codex-multi-auth 0.1.5 → 0.1.8

package/dist/lib/context-overflow.js

@@ -32,16 +32,16 @@ export function isContextOverflowError(status, bodyText) {
 /**
  * The message shown to users when context overflow occurs
  */
-const CONTEXT_OVERFLOW_MESSAGE = `[Plugin Notice] Context is too long for this model.
-
-Please use one of these commands to reduce context size:
-
-• **/compact** - Compress conversation history (recommended)
-• **/clear** - Start fresh with empty context
-• **/undo** - Remove recent messages
-
-Then retry your request.
-
+const CONTEXT_OVERFLOW_MESSAGE = `[Plugin Notice] Context is too long for this model.
+
+Please use one of these commands to reduce context size:
+
+• **/compact** - Compress conversation history (recommended)
+• **/clear** - Start fresh with empty context
+• **/undo** - Remove recent messages
+
+Then retry your request.
+
 Alternatively, you can switch to a model with a larger context window.`;
 /**
  * Creates a synthetic SSE response for context overflow errors.

package/dist/lib/named-backup-export.d.ts

@@ -0,0 +1,69 @@
+export interface NamedBackupExportDependencies {
+    getStoragePath: () => string;
+    exportAccounts: (filePath: string, force?: boolean, beforeCommit?: (resolvedPath: string) => Promise<void> | void) => Promise<void>;
+}
+/**
+ * Validate and normalize a user-provided backup name into a safe `<name>.json` filename.
+ *
+ * Performs trimming, rejects path separators and traversal tokens, forbids rotation-style
+ * substrings and temporary suffixes, and enforces that the base name contains only
+ * letters, numbers, hyphens, and underscores. Checks that a resulting base name is non-empty
+ * and returns the base name with a `.json` extension appended.
+ *
+ * Notes:
+ * - Validation checks that are sensitive to case are performed using a lowercased form;
+ *   this mirrors Windows case-insensitive filesystem behavior for prohibited patterns.
+ * - The function is synchronous and safe for concurrent use (pure string validation/normalization).
+ * - Token redaction: traversal tokens (`..`), path separators, rotation-style substrings,
+ *   and temporary suffixes are rejected rather than sanitized.
+ *
+ * @param name - The user-provided filename or identifier (may include a `.json` extension)
+ * @returns The validated filename with a `.json` extension appended
+ * @throws Error if the name is empty, contains separators or traversal tokens, contains
+ *         prohibited substrings, ends with an invalid temporary suffix, contains disallowed
+ *         characters, or would result in an empty base name
+ */
+export declare function normalizeNamedBackupFileName(name: string): string;
+/**
+ * Compute the absolute path for the "backups" directory placed alongside the given storage path.
+ *
+ * This performs only path resolution and string manipulation; it does not access the filesystem and is insensitive to concurrent filesystem changes. It does not redact or sanitize tokens or sensitive substrings in `storagePath`. Note: other functions in this module handle Windows case-insensitive comparisons when validating paths.
+ *
+ * @param storagePath - Storage file or directory path (may be relative or absolute)
+ * @returns The resolved path to the backups directory adjacent to `storagePath` (i.e. dirname(storagePath)/backups)
+ */
+export declare function getNamedBackupRoot(storagePath: string): string;
+/**
+ * Resolve and validate a safe backup file path for a named backup inside the storage path's backups directory.
+ *
+ * @param name - User-provided backup name; will be normalized and validated (disallows path separators, `..`, prohibited substrings, and invalid suffixes such as `.tmp`/`.wal`) and the canonical filename (`*.json`) will be produced.
+ * @param storagePath - Base storage path used to locate the backups directory; path comparisons treat Windows paths case-insensitively.
+ * @returns The absolute, validated path to the backup file within the backups directory.
+ *
+ * Concurrency: this function only computes and validates the path and does not create files or directories; callers must handle concurrent filesystem operations (e.g., directory creation or file writes).
+ */
+export declare function resolveNamedBackupPath(name: string, storagePath: string): string;
+/**
+ * Create a named backup file inside the storage path's backups directory and return its resolved path.
+ *
+ * The provided `name` is validated and normalized (suffix, allowed characters, and prohibited substrings) and the
+ * backup root directory is created if missing. The export operation will be asked to write to the resolved path; a
+ * safety check ensures the final resolved path stays within the backups root.
+ * The delegated `beforeCommit` hook re-validates containment immediately before
+ * the storage layer commits the final rename, but callers should still serialize
+ * backup-root mutations rather than relying on path checks alone.
+ *
+ * Concurrency: callers should avoid concurrent exports that target the same `name` as behavior is unspecified.
+ * Windows behavior: file-name/path comparisons are case-insensitive and names are normalized to lowercase.
+ * Token rules: input `name` is checked to prevent path traversal, separators, rotation-style substrings, and certain
+ * invalid suffixes (e.g., `.tmp`, `.wal`); the final returned path always includes the `.json` extension.
+ *
+ * @param name - The desired backup file name (validated and normalized).
+ * @param dependencies - Object providing storage path resolution and the exportAccounts implementation.
+ * @param options.force - When true, request overwriting an existing backup.
+ * @returns The absolute path to the created backup file (including `.json`).
+ */
+export declare function exportNamedBackupFile(name: string, dependencies: NamedBackupExportDependencies, options?: {
+    force?: boolean;
+}): Promise<string>;
+//# sourceMappingURL=named-backup-export.d.ts.map

