codex-multi-auth 0.1.0

package/dist/lib/utils.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Consolidated utility functions for the Codex plugin.
+ * Extracted from various modules to eliminate duplication.
+ */
+/**
+ * Type guard for plain objects (not arrays, not null).
+ * @param value - The value to check
+ * @returns True if value is a plain object
+ */
+export declare function isRecord(value: unknown): value is Record<string, unknown>;
+/**
+ * Returns the current timestamp in milliseconds.
+ * Wrapper for Date.now() to enable testing with mocked time.
+ * @returns Current time in milliseconds since epoch
+ */
+export declare function nowMs(): number;
+/**
+ * Safely converts any value to a string representation.
+ * @param value - The value to convert
+ * @returns String representation of the value
+ */
+export declare function toStringValue(value: unknown): string;
+/**
+ * Promisified setTimeout for async/await usage.
+ * @param ms - Milliseconds to sleep
+ * @returns Promise that resolves after the specified time
+ */
+export declare function sleep(ms: number): Promise<void>;
+//# sourceMappingURL=utils.d.ts.map

package/dist/lib/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../lib/utils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzE;AAED;;;;GAIG;AACH,wBAAgB,KAAK,IAAI,MAAM,CAE9B;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAkBpD;AAED;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C"}

package/dist/lib/utils.js

@@ -0,0 +1,54 @@
+/**
+ * Consolidated utility functions for the Codex plugin.
+ * Extracted from various modules to eliminate duplication.
+ */
+/**
+ * Type guard for plain objects (not arrays, not null).
+ * @param value - The value to check
+ * @returns True if value is a plain object
+ */
+export function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+ * Returns the current timestamp in milliseconds.
+ * Wrapper for Date.now() to enable testing with mocked time.
+ * @returns Current time in milliseconds since epoch
+ */
+export function nowMs() {
+    return Date.now();
+}
+/**
+ * Safely converts any value to a string representation.
+ * @param value - The value to convert
+ * @returns String representation of the value
+ */
+export function toStringValue(value) {
+    if (typeof value === "string") {
+        return value;
+    }
+    if (value === null) {
+        return "null";
+    }
+    if (value === undefined) {
+        return "undefined";
+    }
+    if (typeof value === "object") {
+        try {
+            return JSON.stringify(value);
+        }
+        catch {
+            return String(value);
+        }
+    }
+    return String(value);
+}
+/**
+ * Promisified setTimeout for async/await usage.
+ * @param ms - Milliseconds to sleep
+ * @returns Promise that resolves after the specified time
+ */
+export function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+//# sourceMappingURL=utils.js.map

package/dist/lib/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../lib/utils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,KAAK;IACpB,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC;IACf,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,WAAW,CAAC;IACpB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC;YACJ,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACF,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,KAAK,CAAC,EAAU;IAC/B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC1D,CAAC"}

