codex-multi-auth 2.17.0 → 2.17.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.codex-plugin/plugin.json +9 -9
- package/LICENSE +21 -21
- package/README.md +142 -484
- package/assets/codex-multi-auth-icon.svg +39 -39
- package/assets/readme-hero.svg +31 -31
- package/config/README.md +31 -31
- package/config/codex-legacy.json +1221 -1221
- package/config/codex-modern.json +423 -423
- package/config/minimal-codex.json +15 -15
- package/dist/index.d.ts +0 -1
- package/dist/lib/account-policy.d.ts +18 -2
- package/dist/lib/account-policy.js +97 -40
- package/dist/lib/accounts/rate-limits.d.ts +0 -1
- package/dist/lib/accounts.d.ts +1 -8
- package/dist/lib/accounts.d.ts.map +1 -1
- package/dist/lib/accounts.js +7 -19
- package/dist/lib/api-route-store.d.ts +0 -1
- package/dist/lib/audit.d.ts +0 -1
- package/dist/lib/audit.js +43 -12
- package/dist/lib/auth/account-access.d.ts +0 -1
- package/dist/lib/auth/account-access.js +5 -1
- package/dist/lib/auth/auth.d.ts +4 -3
- package/dist/lib/auth/auth.js +220 -28
- package/dist/lib/auth/browser.d.ts +0 -1
- package/dist/lib/auth/callback-guidance.d.ts +0 -1
- package/dist/lib/auth/device-auth.d.ts +0 -1
- package/dist/lib/auth/index.d.ts +0 -1
- package/dist/lib/auth/org-override.d.ts +0 -1
- package/dist/lib/auth/server.d.ts +1 -2
- package/dist/lib/auth/server.js +100 -53
- package/dist/lib/auth/token-utils.d.ts +0 -1
- package/dist/lib/auth-rate-limit.d.ts +0 -1
- package/dist/lib/budget-guard.d.ts +16 -2
- package/dist/lib/budget-guard.js +123 -43
- package/dist/lib/capability-policy.d.ts +0 -1
- package/dist/lib/circuit-breaker.d.ts +20 -1
- package/dist/lib/circuit-breaker.js +24 -5
- package/dist/lib/cli.d.ts +0 -1
- package/dist/lib/codex-cli/index.d.ts +0 -1
- package/dist/lib/codex-cli/observability.d.ts +0 -1
- package/dist/lib/codex-cli/state.d.ts +0 -1
- package/dist/lib/codex-cli/sync.d.ts +0 -1
- package/dist/lib/codex-cli/writer.d.ts +0 -1
- package/dist/lib/codex-manager/account-credentials.d.ts +0 -1
- package/dist/lib/codex-manager/account-manager-commands.d.ts +0 -1
- package/dist/lib/codex-manager/account-pool-write.d.ts +0 -1
- package/dist/lib/codex-manager/active-account-sync.d.ts +6 -0
- package/dist/lib/codex-manager/active-account-sync.js +336 -0
- package/dist/lib/codex-manager/api-login-menu.d.ts +0 -1
- package/dist/lib/codex-manager/backend-category-entry.d.ts +0 -1
- package/dist/lib/codex-manager/backend-category-helpers.d.ts +0 -1
- package/dist/lib/codex-manager/backend-category-prompt.d.ts +0 -1
- package/dist/lib/codex-manager/backend-settings-controller.d.ts +0 -1
- package/dist/lib/codex-manager/backend-settings-entry.d.ts +0 -1
- package/dist/lib/codex-manager/backend-settings-helpers.d.ts +0 -1
- package/dist/lib/codex-manager/backend-settings-prompt.d.ts +0 -1
- package/dist/lib/codex-manager/backend-settings-schema.d.ts +0 -1
- package/dist/lib/codex-manager/behavior-settings-panel.d.ts +0 -1
- package/dist/lib/codex-manager/commands/account.d.ts +8 -3
- package/dist/lib/codex-manager/commands/account.js +46 -34
- package/dist/lib/codex-manager/commands/best.d.ts +0 -1
- package/dist/lib/codex-manager/commands/bridge.d.ts +0 -1
- package/dist/lib/codex-manager/commands/budget.d.ts +8 -3
- package/dist/lib/codex-manager/commands/budget.js +6 -4
- package/dist/lib/codex-manager/commands/check.d.ts +0 -1
- package/dist/lib/codex-manager/commands/config-explain.d.ts +0 -1
- package/dist/lib/codex-manager/commands/debug-bundle.d.ts +0 -1
- package/dist/lib/codex-manager/commands/forecast.d.ts +1 -2
- package/dist/lib/codex-manager/commands/forecast.d.ts.map +1 -1
- package/dist/lib/codex-manager/commands/forecast.js +2 -2
- package/dist/lib/codex-manager/commands/history.d.ts +0 -1
- package/dist/lib/codex-manager/commands/init-config.d.ts +0 -1
- package/dist/lib/codex-manager/commands/integrations.d.ts +0 -1
- package/dist/lib/codex-manager/commands/limits.d.ts +0 -1
- package/dist/lib/codex-manager/commands/models.d.ts +0 -1
- package/dist/lib/codex-manager/commands/monitor.d.ts +0 -1
- package/dist/lib/codex-manager/commands/report.d.ts +0 -1
- package/dist/lib/codex-manager/commands/resets.d.ts +0 -1
- package/dist/lib/codex-manager/commands/resets.js +9 -1
- package/dist/lib/codex-manager/commands/rotation.d.ts +0 -1
- package/dist/lib/codex-manager/commands/status.d.ts +0 -1
- package/dist/lib/codex-manager/commands/switch.d.ts +0 -1
- package/dist/lib/codex-manager/commands/uninstall.d.ts +0 -1
- package/dist/lib/codex-manager/commands/unpin.d.ts +0 -1
- package/dist/lib/codex-manager/commands/usage.d.ts +0 -1
- package/dist/lib/codex-manager/commands/verify.d.ts +0 -1
- package/dist/lib/codex-manager/commands/why-selected.d.ts +0 -1
- package/dist/lib/codex-manager/commands/workspace.d.ts +0 -1
- package/dist/lib/codex-manager/dashboard-display-panel.d.ts +0 -1
- package/dist/lib/codex-manager/dashboard-formatters.d.ts +0 -1
- package/dist/lib/codex-manager/dashboard-settings-controller.d.ts +0 -1
- package/dist/lib/codex-manager/dashboard-settings-data.d.ts +0 -1
- package/dist/lib/codex-manager/dashboard-settings-entry.d.ts +0 -1
- package/dist/lib/codex-manager/experimental-settings-entry.d.ts +0 -1
- package/dist/lib/codex-manager/experimental-settings-prompt.d.ts +0 -1
- package/dist/lib/codex-manager/experimental-settings-schema.d.ts +0 -1
- package/dist/lib/codex-manager/experimental-sync-target-entry.d.ts +0 -1
- package/dist/lib/codex-manager/experimental-sync-target.d.ts +0 -1
- package/dist/lib/codex-manager/forecast-report-shared.d.ts +0 -1
- package/dist/lib/codex-manager/formatters/account-formatters.d.ts +0 -1
- package/dist/lib/codex-manager/formatters/index.d.ts +0 -1
- package/dist/lib/codex-manager/formatters/model-formatters.d.ts +0 -1
- package/dist/lib/codex-manager/formatters/quota-formatters.d.ts +0 -1
- package/dist/lib/codex-manager/formatters/text-style.d.ts +0 -1
- package/dist/lib/codex-manager/health-check.d.ts +0 -1
- package/dist/lib/codex-manager/health-check.js +1 -1
- package/dist/lib/codex-manager/help.d.ts +0 -1
- package/dist/lib/codex-manager/login-action-panel.d.ts +0 -1
- package/dist/lib/codex-manager/login-flow.d.ts +0 -1
- package/dist/lib/codex-manager/login-menu-actions.d.ts +0 -1
- package/dist/lib/codex-manager/login-menu-data.d.ts +0 -1
- package/dist/lib/codex-manager/login-menu-data.d.ts.map +1 -1
