@xiaoso/dsh-tool-plus 0.1.0-beta.3 → 0.1.0-beta.4

package/lib/openai-codex-Bi-4S4PX.mjs

@@ -0,0 +1,255 @@
+import { installBunShim as __installBunShim } from "./bun-shim.mjs";
+__installBunShim();
+import { c as OAuthError, h as LoginCancelledError } from "./error-yCSG0mGC.mjs";
+import "./utils-Bw139LTz.mjs";
+import { n as isRecord } from "./type-guards-B9VVjRDK.mjs";
+import { t as OAuthCallbackFlow } from "./callback-server-DDSrZ6l_.mjs";
+import { t as generatePKCE } from "./pkce-BlQikGPu.mjs";
+import { i as OPENAI_HEADER_VALUES } from "./codex-P1dGpX7G.mjs";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/openai-codex.ts
+/**
+* OpenAI Codex (ChatGPT OAuth) flow — browser and device-code flows.
+*/
+const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+const AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize";
+const TOKEN_URL = "https://auth.openai.com/oauth/token";
+const CALLBACK_PORT = 1455;
+const CALLBACK_PATH = "/auth/callback";
+const SCOPE = "openid profile email offline_access api.connectors.read api.connectors.invoke";
+const JWT_CLAIM_PATH = "https://api.openai.com/auth";
+const JWT_PROFILE_CLAIM = "https://api.openai.com/profile";
+const TOKEN_REQUEST_TIMEOUT_MS = 15e3;
+const DEVICE_USERCODE_URL = "https://auth.openai.com/api/accounts/deviceauth/usercode";
+const DEVICE_TOKEN_URL = "https://auth.openai.com/api/accounts/deviceauth/token";
+const DEVICE_REDIRECT_URI = "https://auth.openai.com/deviceauth/callback";
+const DEVICE_AUTH_URL = "https://auth.openai.com/codex/device";
+const DEVICE_POLL_INTERVAL_MS = 5e3;
+const DEVICE_POLL_SAFETY_MARGIN_MS = 3e3;
+/** Upper bound on device-code polling to avoid infinite loops on server errors. */
+const DEVICE_MAX_POLLS = 120;
+function decodeJwt(token) {
+	try {
+		const parts = token.split(".");
+		if (parts.length !== 3) return null;
+		const payload = parts[1] ?? "";
+		const decoded = Buffer.from(payload, "base64").toString("utf-8");
+		return JSON.parse(decoded);
+	} catch {
+		return null;
+	}
+}
+/**
+* Identity slice decoded from the token claims. The ChatGPT workspace
+* (`chatgpt_account_id`) is the subscription pool the token draws limits
+* from — one account email can hold several (e.g. a personal Pro plan plus a
+* Team seat). `chatgpt_plan_type` may only be present on the `id_token`.
+*/
+function getTokenProfile(accessToken, idToken) {
+	const payload = decodeJwt(accessToken);
+	const idPayload = idToken ? decodeJwt(idToken) : null;
+	const auth = payload?.[JWT_CLAIM_PATH];
+	const idAuth = idPayload?.[JWT_CLAIM_PATH];
+	const accountId = auth?.chatgpt_account_id;
+	const email = payload?.[JWT_PROFILE_CLAIM]?.email?.trim().toLowerCase();
+	const planType = (auth?.chatgpt_plan_type ?? idAuth?.chatgpt_plan_type)?.trim().toLowerCase();
+	return {
+		accountId: typeof accountId === "string" && accountId.length > 0 ? accountId : void 0,
+		email: typeof email === "string" && email.length > 0 ? email : void 0,
+		planType: typeof planType === "string" && planType.length > 0 ? planType : void 0
+	};
+}
+function describeTokenEndpointValue(value) {
+	if (typeof value === "string") {
+		const trimmed = value.trim();
+		return trimmed.length > 0 ? trimmed : void 0;
+	}
+	if (typeof value === "number" || typeof value === "boolean") return String(value);
+	if (!isRecord(value)) return void 0;
+	const code = describeTokenEndpointValue(value.code ?? value.error);
+	const message = describeTokenEndpointValue(value.message ?? value.error_description ?? value.description);
+	if (code && message && code !== message) return `${code}: ${message}`;
+	return code ?? message ?? JSON.stringify(value);
+}
+/** Formats OpenAI Codex OAuth token endpoint errors for login and refresh failures. */
