codex-account-orchestrator 1.0.0

package/dist/constants.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_CAPTURED_LINES = exports.QUOTA_ERROR_PATTERNS = exports.DEFAULT_CONFIG_TOML = exports.AUTH_FILE_NAME = exports.REGISTRY_FILE_NAME = void 0;
+exports.REGISTRY_FILE_NAME = "registry.json";
+exports.AUTH_FILE_NAME = "auth.json";
+exports.DEFAULT_CONFIG_TOML = [
+    "# Codex config for this account",
+    "cli_auth_credentials_store = \"file\"",
+    "forced_login_method = \"chatgpt\"",
+    ""
+].join("\n");
+exports.QUOTA_ERROR_PATTERNS = [
+    /usage\s*limit/i,
+    /quota/i,
+    /exceeded/i,
+    /insufficient\s+credits/i,
+    /insufficient\s+quota/i,
+    /credits?\s+exhausted/i
+];
+exports.MAX_CAPTURED_LINES = 200;

package/dist/gateway/account_pool.d.ts

@@ -0,0 +1,25 @@
+import { TokenPair } from "./token_utils";
+export interface AccountState {
+    name: string;
+    accountDir: string;
+    tokens: TokenPair;
+    cooldownUntilMs: number;
+    lastError?: string;
+    consecutiveFailures: number;
+}
+export declare class AccountPool {
+    private readonly accounts;
+    private readonly sessionAssignments;
+    constructor(accounts: AccountState[]);
+    static loadFromRegistry(baseDir: string): AccountPool;
+    getAccounts(): AccountState[];
+    getStickyAccount(sessionKey: string): AccountState | undefined;
+    assignAccount(sessionKey: string, accountName: string): void;
+    clearAssignment(sessionKey: string): void;
+    pickNextAvailable(excluded: Set<string>): AccountState | undefined;
+    markQuota(account: AccountState, cooldownSeconds: number, resetsAtMs?: number): void;
+    markAuthFailure(account: AccountState, message: string): void;
+    markSuccess(account: AccountState): void;
+    updateTokens(account: AccountState, tokens: TokenPair): void;
+    isTokenFresh(account: AccountState, bufferSeconds: number): boolean;
+}