- package/dist/lib/codex-manager/login-menu-data.js +7 -3
- package/dist/lib/codex-manager/login-oauth.d.ts +0 -1
- package/dist/lib/codex-manager/login-workspace-choice.d.ts +0 -1
- package/dist/lib/codex-manager/manual-callback.d.ts +0 -1
- package/dist/lib/codex-manager/persist-selected-account.d.ts +0 -1
- package/dist/lib/codex-manager/quota-cache-helpers.d.ts +7 -2
- package/dist/lib/codex-manager/quota-cache-helpers.d.ts.map +1 -1
- package/dist/lib/codex-manager/quota-cache-helpers.js +34 -19
- package/dist/lib/codex-manager/rate-limit-markers.d.ts +0 -1
- package/dist/lib/codex-manager/repair-commands.d.ts +0 -1
- package/dist/lib/codex-manager/repair-commands.js +1 -1
- package/dist/lib/codex-manager/settings-hub/backend.d.ts +0 -1
- package/dist/lib/codex-manager/settings-hub/dashboard.d.ts +0 -1
- package/dist/lib/codex-manager/settings-hub/experimental.d.ts +0 -1
- package/dist/lib/codex-manager/settings-hub/index.d.ts +0 -1
- package/dist/lib/codex-manager/settings-hub/shared.d.ts +0 -1
- package/dist/lib/codex-manager/settings-hub-entry.d.ts +0 -1
- package/dist/lib/codex-manager/settings-hub-menu.d.ts +0 -1
- package/dist/lib/codex-manager/settings-hub-prompt.d.ts +0 -1
- package/dist/lib/codex-manager/settings-hub.d.ts +0 -1
- package/dist/lib/codex-manager/settings-panels.d.ts +0 -1
- package/dist/lib/codex-manager/settings-persist-utils.d.ts +0 -1
- package/dist/lib/codex-manager/settings-preview.d.ts +0 -1
- package/dist/lib/codex-manager/settings-write-queue.d.ts +0 -1
- package/dist/lib/codex-manager/statusline-settings-panel.d.ts +0 -1
- package/dist/lib/codex-manager/theme-settings-panel.d.ts +0 -1
- package/dist/lib/codex-manager/unified-settings-controller.d.ts +0 -1
- package/dist/lib/codex-manager/unified-settings-entry.d.ts +0 -1
- package/dist/lib/codex-manager.d.ts +1 -2
- package/dist/lib/codex-manager.js +5 -95
- package/dist/lib/concurrency.d.ts +0 -1
- package/dist/lib/config-schema.d.ts +0 -1
- package/dist/lib/config.d.ts +0 -1
- package/dist/lib/config.js +46 -241
- package/dist/lib/constants.d.ts +0 -1
- package/dist/lib/context-budget/model-context-windows.d.ts +0 -1
- package/dist/lib/context-budget-guard.d.ts +0 -1
- package/dist/lib/context-budget-response.d.ts +0 -1
- package/dist/lib/context-budget-response.js +8 -8
- package/dist/lib/context-overflow.d.ts +0 -1
- package/dist/lib/context-overflow.js +10 -10
- package/dist/lib/dashboard-settings.d.ts +0 -1
- package/dist/lib/entitlement-cache.d.ts +0 -1
- package/dist/lib/env-parsing.d.ts +13 -1
- package/dist/lib/env-parsing.js +21 -0
- package/dist/lib/errors.d.ts +0 -1
- package/dist/lib/forecast.d.ts +0 -1
- package/dist/lib/fs-retry.d.ts +0 -1
- package/dist/lib/health.d.ts +0 -1
- package/dist/lib/index.d.ts +0 -1
- package/dist/lib/integration-generators.d.ts +0 -1
- package/dist/lib/live-account-sync.d.ts +0 -1
- package/dist/lib/local-bridge.d.ts +0 -1
- package/dist/lib/local-bridge.js +4 -1
- package/dist/lib/local-client-tokens.d.ts +0 -1
- package/dist/lib/local-client-tokens.js +125 -30
- package/dist/lib/logger.d.ts +0 -1
- package/dist/lib/logger.js +11 -1
- package/dist/lib/model-capability-matrix.d.ts +0 -1
- package/dist/lib/model-route-policy.d.ts +1 -2
- package/dist/lib/named-backup-export.d.ts +0 -1
- package/dist/lib/oauth-success.html +125 -125
- package/dist/lib/oc-chatgpt-import-adapter.d.ts +0 -1
- package/dist/lib/oc-chatgpt-orchestrator.d.ts +0 -1
- package/dist/lib/oc-chatgpt-target-detection.d.ts +0 -1
- package/dist/lib/parallel-probe.d.ts +0 -1
- package/dist/lib/policy/runtime-policy-cache.d.ts +80 -0
- package/dist/lib/policy/runtime-policy-cache.js +310 -0
- package/dist/lib/policy/runtime-policy.d.ts +1 -2
- package/dist/lib/policy/runtime-policy.js +46 -19
- package/dist/lib/preemptive-quota-scheduler.d.ts +0 -1
- package/dist/lib/proactive-refresh.d.ts +0 -1
- package/dist/lib/prompts/codex-host-bridge.d.ts +0 -1
- package/dist/lib/prompts/codex-host-bridge.js +138 -138
- package/dist/lib/prompts/codex.d.ts +0 -1
- package/dist/lib/prompts/codex.js +79 -79
- package/dist/lib/prompts/fetch-utils.d.ts +0 -1
- package/dist/lib/prompts/host-codex-prompt.d.ts +0 -1
- package/dist/lib/quota-cache.d.ts +7 -4
- package/dist/lib/quota-cache.d.ts.map +1 -1
- package/dist/lib/quota-cache.js +117 -61
- package/dist/lib/quota-probe.d.ts +0 -1
- package/dist/lib/quota-probe.js +5 -2
- package/dist/lib/quota-readiness.d.ts +7 -3
- package/dist/lib/quota-readiness.d.ts.map +1 -1
- package/dist/lib/quota-readiness.js +25 -4
- package/dist/lib/recovery/constants.d.ts +0 -1
- package/dist/lib/recovery/storage.d.ts +0 -1
- package/dist/lib/recovery/types.d.ts +0 -1
- package/dist/lib/recovery.d.ts +0 -1
- package/dist/lib/redaction.d.ts +0 -1
- package/dist/lib/refresh-guardian.d.ts +0 -1
- package/dist/lib/refresh-lease.d.ts +0 -1
- package/dist/lib/refresh-queue.d.ts +0 -1
- package/dist/lib/request/client-cancellation.d.ts +0 -1
- package/dist/lib/request/error-classification.d.ts +0 -1
- package/dist/lib/request/failover-config.d.ts +0 -1
- package/dist/lib/request/failure-policy.d.ts +0 -1
- package/dist/lib/request/fetch-helpers.d.ts +0 -1
- package/dist/lib/request/headers.d.ts +0 -1
- package/dist/lib/request/helpers/input-utils.d.ts +0 -1
- package/dist/lib/request/helpers/input-utils.js +88 -34
- package/dist/lib/request/helpers/model-map.d.ts +0 -1
- package/dist/lib/request/helpers/tool-utils.d.ts +0 -1
- package/dist/lib/request/helpers/tool-utils.js +421 -4
- package/dist/lib/request/index.d.ts +0 -1
- package/dist/lib/request/rate-limit-backoff.d.ts +0 -1
- package/dist/lib/request/rate-limit-decision.d.ts +0 -1
- package/dist/lib/request/request-attempt-budget.d.ts +0 -1
- package/dist/lib/request/request-init.d.ts +0 -1
- package/dist/lib/request/request-resilience.d.ts +0 -1
- package/dist/lib/request/request-transformer.d.ts +0 -1
- package/dist/lib/request/request-transformer.js +50 -25
- package/dist/lib/request/response-compaction.d.ts +0 -1
- package/dist/lib/request/response-handler.d.ts +0 -1
- package/dist/lib/request/response-metadata.d.ts +0 -1
- package/dist/lib/request/response-outcome.d.ts +0 -1
- package/dist/lib/request/stream-failover-runtime.d.ts +0 -1
- package/dist/lib/request/stream-failover.d.ts +0 -1
- package/dist/lib/request/stream-failover.js +28 -4
