codex-multi-auth 1.1.11 → 1.2.1

package/scripts/check-pack-budget-lib.js

@@ -0,0 +1,114 @@
+import { exec } from "node:child_process";
+import { promisify } from "node:util";
+
+const execAsync = promisify(exec);
+
+export const MAX_PACKAGE_SIZE = 8 * 1024 * 1024;
+export const REQUIRED_PREFIXES = [
+	"dist/",
+	"assets/",
+	"config/",
+	"scripts/",
+	"vendor/codex-ai-plugin/",
+	"vendor/codex-ai-sdk/",
+	"README.md",
+	"LICENSE",
+];
+
+export const FORBIDDEN_PREFIXES = [
+	".github/",
+	"test/",
+	"src/",
+	"lib/",
+	"tmp/",
+	".tmp/",
+	".codex/",
+];
+
+export function normalizePackPath(filePath) {
+	return filePath.replaceAll("\\", "/");
+}
+
+export function parsePackMetadata(stdout) {
+	const packs = JSON.parse(stdout);
+	if (!Array.isArray(packs) || packs.length === 0) {
+		throw new Error("npm pack --dry-run --json returned no package metadata");
+	}
+
+	const pack = packs[0];
+	if (!pack || !Array.isArray(pack.files)) {
+		throw new Error("npm pack metadata did not include file list");
+	}
+
+	const packageSize = typeof pack.size === "number" ? pack.size : 0;
+	if (packageSize <= 0) {
+		throw new Error("npm pack metadata did not include a valid package size");
+	}
+
+	const paths = pack.files
+		.map((file) => file?.path)
+		.filter((value) => typeof value === "string")
+		.map((value) => normalizePackPath(value));
+
+	return { packageSize, paths };
+}
+
+export function validatePackMetadata({ packageSize, paths }) {
+	if (packageSize > MAX_PACKAGE_SIZE) {
+		throw new Error(
+			`Packed tarball is too large: ${packageSize} bytes (max ${MAX_PACKAGE_SIZE})`,
+		);
+	}
+
+	for (const forbidden of FORBIDDEN_PREFIXES) {
+		const leaked = paths.find(
+			(path) => path === forbidden || path.startsWith(forbidden),
+		);
+		if (leaked) {
+			throw new Error(`Forbidden file leaked into package: ${leaked}`);
+		}
+	}
+
+	for (const required of REQUIRED_PREFIXES) {
+		const present = paths.some(
+			(path) => path === required || path.startsWith(required),
+		);
+		if (!present) {
+			throw new Error(
+				`Required package content missing from npm pack output: ${required}`,
+			);
+		}
+	}
+
+	return `Pack budget ok: ${packageSize} bytes across ${paths.length} files`;
+}
+
+export async function runPackBudgetCheck(deps = {}) {
+	const npmCommand = process.platform === "win32" ? "npm.cmd" : "npm";
+	const runExec = deps.execAsync ?? execAsync;
+	const log = deps.log ?? console.log;
+	let stdout = "";
+	try {
+		({ stdout } = await runExec(`${npmCommand} pack --dry-run --json`, {
+			windowsHide: true,
+			maxBuffer: 10 * 1024 * 1024,
+		}));
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		const stdoutText = typeof error === "object" && error && "stdout" in error ? String(error.stdout ?? "") : "";
+		const stderrText = typeof error === "object" && error && "stderr" in error ? String(error.stderr ?? "") : "";
+		throw new Error(`npm pack --dry-run --json failed via ${npmCommand}: ${message}${stdoutText ? `
+stdout: ${stdoutText.slice(0, 500)}` : ""}${stderrText ? `
+stderr: ${stderrText.slice(0, 500)}` : ""}`);
+	}
+	let summary;
+	try {
+		summary = validatePackMetadata(parsePackMetadata(stdout));
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		throw new Error(`Failed to validate npm pack output: ${message}
+stdout: ${stdout.slice(0, 500)}`);
+	}
+	log(summary);
+	return summary;
+}

