codex-multi-auth 2.17.0 → 2.17.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (450) hide show
  1. package/.codex-plugin/plugin.json +9 -9
  2. package/LICENSE +21 -21
  3. package/README.md +142 -484
  4. package/assets/codex-multi-auth-icon.svg +39 -39
  5. package/assets/readme-hero.svg +31 -31
  6. package/config/README.md +31 -31
  7. package/config/codex-legacy.json +1221 -1221
  8. package/config/codex-modern.json +423 -423
  9. package/config/minimal-codex.json +15 -15
  10. package/dist/index.d.ts +0 -1
  11. package/dist/lib/account-policy.d.ts +18 -2
  12. package/dist/lib/account-policy.js +97 -40
  13. package/dist/lib/accounts/rate-limits.d.ts +0 -1
  14. package/dist/lib/accounts.d.ts +1 -8
  15. package/dist/lib/accounts.d.ts.map +1 -1
  16. package/dist/lib/accounts.js +7 -19
  17. package/dist/lib/api-route-store.d.ts +0 -1
  18. package/dist/lib/audit.d.ts +0 -1
  19. package/dist/lib/audit.js +43 -12
  20. package/dist/lib/auth/account-access.d.ts +0 -1
  21. package/dist/lib/auth/account-access.js +5 -1
  22. package/dist/lib/auth/auth.d.ts +4 -3
  23. package/dist/lib/auth/auth.js +220 -28
  24. package/dist/lib/auth/browser.d.ts +0 -1
  25. package/dist/lib/auth/callback-guidance.d.ts +0 -1
  26. package/dist/lib/auth/device-auth.d.ts +0 -1
  27. package/dist/lib/auth/index.d.ts +0 -1
  28. package/dist/lib/auth/org-override.d.ts +0 -1
  29. package/dist/lib/auth/server.d.ts +1 -2
  30. package/dist/lib/auth/server.js +100 -53
  31. package/dist/lib/auth/token-utils.d.ts +0 -1
  32. package/dist/lib/auth-rate-limit.d.ts +0 -1
  33. package/dist/lib/budget-guard.d.ts +16 -2
  34. package/dist/lib/budget-guard.js +123 -43
  35. package/dist/lib/capability-policy.d.ts +0 -1
  36. package/dist/lib/circuit-breaker.d.ts +20 -1
  37. package/dist/lib/circuit-breaker.js +24 -5
  38. package/dist/lib/cli.d.ts +0 -1
  39. package/dist/lib/codex-cli/index.d.ts +0 -1
  40. package/dist/lib/codex-cli/observability.d.ts +0 -1
  41. package/dist/lib/codex-cli/state.d.ts +0 -1
  42. package/dist/lib/codex-cli/sync.d.ts +0 -1
  43. package/dist/lib/codex-cli/writer.d.ts +0 -1
  44. package/dist/lib/codex-manager/account-credentials.d.ts +0 -1
  45. package/dist/lib/codex-manager/account-manager-commands.d.ts +0 -1
  46. package/dist/lib/codex-manager/account-pool-write.d.ts +0 -1
  47. package/dist/lib/codex-manager/active-account-sync.d.ts +6 -0
  48. package/dist/lib/codex-manager/active-account-sync.js +336 -0
  49. package/dist/lib/codex-manager/api-login-menu.d.ts +0 -1
  50. package/dist/lib/codex-manager/backend-category-entry.d.ts +0 -1
  51. package/dist/lib/codex-manager/backend-category-helpers.d.ts +0 -1
  52. package/dist/lib/codex-manager/backend-category-prompt.d.ts +0 -1
  53. package/dist/lib/codex-manager/backend-settings-controller.d.ts +0 -1
  54. package/dist/lib/codex-manager/backend-settings-entry.d.ts +0 -1
  55. package/dist/lib/codex-manager/backend-settings-helpers.d.ts +0 -1
  56. package/dist/lib/codex-manager/backend-settings-prompt.d.ts +0 -1
  57. package/dist/lib/codex-manager/backend-settings-schema.d.ts +0 -1
  58. package/dist/lib/codex-manager/behavior-settings-panel.d.ts +0 -1
  59. package/dist/lib/codex-manager/commands/account.d.ts +8 -3
  60. package/dist/lib/codex-manager/commands/account.js +46 -34
  61. package/dist/lib/codex-manager/commands/best.d.ts +0 -1
  62. package/dist/lib/codex-manager/commands/bridge.d.ts +0 -1
  63. package/dist/lib/codex-manager/commands/budget.d.ts +8 -3
  64. package/dist/lib/codex-manager/commands/budget.js +6 -4
  65. package/dist/lib/codex-manager/commands/check.d.ts +0 -1
  66. package/dist/lib/codex-manager/commands/config-explain.d.ts +0 -1
  67. package/dist/lib/codex-manager/commands/debug-bundle.d.ts +0 -1
  68. package/dist/lib/codex-manager/commands/forecast.d.ts +1 -2
  69. package/dist/lib/codex-manager/commands/forecast.d.ts.map +1 -1
  70. package/dist/lib/codex-manager/commands/forecast.js +2 -2
  71. package/dist/lib/codex-manager/commands/history.d.ts +0 -1
  72. package/dist/lib/codex-manager/commands/init-config.d.ts +0 -1
  73. package/dist/lib/codex-manager/commands/integrations.d.ts +0 -1
  74. package/dist/lib/codex-manager/commands/limits.d.ts +0 -1
  75. package/dist/lib/codex-manager/commands/models.d.ts +0 -1
  76. package/dist/lib/codex-manager/commands/monitor.d.ts +0 -1
  77. package/dist/lib/codex-manager/commands/report.d.ts +0 -1
  78. package/dist/lib/codex-manager/commands/resets.d.ts +0 -1
  79. package/dist/lib/codex-manager/commands/resets.js +9 -1
  80. package/dist/lib/codex-manager/commands/rotation.d.ts +0 -1
  81. package/dist/lib/codex-manager/commands/status.d.ts +0 -1
  82. package/dist/lib/codex-manager/commands/switch.d.ts +0 -1
  83. package/dist/lib/codex-manager/commands/uninstall.d.ts +0 -1
  84. package/dist/lib/codex-manager/commands/unpin.d.ts +0 -1
  85. package/dist/lib/codex-manager/commands/usage.d.ts +0 -1
  86. package/dist/lib/codex-manager/commands/verify.d.ts +0 -1
  87. package/dist/lib/codex-manager/commands/why-selected.d.ts +0 -1
  88. package/dist/lib/codex-manager/commands/workspace.d.ts +0 -1
  89. package/dist/lib/codex-manager/dashboard-display-panel.d.ts +0 -1
  90. package/dist/lib/codex-manager/dashboard-formatters.d.ts +0 -1
  91. package/dist/lib/codex-manager/dashboard-settings-controller.d.ts +0 -1
  92. package/dist/lib/codex-manager/dashboard-settings-data.d.ts +0 -1
  93. package/dist/lib/codex-manager/dashboard-settings-entry.d.ts +0 -1
  94. package/dist/lib/codex-manager/experimental-settings-entry.d.ts +0 -1
  95. package/dist/lib/codex-manager/experimental-settings-prompt.d.ts +0 -1
  96. package/dist/lib/codex-manager/experimental-settings-schema.d.ts +0 -1
  97. package/dist/lib/codex-manager/experimental-sync-target-entry.d.ts +0 -1
  98. package/dist/lib/codex-manager/experimental-sync-target.d.ts +0 -1
  99. package/dist/lib/codex-manager/forecast-report-shared.d.ts +0 -1
  100. package/dist/lib/codex-manager/formatters/account-formatters.d.ts +0 -1
  101. package/dist/lib/codex-manager/formatters/index.d.ts +0 -1
  102. package/dist/lib/codex-manager/formatters/model-formatters.d.ts +0 -1
  103. package/dist/lib/codex-manager/formatters/quota-formatters.d.ts +0 -1