- package/dist/lib/request/token-refresh.d.ts +0 -1
- package/dist/lib/request/url-rewriting.d.ts +0 -1
- package/dist/lib/request/wait-utils.d.ts +0 -1
- package/dist/lib/rotation.d.ts +0 -1
- package/dist/lib/routing-mutex.d.ts +0 -1
- package/dist/lib/routing-profiles.d.ts +16 -2
- package/dist/lib/routing-profiles.js +119 -44
- package/dist/lib/runtime/account-check-helpers.d.ts +0 -1
- package/dist/lib/runtime/account-check-types.d.ts +0 -1
- package/dist/lib/runtime/account-check.d.ts +0 -1
- package/dist/lib/runtime/account-manager-cache-entry.d.ts +0 -1
- package/dist/lib/runtime/account-manager-cache.d.ts +0 -1
- package/dist/lib/runtime/account-model-catalog.d.ts +1 -2
- package/dist/lib/runtime/account-pool.d.ts +0 -1
- package/dist/lib/runtime/account-reset-credits.d.ts +0 -1
- package/dist/lib/runtime/account-reset-credits.js +8 -2
- package/dist/lib/runtime/account-scope.d.ts +0 -1
- package/dist/lib/runtime/account-select-event.d.ts +0 -1
- package/dist/lib/runtime/account-selection.d.ts +0 -1
- package/dist/lib/runtime/account-state.d.ts +0 -1
- package/dist/lib/runtime/account-status.d.ts +0 -1
- package/dist/lib/runtime/account-storage-scope-entry.d.ts +0 -1
- package/dist/lib/runtime/api-model-capabilities.d.ts +0 -1
- package/dist/lib/runtime/api-model-runtime.d.ts +0 -1
- package/dist/lib/runtime/app-bind.d.ts +0 -1
- package/dist/lib/runtime/app-bind.d.ts.map +1 -1
- package/dist/lib/runtime/app-bind.js +10 -2
- package/dist/lib/runtime/app-helper-selection.d.ts +0 -1
- package/dist/lib/runtime/auth-facade.d.ts +0 -1
- package/dist/lib/runtime/automatic-account-checks.d.ts +5 -2
- package/dist/lib/runtime/automatic-account-checks.d.ts.map +1 -1
- package/dist/lib/runtime/automatic-account-checks.js +29 -2
- package/dist/lib/runtime/automatic-subscription-checks.d.ts +1 -2
- package/dist/lib/runtime/automatic-subscription-checks.d.ts.map +1 -1
- package/dist/lib/runtime/automatic-subscription-checks.js +13 -16
- package/dist/lib/runtime/browser-oauth-flow.d.ts +0 -1
- package/dist/lib/runtime/capability-boost.d.ts +0 -1
- package/dist/lib/runtime/catalog-capabilities.d.ts +0 -1
- package/dist/lib/runtime/config-toml.d.ts +0 -1
- package/dist/lib/runtime/context-budget-settings.d.ts +0 -1
- package/dist/lib/runtime/event-handler.d.ts +0 -1
- package/dist/lib/runtime/first-run.d.ts +0 -1
- package/dist/lib/runtime/flagged-verify-types.d.ts +0 -1
- package/dist/lib/runtime/hydrate-emails.d.ts +0 -1
- package/dist/lib/runtime/inference-activity.d.ts +0 -1
- package/dist/lib/runtime/live-sync-entry.d.ts +0 -1
- package/dist/lib/runtime/live-sync.d.ts +0 -1
- package/dist/lib/runtime/loader-setup.d.ts +0 -1
- package/dist/lib/runtime/login-menu-accounts.d.ts +0 -1
- package/dist/lib/runtime/manual-oauth-flow.d.ts +0 -1
- package/dist/lib/runtime/model-discovery-status.d.ts +2 -3
- package/dist/lib/runtime/native-account-storage.d.ts +0 -1
- package/dist/lib/runtime/native-account-sync.d.ts +0 -1
- package/dist/lib/runtime/native-binding-lock.d.ts +0 -1
- package/dist/lib/runtime/native-client-auth.d.ts +0 -1
- package/dist/lib/runtime/native-provider-config.d.ts +0 -1
- package/dist/lib/runtime/native-rate-limits.d.ts +2 -1
- package/dist/lib/runtime/native-rate-limits.js +23 -6
- package/dist/lib/runtime/preemptive-quota.d.ts +0 -1
- package/dist/lib/runtime/quota-headers.d.ts +0 -1
- package/dist/lib/runtime/quota-probe.d.ts +0 -1
- package/dist/lib/runtime/quota-settings.d.ts +0 -1
- package/dist/lib/runtime/refresh-guardian-entry.d.ts +0 -1
- package/dist/lib/runtime/refresh-guardian.d.ts +0 -1
- package/dist/lib/runtime/request-init.d.ts +0 -1
- package/dist/lib/runtime/reset-credit-routing.d.ts +0 -1
- package/dist/lib/runtime/reset-credits.d.ts +0 -1
- package/dist/lib/runtime/response-output-history.d.ts +0 -1
- package/dist/lib/runtime/responses-websocket.d.ts +0 -1
- package/dist/lib/runtime/resume-picker.d.ts +0 -1
- package/dist/lib/runtime/rotation-account-selection.d.ts +0 -1
- package/dist/lib/runtime/rotation-proxy-state.d.ts +0 -1
- package/dist/lib/runtime/rotation-server-types.d.ts +0 -1
- package/dist/lib/runtime/rotation-storage-meta.d.ts +0 -1
- package/dist/lib/runtime/rotation-token-refresh.d.ts +0 -1
- package/dist/lib/runtime/runtime-capability-failures.d.ts +0 -1
- package/dist/lib/runtime/runtime-current-account.d.ts +0 -1
- package/dist/lib/runtime/runtime-observability.d.ts +0 -1
- package/dist/lib/runtime/runtime-services.d.ts +0 -1
- package/dist/lib/runtime/session-affinity-entry.d.ts +0 -1
- package/dist/lib/runtime/session-recovery.d.ts +0 -1
- package/dist/lib/runtime/status-marker.d.ts +0 -1
- package/dist/lib/runtime/storage-scope.d.ts +0 -1
- package/dist/lib/runtime/subscription-first-use.d.ts +0 -1
- package/dist/lib/runtime/subscription-quota-event.d.ts +0 -1
- package/dist/lib/runtime/subscription-quota-order.d.ts +0 -1
- package/dist/lib/runtime/toast.d.ts +0 -1
- package/dist/lib/runtime/ui-runtime-entry.d.ts +0 -1
- package/dist/lib/runtime/ui-runtime.d.ts +0 -1
- package/dist/lib/runtime/verify-flagged.d.ts +0 -1
- package/dist/lib/runtime/workspace-model-scopes.d.ts +0 -1
- package/dist/lib/runtime-constants.d.ts +0 -1
- package/dist/lib/runtime-paths.d.ts +0 -1
- package/dist/lib/runtime-rotation-proxy.d.ts +1 -1
- package/dist/lib/runtime-rotation-proxy.js +136 -3
- package/dist/lib/schemas.d.ts +35 -13
- package/dist/lib/schemas.js +19 -2
- package/dist/lib/session-affinity.d.ts +0 -1
- package/dist/lib/shutdown.d.ts +0 -1
- package/dist/lib/storage/account-clear-entry.d.ts +0 -1
- package/dist/lib/storage/account-clear.d.ts +0 -1
- package/dist/lib/storage/account-match-utils.d.ts +0 -1
- package/dist/lib/storage/account-persistence.d.ts +0 -1
- package/dist/lib/storage/account-port.d.ts +0 -1
- package/dist/lib/storage/account-save-entry.d.ts +0 -1
- package/dist/lib/storage/account-save.d.ts +9 -2
- package/dist/lib/storage/account-save.js +4 -1
- package/dist/lib/storage/account-snapshot.d.ts +0 -1
- package/dist/lib/storage/backup-metadata-builder.d.ts +0 -1
- package/dist/lib/storage/backup-metadata.d.ts +0 -1
- package/dist/lib/storage/backup-paths.d.ts +0 -1
- package/dist/lib/storage/backup-restore.d.ts +0 -1
- package/dist/lib/storage/cache-artifacts.d.ts +0 -1
- package/dist/lib/storage/credential-sidecars.d.ts +0 -1
