codex-multi-auth 2.17.0 → 2.17.2

package/dist/lib/runtime/automatic-subscription-checks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"automatic-subscription-checks.d.ts","sourceRoot":"","sources":["../../../lib/runtime/automatic-subscription-checks.ts"],"names":[],"mappings":"AAIA,OAAO,EAAkB,KAAK,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAA2B,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAUrF,KAAK,QAAQ,GAAG,CAAC,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,kBAAkB,EAAE,QAAQ,EAAE,iBAAiB,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAClI,mGAAmG;AACnG,wBAAgB,gCAAgC,CAAC,OAAO,CAAC,EAAE,QAAQ,IASvD,QAAQ,WAAW,mBA+B9B"}
+{"version":3,"file":"automatic-subscription-checks.d.ts","sourceRoot":"","sources":["../../../lib/runtime/automatic-subscription-checks.ts"],"names":[],"mappings":"AAGA,OAAO,EAAkB,KAAK,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAA2B,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAOrF,KAAK,QAAQ,GAAG,CAAC,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,kBAAkB,EAAE,QAAQ,EAAE,iBAAiB,EAAE,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACvJ,mGAAmG;AACnG,wBAAgB,gCAAgC,CAAC,OAAO,CAAC,EAAE,QAAQ,IASvD,QAAQ,WAAW,mBAgC9B"}

package/dist/lib/runtime/automatic-subscription-checks.js

@@ -1,35 +1,33 @@
 import { getStoragePathState, runWithStoragePathState } from "../storage/path-state.js";
-import { join } from "node:path";
 import { AccountManager, resolveAccountRecordId } from "../accounts.js";
 import { getAccountPolicyKey, loadAccountPolicyStore } from "../account-policy.js";
 import { getStoragePath } from "../storage.js";
 import { fetchCodexQuotaSnapshot } from "../quota-probe.js";
 import { loadQuotaCache, saveQuotaCache } from "../quota-cache.js";
-import { updateQuotaCacheForAccount } from "../codex-manager/quota-cache-helpers.js";
-import { getCodexMultiAuthDir } from "../runtime-paths.js";
-import { withFileTransactionLock } from "../storage/file-lock.js";
+import { updateQuotaCacheForWorkspace } from "../codex-manager/quota-cache-helpers.js";
 import { createNativeAccountStorageReader } from "./native-account-storage.js";
 import { ensureFreshAccessToken } from "./rotation-token-refresh.js";
-import { workspaceModelScopes } from "./workspace-model-scopes.js";
-import { runAutomaticAccountChecks } from "./automatic-account-checks.js";
+import { automaticCheckWorkspaceId, runAutomaticAccountChecks } from "./automatic-account-checks.js";
 import { logWarn } from "../logger.js";
 /** Captures this router's pool; reads only verified primary credentials, never API/ZDR entries. */
 export function createAutomaticSubscriptionCheck(observe) {
     const path = getStoragePath(), storageState = getStoragePathState();
     const read = createNativeAccountStorageReader(undefined, path);
-    const quotaPath = join(getCodexMultiAuthDir(), "quota-cache.json");
-    const onQuota = observe ?? (async (account, snapshot, accounts) => withFileTransactionLock(quotaPath, async () => {
+    const onQuota = observe ?? (async (account, snapshot, accounts, workspaceId) => {
         const cache = await loadQuotaCache();
-        updateQuotaCacheForAccount(cache, account, snapshot, accounts);
-        await saveQuotaCache(cache);
-    }));
+        const baseline = structuredClone(cache);
+        updateQuotaCacheForWorkspace(cache, account, workspaceId, snapshot, accounts);
+        await saveQuotaCache(cache, baseline);
+    });
     return (signal) => runWithStoragePathState(storageState, () => runAutomaticAccountChecks({
         path: `${path}.automatic-checks.json`, signal, loadPolicies: loadAccountPolicyStore,
         loadAccounts: async () => { const snapshot = await read(); return snapshot.verified ? snapshot.storage : null; },
         check: async (storage, index) => {
             const manager = new AccountManager(undefined, storage);
             const account = manager.getAccountByIndex(index);
-            if (!account || !workspaceModelScopes(account).some(s => s.bound && s.routable) || signal.aborted)
+            const stored = storage.accounts[index];
+            const targetId = stored && automaticCheckWorkspaceId(stored);
+            if (!account || !targetId || signal.aborted)
                 return;
             const fresh = await ensureFreshAccessToken({ accountManager: manager, account, family: "codex", model: null, now: Date.now(), tokenRefreshSkewMs: 60000, tokenInvalidationCooldownMs: 300000 });
             try {
@@ -41,13 +39,12 @@ export function createAutomaticSubscriptionCheck(observe) {
                 const policy = current ? (await loadAccountPolicyStore()).accounts[getAccountPolicyKey(current)] : undefined;
                 if (!disk.storage || !current || current.refreshToken !== fresh.account.refreshToken || current.accessToken !== fresh.accessToken || !policy?.autoPrime || policy.paused || policy.drained || current.enabled === false || current.authInvalidatedAt || (current.coolingDownUntil ?? 0) > Date.now())
                     return;
-                const bound = workspaceModelScopes(fresh.account).find(s => s.bound && s.routable);
-                if (!bound || (current.accountId && current.accountId !== bound.accountId) || current.workspaces?.some(w => w.id === bound.accountId && w.enabled === false) || signal.aborted)
+                if (automaticCheckWorkspaceId(current) !== targetId || signal.aborted)
                     return;
-                const snapshot = await fetchCodexQuotaSnapshot({ accountId: bound.accountId, accessToken: fresh.accessToken, primeUnusedSubscription: true, signal });
+                const snapshot = await fetchCodexQuotaSnapshot({ accountId: targetId, accessToken: fresh.accessToken, primeUnusedSubscription: true, signal });
                 if (snapshot.primingFailure)
                     logWarn("Automatic first-use completion was not confirmed; retry deferred until the next check.");
-                await onQuota(current, snapshot, disk.storage.accounts);
+                await onQuota(current, snapshot, disk.storage.accounts, targetId);
             }
             finally {
                 await manager.flushPendingSave();