package/scripts/check-pack-budget.mjs

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { runPackBudgetCheck } from "./check-pack-budget-lib.js";
+
+export { runPackBudgetCheck } from "./check-pack-budget-lib.js";
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+	await runPackBudgetCheck();
+}

package/scripts/codex-multi-auth.js

@@ -1,18 +1,42 @@
 #!/usr/bin/env node
 
+// @ts-check
+
 import { createRequire } from "node:module";
-import { runCodexMultiAuthCli } from "../dist/lib/codex-manager.js";
 
-try {
+const versionFlags = new Set(["--version", "-v"]);
+
+function resolveCliVersion() {
 	const require = createRequire(import.meta.url);
-	const pkg = require("../package.json");
-	const version = typeof pkg?.version === "string" ? pkg.version.trim() : "";
-	if (version.length > 0) {
-		process.env.CODEX_MULTI_AUTH_CLI_VERSION = version;
+	try {
+		const pkg = require("../package.json");
+		const version = typeof pkg?.version === "string" ? pkg.version.trim() : "";
+		if (version.length > 0) {
+			return version;
+		}
+	} catch {
+		// Best effort only.
 	}
-} catch {
-	// Best effort only.
+	return "";
 }
 
-const exitCode = await runCodexMultiAuthCli(process.argv.slice(2));
-process.exitCode = Number.isInteger(exitCode) ? exitCode : 1;
+const args = process.argv.slice(2);
+const version = resolveCliVersion();
+
+if (version.length > 0) {
+	process.env.CODEX_MULTI_AUTH_CLI_VERSION = version;
+}
+
+if (args.length === 1 && versionFlags.has(args[0])) {
+	if (version.length > 0) {
+		process.stdout.write(`${version}\n`);
+		process.exitCode = 0;
+	} else {
+		process.stderr.write("codex-multi-auth version is unavailable.\n");
+		process.exitCode = 1;
+	}
+} else {
+	const { runCodexMultiAuthCli } = await import("../dist/lib/codex-manager.js");
+	const exitCode = await runCodexMultiAuthCli(args);
+	process.exitCode = Number.isInteger(exitCode) ? exitCode : 1;
+}

package/scripts/install-codex-auth-utils.js

@@ -1,13 +1,26 @@
-import { join } from "node:path";
-import { homedir } from "node:os";
+// @ts-check
+
 import { rename as fsRename } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
 
 const PLUGIN_NAME = "codex-multi-auth";
-export const FILE_RETRY_CODES = new Set(["EBUSY", "EPERM", "EAGAIN", "ENOTEMPTY", "EACCES"]);
+export const FILE_RETRY_CODES = new Set([
+	"EBUSY",
+	"EPERM",
+	"EAGAIN",
+	"ENOTEMPTY",
+	"EACCES",
+]);
 export const FILE_RETRY_MAX_ATTEMPTS = 6;
 export const FILE_RETRY_BASE_DELAY_MS = 25;
 export const FILE_RETRY_JITTER_MS = 20;
 
+/**
+ * @param {NodeJS.Platform} [platform]
+ * @param {NodeJS.ProcessEnv} [env]
+ * @param {string} [home]
+ */
 export function resolveInstallPaths(
 	platform = process.platform,
 	env = process.env,
@@ -35,6 +48,7 @@ export function resolveInstallPaths(
 	};
 }
 
+/** @param {unknown} list */
 export function normalizePluginList(list) {
 	const entries = Array.isArray(list) ? list.filter(Boolean) : [];
 	const filtered = entries.filter((entry) => {
@@ -44,7 +58,8 @@ export function normalizePluginList(list) {
 	const deduped = [];
 	const seen = new Set();
 	for (const entry of filtered) {
-		const key = typeof entry === "string" ? `s:${entry}` : `j:${JSON.stringify(entry)}`;
+		const key =
+			typeof entry === "string" ? `s:${entry}` : `j:${JSON.stringify(entry)}`;
 		if (seen.has(key)) continue;
 		seen.add(key);
 		deduped.push(entry);
@@ -52,6 +67,7 @@ export function normalizePluginList(list) {
 	return [...deduped, PLUGIN_NAME];
 }
 
