codex-multi-auth 1.2.0 → 1.2.1

package/dist/lib/codex-manager/login.js

@@ -0,0 +1,1041 @@
+import { stdin as input, stdout as output } from "node:process";
+import { createInterface } from "node:readline/promises";
+import { extractAccountEmail, extractAccountId, getAccountIdCandidates, resolveRequestAccountId, sanitizeEmail, selectBestAccountCandidate, } from "../accounts.js";
+import { createAuthorizationFlow, exchangeAuthorizationCode, parseAuthorizationInput, REDIRECT_URI, } from "../auth/auth.js";
+import { copyTextToClipboard, isBrowserLaunchSuppressed, openBrowserUrl, } from "../auth/browser.js";
+import { startLocalOAuthServer } from "../auth/server.js";
+import { promptAddAnotherAccount, promptLoginMode, } from "../cli.js";
+import { setCodexCliActiveSelection } from "../codex-cli/writer.js";
+import { ACCOUNT_LIMITS } from "../constants.js";
+import { loadDashboardDisplaySettings, } from "../dashboard-settings.js";
+import { createLogger } from "../logger.js";
+import { MODEL_FAMILIES } from "../prompts/codex.js";
+import { loadQuotaCache } from "../quota-cache.js";
+import { clearAccounts, findMatchingAccountIndex, formatStorageErrorHint, getNamedBackups, loadAccounts, loadFlaggedAccounts, restoreAccountsFromBackup, StorageError, saveAccounts, setStoragePath, withAccountStorageTransaction, } from "../storage.js";
+import { ANSI } from "../ui/ansi.js";
+import { confirm } from "../ui/confirm.js";
+import { UI_COPY } from "../ui/copy.js";
+import { getUiRuntimeOptions } from "../ui/runtime.js";
+import { select } from "../ui/select.js";
+import { printUsage } from "./help.js";
+import { applyUiThemeFromDashboardSettings } from "./settings-hub.js";
+const log = createLogger("codex-manager-login");
+function parseAuthLoginArgs(args) {
+    const options = {
+        manual: false,
+    };
+    for (const arg of args) {
+        if (arg === "--manual" || arg === "--no-browser") {
+            options.manual = true;
+            continue;
+        }
+        if (arg === "--help" || arg === "-h") {
+            printUsage();
+            return { ok: false, message: "" };
+        }
+        return {
+            ok: false,
+            message: `Unknown login option: ${arg}`,
+        };
+    }
+    return { ok: true, options };
+}
+function isAbortError(error) {
+    if (!(error instanceof Error))
+        return false;
+    const maybe = error;
+    return maybe.name === "AbortError" || maybe.code === "ABORT_ERR";
+}
+function isReadlineClosedError(error) {
+    if (!(error instanceof Error)) {
+        return false;
+    }
+    const errorCode = typeof error === "object" && error !== null && "code" in error
+        ? String(error.code)
+        : "";
+    return (errorCode === "ERR_USE_AFTER_CLOSE" ||
+        /readline was closed/i.test(error.message));
+}
+export function formatBackupSavedAt(mtimeMs) {
+    return new Date(mtimeMs).toLocaleString(undefined, {
+        month: "short",
+        day: "numeric",
+        year: "numeric",
+        hour: "numeric",
+        minute: "2-digit",
+    });
+}
+async function waitForMenuReturn(stylePromptText, options = {}) {
+    if (!input.isTTY || !output.isTTY) {
+        return;
+    }
+    const promptText = options.promptText ?? UI_COPY.returnFlow.continuePrompt;
+    const autoReturnMs = options.autoReturnMs ?? 0;
+    const pauseOnAnyKey = options.pauseOnAnyKey ?? true;
+    try {
+        let chunk;
+        do {
+            chunk = input.read();
+        } while (chunk !== null);
+    }
+    catch {
+        // best effort buffer drain
+    }
+    const writeInlineStatus = (message) => {
+        output.write(`\r${ANSI.clearLine}${stylePromptText(message, "muted")}`);
+    };
+    const clearInlineStatus = () => {
+        output.write(`\r${ANSI.clearLine}`);
+    };
+    if (autoReturnMs > 0) {
+        if (!pauseOnAnyKey) {
+            await new Promise((resolve) => setTimeout(resolve, autoReturnMs));
+            return;
+        }
+        const wasRaw = input.isRaw ?? false;
+        const endAt = Date.now() + autoReturnMs;
+        let lastShownSeconds = null;
+        const renderCountdown = () => {
+            const remainingMs = Math.max(0, endAt - Date.now());
+            const remainingSeconds = Math.max(1, Math.ceil(remainingMs / 1000));
+            if (lastShownSeconds === remainingSeconds)
+                return;
+            lastShownSeconds = remainingSeconds;
+            writeInlineStatus(UI_COPY.returnFlow.autoReturn(remainingSeconds));
+        };
+        renderCountdown();
+        const pinned = await new Promise((resolve) => {
+            let done = false;
+            const interval = setInterval(renderCountdown, 80);
+            let timeout = setTimeout(() => {
+                timeout = null;
+                if (!done) {
+                    done = true;
+                    cleanup();
+                    resolve(false);
+                }
+            }, autoReturnMs);
+            const onData = () => {
+                if (done)
+                    return;
+                done = true;
+                cleanup();
+                resolve(true);
+            };
+            const cleanup = () => {
+                clearInterval(interval);
+                if (timeout) {