package/dist/lib/runtime-rotation-proxy.js

@@ -1366,8 +1366,8 @@ async function handleRequestInner(state, req, res, traceId) {
         const subscriptionQuotaByAccount = {};
         const resetCreditState = state.nativeOpenai && isResponsesRequest ? await cachedRead(state, "reset-credits", loadResetCreditState).catch(() => null) : null;
         const quotaForScope = (account, scope) => {
-            // Cached checks describe only the stored account binding, never its sibling workspaces.
-            const cached = scope.bound ? findQuotaCacheEntryForAccount(subscriptionQuotaCache, account, accountManager.getAccountsSnapshot()) : null;
+            // Scoped observations belong to this credential and workspace; legacy entries only describe the binding.
+            const cached = findQuotaCacheEntryForAccount(subscriptionQuotaCache, account, accountManager.getAccountsSnapshot(), undefined, scope.accountId);
             const observed = state.subscriptionQuotaObservations?.get(JSON.stringify([scope.id, context.model]));
             const reset = resetCreditState?.snapshots[scope.id];
             if (reset && reset.updatedAt > Math.max(cached?.updatedAt ?? 0, observed?.updatedAt ?? 0) && reset.updatedAt <= state.now() && state.now() - reset.updatedAt <= 60000)
@@ -1616,7 +1616,7 @@ async function handleRequestInner(state, req, res, traceId) {
                     continue;
                 for (const scope of scopes)
                     applyConfirmedReset({ account, scope, model: context.model, family: context.family, manager: accountManager, snapshot: resetCreditState.snapshots[scope.id], lastRedemptionAt: resetCreditState.lastRedemptionAt,
-                        previous: state.subscriptionQuotaObservations?.get(JSON.stringify([scope.id, context.model])) ?? (scope.bound ? findQuotaCacheEntryForAccount(subscriptionQuotaCache, account, accountManager.getAccountsSnapshot()) : null),
+                        previous: state.subscriptionQuotaObservations?.get(JSON.stringify([scope.id, context.model])) ?? findQuotaCacheEntryForAccount(subscriptionQuotaCache, account, accountManager.getAccountsSnapshot(), undefined, scope.accountId),
                         observations: state.subscriptionQuotaObservations ??= new Map(), now: state.now(), clearQuotaScheduler: a => state.preemptiveQuotaScheduler.clear(buildQuotaScheduleKey(a, context.family, context.model)) });
             }
         }

