codex-multi-auth 2.1.13-beta.1 → 2.2.0

package/dist/lib/codex-manager.js

@@ -3,6 +3,7 @@ import { createInterface } from "node:readline/promises";
 import { extractAccountEmail, extractAccountId, formatAccountLabel, formatWaitTime, getAccountIdCandidates, resolveRequestAccountId, sanitizeEmail, selectBestAccountCandidate, shouldUpdateAccountIdFromToken, } from "./accounts.js";
 import { createAuthorizationFlow, exchangeAuthorizationCode, parseAuthorizationInput, redactOAuthUrlForLog, REDIRECT_URI, } from "./auth/auth.js";
 import { runDeviceAuthFlow } from "./auth/device-auth.js";
+import { resolveOrgOverride } from "./auth/org-override.js";
 import { copyTextToClipboard, isBrowserLaunchSuppressed, openBrowserUrl, } from "./auth/browser.js";
 import { startLocalOAuthServer } from "./auth/server.js";
 import { promptAddAnotherAccount, promptLoginMode, } from "./cli.js";
@@ -10,6 +11,7 @@ import { loadCodexCliState } from "./codex-cli/state.js";
 import { setCodexCliActiveSelection } from "./codex-cli/writer.js";
 import { runBestCommand, } from "./codex-manager/commands/best.js";
 import { runAccountCommand } from "./codex-manager/commands/account.js";
+import { ACCOUNT_MANAGER_COMMANDS } from "./codex-manager/account-manager-commands.js";
 import { runBudgetCommand } from "./codex-manager/commands/budget.js";
 import { runBridgeCommand } from "./codex-manager/commands/bridge.js";
 import { runCheckCommand } from "./codex-manager/commands/check.js";
@@ -49,7 +51,8 @@ import { formatRateLimitEntry as formatAccountRateLimitEntry, getRateLimitResetT
 import { buildQuotaEmailFallbackState, hasSafeQuotaEmailFallback, hasUniqueQuotaAccountId, isQuotaCacheEntryExhausted, normalizeQuotaAccountId, normalizeQuotaEmail, quotaLeftPercentFromUsed, } from "./quota-readiness.js";
 import { loadQuotaCache, saveQuotaCache, } from "./quota-cache.js";
 import { isDisplayCurrentAccount, readAppRuntimeHelperAccountSignal, resolveAccountCurrentMarkers, resolveRuntimeCurrentAccount, } from "./runtime/runtime-current-account.js";
-import { fetchCodexQuotaSnapshot, formatQuotaSnapshotLine, } from "./quota-probe.js";
+import { fetchCodexQuotaSnapshot, formatQuotaSnapshotLine, CODEX_UNAVAILABLE_PROBE_NOTE, } from "./quota-probe.js";
+import { isCodexUnavailableError } from "./errors.js";
 import { queuedRefresh } from "./refresh-queue.js";
 import { clearAccounts, findMatchingAccountIndex, formatStorageErrorHint, inspectStorageHealth, getLastAccountsSaveTimestamp, getNamedBackups, getStoragePath, loadAccounts, loadFlaggedAccounts, readAffinityGenerationFromDisk, restoreAccountsFromBackup, StorageError, saveAccounts, setStoragePath, withAccountStorageTransaction, } from "./storage.js";
 import { ANSI } from "./ui/ansi.js";
@@ -59,36 +62,6 @@ import { paintUiText, quotaToneFromLeftPercent } from "./ui/format.js";
 import { getUiRuntimeOptions } from "./ui/runtime.js";
 import { select } from "./ui/select.js";
 const log = createLogger("codex-manager");
-const ACCOUNT_MANAGER_COMMANDS = new Set([
-    "login",
-    "list",
-    "status",
-    "switch",
-    "unpin",
-    "workspace",
-    "best",
-    "check",
-    "features",
-    "usage",
-    "verify-flagged",
-    "verify",
-    "forecast",
-    "report",
-    "fix",
-    "doctor",
-    "uninstall",
-    "account",
-    "budget",
-    "bridge",
-    "integrations",
-    "models",
-    "monitor",
-    "rotation",
-    "why-selected",
-    "config",
-    "init-config",
-    "debug",
-]);
 function stylePromptText(text, tone) {
     if (!output.isTTY)
         return text;
@@ -254,7 +227,10 @@ function styleQuotaSummary(summary) {
     });
     return joinStyledSegments(rendered);
 }
-function styleAccountDetailText(detail, fallbackTone = "muted") {
+// Exported for unit tests: tone precedence (danger before warning) is
+// security/UX-relevant — a failure whose text contains "unavailable" must
+// render red, not be downgraded to yellow. See test/codex-manager-detail-tone.test.ts.
+export function styleAccountDetailText(detail, fallbackTone = "muted") {
     const compact = collapseWhitespace(detail);
     if (!compact)
         return stylePromptText("", fallbackTone);
@@ -268,10 +244,14 @@ function styleAccountDetailText(detail, fallbackTone = "muted") {
             : /ok|working|succeeded|valid/i.test(prefix)
                 ? "success"
                 : fallbackTone;
-        const suffixTone = /re-login|stale|warning|retry|fallback/i.test(suffix)
-            ? "warning"
-            : /failed|error/i.test(suffix)
-                ? "danger"
+        const suffixTone = 
+        // danger wins first: a real failure whose text happens to contain
+        // "unavailable"/"not available" (e.g. a 5xx "service not available")
+        // must render red, not be downgraded to a yellow warning.