+                    clearTimeout(timeout);
+                    timeout = null;
+                }
+                input.removeListener("data", onData);
+                try {
+                    input.setRawMode(wasRaw);
+                }
+                catch {
+                    // best effort restore
+                }
+            };
+            try {
+                input.setRawMode(true);
+            }
+            catch {
+                // best effort fallback
+            }
+            input.on("data", onData);
+            input.resume();
+        });
+        clearInlineStatus();
+        if (!pinned) {
+            return;
+        }
+        writeInlineStatus(stylePromptText(UI_COPY.returnFlow.paused, "muted"));
+        await new Promise((resolve) => {
+            const wasRaw = input.isRaw ?? false;
+            const onData = () => {
+                cleanup();
+                resolve();
+            };
+            const cleanup = () => {
+                input.removeListener("data", onData);
+                try {
+                    input.setRawMode(wasRaw);
+                }
+                catch {
+                    // best effort restore
+                }
+            };
+            try {
+                input.setRawMode(true);
+            }
+            catch {
+                // best effort fallback
+            }
+            input.on("data", onData);
+            input.resume();
+        });
+        clearInlineStatus();
+        return;
+    }
+    const rl = createInterface({ input, output });
+    try {
+        const question = promptText.length > 0 ? `${stylePromptText(promptText, "muted")} ` : "";
+        output.write(`\r${ANSI.clearLine}`);
+        await rl.question(question);
+    }
+    catch (error) {
+        if (!isAbortError(error)) {
+            throw error;
+        }
+    }
+    finally {
+        rl.close();
+        clearInlineStatus();
+    }
+}
+function stringifyLogArgs(args) {
+    return args
+        .map((value) => {
+        if (typeof value === "string")
+            return value;
+        try {
+            return JSON.stringify(value);
+        }
+        catch {
+            return String(value);
+        }
+    })
+        .join(" ");
+}
+async function runActionPanel(stylePromptText, title, stage, action, settings) {
+    if (!input.isTTY || !output.isTTY) {
+        await action();
+        return;
+    }
+    const spinnerFrames = ["-", "\\", "|", "/"];
+    let frame = 0;
+    let running = true;
+    let failed = null;
+    const captured = [];
+    const maxVisibleLines = Math.max(8, (output.rows ?? 24) - 8);
+    const previousLog = console.log;
+    const previousWarn = console.warn;
+    const previousError = console.error;
+    const capture = (prefix, args) => {
+        const line = stringifyLogArgs(args).trim();
+        if (!line)
+            return;
+        captured.push(prefix ? `${prefix}${line}` : line);
+        if (captured.length > 400) {
+            captured.splice(0, captured.length - 400);
+        }
+    };
+    const render = () => {
+        output.write(ANSI.clearScreen + ANSI.moveTo(1, 1));
+        const spinner = running
+            ? `${spinnerFrames[frame % spinnerFrames.length] ?? "-"} `
+            : failed
+                ? "x "
+                : "+ ";
+        const stageText = running
+            ? `${spinner}${stage}`
+            : failed
+                ? UI_COPY.returnFlow.failed
+                : UI_COPY.returnFlow.done;
+        previousLog(stylePromptText(title, "accent"));
+        previousLog(stylePromptText(stageText, failed ? "danger" : running ? "accent" : "success"));
+        previousLog("");
+        const lines = captured.slice(-maxVisibleLines);
+        for (const line of lines) {
+            previousLog(line);
+        }
+        const remainingLines = Math.max(0, maxVisibleLines - lines.length);
+        for (let i = 0; i < remainingLines; i += 1) {
+            previousLog("");
+        }
+        previousLog("");
+        if (running)
+            previousLog(stylePromptText(UI_COPY.returnFlow.working, "muted"));
+        frame += 1;
+    };
+    console.log = (...args) => {
+        capture("", args);
+    };
+    console.warn = (...args) => {
+        capture("! ", args);
+    };
+    console.error = (...args) => {
+        capture("x ", args);
+    };
+    output.write(ANSI.altScreenOn + ANSI.hide);
+    let timer = null;
+    try {
+        render();
+        timer = setInterval(() => {
+            if (!running)
+                return;
+            render();
+        }, 120);
+        await action();
+    }
+    catch (error) {
+        failed = error;
+        capture("x ", [error instanceof Error ? error.message : String(error)]);
+    }
+    finally {
+        running = false;
+        if (timer) {
+            clearInterval(timer);
+            timer = null;
+        }
+        render();
+        console.log = previousLog;
+        console.warn = previousWarn;
+        console.error = previousError;
+    }
+    if (failed) {
+        await waitForMenuReturn(stylePromptText, {
+            promptText: UI_COPY.returnFlow.actionFailedPrompt,
+        });
+    }
+    else {