- package/dist/lib/storage/error-hints.d.ts +0 -1
- package/dist/lib/storage/file-lock.d.ts +0 -1
- package/dist/lib/storage/file-lock.js +33 -1
- package/dist/lib/storage/file-paths.d.ts +0 -1
- package/dist/lib/storage/fixture-guards.d.ts +0 -1
- package/dist/lib/storage/flagged-entry.d.ts +0 -1
- package/dist/lib/storage/flagged-load-entry.d.ts +0 -1
- package/dist/lib/storage/flagged-save-entry.d.ts +0 -1
- package/dist/lib/storage/flagged-storage-file.d.ts +0 -1
- package/dist/lib/storage/flagged-storage-io.d.ts +0 -1
- package/dist/lib/storage/flagged-storage.d.ts +0 -1
- package/dist/lib/storage/gitignore.d.ts +0 -1
- package/dist/lib/storage/hash.d.ts +0 -1
- package/dist/lib/storage/health.d.ts +0 -1
- package/dist/lib/storage/identity.d.ts +0 -1
- package/dist/lib/storage/import-export.d.ts +0 -1
- package/dist/lib/storage/json-store-lock.d.ts +105 -0
- package/dist/lib/storage/json-store-lock.js +259 -0
- package/dist/lib/storage/metadata-section.d.ts +0 -1
- package/dist/lib/storage/migrations.d.ts +0 -1
- package/dist/lib/storage/migrations.js +31 -18
- package/dist/lib/storage/named-backup-entry.d.ts +0 -1
- package/dist/lib/storage/named-backups-entry.d.ts +0 -1
- package/dist/lib/storage/named-backups.d.ts +0 -1
- package/dist/lib/storage/path-state.d.ts +0 -1
- package/dist/lib/storage/paths.d.ts +0 -1
- package/dist/lib/storage/pending-auth.d.ts +10 -3
- package/dist/lib/storage/pending-auth.d.ts.map +1 -1
- package/dist/lib/storage/pending-auth.js +33 -9
- package/dist/lib/storage/project-migration.d.ts +0 -1
- package/dist/lib/storage/public-types.d.ts +0 -1
- package/dist/lib/storage/record-identity.d.ts +15 -0
- package/dist/lib/storage/record-identity.d.ts.map +1 -0
- package/dist/lib/storage/record-identity.js +16 -0
- package/dist/lib/storage/record-utils.d.ts +0 -1
- package/dist/lib/storage/restore-assessment.d.ts +0 -1
- package/dist/lib/storage/restore-backup-entry.d.ts +0 -1
- package/dist/lib/storage/restore-metadata.d.ts +0 -1
- package/dist/lib/storage/save-retry.d.ts +0 -1
- package/dist/lib/storage/snapshot-inspectors.d.ts +0 -1
- package/dist/lib/storage/snapshot-merge.d.ts +0 -1
- package/dist/lib/storage/storage-parser.d.ts +2 -1
- package/dist/lib/storage/storage-parser.js +10 -2
- package/dist/lib/storage/transactions.d.ts +0 -1
- package/dist/lib/storage.d.ts +15 -2
- package/dist/lib/storage.js +612 -25
- package/dist/lib/synthetic-response.d.ts +0 -1
- package/dist/lib/table-formatter.d.ts +0 -1
- package/dist/lib/temp-path.d.ts +0 -1
- package/dist/lib/tools/hashline-tools.d.ts +0 -1
- package/dist/lib/types.d.ts +0 -1
- package/dist/lib/ui/ansi.d.ts +0 -1
- package/dist/lib/ui/auth-menu-builder.d.ts +0 -1
- package/dist/lib/ui/auth-menu.d.ts +0 -1
- package/dist/lib/ui/check-progress.d.ts +0 -1
- package/dist/lib/ui/confirm.d.ts +0 -1
- package/dist/lib/ui/display-width.d.ts +0 -1
- package/dist/lib/ui/format.d.ts +0 -1
- package/dist/lib/ui/index.d.ts +0 -1
- package/dist/lib/ui/runtime.d.ts +0 -1
- package/dist/lib/ui/select.d.ts +0 -1
- package/dist/lib/ui/theme.d.ts +0 -1
- package/dist/lib/ui/ui-copy.d.ts +0 -1
- package/dist/lib/unified-settings.d.ts +13 -11
- package/dist/lib/unified-settings.js +22 -14
- package/dist/lib/update-notice.d.ts +0 -1
- package/dist/lib/usage/index.d.ts +0 -1
- package/dist/lib/usage/ledger.d.ts +0 -1
- package/dist/lib/usage/pricing.d.ts +0 -1
- package/dist/lib/usage/redaction.d.ts +0 -1
- package/dist/lib/usage/stream-usage-deferral.d.ts +0 -1
- package/dist/lib/usage/types.d.ts +0 -1
- package/dist/lib/usage/usage-extraction.d.ts +0 -1
- package/dist/lib/utils.d.ts +21 -1
- package/dist/lib/utils.js +31 -0
- package/dist/lib/wsl.d.ts +0 -1
- package/node_modules/@codex-ai/plugin/dist/index.d.ts +2 -2
- package/node_modules/@codex-ai/plugin/dist/index.js +2 -2
- package/node_modules/@codex-ai/plugin/dist/tool.d.ts +42 -42
- package/node_modules/@codex-ai/plugin/dist/tool.js +29 -29
- package/node_modules/@codex-ai/plugin/package.json +9 -9
- package/node_modules/@codex-ai/sdk/dist/index.d.ts +4 -4
- package/node_modules/@codex-ai/sdk/dist/index.js +2 -2
- package/node_modules/@codex-ai/sdk/package.json +8 -8
- package/package.json +206 -200
- package/scripts/codex-app-launcher.js +653 -653
- package/scripts/codex-app-router.js +373 -373
- package/scripts/codex-bin-resolver.js +332 -313
- package/scripts/codex-multi-auth.js +65 -59
- package/scripts/codex-routing.js +62 -62
- package/scripts/codex.js +6923 -6642
- package/scripts/install-codex-auth-utils.js +213 -213
- package/scripts/mcodex.js +367 -367
- package/scripts/postinstall.js +114 -114
- package/scripts/preuninstall.js +265 -265
- package/skills/codex-auth-setup/SKILL.md +73 -0
- package/vendor/codex-ai-plugin/dist/index.d.ts +2 -2
- package/vendor/codex-ai-plugin/dist/index.js +2 -2
- package/vendor/codex-ai-plugin/dist/tool.d.ts +42 -42
- package/vendor/codex-ai-plugin/dist/tool.js +29 -29
- package/vendor/codex-ai-plugin/package.json +9 -9
- package/vendor/codex-ai-sdk/dist/index.d.ts +4 -4
- package/vendor/codex-ai-sdk/dist/index.js +2 -2
- package/vendor/codex-ai-sdk/package.json +8 -8
|
@@ -18,4 +18,16 @@
|
|
|
18
18
|
* @returns `true`/`false` for recognised literals, otherwise `undefined`.
|
|
19
19
|
*/
|
|
20
20
|
export declare function parseBooleanEnv(value: string | undefined): boolean | undefined;
|
|
21
|
-
|
|
21
|
+
/**
|
|
22
|
+
* Parses an integer environment-variable string.
|
|
23
|
+
*
|
|
24
|
+
* Returns `undefined` for `undefined` input, an empty/whitespace-only string,
|
|
25
|
+
* or any value that does not start with a parseable integer — letting callers
|
|
26
|
+
* fall back through nullish coalescing to their default. Matches the semantics
|
|
27
|
+
* of the local `parseEnvInt` copies in lib/refresh-lease.ts and
|
|
28
|
+
* lib/request/failover-config.ts.
|
|
29
|
+
*
|
|
30
|
+
* @param value - Raw env-variable value (or `undefined` when unset).
|
|
31
|
+
* @returns The parsed integer, otherwise `undefined`.
|
|
32
|
+
*/
|
|
33
|
+
export declare function parseIntegerEnv(value: string | undefined): number | undefined;
|
package/dist/lib/env-parsing.js
CHANGED
|
@@ -31,3 +31,24 @@ export function parseBooleanEnv(value) {
|
|
|
31
31
|
return false;
|
|
32
32
|
return undefined;
|
|
33
33
|
}
|
|
34
|
+
/**
|
|
35
|
+
* Parses an integer environment-variable string.