  104. package/dist/lib/codex-manager/formatters/text-style.d.ts +0 -1
  105. package/dist/lib/codex-manager/health-check.d.ts +0 -1
  106. package/dist/lib/codex-manager/health-check.js +1 -1
  107. package/dist/lib/codex-manager/help.d.ts +0 -1
  108. package/dist/lib/codex-manager/login-action-panel.d.ts +0 -1
  109. package/dist/lib/codex-manager/login-flow.d.ts +0 -1
  110. package/dist/lib/codex-manager/login-menu-actions.d.ts +0 -1
  111. package/dist/lib/codex-manager/login-menu-data.d.ts +0 -1
  112. package/dist/lib/codex-manager/login-menu-data.d.ts.map +1 -1
  113. package/dist/lib/codex-manager/login-menu-data.js +7 -3
  114. package/dist/lib/codex-manager/login-oauth.d.ts +0 -1
  115. package/dist/lib/codex-manager/login-workspace-choice.d.ts +0 -1
  116. package/dist/lib/codex-manager/manual-callback.d.ts +0 -1
  117. package/dist/lib/codex-manager/persist-selected-account.d.ts +0 -1
  118. package/dist/lib/codex-manager/quota-cache-helpers.d.ts +7 -2
  119. package/dist/lib/codex-manager/quota-cache-helpers.d.ts.map +1 -1
  120. package/dist/lib/codex-manager/quota-cache-helpers.js +34 -19
  121. package/dist/lib/codex-manager/rate-limit-markers.d.ts +0 -1
  122. package/dist/lib/codex-manager/repair-commands.d.ts +0 -1
  123. package/dist/lib/codex-manager/repair-commands.js +1 -1
  124. package/dist/lib/codex-manager/settings-hub/backend.d.ts +0 -1
  125. package/dist/lib/codex-manager/settings-hub/dashboard.d.ts +0 -1
  126. package/dist/lib/codex-manager/settings-hub/experimental.d.ts +0 -1
  127. package/dist/lib/codex-manager/settings-hub/index.d.ts +0 -1
  128. package/dist/lib/codex-manager/settings-hub/shared.d.ts +0 -1
  129. package/dist/lib/codex-manager/settings-hub-entry.d.ts +0 -1
  130. package/dist/lib/codex-manager/settings-hub-menu.d.ts +0 -1
  131. package/dist/lib/codex-manager/settings-hub-prompt.d.ts +0 -1
  132. package/dist/lib/codex-manager/settings-hub.d.ts +0 -1
  133. package/dist/lib/codex-manager/settings-panels.d.ts +0 -1
  134. package/dist/lib/codex-manager/settings-persist-utils.d.ts +0 -1
  135. package/dist/lib/codex-manager/settings-preview.d.ts +0 -1
  136. package/dist/lib/codex-manager/settings-write-queue.d.ts +0 -1
  137. package/dist/lib/codex-manager/statusline-settings-panel.d.ts +0 -1
  138. package/dist/lib/codex-manager/theme-settings-panel.d.ts +0 -1
  139. package/dist/lib/codex-manager/unified-settings-controller.d.ts +0 -1
  140. package/dist/lib/codex-manager/unified-settings-entry.d.ts +0 -1
  141. package/dist/lib/codex-manager.d.ts +1 -2
  142. package/dist/lib/codex-manager.js +5 -95
  143. package/dist/lib/concurrency.d.ts +0 -1
  144. package/dist/lib/config-schema.d.ts +0 -1
  145. package/dist/lib/config.d.ts +0 -1
  146. package/dist/lib/config.js +46 -241
  147. package/dist/lib/constants.d.ts +0 -1
  148. package/dist/lib/context-budget/model-context-windows.d.ts +0 -1
  149. package/dist/lib/context-budget-guard.d.ts +0 -1
  150. package/dist/lib/context-budget-response.d.ts +0 -1
  151. package/dist/lib/context-budget-response.js +8 -8
  152. package/dist/lib/context-overflow.d.ts +0 -1
  153. package/dist/lib/context-overflow.js +10 -10
  154. package/dist/lib/dashboard-settings.d.ts +0 -1
  155. package/dist/lib/entitlement-cache.d.ts +0 -1
  156. package/dist/lib/env-parsing.d.ts +13 -1
  157. package/dist/lib/env-parsing.js +21 -0
  158. package/dist/lib/errors.d.ts +0 -1
  159. package/dist/lib/forecast.d.ts +0 -1
  160. package/dist/lib/fs-retry.d.ts +0 -1
  161. package/dist/lib/health.d.ts +0 -1
  162. package/dist/lib/index.d.ts +0 -1
  163. package/dist/lib/integration-generators.d.ts +0 -1
  164. package/dist/lib/live-account-sync.d.ts +0 -1
  165. package/dist/lib/local-bridge.d.ts +0 -1
  166. package/dist/lib/local-bridge.js +4 -1
  167. package/dist/lib/local-client-tokens.d.ts +0 -1
  168. package/dist/lib/local-client-tokens.js +125 -30
  169. package/dist/lib/logger.d.ts +0 -1
  170. package/dist/lib/logger.js +11 -1
  171. package/dist/lib/model-capability-matrix.d.ts +0 -1
  172. package/dist/lib/model-route-policy.d.ts +1 -2
  173. package/dist/lib/named-backup-export.d.ts +0 -1
  174. package/dist/lib/oauth-success.html +125 -125
  175. package/dist/lib/oc-chatgpt-import-adapter.d.ts +0 -1
  176. package/dist/lib/oc-chatgpt-orchestrator.d.ts +0 -1
  177. package/dist/lib/oc-chatgpt-target-detection.d.ts +0 -1
  178. package/dist/lib/parallel-probe.d.ts +0 -1
  179. package/dist/lib/policy/runtime-policy-cache.d.ts +80 -0
  180. package/dist/lib/policy/runtime-policy-cache.js +310 -0
  181. package/dist/lib/policy/runtime-policy.d.ts +1 -2
  182. package/dist/lib/policy/runtime-policy.js +46 -19
  183. package/dist/lib/preemptive-quota-scheduler.d.ts +0 -1
  184. package/dist/lib/proactive-refresh.d.ts +0 -1
  185. package/dist/lib/prompts/codex-host-bridge.d.ts +0 -1
  186. package/dist/lib/prompts/codex-host-bridge.js +138 -138
  187. package/dist/lib/prompts/codex.d.ts +0 -1
  188. package/dist/lib/prompts/codex.js +79 -79
  189. package/dist/lib/prompts/fetch-utils.d.ts +0 -1
  190. package/dist/lib/prompts/host-codex-prompt.d.ts +0 -1
  191. package/dist/lib/quota-cache.d.ts +7 -4
  192. package/dist/lib/quota-cache.d.ts.map +1 -1
  193. package/dist/lib/quota-cache.js +117 -61
  194. package/dist/lib/quota-probe.d.ts +0 -1
  195. package/dist/lib/quota-probe.js +5 -2
  196. package/dist/lib/quota-readiness.d.ts +7 -3
  197. package/dist/lib/quota-readiness.d.ts.map +1 -1
  198. package/dist/lib/quota-readiness.js +25 -4
  199. package/dist/lib/recovery/constants.d.ts +0 -1
  200. package/dist/lib/recovery/storage.d.ts +0 -1
  201. package/dist/lib/recovery/types.d.ts +0 -1
  202. package/dist/lib/recovery.d.ts +0 -1
  203. package/dist/lib/redaction.d.ts +0 -1
  204. package/dist/lib/refresh-guardian.d.ts +0 -1
  205. package/dist/lib/refresh-lease.d.ts +0 -1
  206. package/dist/lib/refresh-queue.d.ts +0 -1
  207. package/dist/lib/request/client-cancellation.d.ts +0 -1
  208. package/dist/lib/request/error-classification.d.ts +0 -1
  209. package/dist/lib/request/failover-config.d.ts +0 -1
  210. package/dist/lib/request/failure-policy.d.ts +0 -1
  211. package/dist/lib/request/fetch-helpers.d.ts +0 -1