+function formatOpenAICodexTokenEndpointError(status, bodyText) {
+	const trimmed = bodyText.trim();
+	if (trimmed.length === 0) return `${status}`;
+	try {
+		const body = JSON.parse(trimmed);
+		if (!isRecord(body)) return `${status} ${trimmed}`;
+		const error = describeTokenEndpointValue(body.error);
+		const description = describeTokenEndpointValue(body.error_description);
+		if (error && description && error !== description) return `${status} ${error}: ${description}`;
+		return `${status} ${error ?? description ?? describeTokenEndpointValue(body.message) ?? trimmed}`;
+	} catch {
+		return `${status} ${trimmed}`;
+	}
+}
+/** Builds the Codex browser OAuth URL used by browser login; exported for auth regression tests. */
+function createOpenAICodexAuthorizationUrl(args) {
+	const originator = args.originator?.trim() || OPENAI_HEADER_VALUES.ORIGINATOR_CODEX;
+	const searchParams = new URLSearchParams({
+		response_type: "code",
+		client_id: CLIENT_ID,
+		redirect_uri: args.redirectUri,
+		scope: SCOPE,
+		code_challenge: args.challenge,
+		code_challenge_method: "S256",
+		state: args.state,
+		id_token_add_organizations: "true",
+		codex_cli_simplified_flow: "true",
+		originator
+	});
+	return `${AUTHORIZE_URL}?${searchParams.toString()}`;
+}
+var OpenAICodexOAuthFlow = class extends OAuthCallbackFlow {
+	#pkce;
+	#originator;
+	#fetch;
+	constructor(ctrl, pkce, originator, fetchImpl) {
+		super(ctrl, {
+			preferredPort: CALLBACK_PORT,
+			callbackPath: CALLBACK_PATH,
+			redirectUri: `http://localhost:${CALLBACK_PORT}${CALLBACK_PATH}`
+		});
+		this.#pkce = pkce;
+		this.#originator = originator;
+		this.#fetch = fetchImpl;
+	}
+	async generateAuthUrl(state, redirectUri) {
+		return {
+			url: createOpenAICodexAuthorizationUrl({
+				state,
+				redirectUri,
+				challenge: this.#pkce.challenge,
+				originator: this.#originator
+			}),
+			instructions: "A browser window should open. Complete login to finish."
+		};
+	}
+	async exchangeToken(code, _state, redirectUri) {
+		return exchangeCodeForToken(code, this.#pkce.verifier, redirectUri, this.#fetch);
+	}
+};
+async function exchangeCodeForToken(code, verifier, redirectUri, fetchImpl = fetch) {
+	const tokenResponse = await fetchImpl(TOKEN_URL, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			grant_type: "authorization_code",
+			client_id: CLIENT_ID,
+			code,
+			code_verifier: verifier,
+			redirect_uri: redirectUri
+		}),
+		signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS)
+	});
+	if (!tokenResponse.ok) {
+		const bodyText = await tokenResponse.text();
+		throw new OAuthError(`Token exchange failed: ${formatOpenAICodexTokenEndpointError(tokenResponse.status, bodyText)}`, {
+			kind: "token-exchange",
+			status: tokenResponse.status
+		});
+	}
+	const tokenData = await tokenResponse.json();
+	if (!tokenData.access_token || !tokenData.refresh_token || typeof tokenData.expires_in !== "number") throw new OAuthError("Token response missing required fields", { kind: "validation" });
+	const { accountId, email, planType } = getTokenProfile(tokenData.access_token, tokenData.id_token);
+	if (!accountId) throw new OAuthError("Failed to extract accountId from token", { kind: "validation" });
+	return {
+		access: tokenData.access_token,
+		refresh: tokenData.refresh_token,
+		expires: Date.now() + tokenData.expires_in * 1e3,
+		accountId,
+		email,
+		orgId: accountId,
+		orgName: planType
+	};
+}
+async function loginOpenAICodex(options) {
+	return new OpenAICodexOAuthFlow(options, await generatePKCE(), options.originator?.trim() || OPENAI_HEADER_VALUES.ORIGINATOR_CODEX, options.fetch ?? fetch).login();
+}
+/**
+* Login with OpenAI Codex using the device-code (headless) flow.
