codex-multi-auth 0.1.8 → 0.1.9

package/README.md

@@ -278,9 +278,9 @@ codex auth doctor --json
 
 ## Release Notes
 
-- Current stable: [docs/releases/v0.1.5.md](docs/releases/v0.1.5.md)
-- Previous stable: [docs/releases/v0.1.4.md](docs/releases/v0.1.4.md)
-- Earlier stable: [docs/releases/v0.1.3.md](docs/releases/v0.1.3.md)
+- Current stable: [docs/releases/v0.1.9.md](docs/releases/v0.1.9.md)
+- Previous stable: [docs/releases/v0.1.8.md](docs/releases/v0.1.8.md)
+- Earlier stable: [docs/releases/v0.1.7.md](docs/releases/v0.1.7.md)
 - Archived prerelease: [docs/releases/v0.1.0-beta.0.md](docs/releases/v0.1.0-beta.0.md)
 
 ## License

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,kBAAkB,CAAC;AAmL5D;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,iBAAiB,EAAE,MAk2H/B,CAAC;AAEF,eAAO,MAAM,gBAAgB,KAAoB,CAAC;AAElD,eAAe,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,kBAAkB,CAAC;AAmL5D;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,iBAAiB,EAAE,MA60H/B,CAAC;AAEF,eAAO,MAAM,gBAAgB,KAAoB,CAAC;AAElD,eAAe,iBAAiB,CAAC"}

