clauderipple 0.3.1 → 0.4.0

package/CHANGELOG.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## 0.4.0 — 2026-09-24
+
+Several ChatGPT accounts, for Claude Desktop and for Codex.
+
+### Added
+
+- **Several ChatGPT accounts.** `clauderipple login` (or **+ Add ChatGPT account**
+  in the dashboard) adds an account instead of replacing the one you had; the
+  sign-in asks who is signing in, so the browser's current ChatGPT session is not
+  silently reused. When an account hits its limit, the same request moves to the
+  next one before anything reaches the client, and the spent account rests until
+  the window the backend reports resets. A conversation stays on the account that
+  answered, to keep its prompt cache. A 401 gets one token refresh and a replay;
+  only a freshly minted token refused again asks for a new sign-in. Accounts live
+  in `~/.clauderipple/chatgpt-accounts.json` (0600); the old single login is moved
+  there on the first sign-in. The Codex CLI's own login still takes part, last.
+- **Accounts tab for ChatGPT** in the dashboard: each account's 5-hour and weekly
+  usage, when a resting one is back, and pause/resume, rename, remove, use now and
+  sign in again.
+- **Codex's GPT goes through the account pool.** `clauderipple codex on` now also
+  points Codex's built-in OpenAI provider at ClaudeRipple. Codex keeps its ChatGPT
+  sign-in; its GPT requests reach ChatGPT unchanged except for the account, so when
+  one account runs out Codex carries on with the next — no sign-out. With no account
+  added, or every one at its limit, Codex's own login is used. An `openai_base_url`
+  of your own is never overwritten; `clauderipple codex off` undoes it.
+
+### Changed
+
+- `clauderipple logout` removes every ChatGPT account added with `login`.
+- `/api/status` keeps `chatgpt.quota` (the account that answers next) and adds
+  `chatgpt.accounts`, one entry per account.
+
 ## 0.3.1 — 2026-09-24
 
 Fixes for three reports against 0.3.0.

package/README.ko.md

@@ -125,10 +125,11 @@ ClaudeRipple은 데스크톱 앱·터미널·Codex를 메뉴 막대 앱 하나
 
 | | ClaudeRipple | opencodex / openclaude | claude-code-router | Claude Desktop 게이트웨이(3P) 모드 |
 |---|---|---|---|---|
-| 게이트웨이(3P) 모드 **없이** Claude **Desktop** Code 탭 | ✅ | ❌ ¹ | ❌ | ❌ (정의상 불가) |
-| claude.ai 채팅·Remote Control·클라우드 세션·커넥터 유지 | ✅ | ❌ | ❌ | ❌ |
-| Claude 구독과 GPT 구독 나란히 | ✅ | ❌ 전부 아니면 전무 | ❌ | ❌ |
-| Desktop 피커에 실제 모델 이름 | ✅ | ❌ | ❌ | 일부 |
+| 게이트웨이(3P) 모드 **없이** Claude **Desktop** Code 탭 | ✅ | ✅ ¹ | ❌ | ❌ (정의상 불가) |
+| claude.ai 채팅·Remote Control·클라우드 세션·커넥터 유지 | ✅ | ✅ ¹ | ❌ | ❌ |
+| Claude 구독과 GPT 구독 나란히 | ✅ | ✅ ¹ | ❌ | ❌ |
+| Desktop 피커에 실제 모델 이름 | ✅ | ❌ Claude 이름을 빌려 씀 ¹ | ❌ | 일부 |
+| ChatGPT 계정 여러 개, 한도 차면 자동 전환 (Desktop·Codex) | ✅ | ✅ | ❌ | ❌ |
 | 터미널 `claude` CLI | ✅ | ✅ | ✅ | ✅ |
 | Codex **앱**·Codex CLI → Claude | ✅ | ✅ | ❌ | ❌ |
 | 번역 프로바이더의 프롬프트 캐시 | **94~99 %** 실측 | 미측정 | 제각각 | 해당 없음 |
@@ -136,8 +137,9 @@ ClaudeRipple은 데스크톱 앱·터미널·Codex를 메뉴 막대 앱 하나
 | 터미널 없이 쓰는 설정 GUI | ✅ | ❌ | ❌ | ❌ |
 | 런타임 내장, 서명·공증된 앱 | ✅ | ❌ | ❌ | – |
 
-¹ opencodex는 README에 Claude Desktop 데모를 걸어 두었지만, 저장소에도 문서 사이트에도 설치 절차가 없습니다
-(2026-09-16 확인). 데스크톱 앱으로 들어가는 공개된 경로는 공식 게이트웨이 설정, 즉 마지막 칸뿐입니다.
+¹ opencodex 기준(openclaude는 확인하지 않음). opencodex는 v2.61.0(2026-09-22)부터 게이트웨이 없이 Code 탭에
+들어갑니다. 다만 모델 선택기는 건드리지 않아서, 다른 모델은 Claude 모델 이름에 연결해(`modelMap`) 그 이름으로 고릅니다.
+ClaudeRipple은 선택기에 GPT·DeepSeek 등을 실제 이름으로 띄우고, 고른 추론 강도를 그대로 넘깁니다.
 
