codex-multi-auth 2.17.2 → 2.18.0

package/dist/lib/audit.js

@@ -1,4 +1,4 @@
-import { writeFileSync, mkdirSync, existsSync, statSync, renameSync, readdirSync, unlinkSync } from "node:fs";
+import { writeFileSync, mkdirSync, existsSync, statSync, chmodSync, renameSync, readdirSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
 import { getCorrelationId, maskEmail } from "./logger.js";
 import { getCodexLogDir } from "./runtime-paths.js";
@@ -49,11 +49,32 @@ function ensureLogDir() {
 function getLogFilePath() {
     return join(auditConfig.logDir, "audit.log");
 }
+// POSIX-only permission re-assertion. The append-mode `mode` option applies
+// only when the file is created, so an audit log that already exists with
+// permissive bits (a shared/custom logDir, or one written before this
+// hardening) would stay readable by other local users, and rotation would
+// carry those bits onto the backups. On Windows chmod cannot establish the
+// equivalent ACL — the logDir's ACLs govern access there — so this is skipped
+// on win32 rather than half-applied.
+function restrictLogPermissions(path, currentMode) {
+    if (process.platform === "win32")
+        return;
+    try {
+        const mode = currentMode ?? statSync(path).mode;
+        if ((mode & 0o777) !== 0o600) {
+            chmodSync(path, 0o600);
+        }
+    }
+    catch {
+        // Best-effort hardening: audit logging must never break the application.
+    }
+}
 function rotateLogsIfNeeded() {
     const logPath = getLogFilePath();
     if (!existsSync(logPath))
         return;
     const stats = statSync(logPath);
+    restrictLogPermissions(logPath, stats.mode);
     if (stats.size < auditConfig.maxFileSizeBytes)
         return;
     for (let i = auditConfig.maxFiles - 1; i >= 1; i--) {
@@ -64,26 +85,34 @@ function rotateLogsIfNeeded() {
         }
         if (existsSync(newer)) {
             renameSync(newer, older);
+            restrictLogPermissions(older);
         }
     }
 }
-function sanitizeActor(actor) {
-    if (actor.includes("@")) {
-        return maskEmail(actor);
-    }
-    return actor;
+// Same email shape logger.ts scrubs, applied as a SUBSTRING masker. Feeding
+// the whole value to maskEmail would treat any "@" as an email separator and
+// mangle non-email identifiers that legitimately carry one — "@scope/package",
+// "@user" handles, URLs with embedded credentials — leaving the audit entry
+// unable to identify the resource. Only real email-shaped spans are masked.
+const EMAIL_SUBSTRING_PATTERN = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g;
+function maskAuditField(value) {
+    return value.replace(EMAIL_SUBSTRING_PATTERN, maskEmail);
 }
+// Substring markers matched against the lowercased metadata key. Covers
+// token/secret/password plus credential-carrying spellings: "authorization"
+// (raw headers), "api_key"/"api-key"/"apiKey" (api[-_]?key), and "credential".
+const SENSITIVE_KEY_PATTERN = /token|secret|password|authorization|api[-_]?key|credential/;
 function sanitizeMetadata(metadata) {
     if (!metadata)
         return undefined;
     const sanitized = {};
     for (const [key, value] of Object.entries(metadata)) {
         const lowerKey = key.toLowerCase();
-        if (lowerKey.includes("token") || lowerKey.includes("secret") || lowerKey.includes("password")) {
+        if (SENSITIVE_KEY_PATTERN.test(lowerKey)) {
             sanitized[key] = "***REDACTED***";
         }
-        else if (typeof value === "string" && value.includes("@")) {
-            sanitized[key] = maskEmail(value);
+        else if (typeof value === "string") {
+            sanitized[key] = maskAuditField(value);
         }
         else if (typeof value === "object" && value !== null) {
             sanitized[key] = sanitizeMetadata(value);
@@ -104,14 +133,16 @@ export function auditLog(action, actor, resource, outcome, metadata) {
             timestamp: new Date().toISOString(),
             correlationId: getCorrelationId(),
             action,
-            actor: sanitizeActor(actor),
-            resource,
+            actor: maskAuditField(actor),
+            resource: maskAuditField(resource),
             outcome,
             metadata: sanitizeMetadata(metadata),
         };
         const logPath = getLogFilePath();
         const line = JSON.stringify(entry) + "\n";
-        writeFileSync(logPath, line, { flag: "a" });
+        // mode applies only at creation; rotateLogsIfNeeded already re-asserted
+        // 0o600 on an existing file (and on every backup it renamed).
+        writeFileSync(logPath, line, { flag: "a", mode: 0o600 });
     }
     catch {
         // Audit logging should never break the application