  212. package/dist/lib/request/headers.d.ts +0 -1
  213. package/dist/lib/request/helpers/input-utils.d.ts +0 -1
  214. package/dist/lib/request/helpers/input-utils.js +88 -34
  215. package/dist/lib/request/helpers/model-map.d.ts +0 -1
  216. package/dist/lib/request/helpers/tool-utils.d.ts +0 -1
  217. package/dist/lib/request/helpers/tool-utils.js +421 -4
  218. package/dist/lib/request/index.d.ts +0 -1
  219. package/dist/lib/request/rate-limit-backoff.d.ts +0 -1
  220. package/dist/lib/request/rate-limit-decision.d.ts +0 -1
  221. package/dist/lib/request/request-attempt-budget.d.ts +0 -1
  222. package/dist/lib/request/request-init.d.ts +0 -1
  223. package/dist/lib/request/request-resilience.d.ts +0 -1
  224. package/dist/lib/request/request-transformer.d.ts +0 -1
  225. package/dist/lib/request/request-transformer.js +50 -25
  226. package/dist/lib/request/response-compaction.d.ts +0 -1
  227. package/dist/lib/request/response-handler.d.ts +0 -1
  228. package/dist/lib/request/response-metadata.d.ts +0 -1
  229. package/dist/lib/request/response-outcome.d.ts +0 -1
  230. package/dist/lib/request/stream-failover-runtime.d.ts +0 -1
  231. package/dist/lib/request/stream-failover.d.ts +0 -1
  232. package/dist/lib/request/stream-failover.js +28 -4
  233. package/dist/lib/request/token-refresh.d.ts +0 -1
  234. package/dist/lib/request/url-rewriting.d.ts +0 -1
  235. package/dist/lib/request/wait-utils.d.ts +0 -1
  236. package/dist/lib/rotation.d.ts +0 -1
  237. package/dist/lib/routing-mutex.d.ts +0 -1
  238. package/dist/lib/routing-profiles.d.ts +16 -2
  239. package/dist/lib/routing-profiles.js +119 -44
  240. package/dist/lib/runtime/account-check-helpers.d.ts +0 -1
  241. package/dist/lib/runtime/account-check-types.d.ts +0 -1
  242. package/dist/lib/runtime/account-check.d.ts +0 -1
  243. package/dist/lib/runtime/account-manager-cache-entry.d.ts +0 -1
  244. package/dist/lib/runtime/account-manager-cache.d.ts +0 -1
  245. package/dist/lib/runtime/account-model-catalog.d.ts +1 -2
  246. package/dist/lib/runtime/account-pool.d.ts +0 -1
  247. package/dist/lib/runtime/account-reset-credits.d.ts +0 -1
  248. package/dist/lib/runtime/account-reset-credits.js +8 -2
  249. package/dist/lib/runtime/account-scope.d.ts +0 -1
  250. package/dist/lib/runtime/account-select-event.d.ts +0 -1
  251. package/dist/lib/runtime/account-selection.d.ts +0 -1
  252. package/dist/lib/runtime/account-state.d.ts +0 -1
  253. package/dist/lib/runtime/account-status.d.ts +0 -1
  254. package/dist/lib/runtime/account-storage-scope-entry.d.ts +0 -1
  255. package/dist/lib/runtime/api-model-capabilities.d.ts +0 -1
  256. package/dist/lib/runtime/api-model-runtime.d.ts +0 -1
  257. package/dist/lib/runtime/app-bind.d.ts +0 -1
  258. package/dist/lib/runtime/app-bind.d.ts.map +1 -1
  259. package/dist/lib/runtime/app-bind.js +10 -2
  260. package/dist/lib/runtime/app-helper-selection.d.ts +0 -1
  261. package/dist/lib/runtime/auth-facade.d.ts +0 -1
  262. package/dist/lib/runtime/automatic-account-checks.d.ts +5 -2
  263. package/dist/lib/runtime/automatic-account-checks.d.ts.map +1 -1
  264. package/dist/lib/runtime/automatic-account-checks.js +29 -2
  265. package/dist/lib/runtime/automatic-subscription-checks.d.ts +1 -2
  266. package/dist/lib/runtime/automatic-subscription-checks.d.ts.map +1 -1
  267. package/dist/lib/runtime/automatic-subscription-checks.js +13 -16
  268. package/dist/lib/runtime/browser-oauth-flow.d.ts +0 -1
  269. package/dist/lib/runtime/capability-boost.d.ts +0 -1
  270. package/dist/lib/runtime/catalog-capabilities.d.ts +0 -1
  271. package/dist/lib/runtime/config-toml.d.ts +0 -1
  272. package/dist/lib/runtime/context-budget-settings.d.ts +0 -1
  273. package/dist/lib/runtime/event-handler.d.ts +0 -1
  274. package/dist/lib/runtime/first-run.d.ts +0 -1
  275. package/dist/lib/runtime/flagged-verify-types.d.ts +0 -1
  276. package/dist/lib/runtime/hydrate-emails.d.ts +0 -1
  277. package/dist/lib/runtime/inference-activity.d.ts +0 -1
  278. package/dist/lib/runtime/live-sync-entry.d.ts +0 -1
  279. package/dist/lib/runtime/live-sync.d.ts +0 -1
  280. package/dist/lib/runtime/loader-setup.d.ts +0 -1
  281. package/dist/lib/runtime/login-menu-accounts.d.ts +0 -1
  282. package/dist/lib/runtime/manual-oauth-flow.d.ts +0 -1
  283. package/dist/lib/runtime/model-discovery-status.d.ts +2 -3
  284. package/dist/lib/runtime/native-account-storage.d.ts +0 -1
  285. package/dist/lib/runtime/native-account-sync.d.ts +0 -1
  286. package/dist/lib/runtime/native-binding-lock.d.ts +0 -1
  287. package/dist/lib/runtime/native-client-auth.d.ts +0 -1
  288. package/dist/lib/runtime/native-provider-config.d.ts +0 -1
  289. package/dist/lib/runtime/native-rate-limits.d.ts +2 -1
  290. package/dist/lib/runtime/native-rate-limits.js +23 -6
  291. package/dist/lib/runtime/preemptive-quota.d.ts +0 -1
  292. package/dist/lib/runtime/quota-headers.d.ts +0 -1
  293. package/dist/lib/runtime/quota-probe.d.ts +0 -1
  294. package/dist/lib/runtime/quota-settings.d.ts +0 -1
  295. package/dist/lib/runtime/refresh-guardian-entry.d.ts +0 -1
  296. package/dist/lib/runtime/refresh-guardian.d.ts +0 -1
  297. package/dist/lib/runtime/request-init.d.ts +0 -1
  298. package/dist/lib/runtime/reset-credit-routing.d.ts +0 -1
  299. package/dist/lib/runtime/reset-credits.d.ts +0 -1
  300. package/dist/lib/runtime/response-output-history.d.ts +0 -1
  301. package/dist/lib/runtime/responses-websocket.d.ts +0 -1
  302. package/dist/lib/runtime/resume-picker.d.ts +0 -1
  303. package/dist/lib/runtime/rotation-account-selection.d.ts +0 -1
  304. package/dist/lib/runtime/rotation-proxy-state.d.ts +0 -1
  305. package/dist/lib/runtime/rotation-server-types.d.ts +0 -1
  306. package/dist/lib/runtime/rotation-storage-meta.d.ts +0 -1
  307. package/dist/lib/runtime/rotation-token-refresh.d.ts +0 -1
  308. package/dist/lib/runtime/runtime-capability-failures.d.ts +0 -1
  309. package/dist/lib/runtime/runtime-current-account.d.ts +0 -1
  310. package/dist/lib/runtime/runtime-observability.d.ts +0 -1
  311. package/dist/lib/runtime/runtime-services.d.ts +0 -1
  312. package/dist/lib/runtime/session-affinity-entry.d.ts +0 -1
  313. package/dist/lib/runtime/session-recovery.d.ts +0 -1