+        await waitForMenuReturn(stylePromptText, {
+            autoReturnMs: settings?.actionAutoReturnMs ?? 2_000,
+            pauseOnAnyKey: settings?.actionPauseOnKey ?? true,
+        });
+    }
+    output.write(ANSI.altScreenOff + ANSI.show + ANSI.clearScreen + ANSI.moveTo(1, 1));
+    if (failed) {
+        throw failed;
+    }
+}
+async function promptManualCallback(state, stylePromptText, options = {}) {
+    const useInteractivePrompt = input.isTTY && output.isTTY;
+    if (!useInteractivePrompt && !options.allowNonTty) {
+        return null;
+    }
+    const rl = createInterface({ input, output });
+    try {
+        if (useInteractivePrompt) {
+            console.log("");
+            console.log(stylePromptText(UI_COPY.oauth.pastePrompt, "accent"));
+        }
+        const answer = useInteractivePrompt
+            ? await rl.question("◆  ")
+            : await new Promise((resolve, reject) => {
+                if (input.readableEnded || input.destroyed) {
+                    resolve(null);
+                    return;
+                }
+                let settled = false;
+                const handleInputClosed = () => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    input.off("end", handleInputClosed);
+                    input.off("close", handleInputClosed);
+                    resolve(null);
+                };
+                const finish = (value) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    input.off("end", handleInputClosed);
+                    input.off("close", handleInputClosed);
+                    resolve(value);
+                };
+                const fail = (error) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    input.off("end", handleInputClosed);
+                    input.off("close", handleInputClosed);
+                    reject(error);
+                };
+                rl.question("")
+                    .then((value) => finish(value))
+                    .catch((error) => {
+                    if (isAbortError(error) || isReadlineClosedError(error)) {
+                        handleInputClosed();
+                        return;
+                    }
+                    fail(error);
+                });
+                input.once("end", handleInputClosed);
+                input.once("close", handleInputClosed);
+            });
+        if (answer === null) {
+            return null;
+        }
+        if (answer.includes("\u001b")) {
+            return null;
+        }
+        const normalized = answer.trim().toLowerCase();
+        if (normalized.length === 0 ||
+            normalized === "q" ||
+            normalized === "quit" ||
+            normalized === "cancel" ||
+            normalized === "back") {
+            return null;
+        }
+        const parsed = parseAuthorizationInput(answer);
+        if (!parsed.code)
+            return null;
+        if (parsed.state && parsed.state !== state)
+            return null;
+        return parsed.code;
+    }
+    catch (error) {
+        if (isAbortError(error) || isReadlineClosedError(error)) {
+            return null;
+        }
+        throw error;
+    }
+    finally {
+        rl.close();
+    }
+}
+async function promptOAuthSignInMode(backupOption, backupDiscoveryWarning = null) {
+    if (!input.isTTY || !output.isTTY) {
+        return "browser";
+    }
+    const ui = getUiRuntimeOptions();
+    const items = [
+        {
+            label: UI_COPY.oauth.signInHeading,
+            value: "cancel",
+            kind: "heading",
+        },
+        { label: UI_COPY.oauth.openBrowser, value: "browser", color: "green" },
+        { label: UI_COPY.oauth.manualMode, value: "manual", color: "yellow" },
+        ...(backupOption
+            ? [
+                { separator: true, label: "", value: "cancel" },
+                {
+                    label: UI_COPY.oauth.restoreHeading,
+                    value: "cancel",
+                    kind: "heading",
+                },
+                {
+                    label: UI_COPY.oauth.restoreSavedBackup,
+                    value: "restore-backup",
+                    hint: UI_COPY.oauth.loadLastBackupHint(backupOption.fileName, backupOption.accountCount, formatBackupSavedAt(backupOption.mtimeMs)),
+                    color: "cyan",
+                },
+            ]
+            : []),
+        { separator: true, label: "", value: "cancel" },
+        { label: UI_COPY.oauth.back, value: "cancel", color: "red" },
+    ];
+    const selected = await select(items, {
+        message: UI_COPY.oauth.chooseModeTitle,
+        subtitle: backupDiscoveryWarning
+            ? `${UI_COPY.oauth.chooseModeSubtitle} ${backupDiscoveryWarning}`
+            : UI_COPY.oauth.chooseModeSubtitle,
+        help: backupOption
+            ? UI_COPY.oauth.chooseModeHelpWithBackup
+            : UI_COPY.oauth.chooseModeHelp,
+        clearScreen: true,
+        theme: ui.theme,
+        selectedEmphasis: "minimal",
+        allowEscape: false,
+        onInput: (raw) => {
+            const lower = raw.toLowerCase();
+            if (lower === "q")
+                return "cancel";
+            if (lower === "1")
+                return "browser";
+            if (lower === "2")