package/dist/lib/auth/account-access.d.ts

@@ -112,4 +112,3 @@ export interface StoredAccountIdentity {
  * "manual" is an explicit `login --org` binding this must not override.
  */
 export declare function reboundUnauthorizedAccountIdentity(account: StoredAccountIdentity, accessToken: string, options?: FetchAuthorizedAccountsOptions): Promise<ConstrainedSelection | null>;
-//# sourceMappingURL=account-access.d.ts.map

package/dist/lib/auth/account-access.js

@@ -1,4 +1,5 @@
 import { CODEX_BASE_URL } from "../constants.js";
+import { combineSignals } from "../utils.js";
 const ACCOUNTS_CHECK_PATH = "/wham/accounts/check";
 const ACCOUNTS_CHECK_TIMEOUT_MS = 10_000;
 function readString(value) {
@@ -50,8 +51,11 @@ export async function fetchAuthorizedAccounts(accessToken, options = {}) {
         return null;
     const doFetch = options.fetch ?? globalThis.fetch;
     const timeout = AbortSignal.timeout(ACCOUNTS_CHECK_TIMEOUT_MS);
+    // combineSignals wraps AbortSignal.any (available since Node 18.17, the
+    // engines floor) with null-tolerance; the native composite also detaches
+    // from a long-lived caller signal once this request completes.
     const signal = options.signal
-        ? AbortSignal.any([options.signal, timeout])
+        ? combineSignals(options.signal, timeout)
         : timeout;
     try {
         const response = await doFetch(`${CODEX_BASE_URL}${ACCOUNTS_CHECK_PATH}`, {

package/dist/lib/auth/auth.d.ts

@@ -40,8 +40,10 @@ export declare const AUTH_REDIRECT: Readonly<{
  */
 export declare function sanitizeOAuthResponseBodyForLog(rawBody: string): string;
 /**
- * Redacts sensitive OAuth query parameters for safe logging.
- * Returns the original string when parsing fails.
+ * Redacts sensitive OAuth parameters for safe logging: query keys match
+ * case-insensitively, fragment and nested-URL params are covered, userinfo is
+ * masked, and unparseable input collapses to `<unparseable-url>` so the raw
+ * string can never reach a log verbatim.
  */
 export declare function redactOAuthUrlForLog(rawUrl: string): string;
 /**
@@ -92,4 +94,3 @@ export interface AuthorizationFlowOptions {
  */
 export declare function createAuthorizationFlow(options?: AuthorizationFlowOptions): Promise<AuthorizationFlow>;
 export {};
-//# sourceMappingURL=auth.d.ts.map

