codex-monitor 0.1.0

package/README.md

@@ -0,0 +1,43 @@
+# codex-monitor
+
+Generate a local QR code that imports your Codex login state into Token Monitor on iOS.
+
+The command reads `~/.codex/auth.json` on your Mac, builds a `tokenmonitor://import-codex?...` QR payload, and writes a PNG locally. It does not start a server and does not upload tokens anywhere.
+
+## Install
+
+From this package directory:
+
+```bash
+npm install -g .
+```
+
+After publishing:
+
+```bash
+npm install -g codex-monitor
+```
+
+## Use
+
+```bash
+codex-monitor --open
+```
+
+Then open Token Monitor on iPhone:
+
+1. Go to `Codex dynamic import`.
+2. Tap `Scan Codex credential QR`.
+3. Scan the generated QR code.
+
+The iOS app stores the imported credential in the device Keychain and refreshes Codex quota directly from the device.
+
+## Options
+
+```bash
+codex-monitor --auth-file ~/.codex/auth.json --output codex-import-qr.png
+codex-monitor --no-terminal --open
+codex-monitor --json
+```
+
+The QR code contains a refresh token and should be treated as a secret. Do not share it.

package/bin/token-monitor-codex-qr.js

@@ -0,0 +1,182 @@
+#!/usr/bin/env node
+
+import { readFile, chmod, mkdir } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { homedir } from "node:os";
+import { spawnSync } from "node:child_process";
+import QRCode from "qrcode";
+
+const DEFAULT_AUTH_PATH = "~/.codex/auth.json";
+const DEFAULT_OUTPUT = "codex-import-qr.png";
+
+main().catch((error) => {
+  console.error(`codex-monitor: ${error.message}`);
+  process.exitCode = 1;
+});
+
+async function main() {
+  const options = parseArgs(process.argv.slice(2));
+  if (options.help) {
+    printHelp();
+    return;
+  }
+
+  const authPath = expandHome(options.authFile ?? DEFAULT_AUTH_PATH);
+  const outputPath = resolve(process.cwd(), options.output ?? DEFAULT_OUTPUT);
+  const auth = await readCodexAuth(authPath);
+  const qrPayload = buildImportURL(auth);
+
+  await mkdir(dirname(outputPath), { recursive: true });
+  await QRCode.toFile(outputPath, qrPayload, {
+    errorCorrectionLevel: "M",
+    margin: 4,
+    scale: 10,
+    type: "png"
+  });
+  await chmod(outputPath, 0o600);
+
+  if (options.terminal !== false) {
+    const terminalQR = await QRCode.toString(qrPayload, { type: "terminal" });
+    console.log(terminalQR);
+  }
+
+  if (options.json) {
+    console.log(JSON.stringify({
+      output: outputPath,
+      payloadChars: qrPayload.length
+    }, null, 2));
+  } else {
+    console.log(`QR code written to ${outputPath}`);
+    console.log("Scan it in Token Monitor: Codex dynamic import -> Scan Codex credential QR.");
+  }
+
+  if (options.open) {
+    openFile(outputPath);
+  }
+}
+
+function parseArgs(args) {
+  const options = {
+    terminal: true,
+    help: false,
+    json: false,
+    open: false
+  };
+
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    switch (arg) {
+      case "--help":
+      case "-h":
+        options.help = true;
+        break;
+      case "--auth-file":
+        options.authFile = requireValue(args, index, arg);
+        index += 1;
+        break;
+      case "--output":
+      case "-o":
+        options.output = requireValue(args, index, arg);
+        index += 1;
+        break;
+      case "--no-terminal":
+        options.terminal = false;
+        break;
+      case "--json":
+        options.json = true;
+        options.terminal = false;
+        break;
+      case "--open":
+        options.open = true;
+        break;
+      default:
+        throw new Error(`unknown option: ${arg}`);
+    }
+  }
+
+  return options;
+}
+
+function requireValue(args, index, optionName) {
+  const value = args[index + 1];
+  if (!value || value.startsWith("-")) {
+    throw new Error(`${optionName} requires a value`);
+  }
+  return value;
+}
+
+async function readCodexAuth(authPath) {
+  let raw;
+  try {
+    raw = await readFile(authPath, "utf8");
+  } catch {
+    throw new Error(`cannot read Codex auth file at ${authPath}`);
+  }
+
+  let auth;
+  try {
+    auth = JSON.parse(raw);
+  } catch {
+    throw new Error(`Codex auth file is not valid JSON: ${authPath}`);
+  }
+
+  const tokens = auth.tokens ?? {};
+  if (!tokens.refresh_token || !tokens.account_id) {
+    throw new Error("Codex auth file must contain tokens.refresh_token and tokens.account_id");
+  }
+  return auth;
+}
+
+function buildImportURL(auth) {
+  const tokens = auth.tokens ?? {};
+  const loginState = {
+    auth_mode: auth.auth_mode,
+    tokens: {
+      refresh_token: tokens.refresh_token,
+      account_id: tokens.account_id
+    },
+    last_refresh: auth.last_refresh
+  };
+  const envelope = {
+    kind: "token-monitor.codex-credential",
+    version: 1,
+    credentialType: "codex-login-state",
+    displayName: "Codex Desktop refresh token",
+    payload: JSON.stringify(loginState),
+    createdAt: new Date().toISOString()
+  };
+  const encoded = Buffer.from(JSON.stringify(envelope), "utf8")
+    .toString("base64url");
+  return `tokenmonitor://import-codex?payload=${encoded}`;
+}
+
+function expandHome(path) {
+  if (path === "~") {
+    return homedir();
+  }
+  if (path.startsWith("~/")) {
+    return resolve(homedir(), path.slice(2));
+  }
+  return resolve(process.cwd(), path);
+}
+
+function openFile(path) {
+  if (process.platform !== "darwin") {
+    return;
+  }
+  spawnSync("open", [path], { stdio: "ignore" });
+}
+
+function printHelp() {
+  console.log(`
+Usage: codex-monitor [options]
+
+Options:
+  --auth-file <path>  Codex auth file. Default: ${DEFAULT_AUTH_PATH}
+  -o, --output <png>  PNG output path. Default: ${DEFAULT_OUTPUT}
+  --no-terminal      Do not render a QR code in the terminal
+  --open             Open the generated PNG on macOS
+  --json             Print metadata as JSON
+  -h, --help         Show help
+`);
+}

package/package.json

@@ -0,0 +1,28 @@
+{
+  "name": "codex-monitor",
+  "version": "0.1.0",
+  "description": "Generate a local QR code for importing Codex login state into Token Monitor.",
+  "type": "module",
+  "bin": {
+    "codex-monitor": "bin/token-monitor-codex-qr.js",
+    "token-monitor-codex-qr": "bin/token-monitor-codex-qr.js"
+  },
+  "files": [
+    "bin",
+    "README.md"
+  ],
+  "scripts": {
+    "test": "node --check bin/token-monitor-codex-qr.js"
+  },
+  "dependencies": {
+    "qrcode": "^1.5.4"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "license": "MIT"
+}