|
|
36
|
+
*
|
|
37
|
+
* Returns `undefined` for `undefined` input, an empty/whitespace-only string,
|
|
38
|
+
* or any value that does not start with a parseable integer — letting callers
|
|
39
|
+
* fall back through nullish coalescing to their default. Matches the semantics
|
|
40
|
+
* of the local `parseEnvInt` copies in lib/refresh-lease.ts and
|
|
41
|
+
* lib/request/failover-config.ts.
|
|
42
|
+
*
|
|
43
|
+
* @param value - Raw env-variable value (or `undefined` when unset).
|
|
44
|
+
* @returns The parsed integer, otherwise `undefined`.
|
|
45
|
+
*/
|
|
46
|
+
export function parseIntegerEnv(value) {
|
|
47
|
+
if (value === undefined)
|
|
48
|
+
return undefined;
|
|
49
|
+
const trimmed = value.trim();
|
|
50
|
+
if (trimmed.length === 0)
|
|
51
|
+
return undefined;
|
|
52
|
+
const parsed = Number.parseInt(trimmed, 10);
|
|
53
|
+
return Number.isFinite(parsed) ? parsed : undefined;
|
|
54
|
+
}
|
package/dist/lib/errors.d.ts
CHANGED
|
@@ -134,4 +134,3 @@ export declare class CodexUnavailableError extends CodexError {
|
|
|
134
134
|
* boundaries by also matching on the structural `code` marker.
|
|
135
135
|
*/
|
|
136
136
|
export declare function isCodexUnavailableError(error: unknown): error is CodexUnavailableError;
|
|
137
|
-
//# sourceMappingURL=errors.d.ts.map
|
package/dist/lib/forecast.d.ts
CHANGED
|
@@ -80,4 +80,3 @@ export declare function recommendForecastAccount(results: ForecastAccountResult[
|
|
|
80
80
|
export declare function summarizeForecast(results: ForecastAccountResult[]): ForecastSummary;
|
|
81
81
|
export declare function buildForecastExplanation(results: ForecastAccountResult[], recommendation: ForecastRecommendation): ForecastExplanation;
|
|
82
82
|
export {};
|
|
83
|
-
//# sourceMappingURL=forecast.d.ts.map
|
package/dist/lib/fs-retry.d.ts
CHANGED
|
@@ -47,4 +47,3 @@ export declare function withRetry<T>(operation: () => Promise<T> | T, options: R
|
|
|
47
47
|
*/
|
|
48
48
|
export declare function withRetrySync<T>(operation: () => T, options: RetryOptions): T;
|
|
49
49
|
export declare function withFileOperationRetry<T>(operation: () => Promise<T>): Promise<T>;
|
|
50
|
-
//# sourceMappingURL=fs-retry.d.ts.map
|
package/dist/lib/health.d.ts
CHANGED
package/dist/lib/index.d.ts
CHANGED
|
@@ -11,4 +11,3 @@ export interface IntegrationSnippet {
|
|
|
11
11
|
}
|
|
12
12
|
export declare function generateIntegrationSnippet(kind: IntegrationSnippetKind, input?: IntegrationSnippetInput): IntegrationSnippet;
|
|
13
13
|
export declare function generateIntegrationSnippets(kinds?: IntegrationSnippetKind[], input?: IntegrationSnippetInput): IntegrationSnippet[];
|
|
14
|
-
//# sourceMappingURL=integration-generators.d.ts.map
|
package/dist/lib/local-bridge.js
CHANGED
|
@@ -195,10 +195,13 @@ export async function startLocalBridge(options) {
|
|
|
195
195
|
throw new Error("Local bridge requires requireAuth=true when runtimeClientApiKey is configured.");
|
|
196
196
|
}
|
|
197
197
|
const app = new Hono();
|
|
198
|
+
// Deliberately minimal payload: /health is reachable without a bearer (it is
|
|
199
|
+
// the liveness probe), so it must not echo runtimeBaseUrl back — that value
|
|
200
|
+
// describes where the bridge forwards local client tokens and is internal
|
|
201
|
+
// routing detail, not something to hand unauthenticated callers.
|
|
198
202
|
app.get("/health", (context) => context.json({
|
|
199
203
|
ok: true,
|
|
200
204
|
service: "codex-multi-auth-local-bridge",
|
|
201
|
-
runtimeBaseUrl,
|
|
202
205
|
}));
|
|
203
206
|
const forward = async (request, targetPath) => {
|
|
204
207
|
const startedAt = Date.now();
|
|
@@ -34,4 +34,3 @@ export declare function rotateLocalClientToken(input: {
|
|
|
34
34
|
export declare function revokeLocalClientToken(id: string, now?: number): Promise<boolean>;
|
|
35
35
|
export declare function verifyLocalClientBearerToken(authorizationHeader: string | null, now?: number): Promise<LocalClientTokenRecord | null>;
|
|
36
36
|
export declare function resetLocalClientTokenWriteQueueForTests(): void;
|
|
37
|
-
//# sourceMappingURL=local-client-tokens.d.ts.map
|
|
@@ -1,10 +1,11 @@
|
|
|
1
|
-
import { createHash, randomBytes, randomUUID } from "node:crypto";
|
|
1
|
+
import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
|
|
2
2
|
import { existsSync, promises as fs } from "node:fs";
|
|
3
3
|
import { basename, join } from "node:path";
|
|
4
4
|
import { logWarn } from "./logger.js";
|
|
5
5
|
import { getCodexMultiAuthDir } from "./runtime-paths.js";
|
|
6
6
|
import { isRecord, sleep } from "./utils.js";
|
|
7
7
|
import { tempPathFor } from "./temp-path.js";
|
|
8
|
+
import { assertJsonStoreFileMtimeUnchanged, getJsonStoreFileMtimeMs, withJsonStoreCasRetry, withJsonStoreFileLock, } from "./storage/json-store-lock.js";
|
|
8
9
|
const TOKEN_FILE_NAME = "local-client-tokens.json";
|
|
9
10
|
const TOKEN_PREFIX = "cma_local";
|
|
10
11
|
// Debounce window for persisting a record's lastUsedAt. Bearer verification is
|
|
@@ -43,6 +44,27 @@ function normalizeLabel(value) {
|
|
|
43
44
|
function hashToken(token) {
|
|
44
45
|
return `sha256:${createHash("sha256").update(token).digest("hex")}`;
|
|
45
46
|
}
|
|
47
|
+
/**
|
|
48
|
+
* Constant-time equality for two `sha256:<hex>` token hashes.
|
|
49
|
+
*
|
|
50
|
+
* A `===` on the hex strings returns early at the first differing byte, so a
|
|
51
|
+
* local process that can spam verify calls could measure the comparison cost
|
|
52
|
+
* and recover a stored hash prefix byte-by-byte. Comparing the decoded digest
|
|
53
|
+
* bytes with timingSafeEqual removes the oracle; both inputs are validated to
|
|
54
|
+
* the fixed 32-byte shape first, so timingSafeEqual never throws.
|
|
55
|
+
*/
|
|
56
|
+
function sha256DigestBytes(hash) {
|
|
57
|
+
if (!/^sha256:[0-9a-f]{64}$/i.test(hash))
|
|
58
|
+
return null;
|
|
59
|
+
return Buffer.from(hash.slice("sha256:".length), "hex");
|
|
60
|
+
}
|
|
61
|
+
function tokenHashEqual(left, right) {
|
|
62
|
+
const leftDigest = sha256DigestBytes(left);
|
|
63
|
+
const rightDigest = sha256DigestBytes(right);
|
|
64
|
+
return (leftDigest !== null &&
|
|
65
|
+
rightDigest !== null &&
|
|
66
|
+
timingSafeEqual(leftDigest, rightDigest));
|
|
67
|
+
}
|
|
46
68
|
function createPlainToken() {
|
|
47
69
|
return `${TOKEN_PREFIX}_${randomBytes(32).toString("base64url")}`;
|
|
48
70
|
}
|
|
@@ -120,7 +142,46 @@ export async function loadLocalClientTokenStore() {
|
|
|
120
142
|
return emptyStore();
|
|
121
143
|
}
|
|
122
144
|
}
|
|
123
|
-
|
|
145
|
+
/**
|
|
146
|
+
* Merge a caller-supplied store over the freshest on-disk store by token id.