package/dist/lib/auth/auth.js

@@ -33,6 +33,26 @@ const OAUTH_SENSITIVE_QUERY_PARAMS = [
     "code",
     "code_challenge",
     "code_verifier",
+    "access_token",
+    "id_token",
+    "refresh_token",
+    "token",
+    "device_auth_id",
+    "user_code",
+    "authorization_code",
+    "client_secret",
+    "password",
+    // Credential-carrying names the logger's SENSITIVE_KEYS already masks:
+    // keep the query-key set aligned so they cannot reach a log either.
+    "api_key",
+    "apikey",
+    "authorization",
+    "credential",
+    "credentials",
+    "secret",
+    "assertion",
+    "client_assertion",
+    "id_token_hint",
 ];
 function getOAuthResponseLogMetadata(rawResponse) {
     if (Array.isArray(rawResponse)) {
@@ -55,13 +75,118 @@ const OAUTH_SENSITIVE_BODY_KEYS = [
     "id_token",
     "idToken",
     "codeVerifier",
+    "code_verifier",
+    "code_challenge",
+    "codeChallenge",
     "token",
     "code",
-    "code_verifier",
+    "state",
+    "device_auth_id",
+    "deviceAuthId",
+    "user_code",
+    "userCode",
+    "authorization_code",
+    "authorizationCode",
+    "client_secret",
+    "clientSecret",
+    "password",
+    // Credential-carrying names the logger's SENSITIVE_KEYS already masks:
+    // keep the body-key set aligned so they cannot reach a log either.
+    "api_key",
+    "apiKey",
+    "apikey",
+    "authorization",
+    "credential",
+    "credentials",
+    "secret",
+    "assertion",
+    "client_assertion",
+    "clientAssertion",
+    "id_token_hint",
+    "idTokenHint",
+];
+function normalizeOAuthSensitiveKey(key) {
+    return key.toLowerCase().replace(/[\s_-]/g, "");
+}
+const OAUTH_SENSITIVE_KEY_SET = new Set([...OAUTH_SENSITIVE_BODY_KEYS, ...OAUTH_SENSITIVE_QUERY_PARAMS].map(normalizeOAuthSensitiveKey));
+// A normalized key is also sensitive when it *ends* with a compound secret
+// name — `x-api-key`, `x-client-secret`, `my-refresh-token`,
+// `x-ms-token-aad-id-token` are still credentials. Bare `code`/`state`/`token`
+// are excluded so `error_code`, `csrf_token`, `session_state`, `valid_token`
+// and `api_keys` keep their documented over-redaction protection.
+const OAUTH_SENSITIVE_KEY_SUFFIXES = [
+    "accesstoken",
+    "refreshtoken",
+    "idtoken",
+    "clientsecret",
+    "clientassertion",
+    "apikey",
+    "authorizationcode",
+    "codechallenge",
+    "codeverifier",
+    "deviceauthid",
+    "usercode",
+    "idtokenhint",
+    "authorization",
+    "credential",
+    "credentials",
+    "assertion",
+    "password",
+    "passwords",
+    "secret",
 ];
+function isOAuthSensitiveKey(key) {
+    const normalized = normalizeOAuthSensitiveKey(key);
+    return (OAUTH_SENSITIVE_KEY_SET.has(normalized) ||
+        OAUTH_SENSITIVE_KEY_SUFFIXES.some((suffix) => normalized.endsWith(suffix)));
+}
+// Separator inside a compound key spelling: whitespace, `_`, `-`, `+`, and the
+// percent-encoded space all collapse under normalizeOAuthSensitiveKey, so
+// "client-secret", "ACCESS TOKEN" and "access%20token" must match too.
+const OAUTH_KEY_SEPARATOR = "(?:[\\s_+-]|%20)*";
+// Free-text key shapes. `code`/`state`/`token` need a non-word boundary so
+// longer names like `error_code`/`device_code`/`csrf_token` are untouched.
+const OAUTH_TEXT_SECRET_KEY_PATTERN = [
+    `(?:refresh|access|id)${OAUTH_KEY_SEPARATOR}token`,
+    `code${OAUTH_KEY_SEPARATOR}(?:challenge|verifier)`,
+    `device${OAUTH_KEY_SEPARATOR}auth${OAUTH_KEY_SEPARATOR}id`,
+    `user${OAUTH_KEY_SEPARATOR}code`,
+    `authorization${OAUTH_KEY_SEPARATOR}code`,
+    `client${OAUTH_KEY_SEPARATOR}secret`,
+    `api${OAUTH_KEY_SEPARATOR}key`,
+    `client${OAUTH_KEY_SEPARATOR}assertion`,
+    `id${OAUTH_KEY_SEPARATOR}token${OAUTH_KEY_SEPARATOR}hint`,
+    "authorization",
+    "credentials?",
+    "assertion",
+    "password",
+    "secret",
+    "state",
+    "token",
+    "code",
+].join("|");
 function scrubTokenLikeSubstrings(value) {
-    let scrubbed = value.replace(/(\b(?:refresh|access|id)[_-]?token\s*[:=]\s*)([^\s,;"'}]{8,})/gi, (_match, prefix) => `${prefix}***REDACTED***`);
-    scrubbed = scrubbed.replace(/\b(?:RT|AT)_ch_[A-Za-z0-9_-]{20,}\b/g, "***REDACTED***");
+    // Bearer runs first: in a "key: Bearer <jwt>" shape the key pass below