package/dist/lib/storage/pending-auth.d.ts

@@ -3,6 +3,7 @@ export declare function getPendingAuthPath(storagePath: string): string;
 /** Record a rotated credential beside the account pool. */
 export declare function recordPendingAuth(storagePath: string, auth: {
     priorRefreshToken: string;
+    recordId?: string;
     refreshToken: string;
     accessToken: string;
     expiresAt: number;

package/dist/lib/storage/pending-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pending-auth.d.ts","sourceRoot":"","sources":["../../../lib/storage/pending-auth.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAyB1D,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE9D;AAmCD,2DAA2D;AAC3D,wBAAsB,iBAAiB,CACtC,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;IAAE,iBAAiB,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAC3G,OAAO,CAAC,IAAI,CAAC,CA4Bf;AAED,mFAAmF;AACnF,wBAAsB,gBAAgB,CACrC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,gBAAgB,GAAG,IAAI,GAC9B,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CA4BlC;AAED,mGAAmG;AACnG,wBAAsB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAUlG;AAED,yFAAyF;AACzF,wBAAsB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGzE"}
+{"version":3,"file":"pending-auth.d.ts","sourceRoot":"","sources":["../../../lib/storage/pending-auth.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AA0B1D,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE9D;AAmCD,2DAA2D;AAC3D,wBAAsB,iBAAiB,CACtC,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;IAAE,iBAAiB,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAC9H,OAAO,CAAC,IAAI,CAAC,CA4Bf;AAED,mFAAmF;AACnF,wBAAsB,gBAAgB,CACrC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,gBAAgB,GAAG,IAAI,GAC9B,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CA6BlC;AAED,mGAAmG;AACnG,wBAAsB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAUlG;AAED,yFAAyF;AACzF,wBAAsB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGzE"}

package/dist/lib/storage/pending-auth.js

@@ -17,6 +17,7 @@ import { getIntentionalResetMarkerPath } from "./backup-paths.js";
 const entrySchema = z.object({
     /** sha256 of the spent refresh token: identifies the row without storing it. */
     prior: z.string().regex(/^[0-9a-f]{64}$/),
+    recordId: z.string().trim().min(1).optional(),
     refreshToken: z.string().min(1),
     accessToken: z.string().min(1),
     expiresAt: z.number(),
@@ -82,9 +83,9 @@ export async function recordPendingAuth(storagePath, auth) {
         // the original spent token, so extend that entry rather than add one that
         // no disk row can match.
         const chained = entries.find((entry) => entry.refreshToken === auth.priorRefreshToken);
-        const current = chained ?? { prior, refreshToken: auth.refreshToken, accessToken: auth.accessToken, expiresAt: auth.expiresAt, at: auth.at };
+        const current = chained ?? { prior, recordId: auth.recordId, refreshToken: auth.refreshToken, accessToken: auth.accessToken, expiresAt: auth.expiresAt, at: auth.at };
         if (chained)
-            Object.assign(chained, { refreshToken: auth.refreshToken, accessToken: auth.accessToken, expiresAt: auth.expiresAt, at: auth.at });
+            Object.assign(chained, { recordId: chained.recordId ?? auth.recordId, refreshToken: auth.refreshToken, accessToken: auth.accessToken, expiresAt: auth.expiresAt, at: auth.at });
         else
             entries.push(current);
         const excess = entries.length - MAX_ENTRIES;
@@ -120,6 +121,7 @@ export async function applyPendingAuth(storagePath, storage) {
         const entry = account.refreshToken ? entries.find((item) => item.prior === hash(account.refreshToken)) : undefined;
         if (!entry)
             continue;
+        account.recordId ??= entry.recordId;
         account.refreshToken = entry.refreshToken;
         account.accessToken = entry.accessToken;
         account.expiresAt = entry.expiresAt;