package/dist/lib/named-backup-export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"named-backup-export.d.ts","sourceRoot":"","sources":["../../lib/named-backup-export.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,6BAA6B;IAC7C,cAAc,EAAE,MAAM,MAAM,CAAC;IAC7B,cAAc,EAAE,CACf,QAAQ,EAAE,MAAM,EAChB,KAAK,CAAC,EAAE,OAAO,EACf,YAAY,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,KACzD,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AA6ED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAwCjE;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAK9D;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACrC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GACjB,MAAM,CAMR;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,qBAAqB,CAC1C,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,6BAA6B,EAC3C,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAC3B,OAAO,CAAC,MAAM,CAAC,CAuBjB"}

package/dist/lib/named-backup-export.js

@@ -0,0 +1,207 @@
+import { existsSync, promises as fs, lstatSync, realpathSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, relative, resolve, } from "node:path";
+import { resolvePath } from "./storage/paths.js";
+const BACKUP_EXPORT_DIR_NAME = "backups";
+const BACKUP_FILE_EXTENSION = ".json";
+const BACKUP_SAFE_NAME_REGEX = /^[a-zA-Z0-9_-]+$/;
+const BACKUP_WINDOWS_RESERVED_NAME_REGEX = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])$/i;
+const BACKUP_INVALID_SUFFIXES = [".tmp", ".wal"];
+const BACKUP_PROHIBITED_SUBSTRINGS = [".rotate."];
+const inFlightNamedBackupExports = new Set();
+/**
+ * Compute a canonical, comparison-ready filesystem path for the given input.
+ *
+ * Resolves the input to an absolute path, resolves symlinks (realpath) if the path exists, and on Windows converts the resulting canonical path to lowercase for case-insensitive comparisons. The function does not mask or redact any sensitive tokens contained in the path. Note: the returned value may become stale if the filesystem changes after this call (race conditions are possible).
+ *
+ * @param pathValue - The input filesystem path to normalize.
+ * @returns The canonicalized path suitable for equality or containment comparisons; on Windows the result is returned in lowercase.
+ */
+function normalizePathForComparison(pathValue) {
+    const resolvedPath = resolve(pathValue);
+    const canonicalPath = existsSync(resolvedPath)
+        ? realpathSync(resolvedPath)
+        : resolvedPath;
+    return process.platform === "win32"
+        ? canonicalPath.toLowerCase()
+        : canonicalPath;
+}
+/**
+ * Ensures the resolved target path is located inside the resolved base directory.
+ *
+ * Validates that `baseDir` is not a symbolic link and that the canonical/resolved
+ * forms of `baseDir` and `targetPath` keep `targetPath` rooted under `baseDir`.
+ * On Windows, comparisons are performed in a case-insensitive manner via the
+ * normalization helper. Errors do not include the original path values.
+ *
+ * Concurrency: callers must avoid concurrently mutating the filesystem (for example
+ * creating/removing/moving symlinks or directories) between calling this function
+ * and any subsequent operations that rely on its result. `exportNamedBackupFile`
+ * performs a second containment check through the `beforeCommit` hook, but that
+ * revalidation narrows rather than eliminates time-of-check/time-of-use windows.
+ *
+ * @param baseDir - The directory to treat as the backup root; must remain stable during validation.
+ * @param targetPath - The candidate target file path that must reside within `baseDir`.
+ * @throws Error with message "Named backup path escapes the backup root" if `baseDir` is a symlink,
+ *         if the canonical and resolved base paths differ, or if `targetPath` is not contained
+ *         within `baseDir`.
+ */
+function assertWithinDirectory(baseDir, targetPath) {
+    const resolvedBase = resolve(baseDir);
+    let baseStat = null;
+    try {
+        baseStat = lstatSync(resolvedBase);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code !== "ENOENT") {
+            throw error;
+        }
+    }
+    if (baseStat) {
+        if (baseStat.isSymbolicLink()) {
