codex-multi-auth 2.1.13-beta.2 → 2.2.1

package/dist/lib/codex-manager.js

@@ -3,6 +3,7 @@ import { createInterface } from "node:readline/promises";
 import { extractAccountEmail, extractAccountId, formatAccountLabel, formatWaitTime, getAccountIdCandidates, resolveRequestAccountId, sanitizeEmail, selectBestAccountCandidate, shouldUpdateAccountIdFromToken, } from "./accounts.js";
 import { createAuthorizationFlow, exchangeAuthorizationCode, parseAuthorizationInput, redactOAuthUrlForLog, REDIRECT_URI, } from "./auth/auth.js";
 import { runDeviceAuthFlow } from "./auth/device-auth.js";
+import { resolveOrgOverride } from "./auth/org-override.js";
 import { copyTextToClipboard, isBrowserLaunchSuppressed, openBrowserUrl, } from "./auth/browser.js";
 import { startLocalOAuthServer } from "./auth/server.js";
 import { promptAddAnotherAccount, promptLoginMode, } from "./cli.js";
@@ -10,6 +11,7 @@ import { loadCodexCliState } from "./codex-cli/state.js";
 import { setCodexCliActiveSelection } from "./codex-cli/writer.js";
 import { runBestCommand, } from "./codex-manager/commands/best.js";
 import { runAccountCommand } from "./codex-manager/commands/account.js";
+import { ACCOUNT_MANAGER_COMMANDS } from "./codex-manager/account-manager-commands.js";
 import { runBudgetCommand } from "./codex-manager/commands/budget.js";
 import { runBridgeCommand } from "./codex-manager/commands/bridge.js";
 import { runCheckCommand } from "./codex-manager/commands/check.js";
@@ -44,12 +46,13 @@ import { DEFAULT_DASHBOARD_DISPLAY_SETTINGS, loadDashboardDisplaySettings, } fro
 import { evaluateForecastAccounts, recommendForecastAccount, summarizeForecast, } from "./forecast.js";
 import { createLogger } from "./logger.js";
 import { MODEL_FAMILIES } from "./prompts/codex.js";
-import { getModelCapabilities, getModelProfile, resolveNormalizedModel, } from "./request/helpers/model-map.js";
+import { DEFAULT_MODEL, getModelCapabilities, getModelProfile, resolveNormalizedModel, } from "./request/helpers/model-map.js";
 import { formatRateLimitEntry as formatAccountRateLimitEntry, getRateLimitResetTimeForFamily, resolveActiveIndex, } from "./runtime/account-status.js";
 import { buildQuotaEmailFallbackState, hasSafeQuotaEmailFallback, hasUniqueQuotaAccountId, isQuotaCacheEntryExhausted, normalizeQuotaAccountId, normalizeQuotaEmail, quotaLeftPercentFromUsed, } from "./quota-readiness.js";
 import { loadQuotaCache, saveQuotaCache, } from "./quota-cache.js";
 import { isDisplayCurrentAccount, readAppRuntimeHelperAccountSignal, resolveAccountCurrentMarkers, resolveRuntimeCurrentAccount, } from "./runtime/runtime-current-account.js";
-import { fetchCodexQuotaSnapshot, formatQuotaSnapshotLine, } from "./quota-probe.js";
+import { fetchCodexQuotaSnapshot, formatQuotaSnapshotLine, CODEX_UNAVAILABLE_PROBE_NOTE, } from "./quota-probe.js";
+import { isCodexUnavailableError } from "./errors.js";
 import { queuedRefresh } from "./refresh-queue.js";
 import { clearAccounts, findMatchingAccountIndex, formatStorageErrorHint, inspectStorageHealth, getLastAccountsSaveTimestamp, getNamedBackups, getStoragePath, loadAccounts, loadFlaggedAccounts, readAffinityGenerationFromDisk, restoreAccountsFromBackup, StorageError, saveAccounts, setStoragePath, withAccountStorageTransaction, } from "./storage.js";
 import { ANSI } from "./ui/ansi.js";
@@ -59,36 +62,6 @@ import { paintUiText, quotaToneFromLeftPercent } from "./ui/format.js";
 import { getUiRuntimeOptions } from "./ui/runtime.js";
 import { select } from "./ui/select.js";
 const log = createLogger("codex-manager");
-const ACCOUNT_MANAGER_COMMANDS = new Set([
-    "login",
-    "list",
-    "status",
-    "switch",
-    "unpin",
-    "workspace",
-    "best",
-    "check",
-    "features",
-    "usage",
-    "verify-flagged",
-    "verify",
-    "forecast",
-    "report",
-    "fix",
-    "doctor",
-    "uninstall",
-    "account",
-    "budget",
-    "bridge",
-    "integrations",
-    "models",
-    "monitor",
-    "rotation",
-    "why-selected",
-    "config",
-    "init-config",
-    "debug",
-]);
 function stylePromptText(text, tone) {
     if (!output.isTTY)
         return text;
@@ -245,7 +218,7 @@ function styleQuotaSummary(summary) {
             return stylePromptText(segment, "muted");
         }
         const windowLabel = match[1] ?? "";
-        const leftPercent = Number.parseInt(match[2] ?? "", 10);