package/dist/lib/storage/record-identity.d.ts

@@ -0,0 +1,16 @@
+/** Derive a legacy record identity before its first persisted token rotation. */
+export declare function deriveAccountRecordId(account: {
+    accountId?: string;
+    email?: string;
+    refreshToken: string;
+    addedAt: number;
+}): string;
+/** Resolve the persisted identity, or derive it for a legacy row. */
+export declare function resolveAccountRecordId(account: {
+    recordId?: string;
+    accountId?: string;
+    email?: string;
+    refreshToken: string;
+    addedAt: number;
+}): string;
+//# sourceMappingURL=record-identity.d.ts.map

package/dist/lib/storage/record-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"record-identity.d.ts","sourceRoot":"","sources":["../../../lib/storage/record-identity.ts"],"names":[],"mappings":"AAEA,iFAAiF;AACjF,wBAAgB,qBAAqB,CACpC,OAAO,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CAChB,GACC,MAAM,CAQR;AAED,qEAAqE;AACrE,wBAAgB,sBAAsB,CACrC,OAAO,EAAE;IACR,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CAChB,GACC,MAAM,CAGR"}

package/dist/lib/storage/record-identity.js

@@ -0,0 +1,16 @@
+import { createHash } from "node:crypto";
+/** Derive a legacy record identity before its first persisted token rotation. */
+export function deriveAccountRecordId(account) {
+    const seed = [
+        account.addedAt,
+        account.accountId?.trim() ?? "",
+        account.email?.trim().toLowerCase() ?? "",
+        account.refreshToken.trim(),
+    ].join("\u0000");
+    return `record:${createHash("sha256").update(seed).digest("hex")}`;
+}
+/** Resolve the persisted identity, or derive it for a legacy row. */
+export function resolveAccountRecordId(account) {
+    const stored = account.recordId?.trim();
+    return stored || deriveAccountRecordId(account);
+}

package/node_modules/@codex-ai/plugin/dist/index.d.ts

@@ -1,2 +1,2 @@
-export type PluginInput = any;
-export type Plugin = any;
+export type PluginInput = any;
+export type Plugin = any;

package/node_modules/@codex-ai/plugin/dist/index.js

@@ -1,2 +1,2 @@
-export {};
-
+export {};
+

package/node_modules/@codex-ai/plugin/dist/tool.d.ts

@@ -1,42 +1,42 @@
-export interface ToolContext {
-  [key: string]: any;
-  directory: string;
-  worktree: string;
-  ask: (request: any) => Promise<any> | any;
-}
-
-export interface ToolDefinition<TArgs = any, TResult = any> {
-  description?: string;
-  args?: Record<string, any>;
-  parameters?: unknown;
-  execute: (args: TArgs, context: ToolContext) => Promise<TResult> | TResult;
-  [key: string]: any;
-}
-
-export interface SchemaNode {
-  optional: () => SchemaNode;
-  describe: (_text: string) => SchemaNode;
-  min: (_value: number) => SchemaNode;
-  max: (_value: number) => SchemaNode;
-  default: (_value: unknown) => SchemaNode;
-  int: () => SchemaNode;
-  array: (_node?: unknown) => SchemaNode;
-  [key: string]: any;
-}
-
-export interface ToolFactory {
-  <TArgs = any, TResult = any>(definition: ToolDefinition<TArgs, TResult>): ToolDefinition<TArgs, TResult>;
-  schema: {
-    string: () => SchemaNode;
-    number: () => SchemaNode;
-    boolean: () => SchemaNode;
-    object: (shape: Record<string, unknown>) => SchemaNode;
-    enum: (values: readonly unknown[]) => SchemaNode;
-    literal: (value: unknown) => SchemaNode;
-    array: (node: unknown) => SchemaNode;
-    any: () => SchemaNode;
-    unknown: () => SchemaNode;
-  };
-}
-
-export declare const tool: ToolFactory;
+export interface ToolContext {
+  [key: string]: any;
+  directory: string;
+  worktree: string;
+  ask: (request: any) => Promise<any> | any;
+}
+
+export interface ToolDefinition<TArgs = any, TResult = any> {
+  description?: string;
+  args?: Record<string, any>;
+  parameters?: unknown;
+  execute: (args: TArgs, context: ToolContext) => Promise<TResult> | TResult;
+  [key: string]: any;
+}
+
+export interface SchemaNode {
+  optional: () => SchemaNode;
+  describe: (_text: string) => SchemaNode;
+  min: (_value: number) => SchemaNode;
+  max: (_value: number) => SchemaNode;
+  default: (_value: unknown) => SchemaNode;
+  int: () => SchemaNode;
+  array: (_node?: unknown) => SchemaNode;
+  [key: string]: any;
+}
+
+export interface ToolFactory {
+  <TArgs = any, TResult = any>(definition: ToolDefinition<TArgs, TResult>): ToolDefinition<TArgs, TResult>;
+  schema: {
+    string: () => SchemaNode;
+    number: () => SchemaNode;
+    boolean: () => SchemaNode;
+    object: (shape: Record<string, unknown>) => SchemaNode;
+    enum: (values: readonly unknown[]) => SchemaNode;
+    literal: (value: unknown) => SchemaNode;
+    array: (node: unknown) => SchemaNode;
+    any: () => SchemaNode;
+    unknown: () => SchemaNode;
+  };
+}
+
+export declare const tool: ToolFactory;

