codex-multi-auth 2.0.0 → 2.0.2

package/dist/lib/codex-manager.js

@@ -2,6 +2,7 @@ import { stdin as input, stdout as output } from "node:process";
 import { createInterface } from "node:readline/promises";
 import { extractAccountEmail, extractAccountId, formatAccountLabel, formatWaitTime, getAccountIdCandidates, resolveRequestAccountId, sanitizeEmail, selectBestAccountCandidate, shouldUpdateAccountIdFromToken, } from "./accounts.js";
 import { createAuthorizationFlow, exchangeAuthorizationCode, parseAuthorizationInput, redactOAuthUrlForLog, REDIRECT_URI, } from "./auth/auth.js";
+import { runDeviceAuthFlow } from "./auth/device-auth.js";
 import { copyTextToClipboard, isBrowserLaunchSuppressed, openBrowserUrl, } from "./auth/browser.js";
 import { startLocalOAuthServer } from "./auth/server.js";
 import { promptAddAnotherAccount, promptLoginMode, } from "./cli.js";
@@ -34,7 +35,9 @@ import { createLogger } from "./logger.js";
 import { MODEL_FAMILIES } from "./prompts/codex.js";
 import { getModelCapabilities, getModelProfile, resolveNormalizedModel, } from "./request/helpers/model-map.js";
 import { formatRateLimitEntry as formatAccountRateLimitEntry, getRateLimitResetTimeForFamily, resolveActiveIndex, } from "./runtime/account-status.js";
+import { buildQuotaEmailFallbackState, hasSafeQuotaEmailFallback, hasUniqueQuotaAccountId, isQuotaCacheEntryExhausted, normalizeQuotaAccountId, normalizeQuotaEmail, quotaLeftPercentFromUsed, } from "./quota-readiness.js";
 import { loadQuotaCache, saveQuotaCache, } from "./quota-cache.js";
+import { isDisplayCurrentAccount, readAppRuntimeHelperAccountSignal, resolveAccountCurrentMarkers, resolveRuntimeCurrentAccount, } from "./runtime/runtime-current-account.js";
 import { fetchCodexQuotaSnapshot, formatQuotaSnapshotLine, } from "./quota-probe.js";
 import { queuedRefresh } from "./refresh-queue.js";
 import { clearAccounts, findMatchingAccountIndex, formatStorageErrorHint, inspectStorageHealth, getLastAccountsSaveTimestamp, getNamedBackups, getStoragePath, loadAccounts, loadFlaggedAccounts, restoreAccountsFromBackup, StorageError, saveAccounts, setStoragePath, withAccountStorageTransaction, } from "./storage.js";
@@ -318,70 +321,6 @@ const IMPLEMENTED_FEATURES = [
 function formatRateLimitEntry(account, now, family = "codex") {
     return formatAccountRateLimitEntry(account, now, formatWaitTime, family);
 }
-function normalizeQuotaEmail(email) {
-    const normalized = sanitizeEmail(email);
-    return normalized && normalized.length > 0 ? normalized : null;
-}
-function normalizeQuotaAccountId(accountId) {
-    if (typeof accountId !== "string")
-        return null;
-    const trimmed = accountId.trim();
-    return trimmed.length > 0 ? trimmed : null;
-}
-function hasUniqueQuotaAccountId(accounts, account) {
-    const accountId = normalizeQuotaAccountId(account.accountId);
-    if (!accountId)
-        return false;
-    let matchCount = 0;
-    for (const candidate of accounts) {
-        if (normalizeQuotaAccountId(candidate.accountId) !== accountId)
-            continue;
-        matchCount += 1;
-        if (matchCount > 1)
-            return false;
-    }
-    return matchCount === 1;
-}
-function buildQuotaEmailFallbackState(accounts) {
-    const stateByEmail = new Map();
-    for (const account of accounts) {
-        const email = normalizeQuotaEmail(account.email);
-        if (!email)
-            continue;
-        const existing = stateByEmail.get(email);
-        if (existing) {
-            existing.matchingCount += 1;
-            const accountId = normalizeQuotaAccountId(account.accountId);
-            if (accountId) {
-                existing.distinctAccountIds.add(accountId);
-            }
-            continue;
-        }
-        const distinctAccountIds = new Set();
-        const accountId = normalizeQuotaAccountId(account.accountId);
-        if (accountId) {
-            distinctAccountIds.add(accountId);
-        }
-        stateByEmail.set(email, {
-            matchingCount: 1,
-            distinctAccountIds,
-        });
-    }
-    return stateByEmail;
-}
-function hasSafeQuotaEmailFallback(emailFallbackState, account) {
-    const email = normalizeQuotaEmail(account.email);
-    if (!email)
-        return false;
-    const state = emailFallbackState.get(email);
-    if (!state)
-        return false;
-    // size > 1 only matters when multiple accounts share the same email but
-    // disagree on accountId; a single matching account already implies size <= 1.
