账号与凭据版本、触发刷新，并管理 Keycloak 用户账号绑定", access: "authenticated", examples: ["numa codex admin accounts list", "numa codex admin accounts credential-versions acct_xxx", "numa codex admin accounts refresh acct_xxx", "numa codex admin assignments list", "numa codex admin assignments bind acct_xxx user-subject --default", "numa codex admin assignments unbind assignment_xxx"] },
     { name: "status", description: "Show selection, desktop app, and official credential status", command: "codex status", summary: "查看当前账号选择、ChatGPT Desktop 版本与官方 auth.json 状态", access: "public", examples: ["numa codex status --json"] },

package/dist/command-directory.js.map

@@ -1 +1 @@
-{"version":3,"file":"command-directory.js","sourceRoot":"","sources":["../src/command-directory.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,GAAsC;IACrD,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,wCAAwC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE;IACjM,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,oEAAoE,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,2DAA2D,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,kBAAkB,EAAE,+CAA+C,EAAE,iFAAiF,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE;IACjZ,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wCAAwC,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,uBAAuB,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE;IACpM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,+BAA+B,EAAE,OAAO,EAAE,gCAAgC,EAAE,OAAO,EAAE,qCAAqC,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,uDAAuD,CAAC,EAAE;IACvP,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,yCAAyC,EAAE,OAAO,EAAE,kCAAkC,EAAE,OAAO,EAAE,qDAAqD,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,4EAA4E,CAAC,EAAE;IAC1S,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,0DAA0D,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,gCAAgC,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,yBAAyB,CAAC,EAAE;IACnO,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,+BAA+B,EAAE,OAAO,EAAE,2FAA2F,EAAE,OAAO,EAAE,uCAAuC,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,mBAAmB,EAAE,mCAAmC,EAAE,kCAAkC,CAAC,EAAE;IACxV,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,uCAAuC,EAAE,OAAO,EAAE,mFAAmF,EAAE,OAAO,EAAE,qDAAqD,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,qBAAqB,EAAE,qCAAqC,CAAC,EAAE;IACtU,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,sCAAsC,EAAE,OAAO,EAAE,qGAAqG,EAAE,OAAO,EAAE,yDAAyD,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,6BAA6B,EAAE,wDAAwD,EAAE,4BAA4B,CAAC,EAAE;IAClZ,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,+CAA+C,EAAE,OAAO,EAAE,4BAA4B,EAAE,OAAO,EAAE,oCAAoC,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,gDAAgD,EAAE,8CAA8C,CAAC,EAAE;IACjT,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,mDAAmD,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,uCAAuC,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,gCAAgC,EAAE,wDAAwD,EAAE,4CAA4C,EAAE,mCAAmC,EAAE,mEAAmE,EAAE,oDAAoD,CAAC,EAAE;IACngB,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,6DAA6D,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,6CAA6C,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,0BAA0B,CAAC,EAAE;IACzO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,yCAAyC,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,gCAAgC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,kBAAkB,CAAC,EAAE;CACtL,CAAC;AAEX,MAAM,UAAU,2BAA2B,CACzC,OAAO,GAA2C,EAAE;IAEpD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;IACxE,OAAO,WAAW;SACf,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;SAClE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACd,GAAG,IAAI;QACP,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;QACvE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;KAC/E,CAAC,CAAC,CAAC;AACR,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,2BAA2B,EAAE,CAAC;AACrE,MAAM,CAAC,MAAM,8BAA8B,GAAG,2BAA2B,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC"}
+{"version":3,"file":"command-directory.js","sourceRoot":"","sources":["../src/command-directory.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,GAAsC;IACrD,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,wCAAwC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE;IACjM,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,oEAAoE,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,2DAA2D,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,kBAAkB,EAAE,+CAA+C,EAAE,iFAAiF,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE;IACjZ,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wCAAwC,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,uBAAuB,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE;IACpM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,+BAA+B,EAAE,OAAO,EAAE,gCAAgC,EAAE,OAAO,EAAE,qCAAqC,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