+/** @param {number} ms */
 function sleep(ms) {
 	// Keep this helper local so installer scripts remain standalone and do not depend on lib/.
 	return new Promise((resolve) => {
@@ -59,28 +75,49 @@ function sleep(ms) {
 	});
 }
 
+/** @param {unknown} error */
 function shouldRetryFileOperation(error) {
-	return error instanceof Error &&
-		typeof error.code === "string" &&
-		FILE_RETRY_CODES.has(error.code);
+	const fileError = /** @type {NodeJS.ErrnoException | undefined} */ (error);
+	return (
+		fileError instanceof Error &&
+		typeof fileError.code === "string" &&
+		FILE_RETRY_CODES.has(fileError.code)
+	);
 }
 
+/** @template T @param {() => Promise<T>} operation */
 export async function withFileOperationRetry(operation) {
 	for (let attempt = 1; ; attempt += 1) {
 		try {
 			return await operation();
 		} catch (error) {
-			if (!shouldRetryFileOperation(error) || attempt >= FILE_RETRY_MAX_ATTEMPTS) {
+			if (
+				!shouldRetryFileOperation(error) ||
+				attempt >= FILE_RETRY_MAX_ATTEMPTS
+			) {
 				throw error;
 			}
 
 			const jitter = Math.floor(Math.random() * FILE_RETRY_JITTER_MS);
-			const delayMs = (FILE_RETRY_BASE_DELAY_MS * (2 ** (attempt - 1))) + jitter;
+			const delayMs = FILE_RETRY_BASE_DELAY_MS * 2 ** (attempt - 1) + jitter;
 			await sleep(delayMs);
 		}
 	}
 }
 
+/**
+ * @param {string} sourcePath
+ * @param {string} targetPath
+ * @param {{
+ *   rename?: (sourcePath: string, targetPath: string) => Promise<void>,
+ *   log?: (message: string) => void,
+ *   maxRetries?: number,
+ *   baseDelayMs?: number,
+ *   jitterMs?: number,
+ *   random?: () => number,
+ *   sleep?: (ms: number) => Promise<void>,
+ * }} [options]
+ */
 export async function renameWithRetry(sourcePath, targetPath, options = {}) {
 	const {
 		rename = fsRename,
@@ -101,14 +138,17 @@ export async function renameWithRetry(sourcePath, targetPath, options = {}) {
 			await rename(sourcePath, targetPath);
 			return;
 		} catch (error) {
-			const code = error && typeof error === "object" && "code" in error
-				? error.code
-				: undefined;
-			const isRetryable = typeof code === "string" && FILE_RETRY_CODES.has(code);
+			const code =
+				error && typeof error === "object" && "code" in error
+					? error.code
+					: undefined;
+			const isRetryable =
+				typeof code === "string" && FILE_RETRY_CODES.has(code);
 			if (!isRetryable || attempt === maxRetries - 1) {
 				throw error;
 			}
-			const delayMs = baseDelayMs * 2 ** attempt + Math.floor(random() * jitterMs);
+			const delayMs =
+				baseDelayMs * 2 ** attempt + Math.floor(random() * jitterMs);
 			log(
 				`Retrying atomic rename (${attempt + 1}/${maxRetries}) code=${code ?? "unknown"} source=${sourcePath} target=${targetPath} delayMs=${delayMs}`,
 			);