 데스크톱 앱의 "서드파티 추론" 설정은 앱 전체를 다른 모드로 바꿔 버립니다. claude.ai 채팅, Remote Control,
 클라우드 세션을 잃습니다. `ANTHROPIC_BASE_URL`을 바꿔치기하는 도구들은 데스크톱 앱에 아예 닿지 못합니다.
@@ -155,6 +157,10 @@ ClaudeRipple은 Claude Code 프로세스만 신뢰하는 작은 HTTPS 프록시
   구독 계정을 추가하면, 대화마다 답한 계정에 고정됩니다. 응답이 시작되기 전 한도·인증 거부가 오면 같은 요청을
   다음 계정으로 넘깁니다. 이 Claude Desktop/Code 원형 경로는 번역을 거치는 Codex 입구와 별개이며, Codex 쪽은
   사용 가능한 로그인 하나만 골라 쓰고 계정을 자동 전환하지 않습니다.
+- **ChatGPT 계정 여러 개.** `clauderipple login`(또는 대시보드의 **+ ChatGPT 계정 추가**)을 할 때마다 계정이
+  늘어납니다. 한 계정이 한도에 걸리면 같은 요청을 다음 계정이 이어받고, 그 계정은 한도가 풀릴 때까지 쉽니다.
+  대화는 답한 계정에 고정되어 캐시를 지킵니다. Claude Desktop Code 탭·서브에이전트와 **Codex 앱·CLI의 GPT**에
+  모두 적용됩니다. Codex는 로그인을 그대로 두고, 로그아웃·재로그인 없이 다음 계정으로 넘어갑니다.
 - **Claude Code 하네스는 손대지 않습니다.** 스킬, 훅, MCP, `CLAUDE.md`, 서브에이전트, 플랜 모드, 휴대폰 Remote Control.
   아무것도 꺼지지 않습니다.
 - **구조적으로 올바르게.** 프롬프트 캐시 보존(Anthropic 캐시 브레이크포인트, 고정된 OpenAI 프리픽스), Claude Code의
@@ -299,6 +305,12 @@ clauderipple codex on     # ~/.codex/config.toml에 "clauderipple" 프로바이
 codex --profile clauderipple -m claude-sonnet-5
 ```
 
+`codex on`은 Codex의 기본 OpenAI 경로(`openai_base_url`)도 ClaudeRipple로 돌립니다. Codex는 ChatGPT 로그인을
+그대로 쓰고, GPT 요청은 내용 그대로 ChatGPT로 넘어가되 계정만 ClaudeRipple에 추가한 계정 중에서 골라 끼웁니다.
+그래서 계정을 여러 개 추가해 두면 Codex도 한도가 찬 계정에서 다음 계정으로 넘어갑니다. 추가한 계정이 없거나
+전부 한도에 걸려 있으면 Codex 자신의 로그인으로 보냅니다. 직접 넣어 둔 `openai_base_url`이 있으면 건드리지 않습니다.
+`clauderipple codex off`로 되돌립니다.
+
 Claude 모델이 Codex 모델 목록에 이름 그대로 뜹니다(ClaudeRipple이 Codex 자체 카탈로그 옆에 모델 카탈로그를 씁니다).
 Claude는 Claude Code 로그인(실행 중인 Desktop 세션, 터미널 로그인, 또는 ClaudeRipple 자체 로그인 — **프로바이더 →
 Claude → Claude 구독 연결…**을 누르면 브라우저가 열리고 터미널은 필요 없습니다. `clauderipple claude-login`과 같습니다)이나
@@ -313,7 +325,7 @@ Anthropic API 키로 갑니다. 구독 로그인 재사용은 Anthropic 약관
 
 | 프로바이더 | 종류 | 인증 | 모델 목록 | 비고 |
 |---|---|---|---|---|
-| ChatGPT 구독 | Codex 백엔드 | 로그인(또는 Codex 로그인 재사용) | Terra, Sol, Luna, Astra | 추론 강도 low…max(Luna는 ultra), 프롬프트 캐시 94~99 % |
+| ChatGPT 구독 | Codex 백엔드 | 로그인 여러 개, 한도 차면 자동 전환(Codex 로그인도 재사용) | Terra, Sol, Luna, Astra | 추론 강도 low…max(Luna는 ultra), 프롬프트 캐시 94~99 % |
 | OpenRouter | Anthropic 호환 | API 키 | 400+, 자동 검색 | 모델별 추론 강도 지원을 API에서 읽음 |
 | DeepSeek, Kimi, Z.ai GLM, MiniMax, Qwen(국제/중국) | Anthropic 호환 | API 키 | 프리셋 | 벤더 공식 문서로 확인 |
 | xAI Grok, Mistral, Groq, Together, Fireworks | OpenAI 호환 | API 키 | 자동 검색 | 번역(Chat Completions / Responses) |

package/README.md

@@ -141,10 +141,11 @@ and claude.ai connectors keep working while another model does the thinking.
 
 | | ClaudeRipple | opencodex / openclaude | claude-code-router | Claude Desktop gateway (3P) mode |
 |---|---|---|---|---|
-| Claude **Desktop** Code tab **without** gateway (3P) mode | ✅ | ❌ ¹ | ❌ | ❌ by definition |
-| Keeps claude.ai chat, Remote Control, cloud sessions, connectors | ✅ | ❌ | ❌ | ❌ |
-| Claude and GPT subscriptions side by side | ✅ | ❌ all-or-nothing | ❌ | ❌ |
-| Real model names in the Desktop picker | ✅ | ❌ | ❌ | partial |
+| Claude **Desktop** Code tab **without** gateway (3P) mode | ✅ | ✅ ¹ | ❌ | ❌ by definition |
+| Keeps claude.ai chat, Remote Control, cloud sessions, connectors | ✅ | ✅ ¹ | ❌ | ❌ |
+| Claude and GPT subscriptions side by side | ✅ | ✅ ¹ | ❌ | ❌ |
+| Real model names in the Desktop picker | ✅ | ❌ borrows Claude names ¹ | ❌ | partial |
+| Several ChatGPT accounts, switching when one runs out (Desktop and Codex) | ✅ | ✅ | ❌ | ❌ |
 | Terminal `claude` CLI | ✅ | ✅ | ✅ | ✅ |
 | Codex **app** and Codex CLI → Claude | ✅ | ✅ | ❌ | ❌ |
 | Prompt cache on translated providers | **94–99 %** measured | not measured | varies | n/a |
@@ -152,9 +153,10 @@ and claude.ai connectors keep working while another model does the thinking.
 | Settings GUI, no terminal needed | ✅ | ❌ | ❌ | ❌ |
 | Signed, notarized app with its own runtime | ✅ | ❌ | ❌ | – |
 
-¹ opencodex's README shows Claude Desktop in a demo but publishes no setup steps for it,
-in the repository or on its documentation site (checked 2026-09-16). The only public way
-into the desktop app is the official gateway setting — the last column.
+¹ opencodex (openclaude not checked). Since v2.61.0 (2026-09-22) opencodex reaches the Code
+tab without the gateway. It leaves the model picker alone, so another model is chosen under a
+Claude model's name it is mapped to (`modelMap`). ClaudeRipple puts GPT, DeepSeek and the rest
+in the picker under their own names and passes the effort you pick.
 
 The desktop app's own "third-party inference" setting flips the whole app into another
 mode: you lose claude.ai chat, Remote Control and cloud sessions. Tools that replace
@@ -178,6 +180,12 @@ you map go to your provider, everything else goes to Anthropic byte for byte.
   quota or authentication refusal moves that turn to the next account. This native
   Claude Desktop/Code path is separate from the translated Codex ingress, which picks
   one available login and does not rotate accounts.
+- **Several ChatGPT accounts.** Each `clauderipple login` (or **+ Add ChatGPT account**
+  in the dashboard) adds one. When an account hits its limit, the next one takes over
+  the same request and the spent one rests until its window resets; a conversation
+  stays on the account that answered, to keep its cache. This covers the Claude Desktop
+  Code tab and subagents **and GPT in the Codex app and CLI** — Codex keeps its own
+  sign-in and moves to the next account without signing out.
 - **The full Claude Code harness, untouched.** Skills, hooks, MCP, `CLAUDE.md`,
   subagents, plan mode, Remote Control on your phone: nothing is turned off.
 - **Correct by construction.** Prompt caching preserved (Anthropic cache breakpoints
@@ -342,6 +350,12 @@ clauderipple codex on     # adds a "clauderipple" provider to ~/.codex/config.to
 codex --profile clauderipple -m claude-sonnet-5
 ```
 
