npm - aisubs - Versions diffs - 0.3.0 → 0.3.2 - Mend

aisubs 0.3.0 → 0.3.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (21) hide show

package/CHANGELOG.md +19 -0
package/README.md +36 -0
package/dist/account-key.js +1 -1
package/dist/auth.js +10 -6
package/dist/compatibility.js +34 -40
package/dist/dashboard/assets/index-BJDbjHnw.css +2 -0
package/dist/dashboard/assets/index-DJBtdmoj.js +84 -0
package/dist/dashboard/index.html +2 -2
package/dist/dashboard.js +58 -3
package/dist/http.js +129 -4
package/dist/providers/chatgpt.js +27 -0
package/dist/providers/copilot.js +20 -0
package/dist/providers/grok.js +2 -2
package/dist/realtime.js +2 -0
package/dist/store.js +27 -1
package/dist/types.d.ts +1 -0
package/dist/usage.js +1 -1
package/package.json +3 -1
package/scripts/codex-catalog.mjs +203 -0
package/dist/dashboard/assets/index-CEDww1hA.css +0 -2
package/dist/dashboard/assets/index-DrnM3oWy.js +0 -84

package/dist/dashboard/index.html CHANGED Viewed

@@ -6,8 +6,8 @@
     <meta name="color-scheme" content="light dark" />
     <meta name="theme-color" content="#181818" />
     <title>AI Subs</title>
-    <script type="module" crossorigin src="/assets/index-DrnM3oWy.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-CEDww1hA.css">
+    <script type="module" crossorigin src="/assets/index-DJBtdmoj.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-BJDbjHnw.css">
   </head>
   <body>
     <div id="root"></div>