package/dist/gateway/account_pool.js

@@ -0,0 +1,125 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccountPool = void 0;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const paths_1 = require("../paths");
+const registry_store_1 = require("../registry_store");
+const account_manager_1 = require("../account_manager");
+const token_utils_1 = require("./token_utils");
+class AccountPool {
+    accounts;
+    sessionAssignments = new Map();
+    constructor(accounts) {
+        this.accounts = accounts;
+    }
+    static loadFromRegistry(baseDir) {
+        const registry = (0, registry_store_1.loadRegistry)(baseDir);
+        const orderedAccounts = (0, account_manager_1.getAccountOrder)(registry);
+        const accounts = [];
+        for (const name of orderedAccounts) {
+            const accountDir = (0, paths_1.getAccountDir)(baseDir, name);
+            const tokens = loadTokens(accountDir);
+            if (!tokens) {
+                continue;
+            }
+            accounts.push({
+                name,
+                accountDir,
+                tokens,
+                cooldownUntilMs: 0,
+                consecutiveFailures: 0
+            });
+        }
+        return new AccountPool(accounts);
+    }
+    getAccounts() {
+        return this.accounts;
+    }
+    getStickyAccount(sessionKey) {
+        const assigned = this.sessionAssignments.get(sessionKey);
+        if (!assigned) {
+            return undefined;
+        }
+        return this.accounts.find((account) => account.name === assigned);
+    }
+    assignAccount(sessionKey, accountName) {
+        this.sessionAssignments.set(sessionKey, accountName);
+    }
+    clearAssignment(sessionKey) {
+        this.sessionAssignments.delete(sessionKey);
+    }
+    pickNextAvailable(excluded) {
+        const now = Date.now();
+        for (const account of this.accounts) {
+            if (excluded.has(account.name)) {
+                continue;
+            }
+            if (account.cooldownUntilMs > now) {
+                continue;
+            }
+            return account;
+        }
+        return undefined;
+    }
+    markQuota(account, cooldownSeconds, resetsAtMs) {
+        account.consecutiveFailures += 1;
+        account.lastError = "usage_limit_reached";
+        const until = resetsAtMs && resetsAtMs > Date.now() ? resetsAtMs : Date.now() + cooldownSeconds * 1000;
+        account.cooldownUntilMs = until;
+    }
+    markAuthFailure(account, message) {
+        account.consecutiveFailures += 1;
+        account.lastError = message;
+        account.cooldownUntilMs = Date.now() + 60 * 1000;
+    }
+    markSuccess(account) {
+        account.consecutiveFailures = 0;
+        account.lastError = undefined;
+    }
+    updateTokens(account, tokens) {
+        account.tokens = tokens;
+        persistTokens(account.accountDir, tokens);
+    }
+    isTokenFresh(account, bufferSeconds) {
+        return (0, token_utils_1.isTokenFresh)(account.tokens.expiresAtMs, bufferSeconds);
+    }
+}
+exports.AccountPool = AccountPool;
+function loadTokens(accountDir) {
+    const authPath = path_1.default.join(accountDir, "auth.json");
+    if (!fs_1.default.existsSync(authPath)) {
+        return undefined;
+    }
+    const raw = fs_1.default.readFileSync(authPath, "utf8");
+    const data = JSON.parse(raw);
+    const tokens = data.tokens ?? {};
+    if (!tokens.access_token || !tokens.refresh_token) {
+        return undefined;
+    }
+    const details = (0, token_utils_1.deriveTokenDetails)(tokens.access_token, tokens.id_token);
+    return {
+        accessToken: tokens.access_token,
+        refreshToken: tokens.refresh_token,
+        idToken: tokens.id_token,
+        accountId: tokens.account_id ?? details.chatgptAccountId,
+        ...details
+    };
+}
+function persistTokens(accountDir, tokens) {
+    const authPath = path_1.default.join(accountDir, "auth.json");
+    const data = {
+        OPENAI_API_KEY: null,
+        tokens: {
+            access_token: tokens.accessToken,
+            refresh_token: tokens.refreshToken,
+            id_token: tokens.idToken,
+            account_id: tokens.accountId
+        },
+        last_refresh: new Date().toISOString()
+    };
+    fs_1.default.writeFileSync(authPath, JSON.stringify(data, null, 2) + "\n", "utf8");
+}

package/dist/gateway/codex_config.d.ts

@@ -0,0 +1,6 @@
+export interface CodexConfigUpdate {
+    baseUrl: string;
+}
+export declare function enableGatewayConfig(update: CodexConfigUpdate): void;
+export declare function disableGatewayConfig(): void;
+export declare function getCodexConfigPath(): string;