package/package.json

@@ -0,0 +1,115 @@
+{
+  "name": "codex-multi-auth",
+  "version": "0.1.0",
+  "description": "Codex CLI-first multi-account OAuth rotation plugin for OpenCode",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "type": "module",
+  "license": "MIT",
+  "author": "Numman Ali",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ndycode/codex-multi-auth.git"
+  },
+  "keywords": [
+    "opencode",
+    "openai",
+    "codex",
+    "chatgpt",
+    "oauth",
+    "gpt-5",
+    "plugin",
+    "auth",
+    "chatgpt-plus",
+    "chatgpt-pro",
+    "multi-account"
+  ],
+  "homepage": "https://github.com/ndycode/codex-multi-auth#readme",
+  "bugs": {
+    "url": "https://github.com/ndycode/codex-multi-auth/issues"
+  },
+  "scripts": {
+    "build": "tsc && node scripts/copy-oauth-success.js",
+    "typecheck": "tsc --noEmit",
+    "lint": "npm run lint:ts && npm run lint:scripts",
+    "lint:ts": "eslint . --ext .ts",
+    "lint:scripts": "eslint scripts --ext .js",
+    "lint:fix": "npm run lint:ts:fix && npm run lint:scripts:fix",
+    "lint:ts:fix": "eslint . --ext .ts --fix",
+    "lint:scripts:fix": "eslint scripts --ext .js --fix",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:ui": "vitest --ui",
+    "test:model-matrix": "node scripts/test-model-matrix.js",
+    "test:model-matrix:smoke": "node scripts/test-model-matrix.js --smoke",
+    "test:model-matrix:report": "node scripts/test-model-matrix.js --smoke --report-json=.tmp/model-matrix-report.json",
+    "bench:edit-formats": "node scripts/benchmark-edit-formats.mjs --preset=codex-core",
+    "bench:edit-formats:smoke": "node scripts/benchmark-edit-formats.mjs --smoke --preset=codex-core",
+    "bench:edit-formats:render": "node scripts/benchmark-render-dashboard.mjs",
+    "test:coverage": "vitest run --coverage",
+    "coverage": "vitest run --coverage",
+    "audit:prod": "npm audit --omit=dev --audit-level=high",
+    "audit:all": "npm audit --audit-level=high",
+    "audit:dev:allowlist": "node scripts/audit-dev-allowlist.js",
+    "audit:ci": "npm run audit:prod && npm run audit:dev:allowlist",
+    "prepublishOnly": "npm run build",
+    "prepare": "husky"
+  },
+  "bin": {
+    "codex": "scripts/codex.js",
+    "codex-multi-auth": "scripts/codex-multi-auth.js",
+    "codex-multi-auth-opencode-install": "scripts/install-opencode-codex-auth.js"
+  },
+  "files": [
+    "dist/",
+    "assets/",
+    "config/",
+    "scripts/",
+    "README.md",
+    "LICENSE"
+  ],
+  "lint-staged": {
+    "*.ts": [
+      "eslint --max-warnings=0 --fix --no-warn-ignored"
+    ],
+    "scripts/**/*.js": [
+      "eslint --max-warnings=0 --fix --no-warn-ignored"
+    ]
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "peerDependencies": {
+    "typescript": "^5"
+  },
+  "devDependencies": {
+    "@fast-check/vitest": "^0.2.4",
+    "@opencode-ai/sdk": "^1.2.10",
+    "@types/node": "^25.3.0",
+    "@typescript-eslint/eslint-plugin": "^8.56.0",
+    "@typescript-eslint/parser": "^8.56.0",
+    "@vitest/coverage-v8": "^4.0.18",
+    "@vitest/ui": "^4.0.18",
+    "eslint": "^10.0.0",
+    "fast-check": "^4.5.3",
+    "husky": "^9.1.7",
+    "lint-staged": "^16.2.7",
+    "typescript": "^5.9.3",
+    "typescript-language-server": "^5.1.3",
+    "vitest": "^4.0.18"
+  },
+  "dependencies": {
+    "@openauthjs/openauth": "^0.4.3",
+    "@opencode-ai/plugin": "^1.2.10",
+    "hono": "^4.12.0",
+    "zod": "^4.3.6"
+  },
+  "overrides": {
+    "hono": "^4.12.0",
+    "vite": "^7.3.1",
+    "@typescript-eslint/typescript-estree": {
+      "minimatch": "^9.0.5"
+    }
+  }
+}
+