package/scripts/install-codex-auth.js

@@ -1,9 +1,11 @@
 #!/usr/bin/env node
 
+// @ts-check
+
 import { existsSync } from "node:fs";
-import { readFile, writeFile, mkdir, copyFile, rm } from "node:fs/promises";
-import { fileURLToPath } from "node:url";
+import { copyFile, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
 import {
 	normalizePluginList,
 	renameWithRetry,
@@ -16,17 +18,18 @@ const PLUGIN_NAME = "codex-multi-auth";
 const args = new Set(process.argv.slice(2));
 
 if (args.has("--help") || args.has("-h")) {
-	console.log(`Usage: ${PLUGIN_NAME} [--modern|--legacy] [--dry-run] [--no-cache-clear]\n\n` +
-		"Default behavior:\n" +
-		"  - Installs/updates global config at ~/.config/Codex/Codex.json\n" +
-		"  - Uses modern config (variants) by default\n" +
-		"  - Ensures plugin is unpinned (latest)\n" +
-		"  - Clears Codex plugin cache\n\n" +
-		"Options:\n" +
-		"  --modern           Force modern config (default)\n" +
-		"  --legacy           Use legacy config (older Codex versions)\n" +
-		"  --dry-run          Show actions without writing\n" +
-		"  --no-cache-clear   Skip clearing Codex cache\n"
+	console.log(
+		`Usage: ${PLUGIN_NAME} [--modern|--legacy] [--dry-run] [--no-cache-clear]\n\n` +
+			"Default behavior:\n" +
+			"  - Installs/updates global config at ~/.config/Codex/Codex.json\n" +
+			"  - Uses modern config (variants) by default\n" +
+			"  - Ensures plugin is unpinned (latest)\n" +
+			"  - Clears Codex plugin cache\n\n" +
+			"Options:\n" +
+			"  --modern           Force modern config (default)\n" +
+			"  --legacy           Use legacy config (older Codex versions)\n" +
+			"  --dry-run          Show actions without writing\n" +
+			"  --no-cache-clear   Skip clearing Codex cache\n",
 	);
 	process.exit(0);
 }
@@ -41,25 +44,35 @@ const repoRoot = resolve(scriptDir, "..");
 const templatePath = join(
 	repoRoot,
 	"config",
-	useLegacy ? "codex-legacy.json" : "codex-modern.json"
+	useLegacy ? "codex-legacy.json" : "codex-modern.json",
 );
 
 const installPaths = resolveInstallPaths();
-const { configDir, configPath, cacheNodeModules, cacheBunLock, cachePackageJson } = installPaths;
-
+const {
+	configDir,
+	configPath,
+	cacheNodeModules,
+	cacheBunLock,
+	cachePackageJson,
+} = installPaths;
+
+/** @param {string} message */
 function log(message) {
 	console.log(message);
 }
 
+/** @param {unknown} obj */
 function formatJson(obj) {
 	return `${JSON.stringify(obj, null, 2)}\n`;
 }
 
+/** @param {string} filePath */
 async function readJson(filePath) {
 	const content = await readFile(filePath, "utf-8");
-	return JSON.parse(content);
+	return /** @type {any} */ (JSON.parse(content));
 }
 
+/** @param {string} filePath @param {unknown} value */
 async function writeJsonAtomic(filePath, value) {
 	const tempPath = `${filePath}.tmp-${process.pid}-${Date.now()}-${Math.random()
 		.toString(36)
@@ -79,6 +92,7 @@ async function writeJsonAtomic(filePath, value) {
 	}
 }
 
+/** @param {string} sourcePath */
 async function backupConfig(sourcePath) {
 	const timestamp = new Date()
 		.toISOString()
@@ -98,6 +112,7 @@ async function removePluginFromCachePackage() {
 		return;
 	}
 