package/dist/dashboard.js CHANGED Viewed

@@ -1,8 +1,10 @@
 import cors from "@fastify/cors";
 import websocket from "@fastify/websocket";
 import Fastify from "fastify";
+import { spawn } from "node:child_process";
 import { randomBytes, timingSafeEqual } from "node:crypto";
-import { readFile } from "node:fs/promises";
+import { access, readFile, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
 import { dirname, extname, isAbsolute, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { clientAbortSignal, handleSubscriptionAuthApi, routeSegments, sendWebResponse, } from "./http.js";
@@ -71,6 +73,42 @@ async function responseFailure(response) {
     const message = isRecord(failure) ? stringValue(failure.message) : stringValue(failure);
     return (message ?? `HTTP ${response.status}`).slice(0, 2_000);
 }
+function runCodexCatalog(env) {
+    const script = join(dirname(fileURLToPath(import.meta.url)), "..", "scripts", "codex-catalog.mjs");
+    return new Promise((resolvePromise, reject) => {
+        const child = spawn(process.execPath, [script], { env, stdio: ["ignore", "pipe", "pipe"] });
+        let output = "";
+        child.stdout.on("data", (chunk) => {
+            output += chunk.toString();
+        });
+        child.stderr.on("data", (chunk) => {
+            output += chunk.toString();
+        });
+        child.once("error", reject);
+        child.once("close", (code) => resolvePromise({ output: output.trim(), code: code ?? 1 }));
+    });
+}
+function removeRootSetting(config, pattern) {
+    const firstTable = config.search(/^\[/m);
+    const rootEnd = firstTable < 0 ? config.length : firstTable;
+    return `${config.slice(0, rootEnd).replace(pattern, "")}${config.slice(rootEnd)}`;
+}
+async function restoreOfficialCodexConfig() {
+    const path = process.env.CODEX_CONFIG ?? join(homedir(), ".codex", "config.toml");
+    const backup = `${path}.aisubs-backup`;
+    const config = await readFile(path, "utf8").catch(() => null);
+    if (!config) {
+        return "No existing Codex config found at ~/.codex/config.toml";
+    }
+    await access(backup).catch(() => writeFile(backup, config, { mode: 0o600 }));
+    let restored = removeRootSetting(config, /^model_catalog_json\s*=.*\n?/m);
+    restored = removeRootSetting(restored, /^model_provider\s*=\s*"aisubs-codex"\s*\n?/m);
+    restored = restored
+        .replace(/(?:^|\n)\[model_providers\.aisubs-codex\][\s\S]*?(?=\n\[|$)/, "")
+        .replace(/^AISUBS_API_KEY\s*=.*\n?/m, "");
+    await writeFile(path, restored, { mode: 0o600 });
+    return `Restored official Codex mode. Backup: ${backup}`;
+}
 export async function createSubscriptionAuthDashboardServer(options) {
     const host = options.host ?? "127.0.0.1";
     if (!["127.0.0.1", "::1", "localhost"].includes(host)) {
@@ -118,7 +156,7 @@ export async function createSubscriptionAuthDashboardServer(options) {
             await reply.code(421).send({ error: "Invalid local host" });
             return;
         }
-        if (request.url.startsWith("/aisubs/")) {
+        if (request.url.startsWith("/aisubs/") || request.url.startsWith("/aisubs-codex/")) {
             const startedAt = performance.now();
             reply.raw.once("finish", () => {
                 const path = new URL(request.url, origin).pathname;
@@ -157,7 +195,7 @@ export async function createSubscriptionAuthDashboardServer(options) {
             }
             const bearerAuthenticated = requestApiKeys(request).some((value) => sameSecret(value, apiKey));
             const cookieAuthenticated = sameSecret(cookie(request, "aisubs_session"), sessionToken);
-            const apiRoute = ["v1", "aisubs"].includes(routeSegments(url.pathname)[0] ?? "");
+            const apiRoute = ["v1", "aisubs", "aisubs-codex"].includes(routeSegments(url.pathname)[0] ?? "");
             if (apiRoute && !bearerAuthenticated && !cookieAuthenticated) {
                 await reply.code(401).send({
                     error: {
@@ -192,6 +230,23 @@ export async function createSubscriptionAuthDashboardServer(options) {
                     await reply.send({ apiKey });
                     return;
                 }
+                if (request.method === "POST" && url.pathname === "/v1/codex/configure") {
+                    const result = await runCodexCatalog({
+                        ...process.env,
+                        AISUBS_API_KEY: apiKey,
+                        AISUBS_URL: `http://${request.headers.host ?? `${urlHost(host)}:${options.port ?? 4319}`}`,
+                    });
+                    if (result.code !== 0) {
+                        await reply.code(500).send({ error: result.output || "Codex configuration failed" });
+                        return;
+                    }
+                    await reply.send({ ok: true, output: result.output });
+                    return;
+                }
+                if (request.method === "POST" && url.pathname === "/v1/codex/restore-official") {
+                    await reply.send({ ok: true, output: await restoreOfficialCodexConfig() });
+                    return;
+                }
                 if (request.method === "POST" && url.pathname === "/v1/api-key/regenerate") {
                     regeneratingApiKey ??= (options.regenerateApiKey
                         ? options.regenerateApiKey()