+                return "manual";
+            if (lower === "3" && backupOption)
+                return "restore-backup";
+            return undefined;
+        },
+    });
+    return selected ?? "cancel";
+}
+async function promptBackupRestoreMode(latestBackup) {
+    if (!input.isTTY || !output.isTTY) {
+        return "latest";
+    }
+    const ui = getUiRuntimeOptions();
+    const items = [
+        {
+            label: UI_COPY.oauth.loadLastBackup,
+            value: "latest",
+            hint: `${UI_COPY.oauth.restoreBackupLatestHint}\n${UI_COPY.oauth.manualBackupHint(latestBackup.accountCount, formatBackupSavedAt(latestBackup.mtimeMs))}`,
+            color: "cyan",
+        },
+        {
+            label: UI_COPY.oauth.chooseBackupManually,
+            value: "manual",
+            color: "yellow",
+        },
+        { label: UI_COPY.oauth.back, value: "back", color: "red" },
+    ];
+    const selected = await select(items, {
+        message: UI_COPY.oauth.restoreBackupTitle,
+        subtitle: UI_COPY.oauth.restoreBackupSubtitle,
+        help: UI_COPY.oauth.restoreBackupHelp,
+        clearScreen: true,
+        theme: ui.theme,
+        selectedEmphasis: "minimal",
+        allowEscape: false,
+        onInput: (raw) => {
+            const lower = raw.toLowerCase();
+            if (lower === "q")
+                return "back";
+            if (lower === "1")
+                return "latest";
+            if (lower === "2")
+                return "manual";
+            return undefined;
+        },
+    });
+    return selected ?? "back";
+}
+async function promptManualBackupSelection(backups) {
+    if (!input.isTTY || !output.isTTY) {
+        return backups[0] ?? null;
+    }
+    const ui = getUiRuntimeOptions();
+    const items = backups.map((backup) => ({
+        label: backup.fileName,
+        value: backup,
+        hint: UI_COPY.oauth.manualBackupHint(backup.accountCount, formatBackupSavedAt(backup.mtimeMs)),
+        color: "cyan",
+    }));
+    items.push({ label: UI_COPY.oauth.back, value: null, color: "red" });
+    const selected = await select(items, {
+        message: UI_COPY.oauth.manualBackupTitle,
+        subtitle: UI_COPY.oauth.manualBackupSubtitle,
+        help: UI_COPY.oauth.manualBackupHelp,
+        clearScreen: true,
+        theme: ui.theme,
+        selectedEmphasis: "minimal",
+        allowEscape: false,
+        onInput: (raw) => {
+            if (raw.toLowerCase() === "q")
+                return null;
+            return undefined;
+        },
+    });
+    return selected;
+}
+async function runOAuthFlow(forceNewLogin, signInMode, stylePromptText) {
+    const { pkce, state, url } = await createAuthorizationFlow({ forceNewLogin });
+    let code = null;
+    let oauthServer = null;
+    try {
+        if (signInMode === "browser") {
+            try {
+                oauthServer = await startLocalOAuthServer({ state });
+            }
+            catch {
+                oauthServer = null;
+            }
+        }
+        if (signInMode === "browser") {
+            const opened = openBrowserUrl(url);
+            if (opened) {
+                console.log(stylePromptText(UI_COPY.oauth.browserOpened, "success"));
+            }
+            else {
+                console.log(stylePromptText(UI_COPY.oauth.browserOpenFail, "warning"));
+                console.log(`${stylePromptText(UI_COPY.oauth.goTo, "accent")} ${url}`);
+                const copied = copyTextToClipboard(url);
+                console.log(stylePromptText(copied ? UI_COPY.oauth.copyOk : UI_COPY.oauth.copyFail, copied ? "success" : "warning"));
+            }
+        }
+        else {
+            console.log(`${stylePromptText(UI_COPY.oauth.goTo, "accent")} ${url}`);
+            const copied = copyTextToClipboard(url);
+            console.log(stylePromptText(copied ? UI_COPY.oauth.copyOk : UI_COPY.oauth.copyFail, copied ? "success" : "warning"));
+        }
+        const waitingForCallback = signInMode === "browser" && oauthServer?.ready === true;
+        if (waitingForCallback && oauthServer) {
+            console.log(stylePromptText(UI_COPY.oauth.waitingCallback, "muted"));
+            const callbackResult = await oauthServer.waitForCode(state);
+            code = callbackResult?.code ?? null;
+        }
+        if (!code) {
+            console.log(stylePromptText(waitingForCallback
+                ? UI_COPY.oauth.callbackMissed
+                : signInMode === "manual"
+                    ? UI_COPY.oauth.callbackBypassed
+                    : UI_COPY.oauth.callbackUnavailable, "warning"));
+            code = await promptManualCallback(state, stylePromptText, {
+                allowNonTty: signInMode === "manual",
+            });
+        }
+    }
+    finally {
+        oauthServer?.close();
+    }
+    if (!code) {
+        return {
+            type: "failed",
+            reason: "unknown",
+            message: UI_COPY.oauth.cancelled,
+        };
+    }
+    return exchangeAuthorizationCode(code, pkce.verifier, REDIRECT_URI);
+}
+function isUserCancelledOAuth(result) {
+    if (result.type !== "failed")
+        return false;
+    const message = (result.message ?? "").toLowerCase();