+*
+* Avoids a local callback server entirely — useful when port 1455 is unavailable
+* or when the browser callback flow fails with 403 (e.g. network/proxy issues).
+*/
+async function loginOpenAICodexDevice(ctrl) {
+	ctrl.onProgress?.("Initiating device authorization…");
+	const initResponse = await fetch(DEVICE_USERCODE_URL, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({ client_id: CLIENT_ID }),
+		signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS)
+	});
+	if (!initResponse.ok) throw new OAuthError(`Device authorization initiation failed: ${initResponse.status}`, {
+		kind: "device-auth",
+		status: initResponse.status
+	});
+	const initData = await initResponse.json();
+	if (!initData.device_auth_id || !initData.user_code) throw new OAuthError("Device authorization response missing required fields", { kind: "validation" });
+	const userCode = initData.user_code;
+	const pollIntervalMs = (typeof initData.interval === "number" ? initData.interval : parseInt(String(initData.interval ?? "5"), 10) || 5) * 1e3 + DEVICE_POLL_SAFETY_MARGIN_MS;
+	ctrl.onAuth?.({
+		url: DEVICE_AUTH_URL,
+		instructions: `Enter code: ${userCode}`
+	});
+	ctrl.onProgress?.(`Waiting for browser authorization (code: ${userCode})…`);
+	for (let poll = 0; poll < DEVICE_MAX_POLLS; poll++) {
+		await Bun.sleep(poll === 0 ? Math.min(pollIntervalMs, DEVICE_POLL_INTERVAL_MS) : pollIntervalMs);
+		if (ctrl.signal?.aborted) throw new LoginCancelledError("Device authorization cancelled");
+		const pollResponse = await fetch(DEVICE_TOKEN_URL, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({
+				device_auth_id: initData.device_auth_id,
+				user_code: userCode
+			}),
+			signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS)
+		});
+		if (pollResponse.status === 403 || pollResponse.status === 404) continue;
+		if (!pollResponse.ok) throw new OAuthError(`Device token polling failed: ${pollResponse.status}`, {
+			kind: "polling",
+			status: pollResponse.status
+		});
+		const pollData = await pollResponse.json();
+		if (!pollData.authorization_code || !pollData.code_verifier) throw new OAuthError("Device token response missing authorization_code or code_verifier", { kind: "validation" });
+		ctrl.onProgress?.("Exchanging authorization code for tokens…");
+		return exchangeCodeForToken(pollData.authorization_code, pollData.code_verifier, DEVICE_REDIRECT_URI);
+	}
+	throw new OAuthError("Device authorization timed out — user did not complete login in time", { kind: "timeout" });
+}
+/**
+* Refresh OpenAI Codex OAuth token
+*/
+async function refreshOpenAICodexToken(refreshToken) {
+	const response = await fetch(TOKEN_URL, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			grant_type: "refresh_token",
+			refresh_token: refreshToken,
+			client_id: CLIENT_ID
+		}),
+		signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS)
+	});
+	if (!response.ok) {
+		const bodyText = await response.text();
+		throw new OAuthError(`OpenAI Codex token refresh failed: ${formatOpenAICodexTokenEndpointError(response.status, bodyText)}`, {
+			kind: "token-refresh",
+			status: response.status
+		});
+	}
+	const tokenData = await response.json();
+	if (!tokenData.access_token || !tokenData.refresh_token || typeof tokenData.expires_in !== "number") throw new OAuthError("Token response missing required fields", { kind: "validation" });
+	const { accountId, email } = getTokenProfile(tokenData.access_token);
+	return {
+		access: tokenData.access_token,
+		refresh: tokenData.refresh_token || refreshToken,
+		expires: Date.now() + tokenData.expires_in * 1e3,
+		accountId: accountId ?? void 0,
+		email
+	};
+}
+//#endregion
+export { loginOpenAICodex, loginOpenAICodexDevice, refreshOpenAICodexToken };

package/lib/openai-codex-Ch8CkT3p.mjs

@@ -0,0 +1,255 @@
+import { installBunShim as __installBunShim } from "./bun-shim.mjs";
+__installBunShim();
+import { c as OAuthError, h as LoginCancelledError } from "./error-Dd8DIqs-.mjs";
+import "./utils-Cp76gCyk.mjs";
+import { n as isRecord } from "./type-guards-B9VVjRDK.mjs";
+import { t as OAuthCallbackFlow } from "./callback-server-CQ5Jo8F-.mjs";
+import { t as generatePKCE } from "./pkce-BlQikGPu.mjs";
+import { i as OPENAI_HEADER_VALUES } from "./codex-P1dGpX7G.mjs";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/openai-codex.ts
+/**
+* OpenAI Codex (ChatGPT OAuth) flow — browser and device-code flows.