package/dist/http.js CHANGED Viewed

@@ -97,7 +97,7 @@ export async function sendWebResponse(reply, upstream) {
         await reply.send();
         return;
     }
-    await reply.send(Readable.fromWeb(upstream.body));
+    await reply.send(Readable.from(upstream.body));
 }
 function jsonResponse(body, status = 200, headers = {}) {
     return Response.json(body, {
@@ -132,16 +132,141 @@ function openAiModel(provider, model) {
         },
     };
 }
+function usableForCodex(model) {
+    return (model.endpoints ?? []).some((endpoint) => {
+        const normalized = endpoint.replace(/^\/?(?:v1\/)?/, "");
+        return (["responses", "chat/completions", "messages"].includes(normalized) ||
+            normalized.startsWith("models/"));
+    });
+}
+function codexResponsesBody(input, model) {
+    const body = { ...input, model };
+    if (Array.isArray(body.input)) {
+        body.input = body.input
+            .filter((item) => isRecord(item) &&
+            ["message", "function_call", "function_call_output"].includes(String(item.type)))
+            .map((item) => {
+            if (item.type === "message") {
+                const content = Array.isArray(item.content)
+                    ? item.content
+                        .filter(isRecord)
+                        .map((part) => stringValue(part.text))
+                        .filter((value) => Boolean(value))
+                        .join("")
+                    : item.content;
+                return { type: "message", role: stringValue(item.role) ?? "user", content };
+            }
+            return item;
+        });
+    }
+    if (isRecord(body.reasoning) && body.reasoning.summary === "all_turns") {
+        // Codex can send `all_turns`, but Copilot's GPT-5 Responses endpoint only
+        // accepts `auto` (some model revisions also accept `current_turn`).
+        // `auto` is the common denominator across the connected model revisions.
+        body.reasoning = { ...body.reasoning, summary: "auto" };
+    }
+    if (!Array.isArray(body.tools) || body.tools.length === 0) {
+        // OpenAI Responses permits a default tool choice, but several upstream
+        // providers reject tool_choice unless an actual tools array is present.
+        delete body.tool_choice;
+    }
+    delete body.prompt_cache_retention;
+    delete body.include;
+    return body;
+}
 export async function handleSubscriptionAuthApi(auth, request, signal) {
     const url = new URL(request.url, "http://aisubs.local");
     const parts = routeSegments(url.pathname);
+    // Unified Codex-compatible router. Model ids use provider/model, while the
+    // account is selected from the first authenticated account exposing it.
+    if (parts[0] === "aisubs-codex" && parts[1] === "v1") {
+        if (request.method === "GET" && parts[2] === "models") {
+            const models = [];
+            const seen = new Set();
+            for (const provider of auth.listProviders()) {
+                if (provider.id === "chatgpt")
+                    continue;
+                for (const account of await auth.listAccounts(provider.id)) {
+                    const catalog = await auth.getModels(provider.id, account.accountKey).catch(() => null);
+                    for (const model of catalog?.models ?? []) {
+                        if (!usableForCodex(model))
+                            continue;
+                        const id = `${provider.id}/${model.id}`;
+                        if (seen.has(id))
+                            continue;
+                        seen.add(id);
+                        models.push({ ...openAiModel(provider.id, model), id });
+                    }
+                }
+            }
+            return jsonResponse({ object: "list", data: models, models });
+        }
+        if (request.method === "POST" && parts[2] === "responses") {
+            const raw = jsonBody(request);
+            const input = isRecord(raw) ? raw : {};
+            const requested = stringValue(input.model);
+            if (!requested) {
+                return jsonResponse({ error: { message: "model must be provider/model", type: "invalid_request_error" } }, 400);
+            }
+            const slash = requested.indexOf("/");
+            if (slash <= 0 || slash === requested.length - 1) {
+                return jsonResponse({
+                    error: {
+                        message: `Model "${requested}" must include its provider, for example "copilot/${requested}". No provider fallback was performed.`,
+                        type: "invalid_request_error",
+                        code: "invalid_model_id",
+                    },
+                }, 400);
+            }
+            const provider = requested.slice(0, slash);
+            const model = requested.slice(slash + 1);
+            if (!auth.listProviders().some((candidate) => candidate.id === provider)) {
+                return jsonResponse({
+                    error: {
+                        message: `Model not found: ${requested}`,
+                        type: "invalid_request_error",
+                        code: "model_not_found",
+                    },
+                }, 404);
+            }
+            for (const account of await auth.listAccounts(provider)) {
+                const catalog = await auth.getModels(provider, account.accountKey).catch(() => null);
+                if (!catalog?.models.some((candidate) => candidate.id === model && usableForCodex(candidate)))
+                    continue;
+                // Codex sends Responses-only history/metadata that subscription
+                // providers do not all understand. Keep the router's wire contract
+                // stable and pass each provider only portable input items.
+                const translated = codexResponsesBody(input, model);
+                const compatible = await proxyCompatible(auth, provider, account.accountKey, "responses", Buffer.from(JSON.stringify(translated)), requestHeaders(request), signal);
+                if (compatible)
+                    return compatible;
+                return auth.proxy(provider, account.accountKey, "responses", {
+                    method: "POST",
+                    headers: requestHeaders(request),
+                    body: JSON.stringify(translated),
+                    signal,
+                });
+            }
+            return jsonResponse({
+                error: {
+                    message: `Model not found: ${requested}`,
+                    type: "invalid_request_error",
+                    code: "model_not_found",
+                },
+            }, 404);
+        }
+    }
     const account = accountPath(parts);
     if (account && request.method !== "OPTIONS") {
         if (account.versioned && request.method === "GET" && account.path === "models") {
             const catalog = await auth.getModels(account.provider, account.account);
+            const models = (catalog?.models ?? []).map((model) => openAiModel(account.provider, model));
             return jsonResponse({
                 object: "list",
-                data: (catalog?.models ?? []).map((model) => openAiModel(account.provider, model)),
+                data: models,
+                // Codex's custom-provider catalog reader expects `models`, while
+                // OpenAI-compatible clients expect `data`. Keep both shapes.
+                models,
             });
         }
         if (account.versioned && request.method === "GET" && account.path.startsWith("models/")) {
@@ -170,7 +295,7 @@ export async function handleSubscriptionAuthApi(auth, request, signal) {
         return auth.proxy(account.provider, account.account, path, {
             method: request.method,
             headers,
-            body: body.length ? body : undefined,
+            body: body.length ? new Uint8Array(body) : undefined,
             signal,
         });
     }
@@ -336,7 +461,7 @@ export function createApiApp(options) {
         const statusCode = isRecord(error) ? numberValue(error.statusCode) : undefined;
         const status = statusCode && statusCode >= 400 ? statusCode : 400;
         const code = isRecord(error) ? stringValue(error.code) : undefined;
-        const openAi = request.url.startsWith("/aisubs/");
+        const openAi = request.url.startsWith("/aisubs/") || request.url.startsWith("/aisubs-codex/");
         await reply.code(status).send(openAi
             ? {
                 error: {