+    return message.includes("cancelled");
+}
+function resolveAccountSelection(tokens) {
+    const override = (process.env.CODEX_AUTH_ACCOUNT_ID ?? "").trim();
+    if (override) {
+        return {
+            ...tokens,
+            accountIdOverride: override,
+            accountIdSource: "manual",
+        };
+    }
+    const candidates = getAccountIdCandidates(tokens.access, tokens.idToken);
+    if (candidates.length === 0) {
+        return tokens;
+    }
+    if (candidates.length === 1) {
+        const [candidate] = candidates;
+        if (candidate) {
+            return {
+                ...tokens,
+                accountIdOverride: candidate.accountId,
+                accountIdSource: candidate.source,
+                accountLabel: candidate.label,
+            };
+        }
+    }
+    const best = selectBestAccountCandidate(candidates);
+    if (!best) {
+        return tokens;
+    }
+    return {
+        ...tokens,
+        accountIdOverride: best.accountId,
+        accountIdSource: best.source ?? "token",
+        accountLabel: best.label,
+    };
+}
+async function persistAccountPool(results, replaceAll) {
+    if (results.length === 0)
+        return;
+    await withAccountStorageTransaction(async (loadedStorage, persist) => {
+        const stored = replaceAll ? null : loadedStorage;
+        const now = Date.now();
+        const accounts = stored?.accounts ? [...stored.accounts] : [];
+        let selectedAccountIndex = null;
+        for (const result of results) {
+            const tokenAccountId = extractAccountId(result.access);
+            const accountId = resolveRequestAccountId(result.accountIdOverride, result.accountIdSource, tokenAccountId);
+            const accountIdSource = accountId
+                ? (result.accountIdSource ??
+                    (result.accountIdOverride ? "manual" : "token"))
+                : undefined;
+            const accountLabel = result.accountLabel;
+            const accountEmail = sanitizeEmail(extractAccountEmail(result.access, result.idToken));
+            const existingIndex = findMatchingAccountIndex(accounts, {
+                accountId,
+                email: accountEmail,
+                refreshToken: result.refresh,
+            }, {
+                allowUniqueAccountIdFallbackWithoutEmail: true,
+            });
+            if (existingIndex === undefined) {
+                const newIndex = accounts.length;
+                accounts.push({
+                    accountId,
+                    accountIdSource,
+                    accountLabel,
+                    email: accountEmail,
+                    refreshToken: result.refresh,
+                    accessToken: result.access,
+                    expiresAt: result.expires,
+                    enabled: true,
+                    addedAt: now,
+                    lastUsed: now,
+                });
+                selectedAccountIndex = newIndex;
+                continue;
+            }
+            const existing = accounts[existingIndex];
+            if (!existing)
+                continue;
+            const nextEmail = accountEmail ?? existing.email;
+            const nextAccountId = accountId ?? existing.accountId;
+            const nextAccountIdSource = accountId
+                ? (accountIdSource ?? existing.accountIdSource)
+                : existing.accountIdSource;
+            accounts[existingIndex] = {
+                ...existing,
+                accountId: nextAccountId,
+                accountIdSource: nextAccountIdSource,
+                accountLabel: accountLabel ?? existing.accountLabel,
+                email: nextEmail,
+                refreshToken: result.refresh,
+                accessToken: result.access,
+                expiresAt: result.expires,
+                enabled: true,
+                lastUsed: now,
+            };
+            selectedAccountIndex = existingIndex;
+        }
+        const fallbackActiveIndex = accounts.length === 0
+            ? 0
+            : Math.max(0, Math.min(stored?.activeIndex ?? 0, accounts.length - 1));
+        const nextActiveIndex = accounts.length === 0
+            ? 0
+            : selectedAccountIndex === null
+                ? fallbackActiveIndex
+                : Math.max(0, Math.min(selectedAccountIndex, accounts.length - 1));
+        const activeIndexByFamily = {};
+        for (const family of MODEL_FAMILIES) {
+            activeIndexByFamily[family] = nextActiveIndex;
+        }
+        await persist({
+            version: 3,
+            accounts,
+            activeIndex: nextActiveIndex,
+            activeIndexByFamily,
+        });
+    });
+}
+async function syncSelectionToCodex(tokens) {
+    const tokenAccountId = extractAccountId(tokens.access);
+    const accountId = resolveRequestAccountId(tokens.accountIdOverride, tokens.accountIdSource, tokenAccountId);
+    const email = sanitizeEmail(extractAccountEmail(tokens.access, tokens.idToken));
+    await setCodexCliActiveSelection({
+        accountId,
+        email,
+        accessToken: tokens.access,
+        refreshToken: tokens.refresh,
+        expiresAt: tokens.expires,
+        idToken: tokens.idToken,
+    });
+}
+async function clearAccountsAndReset() {