+    // would otherwise consume the literal word "Bearer" as its value and
+    // strand the token behind it.
+    let scrubbed = value.replace(/\bBearer(?:[\s+]|%20)+[A-Za-z0-9._~+/=-]{8,4096}/gi, "Bearer ***REDACTED***");
+    // `key <sep> value` in free text. Quoted keys and encoded separator gaps
+    // (%20/%22/%27) are tolerated; percent-encoded `:`/`=` (%3A/%3D, plus the
+    // double-encoded %253A/%253D) count as separators, and a key directly
+    // behind a %XX escape still counts as boundary (the escape itself is the
+    // delimiter). `_`/`-` are deliberately absent from the gap classes so
+    // `error_code`/`csrf-token` style names still survive. Value length is
+    // capped so a megabyte-scale run cannot exhaust the regex backtrack
+    // stack; the entropy pass below absorbs any leftover tail.
+    scrubbed = scrubbed.replace(new RegExp(`((?:(?<![A-Za-z0-9_])|(?<=%[0-9a-zA-Z]{2}))(?:${OAUTH_TEXT_SECRET_KEY_PATTERN})(?:[\\s'"+]|%2[027])*(?:[:=]|%3[ad]|%253[ad])(?:[\\s'"+]|%2[027])*)([^\\s,;"'{}&=*()<>?]{4,4096})`, "gi"), (_match, prefix) => `${prefix}***REDACTED***`);
+    // Bare high-entropy slugs (32-512 chars of token charset) with no key
+    // context. No word boundaries: consecutive chunks of a giant run each
+    // match, so a huge homogeneous value is consumed piecewise instead of
+    // overflowing the backtrack stack on one giant quantified match.
+    scrubbed = scrubbed.replace(/[A-Za-z0-9_-]{32,512}/g, "***REDACTED***");
+    // ChatGPT opaque token shapes — catches shorter RT_/AT_ values the entropy
+    // rule misses. No leading boundary: they may be glued inside identifiers.
+    scrubbed = scrubbed.replace(/(?:RT|AT)_ch_[A-Za-z0-9_-]{20,512}/g, "***REDACTED***");
     return scrubbed;
 }
 function redactSensitiveFields(value) {
@@ -69,14 +194,17 @@ function redactSensitiveFields(value) {
         return value.map((item) => redactSensitiveFields(item));
     }
     if (value !== null && typeof value === "object") {
-        const out = {};
-        const sensitiveSet = new Set(OAUTH_SENSITIVE_BODY_KEYS);
+        // Null-prototype map so a `__proto__` key stays ordinary data instead of
+        // munging the output object's prototype.
+        const out = Object.create(null);
         for (const [k, v] of Object.entries(value)) {
-            if (sensitiveSet.has(k)) {
+            if (isOAuthSensitiveKey(k)) {
                 out[k] = "***REDACTED***";
             }
             else {
-                out[k] = redactSensitiveFields(v);
+                // The key name itself can smuggle a token (an error response that
+                // echoes request fields verbatim) — scrub token shapes from it.
+                out[scrubTokenLikeSubstrings(k)] = redactSensitiveFields(v);
             }
         }
         return out;
@@ -120,34 +248,98 @@ export function sanitizeOAuthResponseBodyForLog(rawBody) {
             // Fall through to regex scrub for malformed JSON.
         }
     }
+    // Single-pass alternation over the normalized key shapes so case- and
+    // separator-varied spellings ("client-secret", "ACCESS TOKEN",
+    // "access%20token") still match when the body is not parseable JSON.
     let scrubbed = rawBody;
-    for (const key of OAUTH_SENSITIVE_BODY_KEYS) {
-        // "key":"value" style (JSON-like text)
-        const jsonPattern = new RegExp(`("${key}"\\s*:\\s*)"[^"]*"`, "g");
-        scrubbed = scrubbed.replace(jsonPattern, `$1"***REDACTED***"`);
-        // key=value style (urlencoded / query-string)
-        const urlPattern = new RegExp(`(^|[?&\\s])(${key}=)[^&\\s]+`, "g");
-        scrubbed = scrubbed.replace(urlPattern, `$1$2***REDACTED***`);
+    // "key":"value" / 'key':'value' style (JSON-like text); a stray separator
+    // may sit before the closing quote ("access_token ":).
+    scrubbed = scrubbed.replace(new RegExp(`(["'](?:${OAUTH_TEXT_SECRET_KEY_PATTERN})${OAUTH_KEY_SEPARATOR}["']\\s*:\\s*)["'][^"']*["']`, "gi"), `$1"***REDACTED***"`);
+    // key<sep>value style (urlencoded / query-string). The boundary class
+    // excludes `_` and alphanumerics so `device_code`/`error_code`/
+    // `csrf_token`/`opcode` are not redacted; a leading %XX escape does count