+*/
+const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+const AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize";
+const TOKEN_URL = "https://auth.openai.com/oauth/token";
+const CALLBACK_PORT = 1455;
+const CALLBACK_PATH = "/auth/callback";
+const SCOPE = "openid profile email offline_access api.connectors.read api.connectors.invoke";
+const JWT_CLAIM_PATH = "https://api.openai.com/auth";
+const JWT_PROFILE_CLAIM = "https://api.openai.com/profile";
+const TOKEN_REQUEST_TIMEOUT_MS = 15e3;
+const DEVICE_USERCODE_URL = "https://auth.openai.com/api/accounts/deviceauth/usercode";
+const DEVICE_TOKEN_URL = "https://auth.openai.com/api/accounts/deviceauth/token";
+const DEVICE_REDIRECT_URI = "https://auth.openai.com/deviceauth/callback";
+const DEVICE_AUTH_URL = "https://auth.openai.com/codex/device";
+const DEVICE_POLL_INTERVAL_MS = 5e3;
+const DEVICE_POLL_SAFETY_MARGIN_MS = 3e3;
+/** Upper bound on device-code polling to avoid infinite loops on server errors. */
+const DEVICE_MAX_POLLS = 120;
+function decodeJwt(token) {
+	try {
+		const parts = token.split(".");
+		if (parts.length !== 3) return null;
+		const payload = parts[1] ?? "";
+		const decoded = Buffer.from(payload, "base64").toString("utf-8");
+		return JSON.parse(decoded);
+	} catch {
+		return null;
+	}
+}
+/**
+* Identity slice decoded from the token claims. The ChatGPT workspace
+* (`chatgpt_account_id`) is the subscription pool the token draws limits
+* from — one account email can hold several (e.g. a personal Pro plan plus a
+* Team seat). `chatgpt_plan_type` may only be present on the `id_token`.
+*/
+function getTokenProfile(accessToken, idToken) {
+	const payload = decodeJwt(accessToken);
+	const idPayload = idToken ? decodeJwt(idToken) : null;
+	const auth = payload?.[JWT_CLAIM_PATH];
+	const idAuth = idPayload?.[JWT_CLAIM_PATH];
+	const accountId = auth?.chatgpt_account_id;
+	const email = payload?.[JWT_PROFILE_CLAIM]?.email?.trim().toLowerCase();
+	const planType = (auth?.chatgpt_plan_type ?? idAuth?.chatgpt_plan_type)?.trim().toLowerCase();
+	return {
+		accountId: typeof accountId === "string" && accountId.length > 0 ? accountId : void 0,
+		email: typeof email === "string" && email.length > 0 ? email : void 0,
+		planType: typeof planType === "string" && planType.length > 0 ? planType : void 0
+	};
+}
+function describeTokenEndpointValue(value) {
+	if (typeof value === "string") {
+		const trimmed = value.trim();
+		return trimmed.length > 0 ? trimmed : void 0;
+	}
+	if (typeof value === "number" || typeof value === "boolean") return String(value);
+	if (!isRecord(value)) return void 0;
+	const code = describeTokenEndpointValue(value.code ?? value.error);
+	const message = describeTokenEndpointValue(value.message ?? value.error_description ?? value.description);
+	if (code && message && code !== message) return `${code}: ${message}`;
+	return code ?? message ?? JSON.stringify(value);
+}
+/** Formats OpenAI Codex OAuth token endpoint errors for login and refresh failures. */
+function formatOpenAICodexTokenEndpointError(status, bodyText) {
+	const trimmed = bodyText.trim();
+	if (trimmed.length === 0) return `${status}`;
+	try {
+		const body = JSON.parse(trimmed);
+		if (!isRecord(body)) return `${status} ${trimmed}`;
+		const error = describeTokenEndpointValue(body.error);
+		const description = describeTokenEndpointValue(body.error_description);