+    await clearAccounts();
+}
+async function handleManageAction(storage, menuResult, deps) {
+    if (typeof menuResult.switchAccountIndex === "number") {
+        const index = menuResult.switchAccountIndex;
+        await deps.runSwitch([String(index + 1)]);
+        return;
+    }
+    if (typeof menuResult.deleteAccountIndex === "number") {
+        const idx = menuResult.deleteAccountIndex;
+        if (idx >= 0 && idx < storage.accounts.length) {
+            storage.accounts.splice(idx, 1);
+            storage.activeIndex = 0;
+            storage.activeIndexByFamily = {};
+            for (const family of MODEL_FAMILIES) {
+                storage.activeIndexByFamily[family] = 0;
+            }
+            await saveAccounts(storage);
+            console.log(`Deleted account ${idx + 1}.`);
+        }
+        return;
+    }
+    if (typeof menuResult.toggleAccountIndex === "number") {
+        const idx = menuResult.toggleAccountIndex;
+        const account = storage.accounts[idx];
+        if (account) {
+            account.enabled = account.enabled === false;
+            await saveAccounts(storage);
+            console.log(`${account.enabled === false ? "Disabled" : "Enabled"} account ${idx + 1}.`);
+        }
+        return;
+    }
+    if (typeof menuResult.refreshAccountIndex === "number") {
+        const idx = menuResult.refreshAccountIndex;
+        const existing = storage.accounts[idx];
+        if (!existing)
+            return;
+        const signInMode = await promptOAuthSignInMode(null);
+        if (signInMode === "cancel") {
+            console.log(deps.stylePromptText(UI_COPY.oauth.cancelledBackToMenu, "muted"));
+            return;
+        }
+        if (signInMode !== "browser" && signInMode !== "manual") {
+            return;
+        }
+        const tokenResult = await runOAuthFlow(true, signInMode, deps.stylePromptText);
+        if (tokenResult.type !== "success") {
+            console.error(`Refresh failed: ${tokenResult.message ?? tokenResult.reason ?? "unknown error"}`);
+            return;
+        }
+        const resolved = resolveAccountSelection(tokenResult);
+        await persistAccountPool([resolved], false);
+        await syncSelectionToCodex(resolved);
+        console.log(`Refreshed account ${idx + 1}.`);
+    }
+}
+export async function runAuthLogin(args, deps) {
+    const parsedArgs = parseAuthLoginArgs(args);
+    if (!parsedArgs.ok) {
+        if (parsedArgs.message) {
+            console.error(parsedArgs.message);
+            printUsage();
+            return 1;
+        }
+        return 0;
+    }
+    const loginOptions = parsedArgs.options;
+    setStoragePath(null);
+    let pendingMenuQuotaRefresh = null;
+    let menuQuotaRefreshStatus;
+    loginFlow: while (true) {
+        let existingStorage = await loadAccounts();
+        if (existingStorage && existingStorage.accounts.length > 0) {
+            while (true) {
+                existingStorage = await loadAccounts();
+                if (!existingStorage || existingStorage.accounts.length === 0) {
+                    break;
+                }
+                const currentStorage = existingStorage;
+                const displaySettings = await loadDashboardDisplaySettings();
+                applyUiThemeFromDashboardSettings(displaySettings);
+                const quotaCache = await loadQuotaCache();
+                const shouldAutoFetchLimits = displaySettings.menuAutoFetchLimits ?? true;
+                const showFetchStatus = displaySettings.menuShowFetchStatus ?? true;
+                const quotaTtlMs = displaySettings.menuQuotaTtlMs ?? 5 * 60_000;
+                if (shouldAutoFetchLimits && !pendingMenuQuotaRefresh) {
+                    const staleCount = deps.countMenuQuotaRefreshTargets(currentStorage, quotaCache, quotaTtlMs);
+                    if (staleCount > 0) {
+                        if (showFetchStatus) {
+                            menuQuotaRefreshStatus = `${UI_COPY.mainMenu.loadingLimits} [0/${staleCount}]`;
+                        }
+                        pendingMenuQuotaRefresh = deps
+                            .refreshQuotaCacheForMenu(currentStorage, quotaCache, quotaTtlMs, (current, total) => {
+                            if (!showFetchStatus)
+                                return;
+                            menuQuotaRefreshStatus = `${UI_COPY.mainMenu.loadingLimits} [${current}/${total}]`;
+                        })
+                            .then(() => undefined)
+                            .catch(() => undefined)
+                            .finally(() => {
+                            menuQuotaRefreshStatus = undefined;
+                            pendingMenuQuotaRefresh = null;
+                        });
+                    }
+                }
+                const flaggedStorage = await loadFlaggedAccounts();
+                const menuResult = await promptLoginMode(deps.toExistingAccountInfo(currentStorage, quotaCache, displaySettings), {
+                    flaggedCount: flaggedStorage.accounts.length,
+                    statusMessage: showFetchStatus
+                        ? () => menuQuotaRefreshStatus
+                        : undefined,
+                });