package/dist/providers/chatgpt.js CHANGED Viewed

@@ -98,6 +98,32 @@ function normalizeModel(value) {
         priority: numberValue(value.priority) ?? Number.MAX_SAFE_INTEGER,
     };
 }
+async function normalizeChatGptRequest(request) {
+    if (request.method !== "POST" || !new URL(request.url).pathname.endsWith("/responses")) {
+        return request;
+    }
+    const raw = await request
+        .clone()
+        .json()
+        .catch(() => null);
+    if (!isRecord(raw))
+        return request;
+    const body = { ...raw };
+    delete body.prompt_cache_options;
+    delete body.prompt_cache_retention;
+    const stripBreakpoints = (value) => Array.isArray(value)
+        ? value.map((item) => isRecord(item)
+            ? Object.fromEntries(Object.entries(item).filter(([key]) => key !== "prompt_cache_breakpoint"))
+            : item)
+        : value;
+    body.input = stripBreakpoints(body.input);
+    body.tools = stripBreakpoints(body.tools);
+    return new Request(request, {
+        method: request.method,
+        body: JSON.stringify(body),
+        headers: { ...Object.fromEntries(request.headers), "content-type": "application/json" },
+    });
+}
 export function chatGptProvider(options = {}) {
     const clientId = options.clientId ?? DEFAULT_CLIENT_ID;
     const compatibilityVersion = options.compatibilityVersion ?? "0.144.2";
@@ -350,6 +376,7 @@ export function chatGptProvider(options = {}) {
                 throw new Error("ChatGPT refresh returned invalid JSON");
             return credentialFromTokens(raw, credential);
         },
+        normalizeRequest: normalizeChatGptRequest,
         authorize(request, credential) {
             requireAllowedHost(request, ["chatgpt.com"]);
             const accountId = credential.account?.id;