|
|
147
|
+
* Records the caller does not carry are preserved (this store is append-only:
|
|
148
|
+
* rotation and revocation mark records in place, nothing deletes them), and
|
|
149
|
+
* the monotone fields a concurrent process may have advanced — `lastUsedAt`
|
|
150
|
+
* from verifies, `revokedAt` from revocations/rotations — are kept at their
|
|
151
|
+
* furthest value so a stale snapshot cannot un-revoke or rewind usage.
|
|
152
|
+
*/
|
|
153
|
+
function mergeTokenStoreRecords(current, incoming) {
|
|
154
|
+
const indexById = new Map();
|
|
155
|
+
const tokens = current.tokens.map((record, index) => {
|
|
156
|
+
indexById.set(record.id, index);
|
|
157
|
+
return record;
|
|
158
|
+
});
|
|
159
|
+
for (const record of incoming.tokens) {
|
|
160
|
+
const index = indexById.get(record.id);
|
|
161
|
+
if (index === undefined) {
|
|
162
|
+
indexById.set(record.id, tokens.length);
|
|
163
|
+
tokens.push(record);
|
|
164
|
+
continue;
|
|
165
|
+
}
|
|
166
|
+
const existing = tokens[index];
|
|
167
|
+
if (existing === undefined) {
|
|
168
|
+
// Unreachable: indexes recorded in indexById always point at a
|
|
169
|
+
// slot that exists in `tokens`.
|
|
170
|
+
continue;
|
|
171
|
+
}
|
|
172
|
+
tokens[index] = {
|
|
173
|
+
...record,
|
|
174
|
+
lastUsedAt: record.lastUsedAt === null
|
|
175
|
+
? existing.lastUsedAt
|
|
176
|
+
: existing.lastUsedAt === null
|
|
177
|
+
? record.lastUsedAt
|
|
178
|
+
: Math.max(record.lastUsedAt, existing.lastUsedAt),
|
|
179
|
+
revokedAt: record.revokedAt ?? existing.revokedAt,
|
|
180
|
+
};
|
|
181
|
+
}
|
|
182
|
+
return { version: 1, tokens };
|
|
183
|
+
}
|
|
184
|
+
async function writeStoreToDisk(store, expectedMtimeMs) {
|
|
124
185
|
const path = getLocalClientTokenPath();
|
|
125
186
|
const payload = normalizeStore(store);
|
|
126
187
|
const dir = getCodexMultiAuthDir();
|
|
@@ -153,6 +214,12 @@ async function writeStoreToDisk(store) {
|
|
|
153
214
|
finally {
|
|
154
215
|
await handle.close();
|
|
155
216
|
}
|
|
217
|
+
// Compare-and-swap guard: a writer that did not take the lockfile (or an
|
|
218
|
+
// expired-lock takeover racing this write) moved the target's mtime; abort
|
|
219
|
+
// with ESTALE so the caller reloads and re-merges instead of clobbering.
|
|
220
|
+
if (expectedMtimeMs !== undefined) {
|
|
221
|
+
await assertJsonStoreFileMtimeUnchanged(path, expectedMtimeMs);
|
|
222
|
+
}
|
|
156
223
|
for (let attempt = 0; attempt < 5; attempt += 1) {
|
|
157
224
|
try {
|
|
158
225
|
await fs.rename(tempPath, path);
|
|
@@ -177,8 +244,36 @@ async function writeStoreToDisk(store) {
|
|
|
177
244
|
}
|
|
178
245
|
}
|
|
179
246
|
}
|
|
247
|
+
/**
|
|
248
|
+
* Run a token-store read→mutate→write inside the write queue (in-process
|
|
249
|
+
* serialization) AND the cross-process lock directory, with mtime CAS retry:
|
|
250
|
+
* every attempt re-stats the file, re-reads the freshest on-disk store, and
|
|
251
|
+
* re-applies `mutate` before writing — so an op whose snapshot raced a
|
|
252
|
+
* concurrent process's write reloads-and-retries rather than clobbering it.
|
|
253
|
+
* `mutate` must be re-appliable across retries (apply precomputed work onto
|
|
254
|
+
* the store it is handed, don't capture mutated state).
|
|
255
|
+
*/
|
|
256
|
+
async function updateLocalClientTokenStore(mutate) {
|
|
257
|
+
const path = getLocalClientTokenPath();
|
|
258
|
+
return enqueue(() => withJsonStoreFileLock(path, () => withJsonStoreCasRetry(async () => {
|
|
259
|
+
const expectedMtimeMs = await getJsonStoreFileMtimeMs(path);
|
|
260
|
+
const store = await loadLocalClientTokenStore();
|
|
261
|
+
const { result, dirty } = mutate(store);
|
|
262
|
+
if (dirty) {
|
|
263
|
+
await writeStoreToDisk(store, expectedMtimeMs);
|
|
264
|
+
}
|
|
265
|
+
return result;
|
|
266
|
+
})));
|
|
267
|
+
}
|
|
180
268
|
export async function saveLocalClientTokenStore(store) {
|
|
181
|
-
|
|
269
|
+
const path = getLocalClientTokenPath();
|
|
270
|
+
const incoming = normalizeStore(store);
|
|
271
|
+
await enqueue(() => withJsonStoreFileLock(path, () => withJsonStoreCasRetry(async () => {
|
|
272
|
+
const expectedMtimeMs = await getJsonStoreFileMtimeMs(path);
|
|
273
|
+
const current = await loadLocalClientTokenStore();
|
|
274
|
+
const merged = mergeTokenStoreRecords(current, incoming);
|
|
275
|
+
await writeStoreToDisk(merged, expectedMtimeMs);
|
|
276
|
+
})));
|
|
182
277
|
}
|
|
183
278
|
export function createLocalClientTokenRecord(input = {}) {
|
|
184
279
|
const plainToken = createPlainToken();
|
|
@@ -194,40 +289,40 @@ export function createLocalClientTokenRecord(input = {}) {
|
|
|
194
289
|
return { plainToken, record };
|
|
195
290
|
}
|
|
196
291
|
export async function addLocalClientToken(input = {}) {
|
|
197
|
-
|
|
198
|
-
|
|
199
|
-
|
|
292
|
+
// The token record is created once, outside the CAS retry: re-applying the
|
|
293
|
+
// same record onto a freshly-reloaded store is what makes each retry safe.
|
|
294
|
+
const created = createLocalClientTokenRecord(input);
|
|
295
|
+
return updateLocalClientTokenStore((store) => {
|
|
200
296
|
store.tokens.push(created.record);
|
|
201
|
-
|
|
202
|
-
return created;
|
|
297
|
+
return { result: created, dirty: true };
|
|
203
298
|
});
|
|
204
299
|
}
|
|
205
300
|
export async function rotateLocalClientToken(input) {
|
|
206
|
-
|
|
207
|
-
|
|
301
|
+
const now = input.now ?? Date.now();
|
|
302
|
+
let created = null;
|
|
303
|
+
return updateLocalClientTokenStore((store) => {
|
|
208
304
|
const existing = store.tokens.find((record) => record.id === input.id);
|
|
209
|
-
if (!existing || existing.revokedAt !== null)
|
|
210
|
-
return null;
|
|
211
|
-
|
|
305
|
+
if (!existing || existing.revokedAt !== null) {
|
|
306
|
+
return { result: null, dirty: false };
|
|
307
|
+
}
|
|
212
308
|
existing.revokedAt = now;
|
|
213
|
-
|
|
309
|
+
// Same record across CAS retries so a retry cannot mint a second token.