+		if (error && description && error !== description) return `${status} ${error}: ${description}`;
+		return `${status} ${error ?? description ?? describeTokenEndpointValue(body.message) ?? trimmed}`;
+	} catch {
+		return `${status} ${trimmed}`;
+	}
+}
+/** Builds the Codex browser OAuth URL used by browser login; exported for auth regression tests. */
+function createOpenAICodexAuthorizationUrl(args) {
+	const originator = args.originator?.trim() || OPENAI_HEADER_VALUES.ORIGINATOR_CODEX;
+	const searchParams = new URLSearchParams({
+		response_type: "code",
+		client_id: CLIENT_ID,
+		redirect_uri: args.redirectUri,
+		scope: SCOPE,
+		code_challenge: args.challenge,
+		code_challenge_method: "S256",
+		state: args.state,
+		id_token_add_organizations: "true",
+		codex_cli_simplified_flow: "true",
+		originator
+	});
+	return `${AUTHORIZE_URL}?${searchParams.toString()}`;
+}
+var OpenAICodexOAuthFlow = class extends OAuthCallbackFlow {
+	#pkce;
+	#originator;
+	#fetch;
+	constructor(ctrl, pkce, originator, fetchImpl) {
+		super(ctrl, {
+			preferredPort: CALLBACK_PORT,
+			callbackPath: CALLBACK_PATH,
+			redirectUri: `http://localhost:${CALLBACK_PORT}${CALLBACK_PATH}`
+		});
+		this.#pkce = pkce;
+		this.#originator = originator;
+		this.#fetch = fetchImpl;
+	}
+	async generateAuthUrl(state, redirectUri) {
+		return {
+			url: createOpenAICodexAuthorizationUrl({
+				state,
+				redirectUri,
+				challenge: this.#pkce.challenge,
+				originator: this.#originator
+			}),
+			instructions: "A browser window should open. Complete login to finish."
+		};
+	}
+	async exchangeToken(code, _state, redirectUri) {
+		return exchangeCodeForToken(code, this.#pkce.verifier, redirectUri, this.#fetch);
+	}
+};
+async function exchangeCodeForToken(code, verifier, redirectUri, fetchImpl = fetch) {
+	const tokenResponse = await fetchImpl(TOKEN_URL, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			grant_type: "authorization_code",
+			client_id: CLIENT_ID,
+			code,
+			code_verifier: verifier,
+			redirect_uri: redirectUri
+		}),
+		signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS)
+	});
+	if (!tokenResponse.ok) {
+		const bodyText = await tokenResponse.text();
+		throw new OAuthError(`Token exchange failed: ${formatOpenAICodexTokenEndpointError(tokenResponse.status, bodyText)}`, {
+			kind: "token-exchange",
+			status: tokenResponse.status
+		});
+	}
+	const tokenData = await tokenResponse.json();
+	if (!tokenData.access_token || !tokenData.refresh_token || typeof tokenData.expires_in !== "number") throw new OAuthError("Token response missing required fields", { kind: "validation" });
+	const { accountId, email, planType } = getTokenProfile(tokenData.access_token, tokenData.id_token);
+	if (!accountId) throw new OAuthError("Failed to extract accountId from token", { kind: "validation" });
+	return {
+		access: tokenData.access_token,
+		refresh: tokenData.refresh_token,
+		expires: Date.now() + tokenData.expires_in * 1e3,
+		accountId,
+		email,
+		orgId: accountId,
+		orgName: planType
+	};
+}
+async function loginOpenAICodex(options) {
+	return new OpenAICodexOAuthFlow(options, await generatePKCE(), options.originator?.trim() || OPENAI_HEADER_VALUES.ORIGINATOR_CODEX, options.fetch ?? fetch).login();
+}
+/**
+* Login with OpenAI Codex using the device-code (headless) flow.