+	/** @type {any} */
 	let cacheData;
 	try {
 		cacheData = await readJson(cachePackageJson);
@@ -145,7 +160,9 @@ async function clearCache() {
 		log(`[dry-run] Would remove ${cacheBunLock}`);
 	} else {
 		try {
-			await withFileOperationRetry(() => rm(cacheNodeModules, { recursive: true, force: true }));
+			await withFileOperationRetry(() =>
+				rm(cacheNodeModules, { recursive: true, force: true }),
+			);
 			await withFileOperationRetry(() => rm(cacheBunLock, { force: true }));
 		} catch (error) {
 			log(
@@ -168,27 +185,36 @@ async function main() {
 	let nextConfig = template;
 	if (existsSync(configPath)) {
 		const backupPath = await backupConfig(configPath);
-		log(`${dryRun ? "[dry-run] Would create backup" : "Backup created"}: ${backupPath}`);
+		log(
+			`${dryRun ? "[dry-run] Would create backup" : "Backup created"}: ${backupPath}`,
+		);
 
 		try {
 			const existing = await readJson(configPath);
 			const merged = { ...existing };
 			merged.plugin = normalizePluginList(existing.plugin);
-			const provider = (existing.provider && typeof existing.provider === "object")
-				? { ...existing.provider }
-				: {};
-			const existingOpenAi = provider.openai && typeof provider.openai === "object"
-				? provider.openai
-				: {};
-			const templateOpenAi = template.provider && typeof template.provider === "object" &&
-				template.provider.openai && typeof template.provider.openai === "object"
-				? template.provider.openai
-				: {};
+			const provider =
+				existing.provider && typeof existing.provider === "object"
+					? { ...existing.provider }
+					: {};
+			const existingOpenAi =
+				provider.openai && typeof provider.openai === "object"
+					? provider.openai
+					: {};
+			const templateOpenAi =
+				template.provider &&
+				typeof template.provider === "object" &&
+				template.provider.openai &&
+				typeof template.provider.openai === "object"
+					? template.provider.openai
+					: {};
 			provider.openai = { ...templateOpenAi, ...existingOpenAi };
 			merged.provider = provider;
 			nextConfig = merged;
 		} catch (error) {
-			log(`Warning: Could not parse existing config (${error}). Replacing with template.`);
+			log(
+				`Warning: Could not parse existing config (${error}). Replacing with template.`,
+			);
 			nextConfig = template;
 		}
 	} else {
@@ -196,7 +222,9 @@ async function main() {
 	}
 
 	if (dryRun) {
-		log(`[dry-run] Would write ${configPath} using ${useLegacy ? "legacy" : "modern"} config`);
+		log(
+			`[dry-run] Would write ${configPath} using ${useLegacy ? "legacy" : "modern"} config`,
+		);
 	} else {
 		await mkdir(configDir, { recursive: true });
 		await writeJsonAtomic(configPath, nextConfig);
@@ -222,8 +250,9 @@ const isDirectRun = (() => {
 
 if (isDirectRun) {
 	main().catch((error) => {
-		console.error(`Installer failed: ${error instanceof Error ? error.message : error}`);
+		console.error(
+			`Installer failed: ${error instanceof Error ? error.message : error}`,
+		);
 		process.exit(1);
 	});
 }
-