-    if (state.distinctAccountIds.size > 1)
-        return false;
-    return state.matchingCount === 1;
-}
 function quotaCacheEntryToSnapshot(entry) {
     return {
         status: entry.status,
@@ -417,13 +356,7 @@ function formatCompactQuotaPart(windowMinutes, usedPercent) {
     const left = quotaLeftPercentFromUsed(usedPercent);
     return `${label} ${left}%`;
 }
-function quotaLeftPercentFromUsed(usedPercent) {
-    if (typeof usedPercent !== "number" || !Number.isFinite(usedPercent)) {
-        return undefined;
-    }
-    return Math.max(0, Math.min(100, Math.round(100 - usedPercent)));
-}
-function formatCompactQuotaSnapshot(snapshot) {
+function formatCompactQuotaSnapshot(snapshot, now = Date.now()) {
     const parts = [
         formatCompactQuotaPart(snapshot.primary.windowMinutes, snapshot.primary.usedPercent),
         formatCompactQuotaPart(snapshot.secondary.windowMinutes, snapshot.secondary.usedPercent),
@@ -431,12 +364,15 @@ function formatCompactQuotaSnapshot(snapshot) {
     if (snapshot.status === 429) {
         parts.push("rate-limited");
     }
+    if (isQuotaCacheEntryExhausted(snapshot, now)) {
+        parts.push("quota-exhausted");
+    }
     if (parts.length > 0) {
         return parts.join(" | ");
     }
     return formatQuotaSnapshotLine(snapshot);
 }
-function formatAccountQuotaSummary(entry) {
+function formatAccountQuotaSummary(entry, now = Date.now()) {
     const parts = [
         formatCompactQuotaPart(entry.primary.windowMinutes, entry.primary.usedPercent),
         formatCompactQuotaPart(entry.secondary.windowMinutes, entry.secondary.usedPercent),
@@ -444,6 +380,9 @@ function formatAccountQuotaSummary(entry) {
     if (entry.status === 429) {
         parts.push("rate-limited");
     }
+    if (isQuotaCacheEntryExhausted(entry, now)) {
+        parts.push("quota-exhausted");
+    }
     if (parts.length > 0) {
         return parts.join(" | ");
     }
@@ -481,7 +420,7 @@ function getPersistedQuotaViewForAccount(cache, account, accounts, now, emailFal
     return {
         updatedAt: cachedEntry?.updatedAt ?? now,
         status: 429,
-        model: cachedEntry?.model ?? "gpt-5-codex",
+        model: cachedEntry?.model ?? "gpt-5.3-codex",
         planType: cachedEntry?.planType,
         primary: {
             ...cachedEntry?.primary,
@@ -549,7 +488,7 @@ function pruneUnsafeQuotaEmailCacheEntry(cache, email, accounts, emailFallbackSt
     return true;
 }
 const DEFAULT_MENU_QUOTA_REFRESH_TTL_MS = 5 * 60_000;
-const MENU_QUOTA_REFRESH_MODEL = "gpt-5-codex";
+const MENU_QUOTA_REFRESH_MODEL = "gpt-5.3-codex";
 function resolveMenuQuotaProbeInput(account, cache, maxAgeMs, now, accounts, emailFallbackState = buildQuotaEmailFallbackState(accounts)) {
     if (account.enabled === false)
         return null;
@@ -651,19 +590,22 @@ function hasLikelyInvalidRefreshToken(refreshToken) {
         return true;
     return trimmed.startsWith("token-");
 }
-function mapAccountStatus(account, index, activeIndex, now, persistedQuotaStatus) {
+function mapAccountStatus(account, isCurrentAccount, now, persistedQuotaEntry) {
     if (account.enabled === false)
         return "disabled";
     if (typeof account.coolingDownUntil === "number" &&
         account.coolingDownUntil > now) {
         return "cooldown";
     }
-    if (persistedQuotaStatus === 429)
+    if (persistedQuotaEntry && isQuotaCacheEntryExhausted(persistedQuotaEntry, now)) {
+        return "quota-exhausted";
+    }
+    if (persistedQuotaEntry?.status === 429)
         return "rate-limited";
     const rateLimit = formatRateLimitEntry(account, now, "codex");
     if (rateLimit)
         return "rate-limited";
-    if (index === activeIndex)
+    if (isCurrentAccount)
         return "active";
     return "ok";
 }
@@ -695,6 +637,7 @@ function accountStatusSortBucket(status) {
             return 0;
         case "unknown":
             return 1;
+        case "quota-exhausted":
         case "cooldown":
         case "rate-limited":
             return 2;
@@ -710,7 +653,7 @@ function accountReadinessSortBucket(account) {
     const statusBucket = accountStatusSortBucket(account.status);