|
|
310
|
+
created ??= createLocalClientTokenRecord({
|
|
214
311
|
label: input.label ?? existing.label,
|
|
215
312
|
now,
|
|
216
313
|
});
|
|
217
314
|
store.tokens.push(created.record);
|
|
218
|
-
|
|
219
|
-
return created;
|
|
315
|
+
return { result: created, dirty: true };
|
|
220
316
|
});
|
|
221
317
|
}
|
|
222
318
|
export async function revokeLocalClientToken(id, now = Date.now()) {
|
|
223
|
-
return
|
|
224
|
-
const store = await loadLocalClientTokenStore();
|
|
319
|
+
return updateLocalClientTokenStore((store) => {
|
|
225
320
|
const existing = store.tokens.find((record) => record.id === id);
|
|
226
|
-
if (!existing || existing.revokedAt !== null)
|
|
227
|
-
return false;
|
|
321
|
+
if (!existing || existing.revokedAt !== null) {
|
|
322
|
+
return { result: false, dirty: false };
|
|
323
|
+
}
|
|
228
324
|
existing.revokedAt = now;
|
|
229
|
-
|
|
230
|
-
return true;
|
|
325
|
+
return { result: true, dirty: true };
|
|
231
326
|
});
|
|
232
327
|
}
|
|
233
328
|
export async function verifyLocalClientBearerToken(authorizationHeader, now = Date.now()) {
|
|
@@ -236,11 +331,10 @@ export async function verifyLocalClientBearerToken(authorizationHeader, now = Da
|
|
|
236
331
|
if (!token)
|
|
237
332
|
return null;
|
|
238
333
|
const tokenHash = hashToken(token);
|
|
239
|
-
return
|
|
240
|
-
const
|
|
241
|
-
const record = store.tokens.find((entry) => entry.revokedAt === null && entry.tokenHash === tokenHash);
|
|
334
|
+
return updateLocalClientTokenStore((store) => {
|
|
335
|
+
const record = store.tokens.find((entry) => entry.revokedAt === null && tokenHashEqual(entry.tokenHash, tokenHash));
|
|
242
336
|
if (!record)
|
|
243
|
-
return null;
|
|
337
|
+
return { result: null, dirty: false };
|
|
244
338
|
// Token match (verification correctness) is decided above and never
|
|
245
339
|
// depends on lastUsedAt. Always advance lastUsedAt in-memory so callers
|
|
246
340
|
// see a fresh value, but only flush to disk when it has not been
|
|
@@ -249,10 +343,11 @@ export async function verifyLocalClientBearerToken(authorizationHeader, now = Da
|
|
|
249
343
|
// recent usage on a coarse (>=60s) cadence.
|
|
250
344
|
const persisted = record.lastUsedAt;
|
|
251
345
|
record.lastUsedAt = now;
|
|
252
|
-
|
|
253
|
-
|
|
254
|
-
|
|
255
|
-
|
|
346
|
+
return {
|
|
347
|
+
result: record,
|
|
348
|
+
dirty: persisted === null ||
|
|
349
|
+
now - persisted >= LAST_USED_PERSIST_THRESHOLD_MS,
|
|
350
|
+
};
|
|
256
351
|
});
|
|
257
352
|
}
|
|
258
353
|
export function resetLocalClientTokenWriteQueueForTests() {
|
package/dist/lib/logger.d.ts
CHANGED
|
@@ -45,4 +45,3 @@ export interface ScopedLogger {
|
|
|
45
45
|
export declare function createLogger(scope: string): ScopedLogger;
|
|
46
46
|
export declare function getRequestId(): number;
|
|
47
47
|
export { formatDuration, maskEmail, maskString, maskToken, sanitizeValue };
|
|
48
|
-
//# sourceMappingURL=logger.d.ts.map
|
package/dist/lib/logger.js
CHANGED
|
@@ -21,7 +21,17 @@ const TOKEN_PATTERNS = [
|
|
|
21
21
|
// line of defense and must recognize the project's own token shape too.
|
|
22
22
|
/cma_local_[A-Za-z0-9_-]{16,}/g,
|
|
23
23
|
];
|
|
24
|
-
|
|
24
|
+
// Label-shaped domain instead of `[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}`: letting `.`
|
|
25
|
+
// live inside the quantified class makes every dot a candidate split point,
|
|
26
|
+
// which backtracked quadratically (~3.5s) on dotted near-miss input. Labels
|
|
27
|
+
// are dot-free, so each dot has exactly one structural role.
|
|
28
|
+
// The `(?<!...)` lookbehind confines match starts to a run boundary: the
|
|
29
|
+
// unanchored pattern could otherwise begin inside an overlong local part or
|
|
30
|
+
// domain label and leave its leading/trailing edge visible in logs. Interior
|
|
31
|
+
// positions fail the lookbehind in O(1), which is also what keeps the
|
|
32
|
+
// unbounded quantifiers linear — each character run is scanned once from its
|
|
33
|
+
// edge instead of being rescanned from every offset.
|
|
34
|
+
const EMAIL_PATTERN = /(?<![a-zA-Z0-9._%+-])[a-zA-Z0-9._%+-]+@[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)*\.[a-zA-Z]{2,}/g;
|
|
25
35
|
const SENSITIVE_KEYS = new Set([
|
|
26
36
|
"access",
|
|
27
37
|
"accesstoken",
|
|
@@ -44,9 +44,8 @@ export declare function modelEntitlements(model: RouteModel): {
|
|
|
44
44
|
reasoningLevels: string[];
|
|
45
45
|
accessPrograms: string[];
|
|
46
46
|
probes?: {
|
|
47
|
-
[k: string]: "
|
|
47
|
+
[k: string]: "verified" | "unsupported" | "unverified" | "downgraded";
|
|
48
48
|
} | undefined;
|
|
49
49
|
checkedAt?: number | undefined;
|
|
50
50
|
model: string;
|
|
51
51
|
};
|
|
52
|
-
//# sourceMappingURL=model-route-policy.d.ts.map
|
|
@@ -66,4 +66,3 @@ export declare function resolveNamedBackupPath(name: string, storagePath: string
|
|
|
66
66
|
export declare function exportNamedBackupFile(name: string, dependencies: NamedBackupExportDependencies, options?: {
|
|
67
67
|
force?: boolean;
|
|
68
68
|
}): Promise<string>;
|
|
69
|
-
//# sourceMappingURL=named-backup-export.d.ts.map
|
|
@@ -1,126 +1,126 @@
|
|
|
1
|
-
<!doctype html>
|
|
2
|
-
<html lang="en">
|
|
3
|
-
<head>
|
|
4
|
-
<meta charset="utf-8" />
|
|
5
|
-
<meta name="viewport" content="width=device-width, initial-scale=1" />
|
|
6
|
-
<title>Codex Sign-In Complete</title>
|
|
7
|
-
<style>
|
|
8
|
-
:root {
|
|
9
|
-
color-scheme: dark;
|
|
10
|
-
--bg: #0b0b0b;
|
|
11
|
-
--panel: #111111;
|
|
12
|
-
--text: #f2f2f2;
|
|
13
|
-
--muted: #a3a3a3;
|
|
14
|
-
--line: #232323;
|
|
15
|
-
--ok: #7cf0a6;
|
|
16
|
-
}
|
|
17
|
-
|
|
18
|
-
* {
|
|
19
|
-
box-sizing: border-box;
|
|
20
|
-
}
|
|
21
|
-
|
|
22
|
-
body {
|
|
23
|
-
margin: 0;
|
|
24
|
-
min-height: 100vh;
|
|
25
|
-
display: grid;
|
|
26
|
-
place-items: center;
|
|
27
|
-
background: var(--bg);
|
|
28
|
-