+`codex on` also points Codex's built-in OpenAI provider at ClaudeRipple (`openai_base_url`).
+Codex keeps its ChatGPT sign-in; its GPT requests go on to ChatGPT unchanged, except that the
+account is chosen from the ones added to ClaudeRipple — so with several added, Codex too moves
+from a spent account to the next. With none added, or all of them at their limit, Codex's own
+login is used. An `openai_base_url` you set yourself is left alone. `clauderipple codex off` undoes it.
+
 Claude models show up in Codex's model list under their names (ClaudeRipple writes
 a model catalog next to Codex's own). Claude is reached through your Claude Code
 login (detected from the running Desktop session, the terminal login, or a
@@ -359,7 +373,7 @@ provider you configured is available the same way.
 
 | Provider | Kind | Auth | Model list | Notes |
 |---|---|---|---|---|
-| ChatGPT subscription | Codex backend | sign in (or reuse Codex login) | Terra, Sol, Luna, Astra | effort low…max (Luna: ultra), prompt cache 94–99 % |
+| ChatGPT subscription | Codex backend | several sign-ins, switching when one runs out (Codex login reused too) | Terra, Sol, Luna, Astra | effort low…max (Luna: ultra), prompt cache 94–99 % |
 | OpenRouter | Anthropic-compatible | API key | 400+, discovered | per-model effort support read from the API |
 | DeepSeek, Kimi, Z.ai GLM, MiniMax, Qwen (intl / cn) | Anthropic-compatible | API key | preset | verified against vendor docs |
 | xAI Grok, Mistral, Groq, Together, Fireworks | OpenAI-compatible | API key | discovered | translated (Chat Completions / Responses) |