  314. package/dist/lib/runtime/status-marker.d.ts +0 -1
  315. package/dist/lib/runtime/storage-scope.d.ts +0 -1
  316. package/dist/lib/runtime/subscription-first-use.d.ts +0 -1
  317. package/dist/lib/runtime/subscription-quota-event.d.ts +0 -1
  318. package/dist/lib/runtime/subscription-quota-order.d.ts +0 -1
  319. package/dist/lib/runtime/toast.d.ts +0 -1
  320. package/dist/lib/runtime/ui-runtime-entry.d.ts +0 -1
  321. package/dist/lib/runtime/ui-runtime.d.ts +0 -1
  322. package/dist/lib/runtime/verify-flagged.d.ts +0 -1
  323. package/dist/lib/runtime/workspace-model-scopes.d.ts +0 -1
  324. package/dist/lib/runtime-constants.d.ts +0 -1
  325. package/dist/lib/runtime-paths.d.ts +0 -1
  326. package/dist/lib/runtime-rotation-proxy.d.ts +1 -1
  327. package/dist/lib/runtime-rotation-proxy.js +136 -3
  328. package/dist/lib/schemas.d.ts +35 -13
  329. package/dist/lib/schemas.js +19 -2
  330. package/dist/lib/session-affinity.d.ts +0 -1
  331. package/dist/lib/shutdown.d.ts +0 -1
  332. package/dist/lib/storage/account-clear-entry.d.ts +0 -1
  333. package/dist/lib/storage/account-clear.d.ts +0 -1
  334. package/dist/lib/storage/account-match-utils.d.ts +0 -1
  335. package/dist/lib/storage/account-persistence.d.ts +0 -1
  336. package/dist/lib/storage/account-port.d.ts +0 -1
  337. package/dist/lib/storage/account-save-entry.d.ts +0 -1
  338. package/dist/lib/storage/account-save.d.ts +9 -2
  339. package/dist/lib/storage/account-save.js +4 -1
  340. package/dist/lib/storage/account-snapshot.d.ts +0 -1
  341. package/dist/lib/storage/backup-metadata-builder.d.ts +0 -1
  342. package/dist/lib/storage/backup-metadata.d.ts +0 -1
  343. package/dist/lib/storage/backup-paths.d.ts +0 -1
  344. package/dist/lib/storage/backup-restore.d.ts +0 -1
  345. package/dist/lib/storage/cache-artifacts.d.ts +0 -1
  346. package/dist/lib/storage/credential-sidecars.d.ts +0 -1
  347. package/dist/lib/storage/error-hints.d.ts +0 -1
  348. package/dist/lib/storage/file-lock.d.ts +0 -1
  349. package/dist/lib/storage/file-lock.js +33 -1
  350. package/dist/lib/storage/file-paths.d.ts +0 -1
  351. package/dist/lib/storage/fixture-guards.d.ts +0 -1
  352. package/dist/lib/storage/flagged-entry.d.ts +0 -1
  353. package/dist/lib/storage/flagged-load-entry.d.ts +0 -1
  354. package/dist/lib/storage/flagged-save-entry.d.ts +0 -1
  355. package/dist/lib/storage/flagged-storage-file.d.ts +0 -1
  356. package/dist/lib/storage/flagged-storage-io.d.ts +0 -1
  357. package/dist/lib/storage/flagged-storage.d.ts +0 -1
  358. package/dist/lib/storage/gitignore.d.ts +0 -1
  359. package/dist/lib/storage/hash.d.ts +0 -1
  360. package/dist/lib/storage/health.d.ts +0 -1
  361. package/dist/lib/storage/identity.d.ts +0 -1
  362. package/dist/lib/storage/import-export.d.ts +0 -1
  363. package/dist/lib/storage/json-store-lock.d.ts +105 -0
  364. package/dist/lib/storage/json-store-lock.js +259 -0
  365. package/dist/lib/storage/metadata-section.d.ts +0 -1
  366. package/dist/lib/storage/migrations.d.ts +0 -1
  367. package/dist/lib/storage/migrations.js +31 -18
  368. package/dist/lib/storage/named-backup-entry.d.ts +0 -1
  369. package/dist/lib/storage/named-backups-entry.d.ts +0 -1
  370. package/dist/lib/storage/named-backups.d.ts +0 -1
  371. package/dist/lib/storage/path-state.d.ts +0 -1
  372. package/dist/lib/storage/paths.d.ts +0 -1
  373. package/dist/lib/storage/pending-auth.d.ts +10 -3
  374. package/dist/lib/storage/pending-auth.d.ts.map +1 -1
  375. package/dist/lib/storage/pending-auth.js +33 -9
  376. package/dist/lib/storage/project-migration.d.ts +0 -1
  377. package/dist/lib/storage/public-types.d.ts +0 -1
  378. package/dist/lib/storage/record-identity.d.ts +15 -0
  379. package/dist/lib/storage/record-identity.d.ts.map +1 -0
  380. package/dist/lib/storage/record-identity.js +16 -0
  381. package/dist/lib/storage/record-utils.d.ts +0 -1
  382. package/dist/lib/storage/restore-assessment.d.ts +0 -1
  383. package/dist/lib/storage/restore-backup-entry.d.ts +0 -1
  384. package/dist/lib/storage/restore-metadata.d.ts +0 -1
  385. package/dist/lib/storage/save-retry.d.ts +0 -1
  386. package/dist/lib/storage/snapshot-inspectors.d.ts +0 -1
  387. package/dist/lib/storage/snapshot-merge.d.ts +0 -1
  388. package/dist/lib/storage/storage-parser.d.ts +2 -1
  389. package/dist/lib/storage/storage-parser.js +10 -2
  390. package/dist/lib/storage/transactions.d.ts +0 -1
  391. package/dist/lib/storage.d.ts +15 -2
  392. package/dist/lib/storage.js +612 -25
  393. package/dist/lib/synthetic-response.d.ts +0 -1
  394. package/dist/lib/table-formatter.d.ts +0 -1
  395. package/dist/lib/temp-path.d.ts +0 -1
  396. package/dist/lib/tools/hashline-tools.d.ts +0 -1
  397. package/dist/lib/types.d.ts +0 -1
  398. package/dist/lib/ui/ansi.d.ts +0 -1
  399. package/dist/lib/ui/auth-menu-builder.d.ts +0 -1
  400. package/dist/lib/ui/auth-menu.d.ts +0 -1
  401. package/dist/lib/ui/check-progress.d.ts +0 -1
  402. package/dist/lib/ui/confirm.d.ts +0 -1
  403. package/dist/lib/ui/display-width.d.ts +0 -1
  404. package/dist/lib/ui/format.d.ts +0 -1
  405. package/dist/lib/ui/index.d.ts +0 -1
  406. package/dist/lib/ui/runtime.d.ts +0 -1
  407. package/dist/lib/ui/select.d.ts +0 -1
  408. package/dist/lib/ui/theme.d.ts +0 -1
  409. package/dist/lib/ui/ui-copy.d.ts +0 -1
  410. package/dist/lib/unified-settings.d.ts +13 -11
  411. package/dist/lib/unified-settings.js +22 -14
  412. package/dist/lib/update-notice.d.ts +0 -1
  413. package/dist/lib/usage/index.d.ts +0 -1
  414. package/dist/lib/usage/ledger.d.ts +0 -1
  415. package/dist/lib/usage/pricing.d.ts +0 -1
  416. package/dist/lib/usage/redaction.d.ts +0 -1
  417. package/dist/lib/usage/stream-usage-deferral.d.ts +0 -1
  418. package/dist/lib/usage/types.d.ts +0 -1
  419. package/dist/lib/usage/usage-extraction.d.ts +0 -1
  420. package/dist/lib/utils.d.ts +21 -1
  421. package/dist/lib/utils.js +31 -0
  422. package/dist/lib/wsl.d.ts +0 -1
  423. package/node_modules/@codex-ai/plugin/dist/index.d.ts +2 -2
  424. package/node_modules/@codex-ai/plugin/dist/index.js +2 -2
  425. package/node_modules/@codex-ai/plugin/dist/tool.d.ts +42 -42
  426. package/node_modules/@codex-ai/plugin/dist/tool.js +29 -29
