codex-multi-auth 2.21.0 → 2.23.0

package/dist/lib/codex-manager.js

@@ -39,10 +39,13 @@ import { runInitConfigCommand } from "./codex-manager/commands/init-config.js";
 import { runReportCommand } from "./codex-manager/commands/report.js";
 import { runRotationCommand } from "./codex-manager/commands/rotation.js";
 import { runFeaturesCommand, runStatusCommand, } from "./codex-manager/commands/status.js";
+import { runWebCommand } from "./web-dashboard.js";
 import { loadPersistedRuntimeObservabilitySnapshot } from "./runtime/runtime-observability.js";
 import { runSwitchCommand } from "./codex-manager/commands/switch.js";
 import { runHistoryCommand } from "./codex-manager/commands/history.js";
+import { runLocaleCommand } from "./codex-manager/commands/locale.js";
 import { runUnpinCommand } from "./codex-manager/commands/unpin.js";
+import { resolveOutputLocale } from "./locale.js";
 import { runWorkspaceCommand } from "./codex-manager/commands/workspace.js";
 import { runUsageCommand } from "./codex-manager/commands/usage.js";
 import { refreshQuotaCacheForMenu } from "./codex-manager/login-menu-data.js";
@@ -140,6 +143,7 @@ const IMPLEMENTED_FEATURES = [
     { id: 52, name: "Why-selected and monitor diagnostics" },
     { id: 53, name: "Config explain, init-config templates, and debug bundle" },
     { id: 54, name: "mcodex convenience launcher (monitor/tmux/forward)" },
+    { id: 55, name: "Local real-time web pool dashboard" },
 ];
 async function runForecast(args) {
     return runForecastCommand(args, {
@@ -267,25 +271,50 @@ export function buildSelectAccountTraced() {
 /**
  * Shared handler for `list` and `status` (aliases of the same view).
  */
-const runListOrStatusCommand = (rest) => runStatusCommand({
-    loadApiRoutes,
-    loadResetCreditState,
-    loadInferenceRequestTimes,
-    loadModelInventory,
-    setStoragePath,
-    getStoragePath,
-    loadAccounts,
-    inspectStorageHealth,
-    resolveActiveIndex,
-    formatRateLimitEntry,
-    loadRuntimeObservabilitySnapshot: loadPersistedRuntimeObservabilitySnapshot,
-    loadAppBindStatus: async () => getAppBindStatus()
-        .then((status) => (status.running && status.router ? { ...status.router, nativeOpenai: status.state?.nativeOpenai === true } : null))
-        .catch(() => null),
-    loadAppHelperStatus: readAppRuntimeHelperAccountSignal,
-    loadQuotaCache,
-    json: rest.includes("--json") || rest.includes("-j"),
-});
+function buildStatusCommandDeps(rest, logInfo) {
+    return {
+        loadApiRoutes,
+        loadResetCreditState,
+        loadInferenceRequestTimes,
+        loadModelInventory,
+        setStoragePath,
+        getStoragePath,
+        loadAccounts,
+        inspectStorageHealth,
+        resolveActiveIndex,
+        formatRateLimitEntry,
+        loadRuntimeObservabilitySnapshot: loadPersistedRuntimeObservabilitySnapshot,
+        loadAppBindStatus: async () => getAppBindStatus()
+            .then((status) => status.router ? {
+            ...status.router,
+            // Keep historical diagnostics, but never revive a crashed router's
+            // persisted "running" marker or its account-selection signal.