package/dist/cli/src/codex.js

@@ -10,6 +10,8 @@ const PROFILE_START = "# >>> ClaudeRipple Codex profile >>>";
 const PROFILE_END = "# <<< ClaudeRipple Codex profile <<<";
 const CATALOG_START = "# >>> ClaudeRipple Codex model catalog >>>";
 const CATALOG_END = "# <<< ClaudeRipple Codex model catalog <<<";
+const OPENAI_START = "# >>> ClaudeRipple OpenAI route >>>";
+const OPENAI_END = "# <<< ClaudeRipple OpenAI route <<<";
 export const CODEX_PROVIDER_MARKER = START;
 export function codexHome() {
     return process.env.CODEX_HOME ?? path.join(os.homedir(), ".codex");
@@ -114,6 +116,28 @@ function withCatalog(content, file) {
         return stripped;
     return `${catalogBlock(file)}\n\n${stripped}`.replace(/\n+$/, "\n");
 }
+/**
+ * Codex's built-in `openai` provider pointed at our ingress (`openai_base_url`, a root key). Codex
+ * keeps its ChatGPT sign-in and sends GPT turns here; the ingress passes them to the ChatGPT backend
+ * on one of the signed-in accounts, so running out on one account moves Codex to the next without
+ * a sign-out. A user's own `openai_base_url` is left alone (and then this does not apply).
+ */
+function withOpenAiRoute(content, port) {
+    const stripped = withoutOwnedBlock(content, OPENAI_START, OPENAI_END);
+    if (port === undefined || /^\s*openai_base_url\s*=/m.test(beforeFirstTable(stripped)[0]))
+        return stripped;
+    const block = `${OPENAI_START}\nopenai_base_url = "http://127.0.0.1:${port}/v1"\n${OPENAI_END}`;
+    return `${block}\n\n${stripped}`.replace(/\n+$/, "\n");
+}
+/** Whether Codex's own GPT traffic goes through ClaudeRipple (our route block is in place). */
+export function codexOpenAiRouted(home = codexHome()) {
+    try {
+        return fs.readFileSync(configFile(home), "utf8").includes(OPENAI_START);
+    }
+    catch {
+        return false;
+    }
+}
 function profileBlock() {
     return `${PROFILE_START}
 model_provider = "clauderipple"
@@ -146,7 +170,7 @@ export function codexOn(port, home = codexHome(), models = []) {
     const beforeConfig = fs.existsSync(config) ? fs.readFileSync(config, "utf8") : "";
     const beforeProfile = fs.existsSync(profile) ? fs.readFileSync(profile, "utf8") : "";
     const catalog = models.length ? writeCodexCatalog(models, home) : undefined;
-    const nextConfig = withCatalog(appendBlock(withoutOwnedBlock(beforeConfig, START, END), providerBlock(port)), catalog);
+    const nextConfig = withOpenAiRoute(withCatalog(appendBlock(withoutOwnedBlock(beforeConfig, START, END), providerBlock(port)), catalog), port);
     const nextProfile = appendBlock(withoutOwnedBlock(beforeProfile, PROFILE_START, PROFILE_END), profileBlock());
     if (nextConfig === beforeConfig && nextProfile === beforeProfile)
         return { changed: false, config, profile };
@@ -162,7 +186,7 @@ export function codexOff(home = codexHome()) {
     const profile = profileFile(home);
     const beforeConfig = fs.existsSync(config) ? fs.readFileSync(config, "utf8") : "";
     const beforeProfile = fs.existsSync(profile) ? fs.readFileSync(profile, "utf8") : "";
-    const nextConfig = withoutDanglingSelection(withoutOwnedBlock(withoutOwnedBlock(beforeConfig, START, END), CATALOG_START, CATALOG_END));
+    const nextConfig = withoutDanglingSelection(withoutOwnedBlock(withoutOwnedBlock(withoutOwnedBlock(beforeConfig, START, END), CATALOG_START, CATALOG_END), OPENAI_START, OPENAI_END));
     const nextProfile = withoutOwnedBlock(beforeProfile, PROFILE_START, PROFILE_END);
     fs.rmSync(catalogFile(home), { force: true });
     if (nextConfig === beforeConfig && nextProfile === beforeProfile)

package/dist/cli/src/index.js

@@ -340,8 +340,8 @@ function help() {
   config            print the config file path
   ui                open the dashboard in your browser
   tray [--install]  start the menu-bar / tray app (--install fetches Electron, ~270MB, once)
-  login             sign in to ChatGPT (opens your browser; tokens stay in the home dir)
-  logout            forget the ChatGPT login made with "login"
+  login             add a ChatGPT account (opens your browser; run again to add another — they take turns when one runs out)
+  logout            forget every ChatGPT account added with "login" (the Codex CLI's own login is left alone)
   claude-login      connect a Claude subscription in the browser (--setup-token: via \`claude setup-token\`; --manual: paste the code)
   claude-logout     remove every Claude subscription added to ClaudeRipple
   picker on|off     show your mapped models by name in the Claude Desktop picker (trusts the CA in your login keychain, routes the app through ClaudeRipple)
@@ -426,17 +426,24 @@ try {
         }
         case "login": {
             const { login } = await import("../../router/src/providers/chatgpt/auth.js");
-            console.log("Opening your browser to sign in to ChatGPT. Sign in there; this window waits up to 5 minutes.");
-            const t = await login(homeDir(), (url) => {
+            const { saveChatGptAccount, readChatGptAccounts, chatgptAccountsPath } = await import("../../router/src/providers/chatgpt/accounts.js");
+            const before = readChatGptAccounts(homeDir()).length;
+            console.log(before > 0
+                ? `Opening your browser to add a ChatGPT account (${before} signed in already). Sign in with the account to add; this window waits up to 5 minutes.`
+                : "Opening your browser to sign in to ChatGPT. Sign in there; this window waits up to 5 minutes.");
+            const grant = await login((url) => {
                 if (!openBrowser(url))
                     console.log(`Open this URL manually:\n${url}`);
             });
-            console.log(`✓ signed in (account ${t.accountId.slice(0, 8)}…, token valid until ${new Date(t.expiresAt).toLocaleString()}). Stored in ${homeDir()}/chatgpt-auth.json`);
+            const saved = saveChatGptAccount(homeDir(), grant);
+            const total = readChatGptAccounts(homeDir()).length;
+            console.log(`${saved.added ? "✓ added" : "✓ signed in again as"} ${saved.email ?? saved.label} (token valid until ${new Date(grant.expiresAt).toLocaleString()}). ${total} ChatGPT account${total === 1 ? "" : "s"} in ${chatgptAccountsPath(homeDir())}`);
             break;
         }
         case "logout": {
-            const { logout } = await import("../../router/src/providers/chatgpt/auth.js");
-            console.log(logout(homeDir()) ? "✓ ChatGPT login removed" : "no ChatGPT login stored");
+            const { removeAllChatGptAccounts } = await import("../../router/src/providers/chatgpt/accounts.js");
+            const removed = removeAllChatGptAccounts(homeDir());
+            console.log(removed > 0 ? `✓ removed ${removed} ChatGPT account${removed === 1 ? "" : "s"}` : "no ChatGPT account stored");
             break;
         }
         case "claude-login": {