  427. package/node_modules/@codex-ai/plugin/package.json +9 -9
  428. package/node_modules/@codex-ai/sdk/dist/index.d.ts +4 -4
  429. package/node_modules/@codex-ai/sdk/dist/index.js +2 -2
  430. package/node_modules/@codex-ai/sdk/package.json +8 -8
  431. package/package.json +206 -200
  432. package/scripts/codex-app-launcher.js +653 -653
  433. package/scripts/codex-app-router.js +373 -373
  434. package/scripts/codex-bin-resolver.js +332 -313
  435. package/scripts/codex-multi-auth.js +65 -59
  436. package/scripts/codex-routing.js +62 -62
  437. package/scripts/codex.js +6923 -6642
  438. package/scripts/install-codex-auth-utils.js +213 -213
  439. package/scripts/mcodex.js +367 -367
  440. package/scripts/postinstall.js +114 -114
  441. package/scripts/preuninstall.js +265 -265
  442. package/skills/codex-auth-setup/SKILL.md +73 -0
  443. package/vendor/codex-ai-plugin/dist/index.d.ts +2 -2
  444. package/vendor/codex-ai-plugin/dist/index.js +2 -2
  445. package/vendor/codex-ai-plugin/dist/tool.d.ts +42 -42
  446. package/vendor/codex-ai-plugin/dist/tool.js +29 -29
  447. package/vendor/codex-ai-plugin/package.json +9 -9
  448. package/vendor/codex-ai-sdk/dist/index.d.ts +4 -4
  449. package/vendor/codex-ai-sdk/dist/index.js +2 -2
  450. package/vendor/codex-ai-sdk/package.json +8 -8
@@ -18,4 +18,16 @@
18
18
  * @returns `true`/`false` for recognised literals, otherwise `undefined`.
19
19
  */
20
20
  export declare function parseBooleanEnv(value: string | undefined): boolean | undefined;
21
- //# sourceMappingURL=env-parsing.d.ts.map
21
+ /**
22
+ * Parses an integer environment-variable string.
23
+ *
24
+ * Returns `undefined` for `undefined` input, an empty/whitespace-only string,
25
+ * or any value that does not start with a parseable integer — letting callers
26
+ * fall back through nullish coalescing to their default. Matches the semantics
27
+ * of the local `parseEnvInt` copies in lib/refresh-lease.ts and
28
+ * lib/request/failover-config.ts.
29
+ *
30
+ * @param value - Raw env-variable value (or `undefined` when unset).
31
+ * @returns The parsed integer, otherwise `undefined`.
32
+ */
33
+ export declare function parseIntegerEnv(value: string | undefined): number | undefined;
@@ -31,3 +31,24 @@ export function parseBooleanEnv(value) {
31
31
  return false;
32
32
  return undefined;
33
33
  }
34
+ /**
35
+ * Parses an integer environment-variable string.
36
+ *
37
+ * Returns `undefined` for `undefined` input, an empty/whitespace-only string,
38
+ * or any value that does not start with a parseable integer — letting callers
39
+ * fall back through nullish coalescing to their default. Matches the semantics
40
+ * of the local `parseEnvInt` copies in lib/refresh-lease.ts and
41
+ * lib/request/failover-config.ts.
42
+ *
43
+ * @param value - Raw env-variable value (or `undefined` when unset).
44
+ * @returns The parsed integer, otherwise `undefined`.
45
+ */
46
+ export function parseIntegerEnv(value) {
47
+ if (value === undefined)
48
+ return undefined;
49
+ const trimmed = value.trim();
50
+ if (trimmed.length === 0)
51
+ return undefined;
52
+ const parsed = Number.parseInt(trimmed, 10);
53
+ return Number.isFinite(parsed) ? parsed : undefined;
54
+ }
@@ -134,4 +134,3 @@ export declare class CodexUnavailableError extends CodexError {
134
134
  * boundaries by also matching on the structural `code` marker.
135
135
  */
136
136
  export declare function isCodexUnavailableError(error: unknown): error is CodexUnavailableError;
137
- //# sourceMappingURL=errors.d.ts.map
@@ -80,4 +80,3 @@ export declare function recommendForecastAccount(results: ForecastAccountResult[
80
80
  export declare function summarizeForecast(results: ForecastAccountResult[]): ForecastSummary;
81
81
  export declare function buildForecastExplanation(results: ForecastAccountResult[], recommendation: ForecastRecommendation): ForecastExplanation;
82
82
  export {};
83
- //# sourceMappingURL=forecast.d.ts.map
@@ -47,4 +47,3 @@ export declare function withRetry<T>(operation: () => Promise<T> | T, options: R
47
47
  */
48
48
  export declare function withRetrySync<T>(operation: () => T, options: RetryOptions): T;
49
49
  export declare function withFileOperationRetry<T>(operation: () => Promise<T>): Promise<T>;
50
- //# sourceMappingURL=fs-retry.d.ts.map
@@ -31,4 +31,3 @@ export declare function getAccountHealth(accounts: Array<{
31
31
  lastUsedAt?: number;
32
32
  }>, now?: number): PluginHealth;
33
33
  export declare function formatHealthReport(health: PluginHealth): string;
34
- //# sourceMappingURL=health.d.ts.map
@@ -41,4 +41,3 @@ export * from "./local-bridge.js";
41
41
  export * from "./local-client-tokens.js";
42
42
  export * from "./integration-generators.js";
43
43
  export * from "./temp-path.js";
44
- //# sourceMappingURL=index.d.ts.map
@@ -11,4 +11,3 @@ export interface IntegrationSnippet {
11
11
  }
12
12
  export declare function generateIntegrationSnippet(kind: IntegrationSnippetKind, input?: IntegrationSnippetInput): IntegrationSnippet;
13
13
  export declare function generateIntegrationSnippets(kinds?: IntegrationSnippetKind[], input?: IntegrationSnippetInput): IntegrationSnippet[];
14
- //# sourceMappingURL=integration-generators.d.ts.map
@@ -36,4 +36,3 @@ export declare class LiveAccountSync {
36
36
  private pollOnce;
37
37
  private runReload;
38
38
  }
39
- //# sourceMappingURL=live-account-sync.d.ts.map
@@ -22,4 +22,3 @@ export interface LocalBridgeOptions {
22
22
  runtimeClientApiKey?: string;
23
23
  }
24
24
  export declare function startLocalBridge(options: LocalBridgeOptions): Promise<LocalBridgeServer>;
25
- //# sourceMappingURL=local-bridge.d.ts.map
@@ -195,10 +195,13 @@ export async function startLocalBridge(options) {
195
195
  throw new Error("Local bridge requires requireAuth=true when runtimeClientApiKey is configured.");
196
196
  }
197
197
  const app = new Hono();
198
+ // Deliberately minimal payload: /health is reachable without a bearer (it is
199
+ // the liveness probe), so it must not echo runtimeBaseUrl back — that value
200
+ // describes where the bridge forwards local client tokens and is internal
201
+ // routing detail, not something to hand unauthenticated callers.