+            throw new Error("Named backup path escapes the backup root");
+        }
+        const canonicalBase = realpathSync(resolvedBase);
+        const comparableCanonicalBase = process.platform === "win32"
+            ? canonicalBase.toLowerCase()
+            : canonicalBase;
+        const comparableResolvedBase = process.platform === "win32" ? resolvedBase.toLowerCase() : resolvedBase;
+        if (comparableCanonicalBase !== comparableResolvedBase) {
+            throw new Error("Named backup path escapes the backup root");
+        }
+    }
+    const normalizedBase = normalizePathForComparison(baseDir);
+    const targetParent = dirname(targetPath);
+    const normalizedTargetParent = normalizePathForComparison(targetParent);
+    const normalizedTarget = join(normalizedTargetParent, basename(targetPath));
+    const rel = relative(normalizedBase, normalizedTarget);
+    if (rel === "" || (!rel.startsWith("..") && !isAbsolute(rel))) {
+        return;
+    }
+    throw new Error("Named backup path escapes the backup root");
+}
+/**
+ * Validate and normalize a user-provided backup name into a safe `<name>.json` filename.
+ *
+ * Performs trimming, rejects path separators and traversal tokens, forbids rotation-style
+ * substrings and temporary suffixes, and enforces that the base name contains only
+ * letters, numbers, hyphens, and underscores. Checks that a resulting base name is non-empty
+ * and returns the base name with a `.json` extension appended.
+ *
+ * Notes:
+ * - Validation checks that are sensitive to case are performed using a lowercased form;
+ *   this mirrors Windows case-insensitive filesystem behavior for prohibited patterns.
+ * - The function is synchronous and safe for concurrent use (pure string validation/normalization).
+ * - Token redaction: traversal tokens (`..`), path separators, rotation-style substrings,
+ *   and temporary suffixes are rejected rather than sanitized.
+ *
+ * @param name - The user-provided filename or identifier (may include a `.json` extension)
+ * @returns The validated filename with a `.json` extension appended
+ * @throws Error if the name is empty, contains separators or traversal tokens, contains
+ *         prohibited substrings, ends with an invalid temporary suffix, contains disallowed
+ *         characters, or would result in an empty base name
+ */
+export function normalizeNamedBackupFileName(name) {
+    const trimmed = (name ?? "").trim();
+    if (trimmed.length === 0) {
+        throw new Error("Named backup requires a non-empty filename");
+    }
+    if (/[\\/]/.test(trimmed)) {
+        throw new Error("Backup filename must not contain path separators");
+    }
+    if (trimmed.includes("..")) {
+        throw new Error("Backup filename must not contain traversal tokens");
+    }
+    const lower = trimmed.toLowerCase();
+    if (BACKUP_PROHIBITED_SUBSTRINGS.some((value) => lower.includes(value))) {
+        throw new Error("Backup filename may not contain rotation-style sequences");
+    }
+    const hasJsonExtension = lower.endsWith(BACKUP_FILE_EXTENSION);
+    const baseName = hasJsonExtension
+        ? trimmed.slice(0, trimmed.length - BACKUP_FILE_EXTENSION.length)
+        : trimmed;
+    if (baseName.length === 0) {
+        throw new Error("Backup filename cannot be just an extension");
+    }
+    const baseLower = baseName.toLowerCase();
+    if (BACKUP_INVALID_SUFFIXES.some((value) => baseLower.endsWith(value))) {
+        throw new Error("Backup filename may not end with temporary suffixes");
+    }
+    if (BACKUP_WINDOWS_RESERVED_NAME_REGEX.test(baseName)) {
+        throw new Error("Backup filename may not use a reserved Windows device name");
+    }
+    if (!BACKUP_SAFE_NAME_REGEX.test(baseName)) {
+        throw new Error("Backup filename may only contain letters, numbers, hyphens, and underscores; dots (.) are not allowed");
+    }
+    return `${baseName}${BACKUP_FILE_EXTENSION}`;
+}
+/**
+ * Compute the absolute path for the "backups" directory placed alongside the given storage path.
+ *