     if (statusBucket >= 2)
         return statusBucket;
-    return account.quotaRateLimited ? 2 : statusBucket;
+    return account.quotaRateLimited || account.quotaExhausted ? 2 : statusBucket;
 }
 function compareReadyFirstAccounts(left, right) {
     const bucketDelta = accountReadinessSortBucket(left) - accountReadinessSortBucket(right);
@@ -765,13 +708,16 @@ function applyAccountMenuOrdering(accounts, displaySettings) {
     }
     return sorted;
 }
-function toExistingAccountInfo(storage, quotaCache, displaySettings) {
+function toExistingAccountInfo(storage, quotaCache, displaySettings, runtimeCurrent = null) {
     const now = Date.now();
     const activeIndex = resolveActiveIndex(storage, "codex");
     const layoutMode = resolveMenuLayoutMode(displaySettings);
     const emailFallbackState = buildQuotaEmailFallbackState(storage.accounts);
     const baseAccounts = storage.accounts.map((account, index) => {
         const entry = getPersistedQuotaViewForAccount(quotaCache, account, storage.accounts, now, emailFallbackState);
+        const currentMarkers = resolveAccountCurrentMarkers(index, activeIndex, runtimeCurrent);
+        const isCurrentAccount = isDisplayCurrentAccount(index, activeIndex, runtimeCurrent);
+        const quotaExhausted = entry ? isQuotaCacheEntryExhausted(entry, now) : false;
         return {
             index,
             sourceIndex: index,
@@ -780,16 +726,20 @@ function toExistingAccountInfo(storage, quotaCache, displaySettings) {
             email: account.email,
             addedAt: account.addedAt,
             lastUsed: account.lastUsed,
-            status: mapAccountStatus(account, index, activeIndex, now, entry?.status),
+            status: mapAccountStatus(account, isCurrentAccount, now, entry),
             quotaSummary: (displaySettings.menuShowQuotaSummary ?? true) && entry
-                ? formatAccountQuotaSummary(entry)
+                ? formatAccountQuotaSummary(entry, now)
                 : undefined,
             quota5hLeftPercent: quotaLeftPercentFromUsed(entry?.primary.usedPercent),
             quota5hResetAtMs: entry?.primary.resetAtMs,
             quota7dLeftPercent: quotaLeftPercentFromUsed(entry?.secondary.usedPercent),
             quota7dResetAtMs: entry?.secondary.resetAtMs,
             quotaRateLimited: entry?.status === 429,
-            isCurrentAccount: index === activeIndex,
+            quotaExhausted,
+            isCurrentAccount,
+            isDefaultAccount: index === activeIndex,
+            isRuntimeCurrentAccount: runtimeCurrent?.index === index,
+            currentMarkers,
             enabled: account.enabled !== false,
             showStatusBadge: displaySettings.menuShowStatusBadge ?? true,
             showCurrentBadge: displaySettings.menuShowCurrentBadge ?? true,
@@ -815,6 +765,19 @@ function toExistingAccountInfo(storage, quotaCache, displaySettings) {
             : (account.sourceIndex ?? displayIndex) + 1,
     }));
 }
+async function loadRuntimeCurrentSelectionForStorage(storage, now = Date.now()) {
+    const [runtimeSnapshot, appBindStatus] = await Promise.all([
+        loadPersistedRuntimeObservabilitySnapshot().catch(() => null),
+        getAppBindStatus()
+            .then((status) => (status.running ? status.router : null))
+            .catch(() => null),
+    ]);
+    return resolveRuntimeCurrentAccount(storage, {
+        runtimeSnapshot,
+        appBindStatus,
+        appHelperStatus: readAppRuntimeHelperAccountSignal(),
+    }, { now });
+}
 function activeAccountMatchesCodexCliState(account, state) {
     if (!state)
         return true;
@@ -1473,6 +1436,18 @@ async function runOAuthFlow(forceNewLogin, signInMode) {
     }
     return exchangeAuthorizationCode(code, pkce.verifier, REDIRECT_URI);
 }
+async function runSignInFlow(forceNewLogin, signInMode, options = {}) {
+    if (signInMode === "device") {
+        // OpenAI owns the device-code account picker; there is no force-new-login
+        // equivalent to pass through for this mode.
+        // TODO: Thread a manager-level AbortSignal when login cancellation exists.