198
202
  app.get("/health", (context) => context.json({
199
203
  ok: true,
200
204
  service: "codex-multi-auth-local-bridge",
201
- runtimeBaseUrl,
202
205
  }));
203
206
  const forward = async (request, targetPath) => {
204
207
  const startedAt = Date.now();
@@ -34,4 +34,3 @@ export declare function rotateLocalClientToken(input: {
34
34
  export declare function revokeLocalClientToken(id: string, now?: number): Promise<boolean>;
35
35
  export declare function verifyLocalClientBearerToken(authorizationHeader: string | null, now?: number): Promise<LocalClientTokenRecord | null>;
36
36
  export declare function resetLocalClientTokenWriteQueueForTests(): void;
37
- //# sourceMappingURL=local-client-tokens.d.ts.map
@@ -1,10 +1,11 @@
1
- import { createHash, randomBytes, randomUUID } from "node:crypto";
1
+ import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
2
2
  import { existsSync, promises as fs } from "node:fs";
3
3
  import { basename, join } from "node:path";
4
4
  import { logWarn } from "./logger.js";
5
5
  import { getCodexMultiAuthDir } from "./runtime-paths.js";
6
6
  import { isRecord, sleep } from "./utils.js";
7
7
  import { tempPathFor } from "./temp-path.js";
8
+ import { assertJsonStoreFileMtimeUnchanged, getJsonStoreFileMtimeMs, withJsonStoreCasRetry, withJsonStoreFileLock, } from "./storage/json-store-lock.js";
8
9
  const TOKEN_FILE_NAME = "local-client-tokens.json";
9
10
  const TOKEN_PREFIX = "cma_local";
10
11
  // Debounce window for persisting a record's lastUsedAt. Bearer verification is
@@ -43,6 +44,27 @@ function normalizeLabel(value) {
43
44
  function hashToken(token) {
44
45
  return `sha256:${createHash("sha256").update(token).digest("hex")}`;
45
46
  }
47
+ /**
48
+ * Constant-time equality for two `sha256:<hex>` token hashes.
49
+ *
50
+ * A `===` on the hex strings returns early at the first differing byte, so a
51
+ * local process that can spam verify calls could measure the comparison cost
52
+ * and recover a stored hash prefix byte-by-byte. Comparing the decoded digest
53
+ * bytes with timingSafeEqual removes the oracle; both inputs are validated to
54
+ * the fixed 32-byte shape first, so timingSafeEqual never throws.
55
+ */
56
+ function sha256DigestBytes(hash) {
57
+ if (!/^sha256:[0-9a-f]{64}$/i.test(hash))
58
+ return null;
59
+ return Buffer.from(hash.slice("sha256:".length), "hex");
60
+ }
61
+ function tokenHashEqual(left, right) {
62
+ const leftDigest = sha256DigestBytes(left);
63
+ const rightDigest = sha256DigestBytes(right);
64
+ return (leftDigest !== null &&
65
+ rightDigest !== null &&
66
+ timingSafeEqual(leftDigest, rightDigest));
67
+ }
46
68
  function createPlainToken() {
47
69
  return `${TOKEN_PREFIX}_${randomBytes(32).toString("base64url")}`;
48
70
  }
@@ -120,7 +142,46 @@ export async function loadLocalClientTokenStore() {
120
142
  return emptyStore();
121
143
  }
122
144
  }
123
- async function writeStoreToDisk(store) {
145
+ /**
146
+ * Merge a caller-supplied store over the freshest on-disk store by token id.
147
+ * Records the caller does not carry are preserved (this store is append-only:
148
+ * rotation and revocation mark records in place, nothing deletes them), and
149
+ * the monotone fields a concurrent process may have advanced — `lastUsedAt`
150
+ * from verifies, `revokedAt` from revocations/rotations — are kept at their
151
+ * furthest value so a stale snapshot cannot un-revoke or rewind usage.
152
+ */
153
+ function mergeTokenStoreRecords(current, incoming) {
154
+ const indexById = new Map();
155
+ const tokens = current.tokens.map((record, index) => {
156
+ indexById.set(record.id, index);
157
+ return record;
158
+ });
159
+ for (const record of incoming.tokens) {
160
+ const index = indexById.get(record.id);
161
+ if (index === undefined) {
162
+ indexById.set(record.id, tokens.length);
163
+ tokens.push(record);
164
+ continue;
165
+ }
166
+ const existing = tokens[index];
167
+ if (existing === undefined) {
168
+ // Unreachable: indexes recorded in indexById always point at a
169
+ // slot that exists in `tokens`.
170
+ continue;
171
+ }
172
+ tokens[index] = {
173
+ ...record,
174
+ lastUsedAt: record.lastUsedAt === null
175
+ ? existing.lastUsedAt
176
+ : existing.lastUsedAt === null
177
+ ? record.lastUsedAt
178
+ : Math.max(record.lastUsedAt, existing.lastUsedAt),
179
+ revokedAt: record.revokedAt ?? existing.revokedAt,
180
+ };
181
+ }
182
+ return { version: 1, tokens };
183
+ }
184
+ async function writeStoreToDisk(store, expectedMtimeMs) {
124
185
  const path = getLocalClientTokenPath();
125
186
  const payload = normalizeStore(store);
126
187
  const dir = getCodexMultiAuthDir();
@@ -153,6 +214,12 @@ async function writeStoreToDisk(store) {
153
214
  finally {
154
215
  await handle.close();
155
216
  }
217
+ // Compare-and-swap guard: a writer that did not take the lockfile (or an
218
+ // expired-lock takeover racing this write) moved the target's mtime; abort
219
+ // with ESTALE so the caller reloads and re-merges instead of clobbering.
220
+ if (expectedMtimeMs !== undefined) {
221
+ await assertJsonStoreFileMtimeUnchanged(path, expectedMtimeMs);
222
+ }
156
223
  for (let attempt = 0; attempt < 5; attempt += 1) {
157
224
  try {
158
225
  await fs.rename(tempPath, path);
@@ -177,8 +244,36 @@ async function writeStoreToDisk(store) {
177
244
  }
178
245
  }
179
246
  }
247
+ /**
248
+ * Run a token-store read→mutate→write inside the write queue (in-process
249
+ * serialization) AND the cross-process lock directory, with mtime CAS retry:
250
+ * every attempt re-stats the file, re-reads the freshest on-disk store, and
251
+ * re-applies `mutate` before writing — so an op whose snapshot raced a
252
+ * concurrent process's write reloads-and-retries rather than clobbering it.
253
+ * `mutate` must be re-appliable across retries (apply precomputed work onto
254
+ * the store it is handed, don't capture mutated state).