package/scripts/audit-dev-allowlist.js

@@ -0,0 +1,128 @@
+#!/usr/bin/env node
+
+import { spawnSync } from "node:child_process";
+
+const ALLOWED_HIGH_OR_CRITICAL_PACKAGES = new Set([
+	"eslint",
+	"ajv",
+	"@eslint-community/eslint-utils",
+	"@typescript-eslint/eslint-plugin",
+	"@typescript-eslint/parser",
+	"@typescript-eslint/type-utils",
+	"@typescript-eslint/typescript-estree",
+	"@typescript-eslint/utils",
+	"minimatch",
+]);
+
+function summarizeVia(via) {
+	if (!Array.isArray(via)) return [];
+	return via
+		.map((item) => {
+			if (typeof item === "string") return item;
+			if (!item || typeof item !== "object") return "unknown";
+			const name = typeof item.name === "string" ? item.name : "unknown";
+			const range = typeof item.range === "string" ? item.range : "";
+			return range ? `${name}:${range}` : name;
+		})
+		.slice(0, 5);
+}
+
+const isWindows = process.platform === "win32";
+const command = isWindows ? process.env.ComSpec || "cmd.exe" : "npm";
+const commandArgs = isWindows
+	? ["/d", "/s", "/c", "npm audit --json"]
+	: ["audit", "--json"];
+const audit = spawnSync(command, commandArgs, {
+	encoding: "utf8",
+	stdio: ["ignore", "pipe", "pipe"],
+	env: {
+		...process.env,
+		// npm run -s can suppress child npm JSON output; force a readable level.
+		npm_config_loglevel:
+			process.env.npm_config_loglevel === "silent"
+				? "notice"
+				: process.env.npm_config_loglevel || "notice",
+	},
+});
+
+const stdout = (audit.stdout ?? "").trim();
+const stderr = (audit.stderr ?? "").trim();
+const combined = [stdout, stderr].filter(Boolean).join("\n");
+
+if (!combined) {
+	if ((audit.status ?? 1) === 0) {
+		console.log("No vulnerabilities found in npm audit output.");
+		process.exit(0);
+	}
+	console.error("Failed to read npm audit output.");
+	process.exit(1);
+}
+
+// npm can emit human-readable success text (no JSON) on some versions/configs.
+if (!combined.includes("{") && /found 0 vulnerabilities/i.test(combined)) {
+	console.log("No vulnerabilities found in npm audit output.");
+	process.exit(0);
+}
+
+let auditJson;
+try {
+	const jsonCandidate =
+		(stdout.startsWith("{") ? stdout : "") ||
+		(stderr.startsWith("{") ? stderr : "") ||
+		combined.slice(combined.indexOf("{"));
+	auditJson = JSON.parse(jsonCandidate.replace(/^\uFEFF/, ""));
+} catch (error) {
+	console.error("Failed to parse npm audit JSON output.");
+	if (stderr) {
+		console.error(stderr);
+	}
+	console.error(error instanceof Error ? error.message : String(error));
+	process.exit(1);
+}
+
+const vulnerabilities =
+	auditJson && typeof auditJson === "object" && auditJson.vulnerabilities && typeof auditJson.vulnerabilities === "object"
+		? auditJson.vulnerabilities
+		: {};
+
+const unexpected = [];
+const allowlisted = [];
+
+for (const [name, details] of Object.entries(vulnerabilities)) {
+	if (!details || typeof details !== "object") continue;
+	const severity = typeof details.severity === "string" ? details.severity : "unknown";
+	if (severity !== "high" && severity !== "critical") continue;
+
+	const entry = {
+		name,
+		severity,
+		via: summarizeVia(details.via),
+		fixAvailable: details.fixAvailable ?? false,
+	};
+
+	if (ALLOWED_HIGH_OR_CRITICAL_PACKAGES.has(name)) {
+		allowlisted.push(entry);
+		continue;
+	}
+	unexpected.push(entry);
+}
+
+if (unexpected.length > 0) {
+	console.error("Unexpected high/critical vulnerabilities detected in dev dependency audit:");
+	for (const entry of unexpected) {
+		console.error(
+			`- ${entry.name} (${entry.severity}) via ${entry.via.join(", ") || "unknown"} fixAvailable=${String(entry.fixAvailable)}`,
+		);
+	}
+	process.exit(1);
+}
+
+if (allowlisted.length > 0) {
+	console.warn("Allowlisted high/critical dev vulnerabilities detected:");
+	for (const entry of allowlisted) {
+		console.warn(
+			`- ${entry.name} (${entry.severity}) via ${entry.via.join(", ") || "unknown"} fixAvailable=${String(entry.fixAvailable)}`,
+		);
+	}
+	console.warn("No unexpected high/critical vulnerabilities found.");
+}