+        return runDeviceAuthFlow({
+            log: console.log,
+            timeoutMs: options.timeoutMs,
+        });
+    }
+    return runOAuthFlow(forceNewLogin, signInMode);
+}
 async function persistAccountPool(results, replaceAll) {
     if (results.length === 0)
         return;
@@ -1572,7 +1547,7 @@ async function syncSelectionToCodex(tokens) {
 async function runHealthCheck(options = {}) {
     const forceRefresh = options.forceRefresh === true;
     const liveProbe = options.liveProbe === true;
-    const probeModel = options.model?.trim() || "gpt-5-codex";
+    const probeModel = options.model?.trim() || "gpt-5.3-codex";
     const modelInspection = inspectRequestedModel(probeModel);
     const display = options.display ?? DEFAULT_DASHBOARD_DISPLAY_SETTINGS;
     const quotaCache = liveProbe ? await loadQuotaCache() : null;
@@ -1788,7 +1763,7 @@ function printBestUsage() {
         "Options:",
         "  --live, -l         Probe live quota headers via Codex backend before switching",
         "  --json, -j         Print machine-readable JSON output",
-        "  --model, -m        Probe model for live mode (default: gpt-5-codex)",
+        "  --model, -m        Probe model for live mode (default: gpt-5.3-codex)",
         "",
         "Behavior:",
         "  - Chooses the healthiest account using forecast scoring",
@@ -1799,7 +1774,7 @@ function parseBestArgs(args) {
     const options = {
         live: false,
         json: false,
-        model: "gpt-5-codex",
+        model: "gpt-5.3-codex",
         modelProvided: false,
     };
     for (let i = 0; i < args.length; i += 1) {
@@ -2101,7 +2076,8 @@ async function runAuthLogin(args) {
                 }
                 const flaggedStorage = await loadFlaggedAccounts();
                 await syncCodexCliActiveSelectionIfDrifted(currentStorage);
-                const menuResult = await promptLoginMode(toExistingAccountInfo(currentStorage, quotaCache, displaySettings), {
+                const runtimeCurrent = await loadRuntimeCurrentSelectionForStorage(currentStorage);
+                const menuResult = await promptLoginMode(toExistingAccountInfo(currentStorage, quotaCache, displaySettings, runtimeCurrent), {
                     flaggedCount: flaggedStorage.accounts.length,
                     statusMessage: showFetchStatus
                         ? () => menuQuotaRefreshStatus
@@ -2210,9 +2186,11 @@ async function runAuthLogin(args) {
         while (true) {
             const latestNamedBackup = namedBackups[0] ?? null;
             const preferManualMode = loginOptions.manual || isBrowserLaunchSuppressed();
-            const signInMode = preferManualMode
-                ? "manual"
-                : await promptOAuthSignInMode(latestNamedBackup, onboardingBackupDiscoveryWarning);
+            const signInMode = loginOptions.deviceAuth
+                ? "device"
+                : preferManualMode
+                    ? "manual"
+                    : await promptOAuthSignInMode(latestNamedBackup, onboardingBackupDiscoveryWarning);
             if (signInMode === "cancel") {
                 if (existingCount > 0) {
                     console.log(stylePromptText(UI_COPY.oauth.cancelledBackToMenu, "muted"));
@@ -2280,10 +2258,12 @@ async function runAuthLogin(args) {
                 }
                 continue loginFlow;
             }
-            if (signInMode !== "browser" && signInMode !== "manual") {
+            if (signInMode !== "browser" &&
+                signInMode !== "manual" &&
+                signInMode !== "device") {
                 continue;
             }
-            const tokenResult = await runOAuthFlow(forceNewLogin, signInMode);
+            const tokenResult = await runSignInFlow(forceNewLogin, signInMode);
             if (tokenResult.type !== "success") {
                 if (isOAuthCancellation(tokenResult)) {
                     if (existingCount > 0) {
@@ -2576,6 +2556,11 @@ export async function runCodexMultiAuthCli(rawArgs) {
             resolveActiveIndex,
             formatRateLimitEntry,
             loadRuntimeObservabilitySnapshot: loadPersistedRuntimeObservabilitySnapshot,
+            loadAppBindStatus: async () => getAppBindStatus()
+                .then((status) => (status.running ? status.router : null))
+                .catch(() => null),
+            loadAppHelperStatus: readAppRuntimeHelperAccountSignal,
+            loadQuotaCache,
         });
     }
     if (command === "switch") {
@@ -2628,6 +2613,8 @@ export async function runCodexMultiAuthCli(rawArgs) {
             bindCodexApp: bindCodexAppRuntimeRotation,
             unbindCodexApp: unbindCodexAppRuntimeRotation,
             getCodexAppBindStatus: getAppBindStatus,
+            loadRuntimeObservabilitySnapshot: loadPersistedRuntimeObservabilitySnapshot,
+            loadQuotaCache,
         });
     }
     if (command === "why-selected") {