255
+ */
256
+ async function updateLocalClientTokenStore(mutate) {
257
+ const path = getLocalClientTokenPath();
258
+ return enqueue(() => withJsonStoreFileLock(path, () => withJsonStoreCasRetry(async () => {
259
+ const expectedMtimeMs = await getJsonStoreFileMtimeMs(path);
260
+ const store = await loadLocalClientTokenStore();
261
+ const { result, dirty } = mutate(store);
262
+ if (dirty) {
263
+ await writeStoreToDisk(store, expectedMtimeMs);
264
+ }
265
+ return result;
266
+ })));
267
+ }
180
268
  export async function saveLocalClientTokenStore(store) {
181
- await enqueue(() => writeStoreToDisk(store));
269
+ const path = getLocalClientTokenPath();
270
+ const incoming = normalizeStore(store);
271
+ await enqueue(() => withJsonStoreFileLock(path, () => withJsonStoreCasRetry(async () => {
272
+ const expectedMtimeMs = await getJsonStoreFileMtimeMs(path);
273
+ const current = await loadLocalClientTokenStore();
274
+ const merged = mergeTokenStoreRecords(current, incoming);
275
+ await writeStoreToDisk(merged, expectedMtimeMs);
276
+ })));
182
277
  }
183
278
  export function createLocalClientTokenRecord(input = {}) {
184
279
  const plainToken = createPlainToken();
@@ -194,40 +289,40 @@ export function createLocalClientTokenRecord(input = {}) {
194
289
  return { plainToken, record };
195
290
  }
196
291
  export async function addLocalClientToken(input = {}) {
197
- return enqueue(async () => {
198
- const store = await loadLocalClientTokenStore();
199
- const created = createLocalClientTokenRecord(input);
292
+ // The token record is created once, outside the CAS retry: re-applying the
293
+ // same record onto a freshly-reloaded store is what makes each retry safe.
294
+ const created = createLocalClientTokenRecord(input);
295
+ return updateLocalClientTokenStore((store) => {
200
296
  store.tokens.push(created.record);
201
- await writeStoreToDisk(store);
202
- return created;
297
+ return { result: created, dirty: true };
203
298
  });
204
299
  }
205
300
  export async function rotateLocalClientToken(input) {
206
- return enqueue(async () => {
207
- const store = await loadLocalClientTokenStore();
301
+ const now = input.now ?? Date.now();
302
+ let created = null;
303
+ return updateLocalClientTokenStore((store) => {
208
304
  const existing = store.tokens.find((record) => record.id === input.id);
209
- if (!existing || existing.revokedAt !== null)
210
- return null;
211
- const now = input.now ?? Date.now();
305
+ if (!existing || existing.revokedAt !== null) {
306
+ return { result: null, dirty: false };
307
+ }
212
308
  existing.revokedAt = now;
213
- const created = createLocalClientTokenRecord({
309
+ // Same record across CAS retries so a retry cannot mint a second token.
310
+ created ??= createLocalClientTokenRecord({
214
311
  label: input.label ?? existing.label,
215
312
  now,
216
313
  });
217
314
  store.tokens.push(created.record);
218
- await writeStoreToDisk(store);
219
- return created;
315
+ return { result: created, dirty: true };
220
316
  });
221
317
  }
222
318
  export async function revokeLocalClientToken(id, now = Date.now()) {
223
- return enqueue(async () => {
224
- const store = await loadLocalClientTokenStore();
319
+ return updateLocalClientTokenStore((store) => {
225
320
  const existing = store.tokens.find((record) => record.id === id);
226
- if (!existing || existing.revokedAt !== null)
227
- return false;
321
+ if (!existing || existing.revokedAt !== null) {
322
+ return { result: false, dirty: false };
323
+ }
228
324
  existing.revokedAt = now;
229
- await writeStoreToDisk(store);
230
- return true;
325
+ return { result: true, dirty: true };
231
326
  });
232
327
  }
233
328
  export async function verifyLocalClientBearerToken(authorizationHeader, now = Date.now()) {
@@ -236,11 +331,10 @@ export async function verifyLocalClientBearerToken(authorizationHeader, now = Da
236
331
  if (!token)
237
332
  return null;
238
333
  const tokenHash = hashToken(token);
239
- return enqueue(async () => {
240
- const store = await loadLocalClientTokenStore();
241
- const record = store.tokens.find((entry) => entry.revokedAt === null && entry.tokenHash === tokenHash);
334
+ return updateLocalClientTokenStore((store) => {
335
+ const record = store.tokens.find((entry) => entry.revokedAt === null && tokenHashEqual(entry.tokenHash, tokenHash));
242
336
  if (!record)
243
- return null;
337
+ return { result: null, dirty: false };
244
338
  // Token match (verification correctness) is decided above and never
245
339
  // depends on lastUsedAt. Always advance lastUsedAt in-memory so callers
246
340
  // see a fresh value, but only flush to disk when it has not been
@@ -249,10 +343,11 @@ export async function verifyLocalClientBearerToken(authorizationHeader, now = Da
249
343
  // recent usage on a coarse (>=60s) cadence.
250
344
  const persisted = record.lastUsedAt;
251
345
  record.lastUsedAt = now;
252
- if (persisted === null || now - persisted >= LAST_USED_PERSIST_THRESHOLD_MS) {
253
- await writeStoreToDisk(store);
254
- }
255
- return record;
346
+ return {
347
+ result: record,
348
+ dirty: persisted === null ||
349
+ now - persisted >= LAST_USED_PERSIST_THRESHOLD_MS,
350
+ };
256
351
  });
257
352
  }
258
353
  export function resetLocalClientTokenWriteQueueForTests() {
@@ -45,4 +45,3 @@ export interface ScopedLogger {
45
45
  export declare function createLogger(scope: string): ScopedLogger;
46
46
  export declare function getRequestId(): number;
47
47
  export { formatDuration, maskEmail, maskString, maskToken, sanitizeValue };
48
- //# sourceMappingURL=logger.d.ts.map
@@ -21,7 +21,17 @@ const TOKEN_PATTERNS = [
21
21
  // line of defense and must recognize the project's own token shape too.
22
22
  /cma_local_[A-Za-z0-9_-]{16,}/g,
23
23
  ];
24
- const EMAIL_PATTERN = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g;
24
+ // Label-shaped domain instead of `[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}`: letting `.`
25
+ // live inside the quantified class makes every dot a candidate split point,
26
+ // which backtracked quadratically (~3.5s) on dotted near-miss input. Labels
27
+ // are dot-free, so each dot has exactly one structural role.
28
+ // The `(?<!...)` lookbehind confines match starts to a run boundary: the
29
+ // unanchored pattern could otherwise begin inside an overlong local part or
30
+ // domain label and leave its leading/trailing edge visible in logs. Interior
31
+ // positions fail the lookbehind in O(1), which is also what keeps the
32
+ // unbounded quantifiers linear — each character run is scanned once from its
33
+ // edge instead of being rescanned from every offset.