package/dist/index.js

@@ -34,7 +34,7 @@ import { initLogger, logRequest, logDebug, logInfo, logWarn, logError, setCorrel
 import { checkAndNotify } from "./lib/auto-update-checker.js";
 import { handleContextOverflow } from "./lib/context-overflow.js";
 import { AccountManager, getAccountIdCandidates, extractAccountEmail, extractAccountId, formatAccountLabel, formatCooldown, formatWaitTime, sanitizeEmail, selectBestAccountCandidate, shouldUpdateAccountIdFromToken, resolveRequestAccountId, parseRateLimitReason, lookupCodexCliTokensByEmail, isCodexCliSyncEnabled, } from "./lib/accounts.js";
-import { getStoragePath, loadAccounts, saveAccounts, withAccountStorageTransaction, clearAccounts, setStoragePath, exportAccounts, importAccounts, loadFlaggedAccounts, saveFlaggedAccounts, clearFlaggedAccounts, normalizeEmailKey, StorageError, formatStorageErrorHint, setStorageBackupEnabled, } from "./lib/storage.js";
+import { getStoragePath, loadAccounts, saveAccounts, withAccountStorageTransaction, clearAccounts, setStoragePath, exportAccounts, importAccounts, loadFlaggedAccounts, saveFlaggedAccounts, clearFlaggedAccounts, findMatchingAccountIndex, StorageError, formatStorageErrorHint, setStorageBackupEnabled, } from "./lib/storage.js";
 import { createCodexHeaders, extractRequestUrl, handleErrorResponse, handleSuccessResponse, getUnsupportedCodexModelInfo, resolveUnsupportedCodexFallbackModel, refreshAndUpdateToken, rewriteUrlForCodex, shouldRefreshToken, transformRequestForCodex, } from "./lib/request/fetch-helpers.js";
 import { applyFastSessionDefaults } from "./lib/request/request-transformer.js";
 import { getRateLimitBackoff, RATE_LIMIT_SHORT_RETRY_THRESHOLD_MS, resetRateLimitBackoff, } from "./lib/request/rate-limit-backoff.js";
@@ -315,24 +315,6 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             const now = Date.now();
             const stored = replaceAll ? null : loadedStorage;
             const accounts = stored?.accounts ? [...stored.accounts] : [];
-            const indexByRefreshToken = new Map();
-            const indexByAccountId = new Map();
-            const indexByEmail = new Map();
-            for (let i = 0; i < accounts.length; i += 1) {
-                const account = accounts[i];
-                if (!account)
-                    continue;
-                if (account.refreshToken) {
-                    indexByRefreshToken.set(account.refreshToken, i);
-                }
-                if (account.accountId) {
-                    indexByAccountId.set(account.accountId, i);
-                }
-                const emailKey = normalizeEmailKey(account.email);
-                if (emailKey) {
-                    indexByEmail.set(emailKey, i);
-                }
-            }
             for (const result of results) {
                 const accountId = result.accountIdOverride ?? extractAccountId(result.access);
                 const accountIdSource = accountId
@@ -341,16 +323,14 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     : undefined;
                 const accountLabel = result.accountLabel;
                 const accountEmail = sanitizeEmail(extractAccountEmail(result.access, result.idToken));
-                const existingByEmail = accountEmail && indexByEmail.has(accountEmail)
-                    ? indexByEmail.get(accountEmail)
-                    : undefined;
-                const existingById = accountId && indexByAccountId.has(accountId)
-                    ? indexByAccountId.get(accountId)
-                    : undefined;
-                const existingByToken = indexByRefreshToken.get(result.refresh);
-                const existingIndex = existingById ?? existingByEmail ?? existingByToken;
+                const existingIndex = findMatchingAccountIndex(accounts, {
+                    accountId,
+                    email: accountEmail,
+                    refreshToken: result.refresh,
+                }, {
+                    allowUniqueAccountIdFallbackWithoutEmail: true,
+                });
                 if (existingIndex === undefined) {
-                    const newIndex = accounts.length;
                     accounts.push({
                         accountId,
                         accountIdSource,
@@ -362,20 +342,11 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                         addedAt: now,
                         lastUsed: now,
                     });
-                    indexByRefreshToken.set(result.refresh, newIndex);
-                    if (accountId) {
-                        indexByAccountId.set(accountId, newIndex);
-                    }
-                    if (accountEmail) {
-                        indexByEmail.set(accountEmail, newIndex);
-                    }
                     continue;
                 }
                 const existing = accounts[existingIndex];
                 if (!existing)
                     continue;
-                const oldToken = existing.refreshToken;
-                const oldEmail = existing.email;
                 const nextEmail = accountEmail ?? sanitizeEmail(existing.email);
                 const nextAccountId = accountId ?? existing.accountId;
                 const nextAccountIdSource = accountId ? accountIdSource ?? existing.accountIdSource : existing.accountIdSource;
@@ -391,21 +362,6 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     expiresAt: result.expires,
                     lastUsed: now,
                 };
-                if (oldToken !== result.refresh) {
-                    indexByRefreshToken.delete(oldToken);
-                    indexByRefreshToken.set(result.refresh, existingIndex);
-                }
-                if (accountId) {
-                    indexByAccountId.set(accountId, existingIndex);
-                }
-                const oldEmailKey = normalizeEmailKey(oldEmail);
-                const nextEmailKey = normalizeEmailKey(nextEmail);
-                if (oldEmailKey && oldEmailKey !== nextEmailKey) {
-                    indexByEmail.delete(oldEmailKey);
-                }
-                if (nextEmailKey) {
-                    indexByEmail.set(nextEmailKey, existingIndex);
-                }
             }
             if (accounts.length === 0)
                 return;
@@ -1023,6 +979,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                     const accountCount = accountManager.getAccountCount();
                                     const attempted = new Set();
                                     let restartAccountTraversalWithFallback = false;
+                                    let retryNextAccountBeforeFallback = false;
                                     let usedPreferredSessionAccount = false;