+    // as a boundary since it decodes to a delimiter.
+    scrubbed = scrubbed.replace(new RegExp(`(^|[^A-Za-z0-9_]|%[0-9a-zA-Z]{2})((?:${OAUTH_TEXT_SECRET_KEY_PATTERN})${OAUTH_KEY_SEPARATOR}(?:[:=]|%3[ad]|%253[ad]))[^&\\s]+`, "gi"), "$1$2***REDACTED***");
+    return scrubTokenLikeSubstrings(scrubbed);
+}
+function redactUrlSearchParamsForLog(params, depth) {
+    for (const key of new Set(params.keys())) {
+        if (isOAuthSensitiveKey(key)) {
+            params.set(key, "<redacted>");
+            continue;
+        }
+        // Non-sensitive keys still get a free-text scrub at every depth:
+        // `msg=refresh_token%3D...` or `error_description=Bearer ...` would
+        // otherwise carry embedded secrets straight into the log. URL values
+        // recurse structurally while depth remains, then fall back to the
+        // flat scrub so deeper nesting still loses its secrets.
+        const values = params.getAll(key);
+        const redactedValues = values.map((value) => /^https?:\/\//i.test(value) && depth > 0
+            ? redactOAuthUrlForLogDepth(value, depth - 1)
+            : scrubTokenLikeSubstrings(value));
+        if (redactedValues.some((v, i) => v !== values[i])) {
+            params.delete(key);
+            for (const v of redactedValues)
+                params.append(key, v);
+        }
     }
-    return scrubbed;
 }
-/**
- * Redacts sensitive OAuth query parameters for safe logging.
- * Returns the original string when parsing fails.
- */
-export function redactOAuthUrlForLog(rawUrl) {
+function redactOAuthUrlForLogDepth(rawUrl, depth) {
+    let parsed;
     try {
-        const parsed = new URL(rawUrl);
-        for (const key of OAUTH_SENSITIVE_QUERY_PARAMS) {
-            if (parsed.searchParams.has(key)) {
-                parsed.searchParams.set(key, "<redacted>");
-            }
-        }
-        return parsed.toString();
+        parsed = new URL(rawUrl);
     }
     catch {
-        return rawUrl;
+        return "<unparseable-url>";
     }
+    redactUrlSearchParamsForLog(parsed.searchParams, depth);
+    // Fragment params (#access_token=...) live in `hash`, not `searchParams`.
+    // A route-style fragment (#/path?code=...) keeps its prefix, which is
+    // itself free text that can carry secrets like `#code=...?` — scrub it
+    // rather than copying it back verbatim. The body is decoded first so a
+    // fully percent-encoded fragment cannot hide `?`/`=` from the splitter.
+    let hashBody = parsed.hash.startsWith("#") ? parsed.hash.slice(1) : "";
+    if (hashBody.includes("%")) {
+        try {
+            hashBody = decodeURIComponent(hashBody);
+        }
+        catch {
+            // Malformed escape — keep the raw fragment body.
+        }
+    }
+    if (hashBody.includes("=")) {
+        const qIndex = hashBody.indexOf("?");
+        const fragPath = qIndex >= 0 ? hashBody.slice(0, qIndex + 1) : "";
+        const fragParams = qIndex >= 0 ? hashBody.slice(qIndex + 1) : hashBody;
+        const scrubbedPath = scrubTokenLikeSubstrings(fragPath);
+        const params = new URLSearchParams(fragParams);
+        redactUrlSearchParamsForLog(params, depth);
+        const rebuilt = params.toString();
+        if (rebuilt !== fragParams || scrubbedPath !== fragPath) {
+            parsed.hash = `${scrubbedPath}${rebuilt}`;
+        }
+    }
+    else if (hashBody.length > 0) {
+        parsed.hash = scrubTokenLikeSubstrings(hashBody);
+    }
+    if (parsed.username)
+        parsed.username = "***";
+    if (parsed.password)
+        parsed.password = "***";
+    const scrubbedHost = scrubTokenLikeSubstrings(parsed.hostname);
+    if (scrubbedHost !== parsed.hostname)
+        parsed.hostname = scrubbedHost;
+    parsed.pathname = scrubTokenLikeSubstrings(parsed.pathname);
+    return parsed.toString();
+}
+/**
+ * Redacts sensitive OAuth parameters for safe logging: query keys match
+ * case-insensitively, fragment and nested-URL params are covered, userinfo is
+ * masked, and unparseable input collapses to `<unparseable-url>` so the raw
+ * string can never reach a log verbatim.
+ */
+export function redactOAuthUrlForLog(rawUrl) {
+    return redactOAuthUrlForLogDepth(rawUrl, 1);
 }
 /**
  * Generate a random state value for OAuth flow