package/dist/providers/copilot.js CHANGED Viewed

@@ -383,6 +383,26 @@ export function copilotProvider(options = {}) {
             const session = auto ? await routeAuto(raw, credential, request.signal) : null;
             if (isResponses && raw.store === undefined)
                 raw.store = false;
+            if (isResponses && isRecord(raw.reasoning) && raw.reasoning.summary === "all_turns") {
+                // Codex's cross-turn value is not accepted by Copilot GPT-5 models.
+                raw.reasoning = { ...raw.reasoning, summary: "auto" };
+            }
+            if (isResponses && (!Array.isArray(raw.tools) || raw.tools.length === 0)) {
+                delete raw.tool_choice;
+            }
+            if (isResponses) {
+                delete raw.include;
+                delete raw.prompt_cache_retention;
+                if (Array.isArray(raw.input)) {
+                    for (const item of raw.input) {
+                        if (isRecord(item) &&
+                            isRecord(item.reasoning) &&
+                            item.reasoning.summary === "all_turns") {
+                            item.reasoning = { ...item.reasoning, summary: "auto" };
+                        }
+                    }
+                }
+            }
             if (isResponses && raw.store !== true && Array.isArray(raw.input)) {
                 raw.input = raw.input.flatMap((item) => {
                     if (!isRecord(item))

package/dist/providers/grok.js CHANGED Viewed

@@ -122,8 +122,8 @@ export function grokProvider(options = {}) {
                 signal,
             });
             if (!response.ok) {
-                const raw = (await response.json().catch(() => ({})));
-                throw new GrokTokenError(response.status, stringValue(raw.error));
+                const raw = await response.json().catch(() => null);
+                throw new GrokTokenError(response.status, isRecord(raw) ? stringValue(raw.error) : undefined);
             }
             return credentialFromTokens(await responseJson(response, "Grok token refresh"), credential);
         },

package/dist/realtime.js CHANGED Viewed

@@ -108,6 +108,8 @@ export function registerRealtimeProxy(app, auth, authenticate) {
                 headers: clientHeaders(request),
             })
                 .then((authorized) => {
+                if (socket.readyState !== WebSocket.OPEN)
+                    return;
                 const target = new URL(authorized.url);
                 target.protocol = target.protocol === "https:" ? "wss:" : "ws:";
                 const protocols = request.headers["sec-websocket-protocol"]

package/dist/store.js CHANGED Viewed

@@ -5,6 +5,24 @@ import { dirname, join, resolve } from "node:path";
 import { abortableDelay, isRecord } from "./utils.js";
 const LOCK_TIMEOUT_MS = 15_000;
 const LOCK_STALE_MS = 120_000;
+function isCredential(value) {
+    if (!isRecord(value) || typeof value.accessToken !== "string")
+        return false;
+    if (typeof value.expiresAt !== "number" || !Number.isFinite(value.expiresAt))
+        return false;
+    if (value.refreshToken != null && typeof value.refreshToken !== "string")
+        return false;
+    if (value.account != null &&
+        (!isRecord(value.account) ||
+            ![value.account.id, value.account.label, value.account.email, value.account.plan].every((item) => item == null || typeof item === "string")))
+        return false;
+    return (value.metadata == null ||
+        (isRecord(value.metadata) &&
+            Object.values(value.metadata).every((item) => item == null ||
+                typeof item === "string" ||
+                typeof item === "number" ||
+                typeof item === "boolean")));
+}
 export function defaultAiSubsDataDir() {
     const override = process.env.AISUBS_DATA_DIR?.trim();
     return override ? resolve(override) : join(homedir(), ".aisubs");
@@ -61,7 +79,15 @@ export class FileApiKeyStore {
 async function readEnvelope(file) {
     try {
         const parsed = JSON.parse(await readFile(file, "utf8"));
-        return isRecord(parsed) ? parsed : {};
+        if (!isRecord(parsed))
+            throw new Error("Credential store must contain a JSON object");
+        const credentials = {};
+        for (const [key, value] of Object.entries(parsed)) {
+            if (!isCredential(value))
+                throw new Error(`Credential store entry ${key} is invalid`);
+            credentials[key] = value;
+        }
+        return credentials;
     }
     catch (error) {
         if (error.code === "ENOENT")