+*
+* Avoids a local callback server entirely — useful when port 1455 is unavailable
+* or when the browser callback flow fails with 403 (e.g. network/proxy issues).
+*/
+async function loginOpenAICodexDevice(ctrl) {
+	ctrl.onProgress?.("Initiating device authorization…");
+	const initResponse = await fetch(DEVICE_USERCODE_URL, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({ client_id: CLIENT_ID }),
+		signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS)
+	});
+	if (!initResponse.ok) throw new OAuthError(`Device authorization initiation failed: ${initResponse.status}`, {
+		kind: "device-auth",
+		status: initResponse.status
+	});
+	const initData = await initResponse.json();
+	if (!initData.device_auth_id || !initData.user_code) throw new OAuthError("Device authorization response missing required fields", { kind: "validation" });
+	const userCode = initData.user_code;
+	const pollIntervalMs = (typeof initData.interval === "number" ? initData.interval : parseInt(String(initData.interval ?? "5"), 10) || 5) * 1e3 + DEVICE_POLL_SAFETY_MARGIN_MS;
+	ctrl.onAuth?.({
+		url: DEVICE_AUTH_URL,
+		instructions: `Enter code: ${userCode}`
+	});
+	ctrl.onProgress?.(`Waiting for browser authorization (code: ${userCode})…`);
+	for (let poll = 0; poll < DEVICE_MAX_POLLS; poll++) {
+		await Bun.sleep(poll === 0 ? Math.min(pollIntervalMs, DEVICE_POLL_INTERVAL_MS) : pollIntervalMs);
+		if (ctrl.signal?.aborted) throw new LoginCancelledError("Device authorization cancelled");
+		const pollResponse = await fetch(DEVICE_TOKEN_URL, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({
+				device_auth_id: initData.device_auth_id,
+				user_code: userCode
+			}),
+			signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS)
+		});
+		if (pollResponse.status === 403 || pollResponse.status === 404) continue;
+		if (!pollResponse.ok) throw new OAuthError(`Device token polling failed: ${pollResponse.status}`, {
+			kind: "polling",
+			status: pollResponse.status
+		});
+		const pollData = await pollResponse.json();
+		if (!pollData.authorization_code || !pollData.code_verifier) throw new OAuthError("Device token response missing authorization_code or code_verifier", { kind: "validation" });
+		ctrl.onProgress?.("Exchanging authorization code for tokens…");
+		return exchangeCodeForToken(pollData.authorization_code, pollData.code_verifier, DEVICE_REDIRECT_URI);
+	}
+	throw new OAuthError("Device authorization timed out — user did not complete login in time", { kind: "timeout" });
+}
+/**
+* Refresh OpenAI Codex OAuth token
+*/
+async function refreshOpenAICodexToken(refreshToken) {
+	const response = await fetch(TOKEN_URL, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			grant_type: "refresh_token",
+			refresh_token: refreshToken,
+			client_id: CLIENT_ID
+		}),
+		signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS)
+	});
+	if (!response.ok) {
+		const bodyText = await response.text();
+		throw new OAuthError(`OpenAI Codex token refresh failed: ${formatOpenAICodexTokenEndpointError(response.status, bodyText)}`, {
+			kind: "token-refresh",
+			status: response.status
+		});
+	}
+	const tokenData = await response.json();
+	if (!tokenData.access_token || !tokenData.refresh_token || typeof tokenData.expires_in !== "number") throw new OAuthError("Token response missing required fields", { kind: "validation" });
+	const { accountId, email } = getTokenProfile(tokenData.access_token);
+	return {
+		access: tokenData.access_token,
+		refresh: tokenData.refresh_token || refreshToken,
+		expires: Date.now() + tokenData.expires_in * 1e3,
+		accountId: accountId ?? void 0,
+		email
+	};
+}
+//#endregion
+export { loginOpenAICodex, loginOpenAICodexDevice, refreshOpenAICodexToken };