package/scripts/update-vendor-provenance.mjs

@@ -0,0 +1,96 @@
+#!/usr/bin/env node
+import { createHash } from "node:crypto";
+import { readFile, writeFile } from "node:fs/promises";
+
+const components = [
+	{
+		name: "@codex-ai/plugin",
+		root: "vendor/codex-ai-plugin",
+		source: "vendored dist shim",
+		files: [
+			"vendor/codex-ai-plugin/package.json",
+			"vendor/codex-ai-plugin/dist/index.js",
+			"vendor/codex-ai-plugin/dist/index.d.ts",
+			"vendor/codex-ai-plugin/dist/tool.js",
+			"vendor/codex-ai-plugin/dist/tool.d.ts",
+		],
+	},
+	{
+		name: "@codex-ai/sdk",
+		root: "vendor/codex-ai-sdk",
+		source: "vendored dist shim",
+		files: [
+			"vendor/codex-ai-sdk/package.json",
+			"vendor/codex-ai-sdk/dist/index.js",
+			"vendor/codex-ai-sdk/dist/index.d.ts",
+		],
+	},
+];
+
+async function loadExistingManifest() {
+	try {
+		const content = await readFile("vendor/provenance.json", "utf8");
+		const parsed = JSON.parse(content);
+		return Array.isArray(parsed?.components) ? parsed : { components: [] };
+	} catch {
+		return { components: [] };
+	}
+}
+
+async function hashFile(path) {
+	const content = await readFile(path);
+	return createHash("sha256").update(content).digest("hex");
+}
+
+const existingManifest = await loadExistingManifest();
+const existingFiles = Object.fromEntries(
+	existingManifest.components.flatMap((component) =>
+		Array.isArray(component.files)
+			? component.files
+					.filter(
+						(file) =>
+							file &&
+							typeof file === "object" &&
+							typeof file.path === "string",
+					)
+					.map((file) => [file.path, file])
+			: [],
+	),
+);
+
+const manifest = {
+	generatedAt: new Date().toISOString().slice(0, 10),
+	components: [],
+};
+
+for (const component of components) {
+	const packageJson = JSON.parse(
+		await readFile(`${component.root}/package.json`, "utf8"),
+	);
+	manifest.components.push({
+		name: component.name,
+		version: packageJson.version,
+		source: component.source,
+		root: component.root,
+		files: await Promise.all(
+			component.files.map(async (path) => {
+				const prior = existingFiles[path] ?? {};
+				const { path: _priorPath, sha256: _priorHash, ...extra } = prior;
+				return {
+					path,
+					sha256: await hashFile(path),
+					...extra,
+				};
+			}),
+		),
+	});
+}
+
+await writeFile(
+	"vendor/provenance.json",
+	`${JSON.stringify(manifest, null, 2)}\n`,
+	"utf8",
+);
+console.log(
+	`Updated vendor/provenance.json for ${manifest.components.length} component(s)`,
+);

package/scripts/verify-vendor-provenance.mjs

@@ -0,0 +1,53 @@
+#!/usr/bin/env node
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+
+const manifest = JSON.parse(
+	await readFile(new URL("../vendor/provenance.json", import.meta.url), "utf8"),
+);
+
+if (!manifest || !Array.isArray(manifest.components)) {
+	throw new Error("vendor/provenance.json is missing a valid components array");
+}
+
+for (const component of manifest.components) {
+	if (
+		!component ||
+		!Array.isArray(component.files) ||
+		component.files.length === 0
+	) {
+		throw new Error(
+			`Component provenance entry is invalid: ${JSON.stringify(component)}`,
+		);
+	}
+	for (const file of component.files) {
+		if (!file?.path || !file?.sha256) {
+			throw new Error(`Invalid file provenance entry in ${component.name}`);
+		}
+		let content;
+		try {
+			content = await readFile(new URL(`../${file.path}`, import.meta.url));
+		} catch (error) {
+			const code =
+				error && typeof error === "object"
+					? /** @type {{ code?: string }} */ (error).code
+					: undefined;
+			if (code === "ENOENT") {
+				throw new Error(
+					`Vendor file not found in ${component.name}: ${file.path} (${code})`,
+				);
+			}
+			throw error;
+		}
+		const actual = createHash("sha256").update(content).digest("hex");
+		if (actual !== file.sha256) {
+			throw new Error(
+				`Vendor provenance mismatch for ${file.path}: expected ${file.sha256}, got ${actual}`,
+			);
+		}
+	}
+}
+
+console.log(
+	`Vendor provenance ok: ${manifest.components.length} component(s), ${manifest.components.reduce((/** @type {number} */ sum, /** @type {{ files?: unknown[] }} */ component) => sum + (Array.isArray(component.files) ? component.files.length : 0), 0)} file(s) verified`,
+);