package/dist/lib/auth/browser.d.ts

@@ -36,4 +36,3 @@ export declare function openBrowserUrl(url: string): boolean;
  * @returns `true` if a clipboard command was launched, `false` otherwise
  */
 export declare function copyTextToClipboard(text: string): boolean;
-//# sourceMappingURL=browser.d.ts.map

package/dist/lib/auth/callback-guidance.d.ts

@@ -36,4 +36,3 @@ export type CallbackFailureContext = {
  * @returns Guidance lines. Empty strings are intentional blank separators.
  */
 export declare function describeCallbackFailure(reason: CallbackFailureReason, context?: CallbackFailureContext): string[];
-//# sourceMappingURL=callback-guidance.d.ts.map

package/dist/lib/auth/device-auth.d.ts

@@ -39,4 +39,3 @@ export declare function requestDeviceAuthorization(options?: DeviceAuthFlowOptio
 export declare function pollDeviceAuthorization(deviceCode: DeviceAuthCode, options?: DeviceAuthFlowOptions): Promise<DeviceAuthCompletionResult>;
 export declare function runDeviceAuthFlow(options?: DeviceAuthFlowOptions): Promise<TokenResult>;
 export {};
-//# sourceMappingURL=device-auth.d.ts.map

package/dist/lib/auth/index.d.ts

@@ -1,4 +1,3 @@
 export * from "./auth.js";
 export { runDeviceAuthFlow } from "./device-auth.js";
 export type { DeviceAuthFlowOptions } from "./device-auth.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/lib/auth/org-override.d.ts

@@ -16,4 +16,3 @@
  * @returns the trimmed effective override, or null when neither source provides one
  */
 export declare function resolveOrgOverride(explicitOrg?: string, env?: NodeJS.ProcessEnv): string | null;
-//# sourceMappingURL=org-override.d.ts.map

package/dist/lib/auth/server.d.ts

@@ -6,7 +6,7 @@ import type { OAuthServerInfo } from "../types.js";
  * and retains a single authorization code on the server instance until consumed via `waitForCode`.
  * Only one code is stored at a time; call `close` to abort polling and shut down the server.
  *
- * On platforms such as Windows, binding to localhost:1455 may fail if another process holds the port
+ * On platforms such as Windows, binding the callback port may fail if another process holds it
  * or if firewall/antivirus restrictions prevent local binding; in that case the returned `ready`
  * flag is `false` to allow a manual paste fallback.
  *
@@ -21,4 +21,3 @@ import type { OAuthServerInfo } from "../types.js";
 export declare function startLocalOAuthServer({ state, }: {
     state: string;
 }): Promise<OAuthServerInfo>;
-//# sourceMappingURL=server.d.ts.map