package/dist/router/src/admin.js

@@ -4,8 +4,10 @@
 //   GET  /api/config    raw config.json
 //   PUT  /api/config    validate + atomically save config.json (router picks it up via mtime)
 //   GET  /api/logs?n=   tail of router.log
-//   POST /api/chatgpt-login  begin ChatGPT browser login without holding the request open
+//   POST /api/chatgpt-login  begin ChatGPT browser login (adds an account) without holding the request open
 //   GET  /api/chatgpt-login  ChatGPT browser login state and credential status
+//   GET  /api/chatgpt-accounts?provider=   signed-in ChatGPT accounts, rotation state, quota (no tokens)
+//   PATCH/DELETE /api/chatgpt-accounts/:id rename, pause/resume, clear a cooldown; remove
 //   GET  /*             static files from packages/ui (the GUI itself)
 import crypto from "node:crypto";
 import fs from "node:fs";
@@ -29,6 +31,7 @@ import { syncModelSlots } from "../../cli/src/settings.js";
 import { ClaudeOAuthSession } from "./providers/claude-oauth.js";
 import { readClaudeAuthFile } from "./providers/anthropic-token-file.js";
 import { listClaudeAccounts, removeClaudeAccount, renameClaudeAccount } from "./providers/anthropic-accounts.js";
+import { readChatGptAccounts, removeChatGptAccount, summarize as summarizeChatGptAccount, updateChatGptAccount } from "./providers/chatgpt/accounts.js";
 const MAX_BODY = 1024 * 1024;
 const here = path.dirname(fileURLToPath(import.meta.url));
 const STARTED_AT = new Date().toISOString();
@@ -186,7 +189,7 @@ function tcpReachable(hostname, port, timeoutMs = 2000) {
  * the first request is ever made. "auto" accepts either our own login or a Codex CLI one.
  */
 export function chatgptSignedIn(mode) {
-    const own = fs.existsSync(path.join(homeDir(), "chatgpt-auth.json"));
+    const own = readChatGptAccounts(homeDir()).length > 0;
     const borrowed = fs.existsSync(path.join(os.homedir(), ".codex", "auth.json"));
     return mode === "own" ? own : mode === "borrow-codex" ? borrowed : own || borrowed;
 }
@@ -305,7 +308,9 @@ async function buildStatus(deps, opts = {}) {
             pointsAtRouter: env.HTTPS_PROXY === wantProxy,
         },
         cliVersion: cliVersion(),
-        chatgpt: { ...chatgpt, signedIn, ...(stale ? { stale: true, staleReason: staleReasons } : {}) },
+        // `quota` stays one snapshot per provider (the account in use) for the readers that want one
+        // number; `accounts` is the per-account view, read after the refresh above so it is as fresh.
+        chatgpt: { ...chatgpt, signedIn, accounts: chatgpt.accounts?.() ?? {}, ...(stale ? { stale: true, staleReason: staleReasons } : {}) },
         // Only present for providers that declare a pool; a provider with one credential has nothing
         // to report and would only add a row that never changes.
         credentials: deps.credentials?.() ?? {},
@@ -1136,7 +1141,72 @@ export function startAdmin(deps) {
             }
             if (pathname === "/api/chatgpt-login" && method === "GET") {
                 const provider = Object.values(deps.config().providers).find((candidate) => candidate.type === "chatgpt");
-                sendJson(res, 200, { ...chatgptLogin, signedIn: chatgptSignedIn(provider?.auth) });
+                sendJson(res, 200, { ...chatgptLogin, signedIn: chatgptSignedIn(provider?.auth), accountCount: readChatGptAccounts(homeDir()).length });
+                return;
+            }
+            // Safe account metadata only: labels, emails, plan, rotation state and quota. Tokens and the
+            // workspace id stay in the router.
+            if (pathname === "/api/chatgpt-accounts" && method === "GET") {
+                const all = deps.chatgpt?.().accounts?.() ?? {};
+                const wanted = new URL(url, "http://127.0.0.1").searchParams.get("provider");
+                const name = wanted && all[wanted] ? wanted : Object.keys(all)[0];
+                const accounts = name ? all[name] : readChatGptAccounts(homeDir()).map(summarizeChatGptAccount);
+                sendJson(res, 200, { provider: name ?? null, accounts });
+                return;
+            }
+            if (pathname.startsWith("/api/chatgpt-accounts/") && (method === "PATCH" || method === "DELETE")) {
+                let id;
+                try {
+                    id = decodeURIComponent(pathname.slice("/api/chatgpt-accounts/".length));
+                }
+                catch {
+                    sendJson(res, 400, { error: "invalid account id" });
+                    return;
+                }
+                const own = id === "legacy" || /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(id);
+                if (!own && id !== "codex") {
+                    sendJson(res, 400, { error: "invalid account id" });
+                    return;
+                }
+                if (method === "DELETE") {
+                    if (id === "codex") {
+                        sendJson(res, 409, { error: "the Codex CLI's login belongs to Codex; sign out there instead" });
+                        return;
+                    }
+                    if (!removeChatGptAccount(homeDir(), id)) {
+                        sendJson(res, 404, { error: "ChatGPT account not found" });
+                        return;
+                    }
+                    deps.log.info(`admin: removed ChatGPT account ${id.slice(0, 8)}`);
+                    sendJson(res, 200, { ok: true });
+                    return;
+                }
+                let change;
+                try {
+                    change = JSON.parse((await readBody(req)).toString("utf8"));
+                }
+                catch {
+                    sendJson(res, 400, { error: "invalid JSON" });
+                    return;
+                }
+                if ((change.label !== undefined && (typeof change.label !== "string" || !change.label.trim())) || (change.paused !== undefined && typeof change.paused !== "boolean")) {
+                    sendJson(res, 400, { error: "expected {label?: non-empty string, paused?: boolean, clearCooldown?: true}" });
+                    return;
+                }
+                if (change.clearCooldown === true)
+                    deps.chatgpt?.().clearCooldown?.(id);
+                if (change.label !== undefined || change.paused !== undefined) {
+                    if (id === "codex") {
+                        sendJson(res, 409, { error: "the Codex CLI's login cannot be renamed or paused here" });
+                        return;
+                    }
+                    if (!updateChatGptAccount(homeDir(), id, { ...(typeof change.label === "string" ? { label: change.label } : {}), ...(typeof change.paused === "boolean" ? { paused: change.paused } : {}) })) {
+                        sendJson(res, 404, { error: "ChatGPT account not found" });
+                        return;
+                    }
+                }
+                deps.log.info(`admin: updated ChatGPT account ${id.slice(0, 8)}`);
+                sendJson(res, 200, { ok: true });
                 return;
             }
             if (pathname === "/api/chatgpt-login" && method === "POST") {