package/dist/types.d.ts CHANGED Viewed

@@ -143,6 +143,7 @@ export interface ProviderAdapter {
     readonly proxyBaseUrl?: string | ((credential: OAuthCredential) => string | undefined);
     /** Optional local OpenAI-compatible bridge for providers without a pass-through API. */
     proxy?(request: Request, credential: OAuthCredential): Promise<Response>;
+    normalizeRequest?(request: Request): Request | Promise<Request>;
     normalizeResponse?(request: Request, response: Response): Response | Promise<Response>;
     startLogin(signal: AbortSignal, options?: Record<string, unknown>): Promise<ProviderLogin>;
     refresh(credential: OAuthCredential, signal: AbortSignal): Promise<OAuthCredential>;

package/dist/usage.js CHANGED Viewed

@@ -412,7 +412,7 @@ export function parseGrokUsage(raw, userRaw, settingsRaw) {
             ...(unified ? [{ label: "Usage pool", value: "Shared across Grok products" }] : []),
         ],
         note: percentUsed == null
-            ? "For this Free account, xAI provides only the reset time, not current usage or remaining allowance. Access may stop before the reset if the included allowance is exhausted."
+            ? "xAI provides only the reset time for this account, not current usage or remaining allowance. Access may stop before the reset if the included allowance is exhausted."
             : undefined,
     };
 }

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "aisubs",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "Connect AI provider accounts and use those subscriptions from any local tool or as api.",
   "keywords": [
     "ai",
@@ -38,6 +38,7 @@
     "dashboard/public/aisubs-mark.svg",
     "examples",
     "public",
+    "scripts/codex-catalog.mjs",
     "CHANGELOG.md",
     "README.md"
   ],
@@ -84,6 +85,7 @@
   },
   "scripts": {
     "dev": "node --run build && node scripts/dev.mjs",
+    "codex:catalog": "node scripts/codex-catalog.mjs",
     "prepare": "node --run build",
     "build": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.json && tsc -p dashboard/tsconfig.json --noEmit && vite build --config dashboard/vite.config.ts",
     "prepack": "node --run check",