+ * This performs only path resolution and string manipulation; it does not access the filesystem and is insensitive to concurrent filesystem changes. It does not redact or sanitize tokens or sensitive substrings in `storagePath`. Note: other functions in this module handle Windows case-insensitive comparisons when validating paths.
+ *
+ * @param storagePath - Storage file or directory path (may be relative or absolute)
+ * @returns The resolved path to the backups directory adjacent to `storagePath` (i.e. dirname(storagePath)/backups)
+ */
+export function getNamedBackupRoot(storagePath) {
+    const resolvedStoragePath = resolvePath(storagePath);
+    return resolvePath(join(dirname(resolvedStoragePath), BACKUP_EXPORT_DIR_NAME));
+}
+/**
+ * Resolve and validate a safe backup file path for a named backup inside the storage path's backups directory.
+ *
+ * @param name - User-provided backup name; will be normalized and validated (disallows path separators, `..`, prohibited substrings, and invalid suffixes such as `.tmp`/`.wal`) and the canonical filename (`*.json`) will be produced.
+ * @param storagePath - Base storage path used to locate the backups directory; path comparisons treat Windows paths case-insensitively.
+ * @returns The absolute, validated path to the backup file within the backups directory.
+ *
+ * Concurrency: this function only computes and validates the path and does not create files or directories; callers must handle concurrent filesystem operations (e.g., directory creation or file writes).
+ */
+export function resolveNamedBackupPath(name, storagePath) {
+    const fileName = normalizeNamedBackupFileName(name);
+    const backupRoot = getNamedBackupRoot(storagePath);
+    const candidate = resolvePath(join(backupRoot, fileName));
+    assertWithinDirectory(backupRoot, candidate);
+    return candidate;
+}
+/**
+ * Create a named backup file inside the storage path's backups directory and return its resolved path.
+ *
+ * The provided `name` is validated and normalized (suffix, allowed characters, and prohibited substrings) and the
+ * backup root directory is created if missing. The export operation will be asked to write to the resolved path; a
+ * safety check ensures the final resolved path stays within the backups root.
+ * The delegated `beforeCommit` hook re-validates containment immediately before
+ * the storage layer commits the final rename, but callers should still serialize
+ * backup-root mutations rather than relying on path checks alone.
+ *
+ * Concurrency: callers should avoid concurrent exports that target the same `name` as behavior is unspecified.
+ * Windows behavior: file-name/path comparisons are case-insensitive and names are normalized to lowercase.
+ * Token rules: input `name` is checked to prevent path traversal, separators, rotation-style substrings, and certain
+ * invalid suffixes (e.g., `.tmp`, `.wal`); the final returned path always includes the `.json` extension.
+ *
+ * @param name - The desired backup file name (validated and normalized).
+ * @param dependencies - Object providing storage path resolution and the exportAccounts implementation.
+ * @param options.force - When true, request overwriting an existing backup.
+ * @returns The absolute path to the created backup file (including `.json`).
+ */
+export async function exportNamedBackupFile(name, dependencies, options) {
+    const storagePath = dependencies.getStoragePath();
+    const destination = resolveNamedBackupPath(name, storagePath);
+    const backupRoot = getNamedBackupRoot(storagePath);
+    const exportKey = normalizePathForComparison(destination);
+    if (!options?.force && inFlightNamedBackupExports.has(exportKey)) {
+        throw new Error(`File already exists: ${destination}`);
+    }
+    assertWithinDirectory(dirname(backupRoot), backupRoot);
+    await fs.mkdir(backupRoot, { recursive: true });
+    inFlightNamedBackupExports.add(exportKey);
+    try {
+        await dependencies.exportAccounts(destination, options?.force === true, (resolvedPath) => {
+            assertWithinDirectory(backupRoot, resolvedPath);
+        });
+        return destination;
+    }
+    finally {
+        inFlightNamedBackupExports.delete(exportKey);
+    }
+}
+//# sourceMappingURL=named-backup-export.js.map