package/dist/router/src/index.js

@@ -85,7 +85,7 @@ const health = new UpstreamHealth(() => store.get().health.maxConsecutiveUpstrea
 });
 const observedClaudeCodeAuth = new ObservedClaudeCodeAuth(path.join(home, "claude-auth-observed.json"));
 const proxy = new Proxy({ config: () => store.get(), log, certs, health, home, requests, observedClaudeCodeAuth });
-const ingress = new OpenAiIngress({ config: () => store.get(), log, requests, home, observedClaudeCodeAuth });
+const ingress = new OpenAiIngress({ config: () => store.get(), log, requests, home, observedClaudeCodeAuth, chatgpt: (name) => proxy.chatgptForCodex(name) });
 process.on("uncaughtException", (e) => log.error(`uncaught ${e.stack ?? e}`));
 process.on("unhandledRejection", (e) => log.error(`unhandled ${e?.stack ?? e}`));
 const DRAIN_MS = 90_000; // new model calls are refused during drain, so this is the longest single call we wait for; `clauderipple restart` waits 120s
@@ -142,7 +142,14 @@ proxy
         health: () => health.consecutiveFailures,
         version: VERSION,
         requests,
-        chatgpt: () => ({ quota: proxy.chatgptRateLimits, auth: proxy.chatgptAuthStatus(), refresh: (name) => proxy.chatgptFetchRateLimits(name), models: (name) => proxy.chatgptFetchModels(name) }),
+        chatgpt: () => ({
+            quota: proxy.chatgptRateLimits,
+            auth: proxy.chatgptAuthStatus(),
+            refresh: (name) => proxy.chatgptFetchRateLimits(name),
+            models: (name) => proxy.chatgptFetchModels(name),
+            accounts: () => proxy.chatgptAccounts(),
+            clearCooldown: (id) => proxy.chatgptClearCooldown(id),
+        }),
         credentials: () => proxy.credentialHealth(),
         picker: () => ({ enabled: !!store.get().picker?.enabled, hosts: terminateHosts(store.get()).slice(1), last: proxy.lastPickerInjection }),
         observedClaudeCodeAuth,