+                if (menuResult.mode === "cancel") {
+                    console.log("Cancelled.");
+                    return 0;
+                }
+                if (menuResult.mode === "check") {
+                    await runActionPanel(deps.stylePromptText, "Quick Check", "Checking local session + live status", async () => {
+                        await deps.runHealthCheck({
+                            forceRefresh: false,
+                            liveProbe: true,
+                        });
+                    }, displaySettings);
+                    continue;
+                }
+                if (menuResult.mode === "deep-check") {
+                    await runActionPanel(deps.stylePromptText, "Deep Check", "Refreshing and testing all accounts", async () => {
+                        await deps.runHealthCheck({
+                            forceRefresh: true,
+                            liveProbe: true,
+                        });
+                    }, displaySettings);
+                    continue;
+                }
+                if (menuResult.mode === "forecast") {
+                    await runActionPanel(deps.stylePromptText, "Best Account", "Comparing accounts", async () => {
+                        await deps.runForecast(["--live"]);
+                    }, displaySettings);
+                    continue;
+                }
+                if (menuResult.mode === "fix") {
+                    await runActionPanel(deps.stylePromptText, "Auto-Fix", "Checking and fixing common issues", async () => {
+                        await deps.runFix(["--live"]);
+                    }, displaySettings);
+                    continue;
+                }
+                if (menuResult.mode === "settings") {
+                    await deps.configureUnifiedSettings(displaySettings);
+                    continue;
+                }
+                if (menuResult.mode === "verify-flagged") {
+                    await runActionPanel(deps.stylePromptText, "Problem Account Check", "Checking problem accounts", async () => {
+                        await deps.runVerifyFlagged([]);
+                    }, displaySettings);
+                    continue;
+                }
+                if (menuResult.mode === "fresh" && menuResult.deleteAll) {
+                    await runActionPanel(deps.stylePromptText, "Reset Accounts", "Deleting all saved accounts", async () => {
+                        await clearAccountsAndReset();
+                        console.log("Cleared saved accounts from active storage. Recovery snapshots remain available.");
+                    }, displaySettings);
+                    continue;
+                }
+                if (menuResult.mode === "manage") {
+                    const requiresInteractiveOAuth = typeof menuResult.refreshAccountIndex === "number";
+                    if (requiresInteractiveOAuth) {
+                        await handleManageAction(currentStorage, menuResult, deps);
+                        continue;
+                    }
+                    await runActionPanel(deps.stylePromptText, "Applying Change", "Updating selected account", async () => {
+                        await handleManageAction(currentStorage, menuResult, deps);
+                    }, displaySettings);
+                    continue;
+                }
+                if (menuResult.mode === "add") {
+                    break;
+                }
+            }
+        }
+        const refreshedStorage = await loadAccounts();
+        let existingCount = refreshedStorage?.accounts.length ?? 0;
+        let forceNewLogin = existingCount > 0;
+        let onboardingBackupDiscoveryWarning = null;
+        const loadNamedBackupsForOnboarding = async () => {
+            if (existingCount > 0) {
+                onboardingBackupDiscoveryWarning = null;
+                return [];
+            }
+            try {
+                onboardingBackupDiscoveryWarning = null;
+                return await getNamedBackups();
+            }
+            catch (error) {
+                const code = error.code;
+                log.debug("getNamedBackups failed, skipping restore option", {
+                    code,
+                    error: error instanceof Error ? error.message : String(error),
+                });
+                if (code && code !== "ENOENT") {
+                    onboardingBackupDiscoveryWarning =
+                        "Named backup discovery failed. Continuing with browser or manual sign-in only.";
+                    console.warn(onboardingBackupDiscoveryWarning);
+                }
+                else {
+                    onboardingBackupDiscoveryWarning = null;
+                }
+                return [];
+            }
+        };
+        let namedBackups = await loadNamedBackupsForOnboarding();
+        while (true) {
+            const latestNamedBackup = namedBackups[0] ?? null;
+            const preferManualMode = loginOptions.manual || isBrowserLaunchSuppressed();
+            const signInMode = preferManualMode
+                ? "manual"
+                : await promptOAuthSignInMode(latestNamedBackup, onboardingBackupDiscoveryWarning);
+            if (signInMode === "cancel") {