package/dist/lib/named-backup-export.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"named-backup-export.js","sourceRoot":"","sources":["../../lib/named-backup-export.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,IAAI,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC9E,OAAO,EACN,QAAQ,EACR,OAAO,EACP,UAAU,EACV,IAAI,EACJ,QAAQ,EACR,OAAO,GACP,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,MAAM,sBAAsB,GAAG,SAAS,CAAC;AACzC,MAAM,qBAAqB,GAAG,OAAO,CAAC;AACtC,MAAM,sBAAsB,GAAG,kBAAkB,CAAC;AAClD,MAAM,kCAAkC,GACvC,wCAAwC,CAAC;AAC1C,MAAM,uBAAuB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACjD,MAAM,4BAA4B,GAAG,CAAC,UAAU,CAAC,CAAC;AAClD,MAAM,0BAA0B,GAAG,IAAI,GAAG,EAAU,CAAC;AAWrD;;;;;;;GAOG;AACH,SAAS,0BAA0B,CAAC,SAAiB;IACpD,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,aAAa,GAAG,UAAU,CAAC,YAAY,CAAC;QAC7C,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC;QAC5B,CAAC,CAAC,YAAY,CAAC;IAChB,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO;QAClC,CAAC,CAAC,aAAa,CAAC,WAAW,EAAE;QAC7B,CAAC,CAAC,aAAa,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,qBAAqB,CAAC,OAAe,EAAE,UAAkB;IACjE,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,QAAQ,GAAwC,IAAI,CAAC;IACzD,IAAI,CAAC;QACJ,QAAQ,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;QACnD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvB,MAAM,KAAK,CAAC;QACb,CAAC;IACF,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACd,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,aAAa,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QACjD,MAAM,uBAAuB,GAC5B,OAAO,CAAC,QAAQ,KAAK,OAAO;YAC3B,CAAC,CAAC,aAAa,CAAC,WAAW,EAAE;YAC7B,CAAC,CAAC,aAAa,CAAC;QAClB,MAAM,sBAAsB,GAC3B,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;QAC1E,IAAI,uBAAuB,KAAK,sBAAsB,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC9D,CAAC;IACF,CAAC;IACD,MAAM,cAAc,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,sBAAsB,GAAG,0BAA0B,CAAC,YAAY,CAAC,CAAC;IACxE,MAAM,gBAAgB,GAAG,IAAI,CAAC,sBAAsB,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IAC5E,MAAM,GAAG,GAAG,QAAQ,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IACvD,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC/D,OAAO;IACR,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAY;IACxD,MAAM,OAAO,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACpC,IAAI,4BAA4B,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,gBAAgB,GAAG,KAAK,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,gBAAgB;QAChC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC;QACjE,CAAC,CAAC,OAAO,CAAC;IACX,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,kCAAkC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CACd,4DAA4D,CAC5D,CAAC;IACH,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACd,uGAAuG,CACvG,CAAC;IACH,CAAC;IAED,OAAO,GAAG,QAAQ,GAAG,qBAAqB,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAmB;IACrD,MAAM,mBAAmB,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACrD,OAAO,WAAW,CACjB,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,sBAAsB,CAAC,CAC1D,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACrC,IAAY,EACZ,WAAmB;IAEnB,MAAM,QAAQ,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC1D,qBAAqB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAC7C,OAAO,SAAS,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAC1C,IAAY,EACZ,YAA2C,EAC3C,OAA6B;IAE7B,MAAM,WAAW,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC;IAClD,MAAM,WAAW,GAAG,sBAAsB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,0BAA0B,CAAC,WAAW,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,0BAA0B,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,wBAAwB,WAAW,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,qBAAqB,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;IACvD,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,0BAA0B,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,CAAC;QACJ,MAAM,YAAY,CAAC,cAAc,CAChC,WAAW,EACX,OAAO,EAAE,KAAK,KAAK,IAAI,EACvB,CAAC,YAAY,EAAE,EAAE;YAChB,qBAAqB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QACjD,CAAC,CACD,CAAC;QACF,OAAO,WAAW,CAAC;IACpB,CAAC;YAAS,CAAC;QACV,0BAA0B,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;AACF,CAAC"}