,uDAAuD,CAAC,EAAE;IACvP,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,yCAAyC,EAAE,OAAO,EAAE,kCAAkC,EAAE,OAAO,EAAE,qDAAqD,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,4EAA4E,CAAC,EAAE;IAC1S,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,0DAA0D,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,gCAAgC,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,yBAAyB,CAAC,EAAE;IACnO,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,+BAA+B,EAAE,OAAO,EAAE,2FAA2F,EAAE,OAAO,EAAE,uCAAuC,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,mBAAmB,EAAE,mCAAmC,EAAE,kCAAkC,CAAC,EAAE;IACxV,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,uCAAuC,EAAE,OAAO,EAAE,mFAAmF,EAAE,OAAO,EAAE,6DAA6D,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,qBAAqB,EAAE,qCAAqC,CAAC,EAAE;IAC9U,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,sCAAsC,EAAE,OAAO,EAAE,qGAAqG,EAAE,OAAO,EAAE,4DAA4D,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,6BAA6B,EAAE,wDAAwD,EAAE,4BAA4B,CAAC,EAAE;IACrZ,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,+CAA+C,EAAE,OAAO,EAAE,4BAA4B,EAAE,OAAO,EAAE,oCAAoC,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,gDAAgD,EAAE,8CAA8C,CAAC,EAAE;IACjT,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,mDAAmD,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,uCAAuC,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,gCAAgC,EAAE,wDAAwD,EAAE,4CAA4C,EAAE,mCAAmC,EAAE,mEAAmE,EAAE,oDAAoD,CAAC,EAAE;IACngB,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,6DAA6D,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,6CAA6C,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,0BAA0B,CAAC,EAAE;IACzO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,yCAAyC,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,gCAAgC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,kBAAkB,CAAC,EAAE;CACtL,CAAC;AAEX,MAAM,UAAU,2BAA2B,CACzC,OAAO,GAA2C,EAAE;IAEpD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;IACxE,OAAO,WAAW;SACf,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;SAClE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACd,GAAG,IAAI;QACP,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;QACvE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;KAC/E,CAAC,CAAC,CAAC;AACR,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,2BAA2B,EAAE,CAAC;AACrE,MAAM,CAAC,MAAM,8BAA8B,GAAG,2BAA2B,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC"}

package/dist/commands.js

@@ -12,7 +12,7 @@ import { cleanupLegacyCodexProvider } from "./legacy-cleanup.js";
 import { executeCodexEnrollmentLogin } from "./enrollment-flow.js";
 import { executeCodexMigrationLoginBatch } from "./migration-login-batch.js";
 import { executeCodexShortLivedCredentialDelivery } from "./short-lived-delivery-flow.js";
-import { executeCodexTokenPoolV4Delivery, reportManagedCodexV3Credentials } from "./managed-credential-v3-flow.js";
+import { executeCodexTokenPoolV4Delivery, reconcilePendingManagedCodexV3Operation, reportManagedCodexV3Credentials } from "./managed-credential-v3-flow.js";
 import { resolveManagedCodexV3AssignmentTarget } from "./managed-credential-v3-assignment.js";
 import { executeCodexTokenPoolV4Login } from "./token-pool-v4-upload-flow.js";
 import { readManagedCodexV3State } from "./managed-credential-v3.js";
@@ -168,7 +168,7 @@ async function loadAccountData(deps, options = {}) {
         selectedAccountId: previous?.account.id ?? response.defaultAccountId ?? undefined
     };
 }
-async function chooseAccount(deps, requested, options = {}) {
+async function chooseAccount(deps, requested, options = {}, persistSelection = true) {
     const data = await loadAccountData(deps, options);
     const { response, selectedAccountId } = data;
     const previous = await loadCodexSelection(deps.config.persistence.configDirectory);
@@ -193,7 +193,7 @@ async function chooseAccount(deps, requested, options = {}) {
         ? previous.account.providerAccountId
         : undefined;
     const v3Assignment = data.v3Assignments?.items.find((item) => item.managedAccountId === account.id && item.assignmentId === account.accountId);
-    const selection = await saveCodexSelection(deps.config.persistence.configDirectory, {
+    const selectionInput = {
         serviceUrl: options.server ?? deps.config.connection.serverUrl,
         allowInsecurePoc: Boolean(options.insecurePoc || options.insecureHttp || deps.config.connection.allowInsecureHttp),
         account: v3Assignment ? {
@@ -220,9 +220,24 @@ async function chooseAccount(deps, requested, options = {}) {
             label: accountLabel,
             distributionMode: "SCHEMA_V1"
         }
-    });
+    };
+    // V4 callers stage the selection in memory and persist it only after the
+    // official auth.json has been installed and the delivery has been ACKed.