package/dist/gateway/codex_config.js

@@ -0,0 +1,73 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.enableGatewayConfig = enableGatewayConfig;
+exports.disableGatewayConfig = disableGatewayConfig;
+exports.getCodexConfigPath = getCodexConfigPath;
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const BACKUP_SUFFIX = ".cao.bak";
+function enableGatewayConfig(update) {
+    const configPath = getCodexConfigPath();
+    const original = fs_1.default.existsSync(configPath) ? fs_1.default.readFileSync(configPath, "utf8") : "";
+    ensureBackup(configPath, original);
+    let updated = original;
+    if (/^model_provider\s*=.*$/m.test(updated)) {
+        updated = updated.replace(/^model_provider\s*=.*$/m, 'model_provider = "openai"');
+    }
+    else {
+        updated = `model_provider = "openai"\n${updated}`;
+    }
+    updated = upsertOpenAiBaseUrl(updated, update.baseUrl);
+    fs_1.default.writeFileSync(configPath, `${updated.trimEnd()}\n`, "utf8");
+}
+function disableGatewayConfig() {
+    const configPath = getCodexConfigPath();
+    const backupPath = `${configPath}${BACKUP_SUFFIX}`;
+    if (!fs_1.default.existsSync(backupPath)) {
+        return;
+    }
+    const backup = fs_1.default.readFileSync(backupPath, "utf8");
+    fs_1.default.writeFileSync(configPath, backup, "utf8");
+    fs_1.default.rmSync(backupPath, { force: true });
+}
+function getCodexConfigPath() {
+    return path_1.default.join(os_1.default.homedir(), ".codex", "config.toml");
+}
+function ensureBackup(configPath, content) {
+    const backupPath = `${configPath}${BACKUP_SUFFIX}`;
+    if (fs_1.default.existsSync(backupPath)) {
+        return;
+    }
+    fs_1.default.writeFileSync(backupPath, content, "utf8");
+}
+function buildProviderBlock(baseUrl) {
+    return [
+        "[model_providers.openai]",
+        "name = \"OpenAI\"",
+        `base_url = \"${baseUrl}\"`,
+        ""
+    ].join("\n");
+}
+function upsertOpenAiBaseUrl(configText, baseUrl) {
+    const blockRegex = /\[model_providers\.openai\][\s\S]*?(?=\n\[|$)/;
+    if (blockRegex.test(configText)) {
+        const block = configText.match(blockRegex)?.[0] ?? "";
+        let updatedBlock = block;
+        if (/^base_url\s*=.*$/m.test(updatedBlock)) {
+            updatedBlock = updatedBlock.replace(/^base_url\s*=.*$/m, `base_url = \"${baseUrl}\"`);
+        }
+        else {
+            updatedBlock = `${updatedBlock.trimEnd()}\nbase_url = \"${baseUrl}\"\n`;
+        }
+        if (!/^name\s*=.*$/m.test(updatedBlock)) {
+            updatedBlock = updatedBlock.replace(/\[model_providers\.openai\]\n?/, "[model_providers.openai]\nname = \"OpenAI\"\n");
+        }
+        return configText.replace(blockRegex, updatedBlock.trimEnd());
+    }
+    const appendedBlock = buildProviderBlock(baseUrl);
+    return `${configText.trimEnd()}\n\n${appendedBlock}`;
+}

package/dist/gateway/codex_shim.d.ts

@@ -0,0 +1,7 @@
+export interface ShimResult {
+    shimPath: string;
+    realCodexPath: string;
+    inPath: boolean;
+}
+export declare function enableGatewayShim(baseUrl: string): ShimResult;
+export declare function disableGatewayShim(): boolean;

package/dist/gateway/codex_shim.js

@@ -0,0 +1,83 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.enableGatewayShim = enableGatewayShim;
+exports.disableGatewayShim = disableGatewayShim;
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
+const SHIM_MARKER = "# CAO GATEWAY SHIM";
+const REAL_CODEX_PATH_FILE = "real_codex_path";
+function enableGatewayShim(baseUrl) {
+    const realCodexPath = resolveCodexPath();
+    const shimDir = resolveShimDir();
+    const shimPath = path_1.default.join(shimDir, "codex");
+    if (!fs_1.default.existsSync(shimDir)) {
+        fs_1.default.mkdirSync(shimDir, { recursive: true });
+    }
+    const script = [
+        "#!/usr/bin/env bash",
+        SHIM_MARKER,
+        `REAL_CODEX=\"${realCodexPath}\"`,
+        `export OPENAI_BASE_URL=\"${baseUrl}\"`,
+        "exec \"$REAL_CODEX\" \"$@\"",
+        ""
+    ].join("\n");
+    fs_1.default.writeFileSync(shimPath, script, { encoding: "utf8", mode: 0o755 });
+    const dataDir = path_1.default.join(os_1.default.homedir(), ".codex-account-orchestrator");
+    if (!fs_1.default.existsSync(dataDir)) {
+        fs_1.default.mkdirSync(dataDir, { recursive: true });
+    }
+    fs_1.default.writeFileSync(path_1.default.join(dataDir, REAL_CODEX_PATH_FILE), realCodexPath, "utf8");
+    return {
+        shimPath,
+        realCodexPath,
+        inPath: isDirInPath(shimDir)
+    };
+}
+function disableGatewayShim() {
+    const shimDir = resolveShimDir();
+    const shimPath = path_1.default.join(shimDir, "codex");
+    if (!fs_1.default.existsSync(shimPath)) {
+        return false;
+    }
+    const contents = fs_1.default.readFileSync(shimPath, "utf8");
+    if (!contents.includes(SHIM_MARKER)) {
+        return false;
+    }
+    fs_1.default.rmSync(shimPath, { force: true });
+    return true;
+}
+function resolveCodexPath() {
+    const shimPath = path_1.default.join(resolveShimDir(), "codex");
+    const whichOutput = (0, child_process_1.execSync)("which -a codex", { encoding: "utf8" })
+        .split("\n")
+        .map((line) => line.trim())
+        .filter(Boolean);
+    for (const line of whichOutput) {
+        if (line.includes("aliased to")) {
+            continue;
+        }
+        if (line === shimPath) {
+            continue;
+        }
+        if (fs_1.default.existsSync(line)) {
+            return line;
+        }
+    }
+    const fallback = (0, child_process_1.execSync)("command -v codex", { encoding: "utf8" }).trim();
+    if (!fallback || fallback === shimPath) {
+        throw new Error("codex binary not found in PATH (or only the CAO shim is present). Disable the shim first.");
+    }
+    return fallback;
+}
+function resolveShimDir() {
+    return path_1.default.join(os_1.default.homedir(), ".local", "bin");
+}
+function isDirInPath(dir) {
+    const envPath = process.env.PATH ?? "";
+    return envPath.split(":").includes(dir);
+}