package/dist/router/src/ingress/server.js

@@ -5,6 +5,7 @@ import http from "node:http";
 import https from "node:https";
 import os from "node:os";
 import path from "node:path";
+import zlib from "node:zlib";
 import { providerFor } from "../config.js";
 import { resolve } from "../routing.js";
 import { PRESETS } from "../presets.js";
@@ -19,6 +20,38 @@ import { ObservedClaudeCodeAuth } from "../providers/anthropic-observed.js";
 import { ResponsesEventMapper, chatToAnthropic, formatDataSse, formatSse, responsesEventsToChatChunks, responsesToAnthropic, responsesToChatCompletion, } from "./translate.js";
 const MAX_BODY = 64 * 1024 * 1024;
 const HOP_BY_HOP = new Set(["connection", "keep-alive", "proxy-connection", "transfer-encoding", "upgrade", "host", "content-length", "authorization"]);
+/**
+ * The request body as JSON text. Codex signed in to ChatGPT compresses what it sends with zstd
+ * (`content-encoding: zstd`, measured 2026-09-24 with the Codex CLI through `openai_base_url`), so
+ * reading it raw fails before the model is even known. Throws on an encoding we cannot read.
+ */
+export function decodeRequestBody(raw, encoding) {
+    const name = (Array.isArray(encoding) ? encoding.join(",") : encoding ?? "").trim().toLowerCase();
+    if (!name || name === "identity")
+        return raw;
+    if (name === "zstd")
+        return zlib.zstdDecompressSync(raw);
+    if (name === "gzip" || name === "x-gzip")
+        return zlib.gunzipSync(raw);
+    if (name === "deflate")
+        return zlib.inflateSync(raw);
+    if (name === "br")
+        return zlib.brotliDecompressSync(raw);
+    throw new Error(`unsupported content-encoding ${name}`);
+}
+/** A model Codex means for OpenAI: in the chatgpt provider's list, or named the way OpenAI names them. */
+export function isChatGptModel(model, cfg) {
+    if (/^(gpt-|codex-|chatgpt-|o\d)/i.test(model))
+        return true;
+    return Object.values(cfg.providers).some((p) => p.type === "chatgpt" && (p.models ?? []).some((m) => m.id === model));
+}
+/** The conversation a Codex request belongs to, as Codex names it: its session header, else the cache key. */
+function codexConversation(req, body) {
+    const header = req.headers.session_id ?? req.headers["session-id"] ?? req.headers["thread-id"];
+    if (typeof header === "string" && header)
+        return header;
+    return body && typeof body.prompt_cache_key === "string" ? body.prompt_cache_key : undefined;
+}
 function openAiError(message, type = "invalid_request_error", code = null) {
     return { error: { message, type, param: null, code } };
 }
@@ -107,6 +140,11 @@ export class OpenAiIngress {
         });
         this.server = http.createServer({ maxHeaderSize: 64 * 1024 }, (req, res) => void this.handle(req, res));
         this.server.keepAliveTimeout = 65_000;
+        // Codex tries a WebSocket for Responses first when its OpenAI provider points here. Answering
+        // 426 is what makes it fall back to SSE over HTTP; an unanswered upgrade leaves it hanging.
+        this.server.on("upgrade", (_req, socket) => {
+            socket.end("HTTP/1.1 426 Upgrade Required\r\nconnection: close\r\ncontent-length: 0\r\n\r\n");
+        });
         this.server.on("connection", (socket) => {
             this.sockets.add(socket);
             socket.once("close", () => this.sockets.delete(socket));
@@ -148,7 +186,7 @@ export class OpenAiIngress {
     async handle(req, res) {
         const path = (req.url ?? "/").split("?")[0] ?? "/";
         const method = req.method ?? "GET";
-        const isCall = method === "POST" && (path === "/v1/responses" || path === "/v1/chat/completions");
+        const isCall = method === "POST" && (path === "/v1/responses" || path === "/v1/responses/compact" || path === "/v1/chat/completions");
         this.stats.started++;
         this.stats.inFlight++;
         if (isCall)
@@ -193,6 +231,15 @@ export class OpenAiIngress {
                 finish(499, 0, { note: "client closed" });
         });
         try {
+            const query = (req.url ?? "").includes("?") ? (req.url ?? "").slice((req.url ?? "").indexOf("?")) : "";
+            // Codex signed in to ChatGPT refreshes its model catalogue with `?client_version=`: that is the
+            // backend's list, so it comes from the backend, on one of the accounts.
+            if (path === "/v1/models" && method === "GET" && /[?&]client_version=/.test(query) && this.deps.chatgpt) {
+                req.resume();
+                const outcome = await this.deps.chatgpt(null).passthrough(req, res, `/models${query}`, undefined, undefined);
+                finish(outcome.status, outcome.bytes, { note: "codex models passthrough" });
+                return;
+            }
             if (path === "/v1/models" && method === "GET") {
                 const data = ingressModels(this.deps.config()).map((m) => ({ id: m.id, object: "model", created: 0, owned_by: m.provider }));
                 const bytes = sendJson(res, 200, { object: "list", data });
@@ -219,8 +266,10 @@ export class OpenAiIngress {
                 return;
             }
             let body;
+            let raw;
             try {
-                body = JSON.parse((await readBody(req)).toString("utf8"));
+                raw = await readBody(req);
+                body = JSON.parse(decodeRequestBody(raw, req.headers["content-encoding"]).toString("utf8"));
             }
             catch (error) {
                 const bytes = sendJson(res, 400, openAiError(`Invalid JSON request: ${error.message}`));
@@ -239,10 +288,35 @@ export class OpenAiIngress {
             }
             const requested = typeof body.model === "string" ? body.model : "";
             const cfg = this.deps.config();
+            const explicit = resolve(requested, {}, cfg);
+            const explicitProvider = explicit ? cfg.providers[explicit.provider] : undefined;
+            // Codex's own GPT traffic (its OpenAI provider pointed here): passed through to the ChatGPT
+            // backend on one of the signed-in accounts. A GPT model routed elsewhere on purpose is not.
+            const toChatGpt = path.startsWith("/v1/responses") && this.deps.chatgpt
+                && (explicitProvider ? explicitProvider.type === "chatgpt" : isChatGptModel(requested, cfg));
+            if (toChatGpt) {
+                const adapter = this.deps.chatgpt(explicitProvider ? explicit.provider : null);
+                // As sent, compressed or not; only a mapping to another model name means rewriting it (and
+                // then it goes out uncompressed).
+                const renamed = explicit && explicit.model !== requested;
+                const payload = renamed ? Buffer.from(JSON.stringify({ ...body, model: explicit.model })) : raw;
+                record = { kind: "messages", source: requested, target: explicit?.model ?? requested, provider: adapter.name, stream: body.stream === true };
+                const outcome = await adapter.passthrough(req, res, path.slice("/v1".length), payload, codexConversation(req, body), {
+                    bodyEncoded: !renamed,
+                    onCompleted: (done) => { terminal = { status: done.status, bytes: done.bytes, ...(done.usage ? { usage: done.usage } : {}), ...(done.note ? { note: done.note } : {}) }; },
+                });
+                finish(outcome.status, outcome.bytes, { ...(outcome.usage ? { usage: outcome.usage } : {}), ...(outcome.note ? { note: outcome.note } : {}) });
+                return;
+            }
+            if (path === "/v1/responses/compact") {
+                const bytes = sendJson(res, 400, openAiError("Remote compaction is only available for ChatGPT models", "invalid_request_error", "unsupported_endpoint"));
+                finish(400, bytes);
+                return;
+            }
             // Unmapped models default to the native `anthropic` provider when one is configured, so a
             // Codex user can name any Claude model directly (`-m claude-sonnet-5`) without a mapping.
             const fallback = Object.entries(cfg.providers).find(([, p]) => p.type === "anthropic");
-            const route = resolve(requested, {}, cfg) ?? (fallback && requested ? { provider: fallback[0], model: requested, effort: undefined, tag: `${requested}->${requested}` } : null);
+            const route = explicit ?? (fallback && requested ? { provider: fallback[0], model: requested, effort: undefined, tag: `${requested}->${requested}` } : null);
             if (!route) {
                 const bytes = sendJson(res, 400, openAiError(`No ClaudeRipple route for model ${requested || "(missing)"}`, "invalid_request_error", "model_not_found"));
                 finish(400, bytes);