package/dist/lib/oauth-success.html

@@ -2,21 +2,17 @@
 <html lang="en">
 <head>
   <meta charset="utf-8" />
-  <meta name="viewport" content="width=device-width,initial-scale=1" />
-  <title>OpenAI Codex Callback Received</title>
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>Codex Sign-In Complete</title>
   <style>
-    /* Space Grotesk import removed to avoid CSP font-src violations; rely on system stack. */
-
     :root {
-      --bg: #020403;
-      --bg2: #050908;
-      --surface: rgba(6, 10, 9, 0.92);
-      --border: rgba(255, 255, 255, 0.08);
-      --divider: rgba(255, 255, 255, 0.07);
-      --text: #f5fbf7;
-      --muted: rgba(245, 251, 247, 0.68);
-      --accent: #49f1a8;
-      --accent-soft: rgba(73, 241, 168, 0.15);
+      color-scheme: dark;
+      --bg: #0b0b0b;
+      --panel: #111111;
+      --text: #f2f2f2;
+      --muted: #a3a3a3;
+      --line: #232323;
+      --ok: #7cf0a6;
     }
 
     * {
@@ -26,245 +22,105 @@
     body {
       margin: 0;
       min-height: 100vh;
-      font-family: "Segoe UI", system-ui, -apple-system, "IBM Plex Sans", sans-serif;
-      background: radial-gradient(circle at top, rgba(73, 241, 168, 0.12), transparent 55%),
-                  linear-gradient(180deg, var(--bg), var(--bg2));
-      color: var(--text);
       display: grid;
       place-items: center;
-      padding: 32px 16px;
+      background: var(--bg);
+      color: var(--text);
+      font-family: "Geist Mono", "GeistMono", ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace;
+      padding: 24px;
     }
 
     main {
-      width: min(440px, 100%);
-      background: var(--surface);
-      border-radius: 22px;
-      border: 1px solid var(--border);
-      padding: 32px;
-      box-shadow: 0 24px 60px rgba(0, 0, 0, 0.55);
-      display: flex;
-      flex-direction: column;
-      gap: 18px;
-    }
-
-    .eyebrow {
-      font-size: 12px;
-      text-transform: uppercase;
-      letter-spacing: 0.22em;
-      color: var(--muted);
-    }
-
-    .icon {
-      width: 64px;
-      height: 64px;
-      border-radius: 16px;
-      border: 1px solid var(--border);
-      background: var(--accent-soft);
+      width: min(520px, 100%);
+      background: var(--panel);
+      border: 1px solid var(--line);
+      border-radius: 12px;
+      padding: 20px;
       display: grid;
-      place-items: center;
-      color: var(--accent);
-      margin: 4px 0 6px;
-      position: relative;
-      animation: fade 1s ease both;
-    }
-
-    .icon::after {
-      content: "";
-      width: 20px;
-      height: 12px;
-      border-left: 3px solid currentColor;
-      border-bottom: 3px solid currentColor;
-      transform: rotate(-45deg);
+      gap: 14px;
     }
 
     h1 {
       margin: 0;
-      font-size: clamp(26px, 4vw, 32px);
+      font-size: 20px;
+      font-weight: 600;
       letter-spacing: -0.02em;
     }
 
-    .lead {
+    p {
       margin: 0;
       color: var(--muted);
-      font-size: 15px;
-      line-height: 1.6;
-    }
-
-    .state {
-      display: flex;
-      align-items: baseline;
-      justify-content: space-between;
-      padding: 16px 18px;
-      border-radius: 16px;
-      background: rgba(8, 14, 11, 0.75);
-      border: 1px solid var(--border);
-    }
-
-    .state span {
-      font-size: 13px;
-      text-transform: uppercase;
-      letter-spacing: 0.15em;
-      color: var(--muted);
-    }
-
-    .state strong {
-      font-size: 20px;
-      color: var(--accent);
-      font-weight: 600;
-    }
-
-    .status-list {
-      list-style: none;
-      margin: 8px 0 0;
-      padding: 0;
-      display: flex;
-      flex-direction: column;
-      gap: 10px;
-    }
-
-    .status-list li {
-      display: flex;
-      align-items: center;
-      justify-content: space-between;
-      border-bottom: 1px solid var(--divider);
-      padding-bottom: 8px;
       font-size: 14px;
+      line-height: 1.5;
     }
 
-    .status-list li:last-child {
-      border-bottom: none;
-      padding-bottom: 0;
-    }
-
-    .status-list span {
-      color: var(--muted);
+    .status {
+      display: inline-flex;
+      align-items: center;
+      gap: 8px;
+      color: var(--ok);
       font-size: 13px;
-      letter-spacing: 0.02em;
     }
 
