@victor-software-house/pi-multicodex 2.1.3 → 2.1.5

package/account-manager.ts

@@ -313,6 +313,42 @@ export class AccountManager {
 		);
 	}
 
+	private getLinkedImportedAccount(): Account | undefined {
+		return this.data.accounts.find(
+			(account) =>
+				account.importSource === "pi-openai-codex" &&
+				account.importMode !== "synthetic",
+		);
+	}
+
+	private getSyntheticImportedAccount(): Account | undefined {
+		return this.data.accounts.find(
+			(account) =>
+				account.importSource === "pi-openai-codex" &&
+				account.importMode === "synthetic",
+		);
+	}
+
+	private findManagedImportedTarget(imported: {
+		identifier: string;
+		credentials: OAuthCredentials;
+	}): Account | undefined {
+		const byRefreshToken = this.data.accounts.find(
+			(account) =>
+				account.importMode !== "synthetic" &&
+				account.refreshToken === imported.credentials.refresh,
+		);
+		if (byRefreshToken) {
+			return byRefreshToken;
+		}
+
+		return this.data.accounts.find(
+			(account) =>
+				account.importMode !== "synthetic" &&
+				account.email === imported.identifier,
+		);
+	}
+
 	private clearImportedLink(account: Account): boolean {
 		let changed = false;
 		if (account.importSource) {
@@ -334,15 +370,18 @@ export class AccountManager {
 		const imported = await loadImportedOpenAICodexAuth();
 		if (!imported) return false;
 
-		const existingImported = this.getImportedAccount();
-		if (existingImported?.importFingerprint === imported.fingerprint) {
+		const linkedImported = this.getLinkedImportedAccount();
+		const syntheticImported = this.getSyntheticImportedAccount();
+		const currentImported = linkedImported ?? syntheticImported;
+		if (
+			currentImported?.importFingerprint === imported.fingerprint &&
+			(currentImported.importMode !== "synthetic" ||
+				currentImported.email === imported.identifier)
+		) {
 			return false;
 		}
 
-		const matchingAccount = this.findAccountByRefreshToken(
-			imported.credentials.refresh,
-			existingImported?.email,
-		);
+		const matchingAccount = this.findManagedImportedTarget(imported);
 		if (matchingAccount) {
 			let changed = this.applyCredentials(
 				matchingAccount,
@@ -353,12 +392,11 @@ export class AccountManager {
 					importFingerprint: imported.fingerprint,
 				},
 			);
-			if (existingImported && existingImported !== matchingAccount) {
-				if (existingImported.importMode === "synthetic") {
-					changed = this.removeAccountRecord(existingImported) || changed;
-				} else {
-					changed = this.clearImportedLink(existingImported) || changed;
-				}
+			if (linkedImported && linkedImported !== matchingAccount) {
+				changed = this.clearImportedLink(linkedImported) || changed;
+			}
+			if (syntheticImported) {
+				changed = this.removeAccountRecord(syntheticImported) || changed;
 			}
 			if (changed) {
 				this.save();
@@ -367,17 +405,24 @@ export class AccountManager {
 			return changed;
 		}
 
-		if (existingImported?.importMode === "synthetic") {
-			const target = this.getAccount(imported.identifier);
+		if (linkedImported) {
+			const changed = this.clearImportedLink(linkedImported);
+			if (changed) {
+				this.save();
+				this.notifyStateChanged();
+			}
+		}
+
+		if (syntheticImported) {
 			let changed = false;
-			if (!target && existingImported.email !== imported.identifier) {
+			if (syntheticImported.email !== imported.identifier) {
 				changed = this.updateAccountEmail(
-					existingImported,
+					syntheticImported,
 					imported.identifier,
 				);
 			}
 			changed =
-				this.applyCredentials(existingImported, imported.credentials, {
+				this.applyCredentials(syntheticImported, imported.credentials, {
 					importSource: "pi-openai-codex",
 					importMode: "synthetic",
 					importFingerprint: imported.fingerprint,
@@ -389,14 +434,6 @@ export class AccountManager {
 			return changed;
 		}
 
-		if (existingImported) {
-			const changed = this.clearImportedLink(existingImported);
-			if (changed) {
-				this.save();
-				this.notifyStateChanged();
-			}
-		}
-
 		this.addOrUpdateAccount(imported.identifier, imported.credentials, {
 			importSource: "pi-openai-codex",
 			importMode: "synthetic",

package/auth.ts

@@ -45,7 +45,44 @@ function getRequiredString(
 	return typeof value === "string" && value.trim() ? value.trim() : undefined;
 }
 
-function createImportedIdentifier(accountId: string): string {
+function decodeJwtPayload(token: string): Record<string, unknown> | undefined {
+	const parts = token.split(".");
+	if (parts.length !== 3) return undefined;
+	const payload = parts[1];
+	if (!payload) return undefined;
+	try {
+		const normalized = payload.replace(/-/g, "+").replace(/_/g, "/");
+		const padded = normalized.padEnd(
+			normalized.length + ((4 - (normalized.length % 4)) % 4),
+			"=",
+		);
+		const decoded = Buffer.from(padded, "base64").toString("utf8");
+		const parsed = JSON.parse(decoded) as unknown;
+		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+			return undefined;
+		}
+		return parsed as Record<string, unknown>;
+	} catch {
+		return undefined;
+	}
+}
+
+function getProfileEmail(accessToken: string): string | undefined {
+	const payload = decodeJwtPayload(accessToken);
+	const profile = payload?.["https://api.openai.com/profile"];
+	if (!profile || typeof profile !== "object" || Array.isArray(profile)) {
+		return undefined;
+	}
+	const email = (profile as Record<string, unknown>).email;
+	return typeof email === "string" && email.trim() ? email.trim() : undefined;
+}
+
+function createImportedIdentifier(
+	accessToken: string,
+	accountId: string,
+): string {
+	const email = getProfileEmail(accessToken);
+	if (email) return email;
 	return `${IMPORTED_ACCOUNT_PREFIX} ${accountId.slice(0, 8)}`;
 }
 
@@ -84,7 +121,7 @@ export function parseImportedOpenAICodexAuth(
 		accountId,
 	};
 	return {
-		identifier: createImportedIdentifier(accountId ?? "default"),
+		identifier: createImportedIdentifier(access, accountId ?? "default"),
 		fingerprint: createFingerprint({ access, refresh, expires, accountId }),
 		credentials,
 	};

package/commands.ts

@@ -99,7 +99,11 @@ function formatAccountStatusLine(
 	const quotaHit =
 		account.quotaExhaustedUntil && account.quotaExhaustedUntil > Date.now();
 	const untouched = isUsageUntouched(usage) ? "untouched" : null;
-	const imported = account.importSource ? "linked-auth" : null;
+	const imported = account.importSource
+		? account.importMode === "synthetic"
+			? "pi auth only"
+			: "pi auth"
+		: null;
 	const reauth = account.needsReauth ? "needs reauth" : null;
 	const tags = [
 		active?.email === account.email ? "active" : null,

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@victor-software-house/pi-multicodex",
-	"version": "2.1.3",
+	"version": "2.1.5",
 	"description": "Codex account rotation extension for pi",
 	"license": "MIT",
 	"type": "module",