34
+ const EMAIL_PATTERN = /(?<![a-zA-Z0-9._%+-])[a-zA-Z0-9._%+-]+@[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)*\.[a-zA-Z]{2,}/g;
25
35
  const SENSITIVE_KEYS = new Set([
26
36
  "access",
27
37
  "accesstoken",
@@ -35,4 +35,3 @@ export declare function buildModelCapabilityMatrix(input: {
35
35
  quotaCache?: QuotaCacheData | null;
36
36
  now?: number;
37
37
  }): ModelCapabilityMatrix;
38
- //# sourceMappingURL=model-capability-matrix.d.ts.map
@@ -44,9 +44,8 @@ export declare function modelEntitlements(model: RouteModel): {
44
44
  reasoningLevels: string[];
45
45
  accessPrograms: string[];
46
46
  probes?: {
47
- [k: string]: "unsupported" | "verified" | "unverified" | "downgraded";
47
+ [k: string]: "verified" | "unsupported" | "unverified" | "downgraded";
48
48
  } | undefined;
49
49
  checkedAt?: number | undefined;
50
50
  model: string;
51
51
  };
52
- //# sourceMappingURL=model-route-policy.d.ts.map
@@ -66,4 +66,3 @@ export declare function resolveNamedBackupPath(name: string, storagePath: string
66
66
  export declare function exportNamedBackupFile(name: string, dependencies: NamedBackupExportDependencies, options?: {
67
67
  force?: boolean;
68
68
  }): Promise<string>;
69
- //# sourceMappingURL=named-backup-export.d.ts.map
@@ -1,126 +1,126 @@
1
- <!doctype html>
2
- <html lang="en">
3
- <head>
4
- <meta charset="utf-8" />
5
- <meta name="viewport" content="width=device-width, initial-scale=1" />
6
- <title>Codex Sign-In Complete</title>
7
- <style>
8
- :root {
9
- color-scheme: dark;
10
- --bg: #0b0b0b;
11
- --panel: #111111;
12
- --text: #f2f2f2;
13
- --muted: #a3a3a3;
14
- --line: #232323;
15
- --ok: #7cf0a6;
16
- }
17
-
18
- * {
19
- box-sizing: border-box;
20
- }
21
-
22
- body {
23
- margin: 0;
24
- min-height: 100vh;
25
- display: grid;
26
- place-items: center;
27
- background: var(--bg);
28
- color: var(--text);
29
- font-family: "Geist Mono", "GeistMono", ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace;
30
- padding: 24px;
31
- }
32
-
33
- main {
34
- width: min(520px, 100%);
35
- background: var(--panel);
36
- border: 1px solid var(--line);
37
- border-radius: 12px;
38
- padding: 20px;
39
- display: grid;
40
- gap: 14px;
41
- }
42
-
43
- h1 {
44
- margin: 0;
45
- font-size: 20px;
46
- font-weight: 600;
47
- letter-spacing: -0.02em;
48
- }
49
-
50
- p {
51
- margin: 0;
52
- color: var(--muted);
53
- font-size: 14px;
54
- line-height: 1.5;
55
- }
56
-
57
- .status {
58
- display: inline-flex;
59
- align-items: center;
60
- gap: 8px;
61
- color: var(--ok);
62
- font-size: 13px;
63
- }
64
-
65
- .dot {
66
- width: 8px;
67
- height: 8px;
68
- border-radius: 50%;
69
- background: currentColor;
70
- }
71
-
72
- dl {
73
- margin: 0;
74
- display: grid;
75
- grid-template-columns: 120px 1fr;
76
- gap: 8px 12px;
77
- font-size: 13px;
78
- }
79
-
80
- dt {
81
- color: var(--muted);
82
- }
83
-
84
- dd {
85
- margin: 0;
86
- color: var(--text);
87
- word-break: break-word;
88
- }
89
-
90
- code {
91
- background: #171717;
92
- border: 1px solid var(--line);
93
- border-radius: 6px;
94
- padding: 2px 6px;
95
- font-family: inherit;
96
- font-size: 12px;
97
- }
98
-
99
- @media (max-width: 520px) {
100
- dl {
101
- grid-template-columns: 1fr;
102
- }
103
- }
104
- </style>
105
- </head>
106
- <body>
107
- <main role="main" aria-label="OAuth callback received">
108
- <h1>Sign-in complete</h1>
109
- <p>Return to your terminal to finish Codex login.</p>
110
-
111
- <div class="status" aria-live="polite">
112
- <span class="dot" aria-hidden="true"></span>
113
- Callback received
114
- </div>
115
-
116
- <dl>
117
- <dt>Endpoint</dt>
118
- <dd><code>localhost:1455</code></dd>
119
- <dt>Flow</dt>
120
- <dd>OAuth callback captured</dd>
121
- <dt>Next</dt>
122
- <dd>Close this tab and continue in terminal</dd>
123
- </dl>
124
- </main>
125
- </body>
1
+ <!doctype html>
2
+ <html lang="en">
3
+ <head>
4
+ <meta charset="utf-8" />
5
+ <meta name="viewport" content="width=device-width, initial-scale=1" />
6
+ <title>Codex Sign-In Complete</title>
7
+ <style>
8
+ :root {
9
+ color-scheme: dark;
10
+ --bg: #0b0b0b;
11
+ --panel: #111111;
12
+ --text: #f2f2f2;
13
+ --muted: #a3a3a3;
14
+ --line: #232323;
15
+ --ok: #7cf0a6;
16
+ }
17
+
18
+ * {
19
+ box-sizing: border-box;
20
+ }
21
+
22
+ body {
23
+ margin: 0;
24
+ min-height: 100vh;
25
+ display: grid;
26
+ place-items: center;
27
+ background: var(--bg);
28
+ color: var(--text);
29
+ font-family: "Geist Mono", "GeistMono", ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace;
30
+ padding: 24px;
31
+ }
32
+
33
+ main {
34
+ width: min(520px, 100%);
35
+ background: var(--panel);
36
+ border: 1px solid var(--line);
37
+ border-radius: 12px;
38
+ padding: 20px;
39
+ display: grid;
40
+ gap: 14px;
41
+ }
42
+
43
+ h1 {
44
+ margin: 0;
45
+ font-size: 20px;
46
+ font-weight: 600;
47
+ letter-spacing: -0.02em;
48
+ }
49
+
50
+ p {
51
+ margin: 0;
52
+ color: var(--muted);
53
+ font-size: 14px;
54
+ line-height: 1.5;
55
+ }
56
+
57
+ .status {
58
+ display: inline-flex;
59
+ align-items: center;
60
+ gap: 8px;
61
+ color: var(--ok);
62
+ font-size: 13px;
63
+ }
64
+
65
+ .dot {
66
+ width: 8px;
67
+ height: 8px;
68
+ border-radius: 50%;
69
+ background: currentColor;
70
+ }
71
+
72
+ dl {
73
+ margin: 0;
74
+ display: grid;
75
+ grid-template-columns: 120px 1fr;
76
+ gap: 8px 12px;
77
+ font-size: 13px;
78
+ }
79
+
80
+ dt {
81
+ color: var(--muted);
82
+ }
83
+
84
+ dd {
85
+ margin: 0;
86
+ color: var(--text);
87
+ word-break: break-word;
88
+ }
89
+
90
+ code {
91
+ background: #171717;
92
+ border: 1px solid var(--line);
93
+ border-radius: 6px;
94
+ padding: 2px 6px;
95
+ font-family: inherit;
96
+ font-size: 12px;
97
+ }
98
+
99
+ @media (max-width: 520px) {
100
+ dl {
101
+ grid-template-columns: 1fr;
102
+ }
103
+ }
104
+ </style>
105
+ </head>
106
+ <body>
107
+ <main role="main" aria-label="OAuth callback received">
108
+ <h1>Sign-in complete</h1>
109
+ <p>Return to your terminal to finish Codex login.</p>
110
+
111
+ <div class="status" aria-live="polite">
112
+ <span class="dot" aria-hidden="true"></span>
113
+ Callback received
114
+ </div>
115
+
116
+ <dl>
117
+ <dt>Endpoint</dt>
118
+ <dd><code>localhost:1455</code></dd>
119
+ <dt>Flow</dt>
120
+ <dd>OAuth callback captured</dd>
121
+ <dt>Next</dt>
122
+ <dd>Close this tab and continue in terminal</dd>
123
+ </dl>
124
+ </main>
125
+ </body>
126
126
  </html>
@@ -61,4 +61,3 @@ export declare function previewOcChatgptImportMerge(options: {
61
61
  destination: AccountStorageV3 | null;
62
62
  }): OcChatgptMergePreview;
63
63
  export {};
64
- //# sourceMappingURL=oc-chatgpt-import-adapter.d.ts.map
@@ -83,4 +83,3 @@ export type RunNamedBackupExportResult = {
83
83
  };
84
84
  export declare function runNamedBackupExport(options: RunNamedBackupExportOptions): Promise<RunNamedBackupExportResult>;
85
85
  export {};
86
- //# sourceMappingURL=oc-chatgpt-orchestrator.d.ts.map