                                     const capabilityBoostByAccount = {};
                                     const accountSnapshotSource = accountManager;
@@ -1111,22 +1068,23 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                         const hadAccountId = !!account.accountId;
                                         const tokenAccountId = extractAccountId(accountAuth.access);
                                         const accountId = resolveRequestAccountId(account.accountId, account.accountIdSource, tokenAccountId);
-                                        const entitlementAccountKey = resolveEntitlementAccountKey({
-                                            accountId: hadAccountId ? account.accountId : undefined,
-                                            email: account.email,
-                                            index: account.index,
-                                        });
                                         if (!accountId) {
                                             accountManager.markAccountCoolingDown(account, ACCOUNT_LIMITS.AUTH_FAILURE_COOLDOWN_MS, "auth-failure");
                                             accountManager.saveToDiskDebounced();
                                             continue;
                                         }
+                                        const resolvedEmail = extractAccountEmail(accountAuth.access) ?? account.email;
+                                        const entitlementAccountKey = resolveEntitlementAccountKey({
+                                            accountId: account.accountId ?? accountId,
+                                            email: resolvedEmail,
+                                            refreshToken: account.refreshToken,
+                                            index: account.index,
+                                        });
                                         account.accountId = accountId;
                                         if (!hadAccountId && tokenAccountId && accountId === tokenAccountId) {
                                             account.accountIdSource = account.accountIdSource ?? "token";
                                         }
-                                        account.email =
-                                            extractAccountEmail(accountAuth.access) ?? account.email;
+                                        account.email = resolvedEmail;
                                         const entitlementBlock = entitlementCache.isBlocked(entitlementAccountKey, model ?? modelFamily);
                                         if (entitlementBlock.blocked) {
                                             runtimeMetrics.accountRotations++;
@@ -1299,6 +1257,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                         fallbackApplied: false,
                                                         fallbackReason: "unsupported-model-entitlement",
                                                     });
+                                                    retryNextAccountBeforeFallback = true;
                                                     break;
                                                 }
                                                 const fallbackModel = resolveUnsupportedCodexFallbackModel({
@@ -1626,7 +1585,9 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             if (successAccountForResponse.index !== account.index) {
                                                 accountManager.markSwitched(successAccountForResponse, "rotation", modelFamily);
                                             }
-                                            const successAccountKey = resolveEntitlementAccountKey(successAccountForResponse);
+                                            const successAccountKey = successAccountForResponse.index === account.index
+                                                ? entitlementAccountKey
+                                                : resolveEntitlementAccountKey(successAccountForResponse);
                                             accountManager.recordSuccess(successAccountForResponse, modelFamily, model);
                                             capabilityPolicyStore.recordSuccess(successAccountKey, capabilityModelKey);
                                             entitlementCache.clear(successAccountKey, capabilityModelKey);
@@ -1639,6 +1600,10 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             }
                                             return successResponse;
                                         }
+                                        if (retryNextAccountBeforeFallback) {
+                                            retryNextAccountBeforeFallback = false;
+                                            continue;
+                                        }
                                         if (restartAccountTraversalWithFallback) {
                                             break;
                                         }
@@ -2398,9 +2363,17 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                 const accountId = resolved.accountIdOverride ?? extractAccountId(resolved.access);
                                 const label = resolved.accountLabel ?? email ?? accountId ?? "Unknown account";
                                 logInfo(`Authenticated as: ${label}`);
-                                const isDuplicate = accounts.some((account) => (accountId &&
-                                    (account.accountIdOverride ?? extractAccountId(account.access)) === accountId) ||
-                                    (email && extractAccountEmail(account.access, account.idToken) === email));
+                                const isDuplicate = findMatchingAccountIndex(accounts.map((account) => ({
+                                    accountId: account.accountIdOverride ?? extractAccountId(account.access),
+                                    email: sanitizeEmail(extractAccountEmail(account.access, account.idToken)),
+                                    refreshToken: account.refresh,
+                                })), {
+                                    accountId,
+                                    email: sanitizeEmail(email),
+                                    refreshToken: resolved.refresh,
+                                }, {
+                                    allowUniqueAccountIdFallbackWithoutEmail: true,
+                                }) !== undefined;
                                 if (isDuplicate) {
                                     logWarn(`WARNING: duplicate account login detected (${label}). Existing entry will be updated.`);
                                 }