-    .status-list .ok {
-      color: var(--accent);
-      font-weight: 500;
+    .dot {
+      width: 8px;
+      height: 8px;
+      border-radius: 50%;
+      background: currentColor;
     }
 
-    .meta {
-      border-top: 1px solid var(--divider);
-      padding-top: 14px;
+    dl {
+      margin: 0;
       display: grid;
-      gap: 10px;
-    }
-
-    .meta-row {
-      display: flex;
-      justify-content: space-between;
-      align-items: baseline;
+      grid-template-columns: 120px 1fr;
+      gap: 8px 12px;
       font-size: 13px;
-      color: var(--muted);
-    }
-
-    .meta-row code {
-      font-family: "Segoe UI", system-ui, -apple-system, "SFMono-Regular", Menlo, monospace;
-      background: rgba(255, 255, 255, 0.04);
-      border-radius: 8px;
-      padding: 4px 8px;
-      color: var(--text);
     }
 
-    .tip {
-      margin: 0;
-      font-size: 13px;
+    dt {
       color: var(--muted);
-      border-top: 1px solid var(--divider);
-      padding-top: 14px;
     }
 
-    .tip strong {
+    dd {
+      margin: 0;
       color: var(--text);
+      word-break: break-word;
     }
 
-    footer {
+    code {
+      background: #171717;
+      border: 1px solid var(--line);
+      border-radius: 6px;
+      padding: 2px 6px;
+      font-family: inherit;
       font-size: 12px;
-      color: var(--muted);
-      text-align: center;
-    }
-
-    @keyframes fade {
-      from { opacity: 0; transform: translateY(6px); }
-      to { opacity: 1; transform: translateY(0); }
     }
 
-    @media (prefers-reduced-motion: reduce) {
-      .icon {
-        animation: none;
-      }
-    }
-
-    @media (max-width: 480px) {
-      main {
-        padding: 24px;
-        border-radius: 18px;
-      }
-
-      .state {
-        flex-direction: column;
-        align-items: flex-start;
-        gap: 4px;
-      }
-
-      .status-list li {
-        flex-direction: column;
-        align-items: flex-start;
-        gap: 2px;
-      }
-
-      .meta-row {
-        flex-direction: column;
-        gap: 4px;
+    @media (max-width: 520px) {
+      dl {
+        grid-template-columns: 1fr;
       }
     }
   </style>
 </head>
 <body>
   <main role="main" aria-label="OAuth callback received">
-    <p class="eyebrow">OpenAI Codex</p>
-    <div class="icon" aria-hidden="true"></div>
-    <h1>Callback received</h1>
-    <p class="lead">Return to your terminal to complete sign-in.</p>
-    <div class="state">
-      <span>Status</span>
-      <strong>Processing</strong>
+    <h1>Sign-in complete</h1>
+    <p>Return to your terminal to finish Codex login.</p>
+
+    <div class="status" aria-live="polite">
+      <span class="dot" aria-hidden="true"></span>
+      Callback received
     </div>
-    <ul class="status-list" aria-label="OAuth steps">
-      <li>
-        <span>Authorization code</span>
-        <span class="ok">received</span>
-      </li>
-      <li>
-        <span>Token exchange</span>
-        <span>running in terminal</span>
-      </li>
-      <li>
-        <span>Credentials</span>
-        <span>persisting after terminal completes</span>
-      </li>
-      <li>
-        <span>Session</span>
-        <span>activating in terminal</span>
-      </li>
-    </ul>
-    <section class="meta" aria-label="Callback summary">
-      <div class="meta-row">
-        <span>Callback</span>
-        <!-- Port 1455 is fixed by design via REDIRECT_URI -->
-        <code>localhost:1455</code>
-      </div>
-      <div class="meta-row">
-        <span>Tip</span>
-        <span>Close this tab when you are done.</span>
-      </div>
-    </section>
-    <p class="tip"><strong>Next:</strong> return to the terminal window to continue.</p>
-    <footer>Back to terminal to continue.</footer>
+
+    <dl>
+      <dt>Endpoint</dt>
+      <dd><code>localhost:1455</code></dd>
+      <dt>Flow</dt>
+      <dd>OAuth callback captured</dd>
+      <dt>Next</dt>
+      <dd>Close this tab and continue in terminal</dd>
+    </dl>
   </main>
 </body>
-</html>
+</html>