+    // This keeps a failed account switch from pointing selection at credentials
+    // that were never installed.
+    const selection = persistSelection
+        ? await saveCodexSelection(deps.config.persistence.configDirectory, selectionInput)
+        : { schemaVersion: 1, ...selectionInput, updatedAt: new Date().toISOString() };
     return { account, selection };
 }
+async function persistInstalledSelection(deps, installed) {
+    const selection = await saveCodexSelection(deps.config.persistence.configDirectory, {
+        serviceUrl: installed.selection.serviceUrl,
+        allowInsecurePoc: installed.selection.allowInsecurePoc,
+        account: installed.selection.account
+    });
+    return { ...installed, selection };
+}
 async function installCredentials(deps, selection, service) {
     const client = deps.clientFor(service);
     await cleanupLegacyCodexProvider(codexConfigPathForEnv(deps.env));
@@ -232,6 +247,13 @@ async function installCredentials(deps, selection, service) {
             || !selection.account.providerAccountId) {
             throw new CodexServiceError("The selected account is not a v4 token-pool assignment.", "codex_assignment_not_found", 404);
         }
+        await reconcilePendingManagedCodexV3Operation({
+            client,
+            tenantId: deps.config.connection.tenantId,
+            env: deps.env
+        });
+        // Recovery may ACK or renew a previous delivery and therefore advance the
+        // Server assignment tuple. Always fetch a fresh snapshot afterwards.
         const assignments = await client.listV3CredentialAssignments();
         const assignment = assignments.items.find((item) => item.assignmentId === selection.account.assignmentId
             && item.managedAccountId === selection.account.managedAccountId
@@ -301,10 +323,38 @@ async function installCredentials(deps, selection, service) {
 }
 async function selectedCredentials(deps, requested, options = {}) {
     if (accountTokenPoolV4Enabled(deps.config)) {
+        const client = deps.clientFor(serviceConnection(options));
+        const recovered = await reconcilePendingManagedCodexV3Operation({
+            client,
+            tenantId: deps.config.connection.tenantId,
+            env: deps.env
+        });
+        if (!requested && recovered) {
+            const assignments = await client.listV3CredentialAssignments();
+            const assignment = findV3Assignment({ assignments, ...recovered });
+            if (!assignment || assignment.currentGenerationVersion !== recovered.generationVersion
+                || assignment.authorityMode !== "CLIENT_MANAGED") {
+                throw new CodexServiceError("The recovered local v4 lineage no longer matches the server assignment.", "lineage_version_conflict", 409);
+            }
+            const selection = await saveCodexSelection(deps.config.persistence.configDirectory, {
+                serviceUrl: options.server ?? deps.config.connection.serverUrl,
+                allowInsecurePoc: Boolean(options.insecurePoc || options.insecureHttp || deps.config.connection.allowInsecureHttp),
+                account: {
+                    id: recovered.managedAccountId,
+                    accountId: recovered.providerAccountId,
+                    label: assignment.label,
+                    distributionMode: "CLIENT_MANAGED_V4",
+                    assignmentId: recovered.assignmentId,
+                    managedAccountId: recovered.managedAccountId,
+                    providerAccountId: recovered.providerAccountId
+                }
+            });
+            return { selection, expiresAt: Date.parse(recovered.credentialExpiresAt) };
+        }
         const state = await readManagedCodexV3State(deps.env);
         if (!state || state.phase !== "INSTALLED" || state.authorityMode !== "CLIENT_MANAGED") {
-            const selection = (await chooseAccount(deps, requested, options)).selection;
-            return installCredentials(deps, selection, serviceConnection(options));
+            const selection = (await chooseAccount(deps, requested, options, false)).selection;