+        const leftPercent = Math.max(0, Math.min(100, Number.parseInt(match[2] ?? "", 10)));
         if (!Number.isFinite(leftPercent)) {
             return stylePromptText(segment, "muted");
         }
@@ -254,7 +227,10 @@ function styleQuotaSummary(summary) {
     });
     return joinStyledSegments(rendered);
 }
-function styleAccountDetailText(detail, fallbackTone = "muted") {
+// Exported for unit tests: tone precedence (danger before warning) is
+// security/UX-relevant — a failure whose text contains "unavailable" must
+// render red, not be downgraded to yellow. See test/codex-manager-detail-tone.test.ts.
+export function styleAccountDetailText(detail, fallbackTone = "muted") {
     const compact = collapseWhitespace(detail);
     if (!compact)
         return stylePromptText("", fallbackTone);
@@ -263,15 +239,24 @@ function styleAccountDetailText(detail, fallbackTone = "muted") {
         const prefix = (quotaMatch[1] ?? "").trim();
         const quota = (quotaMatch[2] ?? "").trim();
         const suffix = (quotaMatch[3] ?? "").trim();
-        const prefixTone = /failed|error/i.test(prefix)
+        // danger wins across the WHOLE detail: a failure keyword anywhere — even
+        // trapped inside the (…%) quota segment, e.g.
+        // "signed in and working (live check failed: … 0%)" — must keep the prefix
+        // red, never let a "working"/"ok" prefix render green over a real failure.
+        const detailHasFailure = /failed|error|rate-limited/i.test(compact);
+        const prefixTone = detailHasFailure
             ? "danger"
-            : /ok|working|succeeded|valid/i.test(prefix)
+            : /\b(ok|working|succeeded|valid)\b/i.test(prefix)
                 ? "success"
                 : fallbackTone;
-        const suffixTone = /re-login|stale|warning|retry|fallback/i.test(suffix)
-            ? "warning"
-            : /failed|error/i.test(suffix)
-                ? "danger"
+        const suffixTone = 
+        // danger wins first: a real failure whose text happens to contain
+        // "unavailable"/"not available" (e.g. a 5xx "service not available")
+        // must render red, not be downgraded to a yellow warning.
+        /failed|error/i.test(suffix)
+            ? "danger"
+            : /re-login|stale|warning|retry|fallback|unavailable|not available/i.test(suffix)
+                ? "warning"
                 : "muted";
         const chunks = [];
         if (prefix)
@@ -283,11 +268,11 @@ function styleAccountDetailText(detail, fallbackTone = "muted") {
     }
     if (/rate-limited/i.test(compact))
         return stylePromptText(compact, "danger");
-    if (/re-login|stale|warning|fallback/i.test(compact))
-        return stylePromptText(compact, "warning");
     if (/failed|error/i.test(compact))
         return stylePromptText(compact, "danger");
-    if (/ok|working|succeeded|valid/i.test(compact))
+    if (/re-login|stale|warning|fallback|unavailable|not available/i.test(compact))
+        return stylePromptText(compact, "warning");
+    if (/\b(ok|working|succeeded|valid)\b/i.test(compact))
         return stylePromptText(compact, "success");
     return stylePromptText(compact, fallbackTone);
 }
@@ -461,7 +446,7 @@ function getPersistedQuotaViewForAccount(cache, account, accounts, now, emailFal
     return {
         updatedAt: cachedEntry?.updatedAt ?? now,
         status: 429,
-        model: cachedEntry?.model ?? "gpt-5.3-codex",
+        model: cachedEntry?.model ?? DEFAULT_MODEL,
         planType: cachedEntry?.planType,
         primary: {
             ...cachedEntry?.primary,
@@ -529,7 +514,8 @@ function pruneUnsafeQuotaEmailCacheEntry(cache, email, accounts, emailFallbackSt
     return true;
 }
 const DEFAULT_MENU_QUOTA_REFRESH_TTL_MS = 5 * 60_000;
-const MENU_QUOTA_REFRESH_MODEL = "gpt-5.3-codex";
+const DEFAULT_LIVE_PROBE_MODEL = DEFAULT_MODEL;
+const MENU_QUOTA_REFRESH_MODEL = DEFAULT_LIVE_PROBE_MODEL;
 function resolveMenuQuotaProbeInput(account, cache, maxAgeMs, now, accounts, emailFallbackState = buildQuotaEmailFallbackState(accounts)) {
     if (account.enabled === false)
         return null;
@@ -860,8 +846,17 @@ async function syncCodexCliActiveSelectionIfDrifted(storage) {
         return false;
     }
 }
-function resolveAccountSelection(tokens) {
-    const override = (process.env.CODEX_AUTH_ACCOUNT_ID ?? "").trim();
+/**
+ * Resolve the account-id selection for freshly-minted tokens.