package/scripts/codex-catalog.mjs ADDED Viewed

@@ -0,0 +1,203 @@
+#!/usr/bin/env node
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+const home = homedir();
+const base = (process.env.AISUBS_URL ?? "http://127.0.0.1:4319").replace(/\/+$/, "");
+const keyPath = join(home, ".aisubs", "api-key");
+const key = (
+  process.env.AISUBS_API_KEY ?? (await readFile(keyPath, "utf8").catch(() => ""))
+).trim();
+const output = process.env.CODEX_CATALOG ?? join(home, ".codex", "aisubs-catalog.json");
+const codexConfig = process.env.CODEX_CONFIG ?? join(home, ".codex", "config.toml");
+const providers = (
+  process.env.AISUBS_PROVIDERS ?? "chatgpt,claude,copilot,grok,opencode-go,opencode-zen"
+)
+  .split(",")
+  .map((value) => value.trim())
+  .filter(Boolean);
+if (!key) throw new Error(`AISubs API key not found in ${keyPath}`);
+const message = (error) => (error instanceof Error ? error.message : String(error));
+const headers = { authorization: `Bearer ${key}`, accept: "application/json" };
+async function get(path) {
+  const response = await fetch(`${base}${path}`, { headers });
+  const text = await response.text();
+  let body;
+  try {
+    body = JSON.parse(text);
+  } catch {
+    body = text;
+  }
+  if (!response.ok) {
+    const failure = body?.error;
+    const detail =
+      typeof body === "string"
+        ? body.slice(0, 240)
+        : typeof failure === "string"
+          ? failure
+          : (failure?.message ?? body?.message ?? response.status);
+    throw new Error(`${path}: ${detail}`);
+  }
+  return body;
+}
+try {
+  await get("/health");
+} catch (error) {
+  throw new Error(
+    `AISubs is not reachable at ${base}. Start it with "nub run dev" and run this command again. ${message(error)}`,
+  );
+}
+const native = await readFile(join(home, ".codex", "models_cache.json"), "utf8")
+  .then(JSON.parse)
+  .catch(() => ({ models: [] }));
+const template = native.models?.[0] ?? {
+  default_reasoning_level: "medium",
+  supported_reasoning_levels: ["low", "medium", "high"].map((effort) => ({ effort })),
+  shell_type: "shell_command",
+  visibility: "list",
+  supported_in_api: true,
+};
+const entries = new Map();
+const failures = [];
+const usable = (model) => {
+  const endpoints = model.capabilities?.endpoints ?? model.endpoints ?? [];
+  return endpoints.some((endpoint) => {
+    const normalized = String(endpoint).replace(/^\/?(?:v1\/)?/, "");
+    return (
+      ["responses", "chat/completions", "messages"].includes(normalized) ||
+      normalized.startsWith("models/")
+    );
+  });
+};
+for (const provider of providers) {
+  let accounts;
+  try {
+    accounts = await get(`/v1/auth/${provider}/accounts`);
+  } catch (error) {
+    failures.push(`${provider}: ${message(error)}`);
+    continue;
+  }
+  for (const account of accounts.accounts ?? accounts) {
+    // The account-list API returns the route key as `accountKey`; `account`
+    // is the nested display/identity object.
+    const accountId = account.accountKey ?? account.account ?? account.name;
+    if (!accountId) continue;
+    let catalog;
+    try {
+      catalog = await get(`/aisubs/${provider}/${encodeURIComponent(accountId)}/v1/models`);
+    } catch (error) {
+      failures.push(`${provider}/${accountId}: ${message(error)}`);
+      continue;
+    }
+    for (const model of catalog.data ?? catalog.models ?? []) {
+      const id = model.id;
+      if (!id) continue;
+      if (!usable(model)) continue;
+      // GitHub currently advertises this legacy alias but rejects it at
+      // generation time (the backend asks for gpt-5-mini-2025-08-07).
+      // Omitting it prevents Codex from presenting a model that cannot run.
+      if (provider === "copilot" && id === "gpt-5-mini") continue;
+      // Keep OpenAI/ChatGPT's official catalog entries native. Re-emitting
+      // them as `chatgpt/<model>` makes Codex treat them as third-party IDs
+      // and reject them for ChatGPT-authenticated sessions.
+      if (provider === "chatgpt") continue;
+      const slug = `${provider}/${id}`;
+      if (entries.has(slug)) continue;
+      entries.set(slug, {