+            return persistInstalledSelection(deps, await installCredentials(deps, selection, serviceConnection(options)));
         }
         if (requested && ![
             state.assignmentId,
@@ -312,10 +362,10 @@ async function selectedCredentials(deps, requested, options = {}) {
             state.providerAccountId,
             state.lineageId
         ].includes(requested)) {
-            const selection = (await chooseAccount(deps, requested, options)).selection;
-            return installCredentials(deps, selection, serviceConnection(options));
+            const selection = (await chooseAccount(deps, requested, options, false)).selection;
+            return persistInstalledSelection(deps, await installCredentials(deps, selection, serviceConnection(options)));
         }
-        const assignments = await deps.clientFor(serviceConnection(options)).listV3CredentialAssignments();
+        const assignments = await client.listV3CredentialAssignments();
         const assignment = findV3Assignment({ assignments, ...state });
         if (!assignment || assignment.assignmentId !== state.assignmentId
             || assignment.managedAccountId !== state.managedAccountId
@@ -524,8 +574,11 @@ export function registerCodexCommands(program, deps, options = {}) {
     });
     serviceOptions(codex.command("use [account]").description("Select an account and update the official Codex auth.json"))
         .action(async (account, opts, command) => {
-        const result = await chooseAccount(deps, account, opts);
-        await installCredentials(deps, result.selection, serviceConnection(opts));
+        const v4 = accountTokenPoolV4Enabled(deps.config);
+        const result = await chooseAccount(deps, account, opts, !v4);
+        const installed = await installCredentials(deps, result.selection, serviceConnection(opts));
+        if (v4)
+            await persistInstalledSelection(deps, installed);
         if (await json(command, deps))
             print(deps.output, success({ account: result.account, auth_mode: "chatgpt" }));
         else
@@ -542,7 +595,7 @@ export function registerCodexCommands(program, deps, options = {}) {
         deps.errorOutput.write(`Using ChatGPT account: ${selected.selection.account.label} (${selected.selection.account.id})\n`);
         process.exitCode = await launchWithSelectedCredentials(deps, selected, (signal) => deps.run(args, { signal }));
     });
-    serviceOptions(codex.command("app [workspace]").description("Validate and launch the official Codex desktop app"))
+    serviceOptions(codex.command("app [workspace]").description("Launch the existing official Codex desktop app without modifying its version"))
         .option("-a, --account <id>", "account id")
         .option("-s, --select-account", "select an account before launch")
         .action(async (workspace, opts) => {
@@ -576,9 +629,7 @@ export function registerCodexCommands(program, deps, options = {}) {
                     path: local.desktopApp.path ?? null,
                     bundle_id: local.desktopApp.bundleId ?? null,
                     version: local.desktopApp.version ?? null,
-                    build: local.desktopApp.build ?? null,
-                    target_version: local.desktopApp.targetVersion ?? null,
-                    remediation_required: local.desktopApp.remediationRequired ?? false
+                    build: local.desktopApp.build ?? null
                 } : null,
                 selection: local.selection ? {
                     account: local.selection.account,
@@ -592,7 +643,7 @@ export function registerCodexCommands(program, deps, options = {}) {
             deps.output.write(`Official ChatGPT login: ${local.officialAuthMatchesSelection ? "matched" : "not matched"}\n`);
             if (local.desktopApp) {
                 const desktop = !local.desktopApp.supported
-                    ? `not managed on ${local.desktopApp.platform}`
+                    ? `not available on ${local.desktopApp.platform}`
                     : local.desktopApp.installed
                         ? `${local.desktopApp.version ?? "unknown version"}${local.desktopApp.build ? ` (${local.desktopApp.build})` : ""}`
                         : "not installed";