+                if (existingCount > 0) {
+                    console.log(deps.stylePromptText(UI_COPY.oauth.cancelledBackToMenu, "muted"));
+                    continue loginFlow;
+                }
+                console.log("Cancelled.");
+                return 0;
+            }
+            if (signInMode === "restore-backup") {
+                const latestAvailableBackup = namedBackups[0] ?? null;
+                if (!latestAvailableBackup) {
+                    namedBackups = await loadNamedBackupsForOnboarding();
+                    continue;
+                }
+                const restoreMode = await promptBackupRestoreMode(latestAvailableBackup);
+                if (restoreMode === "back") {
+                    namedBackups = await loadNamedBackupsForOnboarding();
+                    continue;
+                }
+                const selectedBackup = restoreMode === "manual"
+                    ? await promptManualBackupSelection(namedBackups)
+                    : latestAvailableBackup;
+                if (!selectedBackup) {
+                    namedBackups = await loadNamedBackupsForOnboarding();
+                    continue;
+                }
+                const confirmed = await confirm(UI_COPY.oauth.restoreBackupConfirm(selectedBackup.fileName, selectedBackup.accountCount));
+                if (!confirmed) {
+                    namedBackups = await loadNamedBackupsForOnboarding();
+                    continue;
+                }
+                const displaySettings = await loadDashboardDisplaySettings();
+                applyUiThemeFromDashboardSettings(displaySettings);
+                try {
+                    await runActionPanel(deps.stylePromptText, "Load Backup", `Loading ${selectedBackup.fileName}`, async () => {
+                        const restoredStorage = await restoreAccountsFromBackup(selectedBackup.path, { persist: false });
+                        const targetIndex = deps.resolveActiveIndex(restoredStorage);
+                        const { synced } = await deps.persistAndSyncSelectedAccount({
+                            storage: restoredStorage,
+                            targetIndex,
+                            parsed: targetIndex + 1,
+                            switchReason: "restore",
+                            preserveActiveIndexByFamily: true,
+                        });
+                        console.log(UI_COPY.oauth.restoreBackupLoaded(selectedBackup.fileName, restoredStorage.accounts.length));
+                        if (!synced) {
+                            console.warn(UI_COPY.oauth.restoreBackupSyncWarning);
+                        }
+                    }, displaySettings);
+                }
+                catch (error) {
+                    const message = error instanceof Error ? error.message : String(error);
+                    if (error instanceof StorageError) {
+                        console.error(formatStorageErrorHint(error, selectedBackup.path));
+                    }
+                    else {
+                        console.error(`Backup restore failed: ${message}`);
+                    }
+                    const storageAfterRestoreAttempt = await loadAccounts().catch(() => null);
+                    if ((storageAfterRestoreAttempt?.accounts.length ?? 0) > 0) {
+                        continue loginFlow;
+                    }
+                    namedBackups = await loadNamedBackupsForOnboarding();
+                    continue;
+                }
+                continue loginFlow;
+            }
+            if (signInMode !== "browser" && signInMode !== "manual") {
+                continue;
+            }
+            const tokenResult = await runOAuthFlow(forceNewLogin, signInMode, deps.stylePromptText);
+            if (tokenResult.type !== "success") {
+                if (isUserCancelledOAuth(tokenResult)) {
+                    if (existingCount > 0) {
+                        console.log(deps.stylePromptText(UI_COPY.oauth.cancelledBackToMenu, "muted"));
+                        continue loginFlow;
+                    }
+                    console.log("Cancelled.");
+                    return 0;
+                }
+                console.error(`Login failed: ${tokenResult.message ?? tokenResult.reason ?? "unknown error"}`);
+                return 1;
+            }
+            const resolved = resolveAccountSelection(tokenResult);
+            await persistAccountPool([resolved], false);
+            await syncSelectionToCodex(resolved);
+            const latestStorage = await loadAccounts();
+            const count = latestStorage?.accounts.length ?? 1;
+            existingCount = count;
+            namedBackups = [];
+            onboardingBackupDiscoveryWarning = null;
+            console.log(`Added account. Total: ${count}`);
+            if (count >= ACCOUNT_LIMITS.MAX_ACCOUNTS) {
+                console.log(`Reached maximum account limit (${ACCOUNT_LIMITS.MAX_ACCOUNTS}).`);
+                break;
+            }
+            const addAnother = await promptAddAnotherAccount(count);
+            if (!addAnother)
+                break;
+            forceNewLogin = true;
+        }
+    }
+}
+//# sourceMappingURL=login.js.map