package/dist/gateway/gateway_config.d.ts

@@ -0,0 +1,14 @@
+export interface GatewayConfig {
+    bindAddress: string;
+    port: number;
+    baseUrl: string;
+    oauthClientId: string;
+    cooldownSeconds: number;
+    maxRetryPasses: number;
+    requestTimeoutMs: number;
+    overrideAuth: boolean;
+}
+export declare function resolveGatewayConfig(overrides: Partial<GatewayConfig>): GatewayConfig;
+export declare function getGatewayConfigPath(): string;
+export declare function loadGatewayConfig(): Partial<GatewayConfig>;
+export declare function saveGatewayConfig(config: Partial<GatewayConfig>): void;

package/dist/gateway/gateway_config.js

@@ -0,0 +1,46 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveGatewayConfig = resolveGatewayConfig;
+exports.getGatewayConfigPath = getGatewayConfigPath;
+exports.loadGatewayConfig = loadGatewayConfig;
+exports.saveGatewayConfig = saveGatewayConfig;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const DEFAULT_CONFIG = {
+    bindAddress: "127.0.0.1",
+    port: 4319,
+    baseUrl: "https://chatgpt.com/backend-api/codex",
+    oauthClientId: "app_EMoamEEZ73f0CkXaXp7hrann",
+    cooldownSeconds: 900,
+    maxRetryPasses: 1,
+    requestTimeoutMs: 120_000,
+    overrideAuth: true
+};
+function resolveGatewayConfig(overrides) {
+    return {
+        ...DEFAULT_CONFIG,
+        ...overrides
+    };
+}
+function getGatewayConfigPath() {
+    return path_1.default.join(process.env.HOME ?? "", ".codex-account-orchestrator", "gateway.json");
+}
+function loadGatewayConfig() {
+    const configPath = getGatewayConfigPath();
+    if (!fs_1.default.existsSync(configPath)) {
+        return {};
+    }
+    const raw = fs_1.default.readFileSync(configPath, "utf8");
+    return JSON.parse(raw);
+}
+function saveGatewayConfig(config) {
+    const configPath = getGatewayConfigPath();
+    const dir = path_1.default.dirname(configPath);
+    if (!fs_1.default.existsSync(dir)) {
+        fs_1.default.mkdirSync(dir, { recursive: true });
+    }
+    fs_1.default.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n", "utf8");
+}

package/dist/gateway/openai_gateway.d.ts

@@ -0,0 +1,15 @@
+import { IncomingMessage, ServerResponse } from "http";
+import { AccountPool } from "./account_pool";
+import { GatewayConfig } from "./gateway_config";
+export declare class OpenAiGateway {
+    private readonly pool;
+    private readonly config;
+    private readonly inFlightRefresh;
+    constructor(pool: AccountPool, config: GatewayConfig);
+    handleRequest(req: IncomingMessage, res: ServerResponse): Promise<void>;
+    private selectAccount;
+    private forwardRequest;
+    private fetchOnce;
+    private ensureAccessToken;
+    private refreshToken;
+}