+ *
+ * The org-override precedence (explicit `login --org` wins over the ambient
+ * CODEX_AUTH_ACCOUNT_ID env, for this call only) lives in the internal
+ * lib/auth/org-override.ts module so it can be unit-tested without exporting this
+ * CLI-internal function. Threading the org as a parameter avoids mutating
+ * process.env for the duration of a login, which raced on concurrent re-entry.
+ */
+function resolveAccountSelection(tokens, orgOverride) {
+    const override = resolveOrgOverride(orgOverride);
     if (override) {
         return {
             ...tokens,
@@ -1592,7 +1587,7 @@ async function syncSelectionToCodex(tokens) {
 async function runHealthCheck(options = {}) {
     const forceRefresh = options.forceRefresh === true;
     const liveProbe = options.liveProbe === true;
-    const probeModel = options.model?.trim() || "gpt-5.3-codex";
+    const probeModel = options.model?.trim() || DEFAULT_LIVE_PROBE_MODEL;
     const modelInspection = inspectRequestedModel(probeModel);
     const display = options.display ?? DEFAULT_DASHBOARD_DISPLAY_SETTINGS;
     const quotaCache = liveProbe ? await loadQuotaCache() : null;
@@ -1611,6 +1606,8 @@ async function runHealthCheck(options = {}) {
     let ok = 0;
     let failed = 0;
     let warnings = 0;
+    let codexAvailable = 0;
+    let signedInOnly = 0;
     const activeIndex = resolveActiveIndex(storage, "codex");
     let activeAccountRefreshed = false;
     const now = Date.now();
@@ -1636,6 +1633,7 @@ async function runHealthCheck(options = {}) {
                 activeAccountRefreshed = true;
             }
             let healthDetail = "signed in and working";
+            let healthTone = "success";
             if (liveProbe) {
                 const currentAccessToken = account.accessToken;
                 const probeAccountId = currentAccessToken
@@ -1643,8 +1641,10 @@ async function runHealthCheck(options = {}) {
                     : undefined;
                 if (!probeAccountId || !currentAccessToken) {
                     warnings += 1;
+                    signedInOnly += 1;
+                    healthTone = "warning";
                     healthDetail =
-                        "signed in and working (live check skipped: missing account ID)";
+                        "signed in (live check skipped: missing account ID)";
                 }
                 else {
                     try {
@@ -1658,11 +1658,20 @@ async function runHealthCheck(options = {}) {
                                 updateQuotaCacheForAccount(workingQuotaCache, account, snapshot, storage.accounts, quotaEmailFallbackState ?? undefined) || quotaCacheChanged;
                         }
                         healthDetail = formatQuotaSnapshotForDashboard(snapshot, display);
+                        codexAvailable += 1;
                     }
                     catch (error) {
-                        const message = normalizeFailureDetail(error instanceof Error ? error.message : String(error), undefined);
                         warnings += 1;
-                        healthDetail = `signed in and working (live check failed: ${message})`;
+                        signedInOnly += 1;
+                        healthTone = "warning";
+                        if (isCodexUnavailableError(error)) {
+                            healthDetail =
+                                `signed in; ${CODEX_UNAVAILABLE_PROBE_NOTE}`;
+                        }
+                        else {
+                            const message = normalizeFailureDetail(error instanceof Error ? error.message : String(error), undefined);
+                            healthDetail = `signed in (live check failed: ${message})`;
+                        }
                     }
                 }
             }
@@ -1671,7 +1680,8 @@ async function runHealthCheck(options = {}) {
             }
             ok += 1;
             if (display.showPerAccountRows) {
-                console.log(`  ${stylePromptText("✓", "success")} ${labelText} ${stylePromptText("|", "muted")} ${styleAccountDetailText(healthDetail)}`);
+                const healthMarker = healthTone === "success" ? "✓" : "!";
+                console.log(`  ${stylePromptText(healthMarker, healthTone)} ${labelText} ${stylePromptText("|", "muted")} ${styleAccountDetailText(healthDetail, healthTone)}`);
             }
             continue;