package/node_modules/@codex-ai/plugin/dist/tool.js

@@ -1,29 +1,29 @@
-const chain = {
-  optional() { return this; },
-  describe() { return this; },
-  min() { return this; },
-  max() { return this; },
-  default() { return this; },
-  int() { return this; },
-  array() { return this; },
-};
-
-function node() {
-  return Object.create(chain);
-}
-
-export function tool(definition) {
-  return definition;
-}
-
-tool.schema = {
-  string: () => node(),
-  number: () => node(),
-  boolean: () => node(),
-  object: () => node(),
-  enum: () => node(),
-  literal: () => node(),
-  array: () => node(),
-  any: () => node(),
-  unknown: () => node(),
-};
+const chain = {
+  optional() { return this; },
+  describe() { return this; },
+  min() { return this; },
+  max() { return this; },
+  default() { return this; },
+  int() { return this; },
+  array() { return this; },
+};
+
+function node() {
+  return Object.create(chain);
+}
+
+export function tool(definition) {
+  return definition;
+}
+
+tool.schema = {
+  string: () => node(),
+  number: () => node(),
+  boolean: () => node(),
+  object: () => node(),
+  enum: () => node(),
+  literal: () => node(),
+  array: () => node(),
+  any: () => node(),
+  unknown: () => node(),
+};

package/node_modules/@codex-ai/plugin/package.json

@@ -1,9 +1,9 @@
-{
-  "name": "@codex-ai/plugin",
-  "version": "1.2.10-codex.1",
-  "type": "module",
-  "exports": {
-    ".": { "import": "./dist/index.js", "types": "./dist/index.d.ts" },
-    "./tool": { "import": "./dist/tool.js", "types": "./dist/tool.d.ts" }
-  }
-}
+{
+  "name": "@codex-ai/plugin",
+  "version": "1.2.10-codex.1",
+  "type": "module",
+  "exports": {
+    ".": { "import": "./dist/index.js", "types": "./dist/index.d.ts" },
+    "./tool": { "import": "./dist/tool.js", "types": "./dist/tool.d.ts" }
+  }
+}

package/node_modules/@codex-ai/sdk/dist/index.d.ts

@@ -1,4 +1,4 @@
-export type Auth = any;
-export type Provider = any;
-export type Model = any;
-export type CodexClient = any;
+export type Auth = any;
+export type Provider = any;
+export type Model = any;
+export type CodexClient = any;

package/node_modules/@codex-ai/sdk/dist/index.js

@@ -1,2 +1,2 @@
-export {};
-
+export {};
+

package/node_modules/@codex-ai/sdk/package.json

@@ -1,8 +1,8 @@
-{
-  "name": "@codex-ai/sdk",
-  "version": "1.2.10-codex.1",
-  "type": "module",
-  "exports": {
-    ".": { "import": "./dist/index.js", "types": "./dist/index.d.ts" }
-  }
-}
+{
+  "name": "@codex-ai/sdk",
+  "version": "1.2.10-codex.1",
+  "type": "module",
+  "exports": {
+    ".": { "import": "./dist/index.js", "types": "./dist/index.d.ts" }
+  }
+}