+        ...template,
+        slug,
+        display_name: `${provider} / ${id}`,
+        description: `AISubs ${provider} account ${accountId}`,
+        visibility: "list",
+        supported_in_api: true,
+        priority: 10,
+        additional_speed_tiers: undefined,
+        service_tiers: undefined,
+        aisubs_provider: provider,
+        aisubs_account: accountId,
+        aisubs_model: id,
+      });
+    }
+  }
+}
+const clean = [...entries.values()].map((entry) =>
+  Object.fromEntries(Object.entries(entry).filter(([, value]) => value !== undefined)),
+);
+if (!clean.length) {
+  const detail = failures.length ? `\n${failures.join("\n")}` : "";
+  throw new Error(
+    `No non-ChatGPT models were discovered; refusing to overwrite the existing catalog.${detail}`,
+  );
+}
+// Codex has one active provider per configuration. Keep this catalog scoped to
+// AISubs models; native models are restored by the dashboard's Restore action.
+// Mixing native IDs here makes Codex probe them through the AISubs provider.
+await mkdir(dirname(output), { recursive: true });
+await writeFile(output, `${JSON.stringify({ models: clean }, null, 2)}\n`, { mode: 0o600 });
+await syncCodexConfig();
+console.log(`Wrote ${clean.length} models to ${output}`);
+if (failures.length) console.warn(`Some accounts were skipped:\n${failures.join("\n")}`);
+function setRootSetting(config, name, value) {
+  const firstTable = config.search(/^\[/m);
+  const rootEnd = firstTable < 0 ? config.length : firstTable;
+  const root = config.slice(0, rootEnd);
+  const rest = config.slice(rootEnd);
+  const pattern = new RegExp(`^${name}\\s*=.*$`, "m");
+  if (pattern.test(root)) return `${root.replace(pattern, value)}${rest}`;
+  const updatedRoot = `${root.trimEnd()}${root.trim() ? "\n" : ""}${value}\n`;
+  return rest ? `${updatedRoot}\n${rest}` : updatedRoot;
+}
+async function syncCodexConfig() {
+  await mkdir(dirname(codexConfig), { recursive: true });
+  let config = await readFile(codexConfig, "utf8").catch(() => "");
+  const previousKey = config.match(/^AISUBS_API_KEY\s*=\s*"([^"]+)"/m)?.[1];
+  const keyRotated = previousKey && previousKey !== key;
+  config = setRootSetting(
+    config,
+    "model_catalog_json",
+    `model_catalog_json = ${JSON.stringify(output)}`,
+  );
+  // Codex has one active model_provider per config. Native models are restored
+  // by switching back to the official provider/profile.
+  config = setRootSetting(config, "model_provider", 'model_provider = "aisubs-codex"');
+  const providerBlock = `[model_providers.aisubs-codex]\nname = "AISubs Codex Router"\nbase_url = "${base}/aisubs-codex/v1"\nwire_api = "responses"\nrequires_openai_auth = false\nenv_key = "AISUBS_API_KEY"\n`;
+  const providerPattern = /\[model_providers\.aisubs-codex\][\s\S]*?(?=\n\[|$)/;
+  config = providerPattern.test(config)
+    ? config.replace(providerPattern, providerBlock.trimEnd())
+    : `${config.trimEnd()}\n\n${providerBlock}`;
+  const envLine = `AISUBS_API_KEY = ${JSON.stringify(key)}`;
+  if (/^\[shell_environment_policy\.set\]$/m.test(config)) {
+    const marker = "[shell_environment_policy.set]";
+    const start = config.indexOf(marker) + marker.length;
+    const next = config.indexOf("\n[", start);
+    const end = next < 0 ? config.length : next;
+    const section = config.slice(start, end);
+    config = /^AISUBS_API_KEY\s*=.*$/m.test(section)
+      ? `${config.slice(0, start)}${section.replace(/^AISUBS_API_KEY\s*=.*$/m, envLine)}${config.slice(end)}`
+      : `${config.slice(0, end)}\n${envLine}${config.slice(end)}`;
+  } else {
+    config += `\n\n[shell_environment_policy.set]\n${envLine}\n`;
+  }
+  await writeFile(codexConfig, config, { mode: 0o600 });
+  console.log(`Updated ${codexConfig}`);
+  if (keyRotated) {
+    console.log(
+      `\nAISubs API key changed. Next steps:\n` +
+        `1. Restart the AISubs server (nub run dev).\n` +
+        `2. Restart Codex Desktop completely.\n` +
+        `3. Run this sync again if the model catalog is stale.\n` +
+        `4. Send a small test prompt before normal use.\n`,
+    );
+  }
+}