         }
@@ -1717,12 +1727,15 @@ async function runHealthCheck(options = {}) {
             }
             ok += 1;
             let healthyMessage = "working now";
+            let healthyTone = "success";
             if (liveProbe) {
                 const probeAccountId = account.accountId ?? tokenAccountId;
                 if (!probeAccountId) {
                     warnings += 1;
+                    signedInOnly += 1;
+                    healthyTone = "warning";
                     healthyMessage =
-                        "working now (live check skipped: missing account ID)";
+                        "signed in (live check skipped: missing account ID)";
                 }
                 else {
                     try {
@@ -1736,22 +1749,35 @@ async function runHealthCheck(options = {}) {
                                 updateQuotaCacheForAccount(workingQuotaCache, account, snapshot, storage.accounts, quotaEmailFallbackState ?? undefined) || quotaCacheChanged;
                         }
                         healthyMessage = formatQuotaSnapshotForDashboard(snapshot, display);
+                        codexAvailable += 1;
                     }
                     catch (error) {
-                        const message = normalizeFailureDetail(error instanceof Error ? error.message : String(error), undefined);
                         warnings += 1;
-                        healthyMessage = `working now (live check failed: ${message})`;
+                        signedInOnly += 1;
+                        healthyTone = "warning";
+                        if (isCodexUnavailableError(error)) {
+                            healthyMessage =
+                                `signed in; ${CODEX_UNAVAILABLE_PROBE_NOTE}`;
+                        }
+                        else {
+                            const message = normalizeFailureDetail(error instanceof Error ? error.message : String(error), undefined);
+                            healthyMessage = `signed in (live check failed: ${message})`;
+                        }
                     }
                 }
             }
             if (display.showPerAccountRows) {
-                console.log(`  ${stylePromptText("✓", "success")} ${labelText} ${stylePromptText("|", "muted")} ${styleAccountDetailText(healthyMessage)}`);
+                const healthyMarker = healthyTone === "success" ? "✓" : "!";
+                console.log(`  ${stylePromptText(healthyMarker, healthyTone)} ${labelText} ${stylePromptText("|", "muted")} ${styleAccountDetailText(healthyMessage, healthyTone)}`);
             }
         }
         else {
             const detail = normalizeFailureDetail(result.message, result.reason);
             if (sessionLikelyValid) {
                 warnings += 1;
+                if (liveProbe) {
+                    signedInOnly += 1;
+                }
                 if (display.showPerAccountRows) {
                     console.log(`  ${stylePromptText("!", "warning")} ${labelText} ${stylePromptText("|", "muted")} ${stylePromptText(`refresh failed (${detail}) but this account still works right now`, "warning")}`);
                 }
@@ -1795,17 +1821,32 @@ async function runHealthCheck(options = {}) {
         }
     }
     console.log("");
-    console.log(formatResultSummary([
-        { text: `${ok} working`, tone: "success" },
-        {
-            text: `${failed} need re-login`,
-            tone: failed > 0 ? "danger" : "muted",
-        },
-        {
-            text: `${warnings} warning${warnings === 1 ? "" : "s"}`,
-            tone: warnings > 0 ? "warning" : "muted",
-        },
-    ]));
+    console.log(formatResultSummary(liveProbe
+        ? [
+            {
+                text: `${codexAvailable} Codex available`,
+                tone: codexAvailable > 0 ? "success" : "muted",
+            },
+            {
+                text: `${signedInOnly} signed in only`,
+                tone: signedInOnly > 0 ? "warning" : "muted",
+            },
+            {
+                text: `${failed} need re-login`,
+                tone: failed > 0 ? "danger" : "muted",
+            },
+        ]
+        : [
+            { text: `${ok} working`, tone: "success" },
+            {
+                text: `${failed} need re-login`,
+                tone: failed > 0 ? "danger" : "muted",
+            },