+        /failed|error/i.test(suffix)
+            ? "danger"
+            : /re-login|stale|warning|retry|fallback|unavailable|not available/i.test(suffix)
+                ? "warning"
                 : "muted";
         const chunks = [];
         if (prefix)
@@ -283,10 +263,10 @@ function styleAccountDetailText(detail, fallbackTone = "muted") {
     }
     if (/rate-limited/i.test(compact))
         return stylePromptText(compact, "danger");
-    if (/re-login|stale|warning|fallback/i.test(compact))
-        return stylePromptText(compact, "warning");
     if (/failed|error/i.test(compact))
         return stylePromptText(compact, "danger");
+    if (/re-login|stale|warning|fallback|unavailable|not available/i.test(compact))
+        return stylePromptText(compact, "warning");
     if (/ok|working|succeeded|valid/i.test(compact))
         return stylePromptText(compact, "success");
     return stylePromptText(compact, fallbackTone);
@@ -860,8 +840,17 @@ async function syncCodexCliActiveSelectionIfDrifted(storage) {
         return false;
     }
 }
-function resolveAccountSelection(tokens) {
-    const override = (process.env.CODEX_AUTH_ACCOUNT_ID ?? "").trim();
+/**
+ * Resolve the account-id selection for freshly-minted tokens.
+ *
+ * The org-override precedence (explicit `login --org` wins over the ambient
+ * CODEX_AUTH_ACCOUNT_ID env, for this call only) lives in the internal
+ * lib/auth/org-override.ts module so it can be unit-tested without exporting this
+ * CLI-internal function. Threading the org as a parameter avoids mutating
+ * process.env for the duration of a login, which raced on concurrent re-entry.
+ */
+function resolveAccountSelection(tokens, orgOverride) {
+    const override = resolveOrgOverride(orgOverride);
     if (override) {
         return {
             ...tokens,
@@ -1660,9 +1649,15 @@ async function runHealthCheck(options = {}) {
                         healthDetail = formatQuotaSnapshotForDashboard(snapshot, display);
                     }
                     catch (error) {
-                        const message = normalizeFailureDetail(error instanceof Error ? error.message : String(error), undefined);
                         warnings += 1;
-                        healthDetail = `signed in and working (live check failed: ${message})`;
+                        if (isCodexUnavailableError(error)) {
+                            healthDetail =
+                                `signed in and working (${CODEX_UNAVAILABLE_PROBE_NOTE})`;
+                        }
+                        else {
+                            const message = normalizeFailureDetail(error instanceof Error ? error.message : String(error), undefined);
+                            healthDetail = `signed in and working (live check failed: ${message})`;
+                        }
                     }
                 }
             }
@@ -1738,9 +1733,15 @@ async function runHealthCheck(options = {}) {
                         healthyMessage = formatQuotaSnapshotForDashboard(snapshot, display);
                     }
                     catch (error) {
-                        const message = normalizeFailureDetail(error instanceof Error ? error.message : String(error), undefined);
                         warnings += 1;
-                        healthyMessage = `working now (live check failed: ${message})`;
+                        if (isCodexUnavailableError(error)) {
+                            healthyMessage =
+                                `working now (${CODEX_UNAVAILABLE_PROBE_NOTE})`;
+                        }
+                        else {
+                            const message = normalizeFailureDetail(error instanceof Error ? error.message : String(error), undefined);
+                            healthyMessage = `working now (live check failed: ${message})`;
+                        }
                     }
                 }
             }
@@ -2074,27 +2075,13 @@ async function runAuthLogin(args) {
     const loginOptions = parsedArgs.options;
     // `--org <id>` binds this login to a specific workspace/org so the same
     // email's personal vs business/team workspace can be registered on demand
-    // (issue #491). It reuses the CODEX_AUTH_ACCOUNT_ID override that every login
-    // resolver already honors. Scope it to this invocation and restore the prior
-    // value in a finally so a later login in the same process (menu re-entry, a
-    // reused test worker) is never silently bound to a stale org.
-    if (!loginOptions.org) {
-        return runAuthLoginFlow(loginOptions);
-    }
-    const previousAccountIdOverride = process.env.CODEX_AUTH_ACCOUNT_ID;
-    process.env.CODEX_AUTH_ACCOUNT_ID = loginOptions.org;
-    console.log(`Binding this login to workspace org id: ${loginOptions.org}`);
-    try {
-        return await runAuthLoginFlow(loginOptions);
-    }
-    finally {
-        if (previousAccountIdOverride === undefined) {
-            delete process.env.CODEX_AUTH_ACCOUNT_ID;
-        }
-        else {
-            process.env.CODEX_AUTH_ACCOUNT_ID = previousAccountIdOverride;
-        }
+    // (issue #491). The org is threaded explicitly into resolveAccountSelection
+    // (no process.env mutation), so concurrent re-entry (menu re-entry, a reused
+    // test worker) can never bind a login to a stale org via a shared global.
+    if (loginOptions.org) {
+        console.log(`Binding this login to workspace org id: ${loginOptions.org}`);
     }
+    return runAuthLoginFlow(loginOptions);
 }
 async function runAuthLoginFlow(loginOptions) {
     setStoragePath(null);
@@ -2368,7 +2355,7 @@ async function runAuthLoginFlow(loginOptions) {
                 console.error(`Login failed: ${tokenResult.message ?? tokenResult.reason ?? "unknown error"}`);
                 return 1;
             }
-            const resolved = resolveAccountSelection(tokenResult);
+            const resolved = resolveAccountSelection(tokenResult, loginOptions.org);
             await persistAccountPool([resolved], false);
             await syncSelectionToCodex(resolved);
             const latestStorage = await loadAccounts();
@@ -2688,6 +2675,7 @@ export async function runCodexMultiAuthCli(rawArgs) {
                 .catch(() => null),
             loadAppHelperStatus: readAppRuntimeHelperAccountSignal,
             loadQuotaCache,
+            json: rest.includes("--json") || rest.includes("-j"),
         });
     }
     if (command === "switch") {