color: var(--text);
|
|
29
|
-
font-family: "Geist Mono", "GeistMono", ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace;
|
|
30
|
-
padding: 24px;
|
|
31
|
-
}
|
|
32
|
-
|
|
33
|
-
main {
|
|
34
|
-
width: min(520px, 100%);
|
|
35
|
-
background: var(--panel);
|
|
36
|
-
border: 1px solid var(--line);
|
|
37
|
-
border-radius: 12px;
|
|
38
|
-
padding: 20px;
|
|
39
|
-
display: grid;
|
|
40
|
-
gap: 14px;
|
|
41
|
-
}
|
|
42
|
-
|
|
43
|
-
h1 {
|
|
44
|
-
margin: 0;
|
|
45
|
-
font-size: 20px;
|
|
46
|
-
font-weight: 600;
|
|
47
|
-
letter-spacing: -0.02em;
|
|
48
|
-
}
|
|
49
|
-
|
|
50
|
-
p {
|
|
51
|
-
margin: 0;
|
|
52
|
-
color: var(--muted);
|
|
53
|
-
font-size: 14px;
|
|
54
|
-
line-height: 1.5;
|
|
55
|
-
}
|
|
56
|
-
|
|
57
|
-
.status {
|
|
58
|
-
display: inline-flex;
|
|
59
|
-
align-items: center;
|
|
60
|
-
gap: 8px;
|
|
61
|
-
color: var(--ok);
|
|
62
|
-
font-size: 13px;
|
|
63
|
-
}
|
|
64
|
-
|
|
65
|
-
.dot {
|
|
66
|
-
width: 8px;
|
|
67
|
-
height: 8px;
|
|
68
|
-
border-radius: 50%;
|
|
69
|
-
background: currentColor;
|
|
70
|
-
}
|
|
71
|
-
|
|
72
|
-
dl {
|
|
73
|
-
margin: 0;
|
|
74
|
-
display: grid;
|
|
75
|
-
grid-template-columns: 120px 1fr;
|
|
76
|
-
gap: 8px 12px;
|
|
77
|
-
font-size: 13px;
|
|
78
|
-
}
|
|
79
|
-
|
|
80
|
-
dt {
|
|
81
|
-
color: var(--muted);
|
|
82
|
-
}
|
|
83
|
-
|
|
84
|
-
dd {
|
|
85
|
-
margin: 0;
|
|
86
|
-
color: var(--text);
|
|
87
|
-
word-break: break-word;
|
|
88
|
-
}
|
|
89
|
-
|
|
90
|
-
code {
|
|
91
|
-
background: #171717;
|
|
92
|
-
border: 1px solid var(--line);
|
|
93
|
-
border-radius: 6px;
|
|
94
|
-
padding: 2px 6px;
|
|
95
|
-
font-family: inherit;
|
|
96
|
-
font-size: 12px;
|
|
97
|
-
}
|
|
98
|
-
|
|
99
|
-
@media (max-width: 520px) {
|
|
100
|
-
dl {
|
|
101
|
-
grid-template-columns: 1fr;
|
|
102
|
-
}
|
|
103
|
-
}
|
|
104
|
-
</style>
|
|
105
|
-
</head>
|
|
106
|
-
<body>
|
|
107
|
-
<main role="main" aria-label="OAuth callback received">
|
|
108
|
-
<h1>Sign-in complete</h1>
|
|
109
|
-
<p>Return to your terminal to finish Codex login.</p>
|
|
110
|
-
|
|
111
|
-
<div class="status" aria-live="polite">
|
|
112
|
-
<span class="dot" aria-hidden="true"></span>
|
|
113
|
-
Callback received
|
|
114
|
-
</div>
|
|
115
|
-
|
|
116
|
-
<dl>
|
|
117
|
-
<dt>Endpoint</dt>
|
|
118
|
-
<dd><code>localhost:1455</code></dd>
|
|
119
|
-
<dt>Flow</dt>
|
|
120
|
-
<dd>OAuth callback captured</dd>
|
|
121
|
-
<dt>Next</dt>
|
|
122
|
-
<dd>Close this tab and continue in terminal</dd>
|
|
123
|
-
</dl>
|
|
124
|
-
</main>
|
|
125
|
-
</body>
|
|
1
|
+
<!doctype html>
|
|
2
|
+
<html lang="en">
|
|
3
|
+
<head>
|
|
4
|
+
<meta charset="utf-8" />
|
|
5
|
+
<meta name="viewport" content="width=device-width, initial-scale=1" />
|
|
6
|
+
<title>Codex Sign-In Complete</title>
|
|
7
|
+
<style>
|
|
8
|
+
:root {
|
|
9
|
+
color-scheme: dark;
|
|
10
|
+
--bg: #0b0b0b;
|
|
11
|
+
--panel: #111111;
|
|
12
|
+
--text: #f2f2f2;
|
|
13
|
+
--muted: #a3a3a3;
|
|
14
|
+
--line: #232323;
|
|
15
|
+
--ok: #7cf0a6;
|
|
16
|
+
}
|
|
17
|
+
|
|
18
|
+
* {
|
|
19
|
+
box-sizing: border-box;
|
|
20
|
+
}
|
|
21
|
+
|
|
22
|
+
body {
|
|
23
|
+
margin: 0;
|
|
24
|
+
min-height: 100vh;
|
|
25
|
+
display: grid;
|
|
26
|
+
place-items: center;
|
|
27
|
+
background: var(--bg);
|
|
28
|
+
color: var(--text);
|
|
29
|
+
font-family: "Geist Mono", "GeistMono", ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace;
|
|
30
|
+
padding: 24px;
|
|
31
|
+
}
|
|
32
|
+
|
|
33
|
+
main {
|
|
34
|
+
width: min(520px, 100%);
|
|
35
|
+
background: var(--panel);
|
|
36
|
+
border: 1px solid var(--line);
|
|
37
|
+
border-radius: 12px;
|
|
38
|
+
padding: 20px;
|
|
39
|
+
display: grid;
|
|
40
|
+
gap: 14px;
|
|
41
|
+
}
|
|
42
|
+
|
|
43
|
+
h1 {
|
|
44
|
+
margin: 0;
|
|
45
|
+
font-size: 20px;
|
|
46
|
+
font-weight: 600;
|
|
47
|
+
letter-spacing: -0.02em;
|
|
48
|
+
}
|
|
49
|
+
|
|
50
|
+
p {
|
|
51
|
+
margin: 0;
|
|
52
|
+
color: var(--muted);
|
|
53
|
+
font-size: 14px;
|
|
54
|
+
line-height: 1.5;
|
|
55
|
+
}
|
|
56
|
+
|
|
57
|
+
.status {
|
|
58
|
+
display: inline-flex;
|
|
59
|
+
align-items: center;
|
|
60
|
+
gap: 8px;
|
|
61
|
+
color: var(--ok);
|
|
62
|
+
font-size: 13px;
|
|
63
|
+
}
|
|
64
|
+
|
|
65
|
+
.dot {
|
|
66
|
+
width: 8px;
|
|
67
|
+
height: 8px;
|
|
68
|
+
border-radius: 50%;
|
|
69
|
+
background: currentColor;
|
|
70
|
+
}
|
|
71
|
+
|
|
72
|
+
dl {
|
|
73
|
+
margin: 0;
|
|
74
|
+
display: grid;
|
|
75
|
+
grid-template-columns: 120px 1fr;
|
|
76
|
+
gap: 8px 12px;
|
|
77
|
+
font-size: 13px;
|
|
78
|
+
}
|
|
79
|
+
|
|
80
|
+
dt {
|
|
81
|
+
color: var(--muted);
|
|
82
|
+
}
|
|
83
|
+
|
|
84
|
+
dd {
|
|
85
|
+
margin: 0;
|
|
86
|
+
color: var(--text);
|
|
87
|
+
word-break: break-word;
|
|
88
|
+
}
|
|
89
|
+
|
|
90
|
+
code {
|
|
91
|
+
background: #171717;
|
|
92
|
+
border: 1px solid var(--line);
|
|
93
|
+
border-radius: 6px;
|
|
94
|
+
padding: 2px 6px;
|
|
95
|
+
font-family: inherit;
|
|
96
|
+
font-size: 12px;
|
|
97
|
+
}
|
|
98
|
+
|
|
99
|
+
@media (max-width: 520px) {
|
|
100
|
+
dl {
|
|
101
|
+
grid-template-columns: 1fr;
|
|
102
|
+
}
|
|
103
|
+
}
|
|
104
|
+
</style>
|
|
105
|
+
</head>
|
|
106
|
+
<body>
|
|
107
|
+
<main role="main" aria-label="OAuth callback received">
|
|
108
|
+
<h1>Sign-in complete</h1>
|
|
109
|
+
<p>Return to your terminal to finish Codex login.</p>
|
|
110
|
+
|
|
111
|
+
<div class="status" aria-live="polite">
|
|
112
|
+
<span class="dot" aria-hidden="true"></span>
|
|
113
|
+
Callback received
|
|
114
|
+
</div>
|
|
115
|
+
|
|
116
|
+
<dl>
|
|
117
|
+
<dt>Endpoint</dt>
|
|
118
|
+
<dd><code>localhost:1455</code></dd>
|
|
119
|
+
<dt>Flow</dt>
|
|
120
|
+
<dd>OAuth callback captured</dd>
|
|
121
|
+
<dt>Next</dt>
|
|
122
|
+
<dd>Close this tab and continue in terminal</dd>
|
|
123
|
+
</dl>
|
|
124
|
+
</main>
|
|
125
|
+
</body>
|
|
126
126
|
</html>
|