package/dist/router/src/locked-file.js

@@ -0,0 +1,80 @@
+// Secret-bearing JSON files that more than one process writes: the router refreshes tokens while a
+// `clauderipple login` in another terminal adds an account. Every mutation holds a cross-process
+// lock and replaces the file atomically, so a reader sees the old file or the new one, never half.
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { lockSync } from "proper-lockfile";
+const LOCK_STALE_MS = 30_000;
+const LOCK_WAIT_MS = 100;
+const LOCK_TIMEOUT_MS = 2_000;
+/** Run `mutate` while holding the lock for `file`. Waits up to two seconds for another writer. */
+export function withFileLock(file, mutate) {
+    fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+    const deadline = Date.now() + LOCK_TIMEOUT_MS;
+    let release;
+    for (;;) {
+        try {
+            release = lockSync(file, { realpath: false, stale: LOCK_STALE_MS, update: 10_000 });
+            break;
+        }
+        catch (error) {
+            if (error.code !== "ELOCKED" || Date.now() >= deadline)
+                throw error;
+            Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, LOCK_WAIT_MS);
+        }
+    }
+    try {
+        return mutate();
+    }
+    finally {
+        release();
+    }
+}
+/**
+ * Replace `file` with `value` as JSON (mode 0600): flushed temp file, then rename. Returns whether
+ * the directory entry was also made durable — POSIX can fsync a directory, Windows cannot, and a
+ * caller retiring an older copy of the same secret needs to know which it got.
+ */
+export function writeJsonAtomic(file, value) {
+    const dirName = path.dirname(file);
+    fs.mkdirSync(dirName, { recursive: true, mode: 0o700 });
+    const tmp = `${file}.tmp-${process.pid}-${crypto.randomBytes(6).toString("hex")}`;
+    try {
+        const fd = fs.openSync(tmp, "wx", 0o600);
+        try {
+            fs.writeFileSync(fd, JSON.stringify(value, null, 2) + "\n", "utf8");
+            fs.fsyncSync(fd);
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+        fs.renameSync(tmp, file);
+        let directoryDurable = false;
+        try {
+            const dir = fs.openSync(dirName, "r");
+            try {
+                fs.fsyncSync(dir);
+            }
+            finally {
+                fs.closeSync(dir);
+            }
+            directoryDurable = true;
+        }
+        catch (error) {
+            const code = error.code;
+            if (process.platform !== "win32" && code !== "EINVAL" && code !== "ENOTSUP" && code !== "EBADF")
+                throw error;
+        }
+        return { directoryDurable };
+    }
+    finally {
+        try {
+            fs.unlinkSync(tmp);
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+    }
+}