+            {
+                text: `${warnings} warning${warnings === 1 ? "" : "s"}`,
+                tone: warnings > 0 ? "warning" : "muted",
+            },
+        ]));
 }
 function printBestUsage() {
     console.log([
@@ -1815,7 +1856,7 @@ function printBestUsage() {
         "Options:",
         "  --live, -l         Probe live quota headers via Codex backend before switching",
         "  --json, -j         Print machine-readable JSON output",
-        "  --model, -m        Probe model for live mode (default: gpt-5.3-codex)",
+        `  --model, -m        Probe model for live mode (default: ${DEFAULT_LIVE_PROBE_MODEL})`,
         "",
         "Behavior:",
         "  - Chooses the healthiest account using forecast scoring",
@@ -1826,7 +1867,7 @@ function parseBestArgs(args) {
     const options = {
         live: false,
         json: false,
-        model: "gpt-5.3-codex",
+        model: DEFAULT_LIVE_PROBE_MODEL,
         modelProvided: false,
     };
     for (let i = 0; i < args.length; i += 1) {
@@ -1842,8 +1883,8 @@ function parseBestArgs(args) {
             continue;
         }
         if (arg === "--model" || arg === "-m") {
-            const value = args[i + 1];
-            if (!value) {
+            const value = args[i + 1]?.trim();
+            if (!value || value.startsWith("-")) {
                 return { ok: false, message: "Missing value for --model" };
             }
             options.model = value;
@@ -1853,7 +1894,7 @@ function parseBestArgs(args) {
         }
         if (arg.startsWith("--model=")) {
             const value = arg.slice("--model=".length).trim();
-            if (!value) {
+            if (!value || value.startsWith("-")) {
                 return { ok: false, message: "Missing value for --model" };
             }
             options.model = value;
@@ -2074,27 +2115,13 @@ async function runAuthLogin(args) {
     const loginOptions = parsedArgs.options;
     // `--org <id>` binds this login to a specific workspace/org so the same
     // email's personal vs business/team workspace can be registered on demand
-    // (issue #491). It reuses the CODEX_AUTH_ACCOUNT_ID override that every login
-    // resolver already honors. Scope it to this invocation and restore the prior
-    // value in a finally so a later login in the same process (menu re-entry, a
-    // reused test worker) is never silently bound to a stale org.
-    if (!loginOptions.org) {
-        return runAuthLoginFlow(loginOptions);
-    }
-    const previousAccountIdOverride = process.env.CODEX_AUTH_ACCOUNT_ID;
-    process.env.CODEX_AUTH_ACCOUNT_ID = loginOptions.org;
-    console.log(`Binding this login to workspace org id: ${loginOptions.org}`);
-    try {
-        return await runAuthLoginFlow(loginOptions);
-    }
-    finally {
-        if (previousAccountIdOverride === undefined) {
-            delete process.env.CODEX_AUTH_ACCOUNT_ID;
-        }
-        else {
-            process.env.CODEX_AUTH_ACCOUNT_ID = previousAccountIdOverride;
-        }
+    // (issue #491). The org is threaded explicitly into resolveAccountSelection
+    // (no process.env mutation), so concurrent re-entry (menu re-entry, a reused
+    // test worker) can never bind a login to a stale org via a shared global.
+    if (loginOptions.org) {
+        console.log(`Binding this login to workspace org id: ${loginOptions.org}`);
     }
+    return runAuthLoginFlow(loginOptions);
 }
 async function runAuthLoginFlow(loginOptions) {
     setStoragePath(null);
@@ -2368,7 +2395,7 @@ async function runAuthLoginFlow(loginOptions) {
                 console.error(`Login failed: ${tokenResult.message ?? tokenResult.reason ?? "unknown error"}`);
                 return 1;
             }
-            const resolved = resolveAccountSelection(tokenResult);
+            const resolved = resolveAccountSelection(tokenResult, loginOptions.org);
             await persistAccountPool([resolved], false);
             await syncSelectionToCodex(resolved);
             const latestStorage = await loadAccounts();
@@ -2688,6 +2715,7 @@ export async function runCodexMultiAuthCli(rawArgs) {
                 .catch(() => null),
             loadAppHelperStatus: readAppRuntimeHelperAccountSignal,
             loadQuotaCache,
+            json: rest.includes("--json") || rest.includes("-j"),
         });
     }
     if (command === "switch") {