+            state: status.running ? status.router.state : "stopped",
+            nativeOpenai: status.running && status.state?.nativeOpenai === true,
+        } : null)
+            .catch(() => null),
+        loadAppHelperStatus: readAppRuntimeHelperAccountSignal,
+        loadQuotaCache,
+        json: rest.includes("--json") || rest.includes("-j"),
+        compact: !rest.includes("--details") && !rest.includes("--verbose") && !rest.includes("--json") && !rest.includes("-j"),
+        locale: resolveOutputLocale(loadPluginConfig().locale),
+        ...(logInfo ? { logInfo } : {}),
+    };
+}
+const runListOrStatusCommand = (rest) => runStatusCommand(buildStatusCommandDeps(rest));
+async function loadStatusJsonSnapshot() {
+    let serialized = "";
+    const exitCode = await runStatusCommand(buildStatusCommandDeps(["--json"], (message) => {
+        serialized = message;
+    }));
+    if (exitCode !== 0)
+        throw new Error("Unable to load status snapshot.");
+    const parsed = JSON.parse(serialized);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new Error("Status snapshot is not an object.");
+    }
+    return parsed;
+}
 /**
  * Command registry for the `auth` dispatcher (audit roadmap §4.1.1 phase 2).
  *
@@ -301,6 +330,10 @@ const CLI_COMMAND_HANDLERS = new Map([
     ["login", (rest) => runAuthLogin(rest, { runForecast, createRepairCommandDeps })],
     ["list", runListOrStatusCommand],
     ["status", runListOrStatusCommand],
+    ["web", (rest) => runWebCommand(rest, {
+            getStatus: loadStatusJsonSnapshot,
+            locale: resolveOutputLocale(loadPluginConfig().locale),
+        })],
     [
         "limits",
         (rest) => runLimitsCommand(rest, {
@@ -475,6 +508,12 @@ const CLI_COMMAND_HANDLERS = new Map([
             if (subcommand === "template") {
                 return runInitConfigCommand(configArgs);
             }
+            if (subcommand === "locale") {
+                return runLocaleCommand(configArgs, {
+                    loadConfig: () => loadPluginConfig(),
+                    saveConfig: savePluginConfig,
+                });
+            }
             console.error(`Unknown config command: ${subcommand ?? "(missing)"}`);
             return 1;
         },
@@ -500,6 +539,32 @@ const CLI_COMMAND_HANDLERS = new Map([
     ],
 ]);
 export async function runCodexMultiAuthCli(rawArgs) {
+    const localeArgs = [...rawArgs];
+    const previousLocaleOverride = process.env.CODEX_MULTI_AUTH_LOCALE;
+    let localeOverrideChanged = false;
+    const restoreLocaleOverride = () => {
+        if (!localeOverrideChanged)
+            return;
+        if (previousLocaleOverride === undefined)
+            delete process.env.CODEX_MULTI_AUTH_LOCALE;
+        else
+            process.env.CODEX_MULTI_AUTH_LOCALE = previousLocaleOverride;
+    };
+    for (let i = 0; i < localeArgs.length; i += 1) {
+        const arg = localeArgs[i];
+        if (arg === "--locale" && localeArgs[i + 1]) {
+            process.env.CODEX_MULTI_AUTH_LOCALE = localeArgs[i + 1];
+            localeOverrideChanged = true;
+            localeArgs.splice(i, 2);
+            i -= 1;
+        }
+        else if (typeof arg === "string" && arg.startsWith("--locale=")) {
+            process.env.CODEX_MULTI_AUTH_LOCALE = arg.slice("--locale=".length);
+            localeOverrideChanged = true;
+            localeArgs.splice(i, 1);
+            i -= 1;
+        }
+    }
     // Lazy install setup (audit roadmap §4.5.4): app detection, Codex app bind,
     // and launcher routing moved out of npm postinstall to the first CLI run.
     // ensureFirstRunSetup never throws; the catch is belt-and-braces so no
@@ -509,31 +574,41 @@ export async function runCodexMultiAuthCli(rawArgs) {
     }).catch(() => undefined);
     const startupDisplaySettings = await loadDashboardDisplaySettings();
     applyUiThemeFromDashboardSettings(startupDisplaySettings);
-    const args = rawArgs[0] && rawArgs[0] !== "auth" && ACCOUNT_MANAGER_COMMANDS.has(rawArgs[0])
-        ? ["auth", ...rawArgs]
-        : [...rawArgs];
+    const args = localeArgs[0] && localeArgs[0] !== "auth" && ACCOUNT_MANAGER_COMMANDS.has(localeArgs[0])
+        ? ["auth", ...localeArgs]
+        : [...localeArgs];
     if (args.length === 0) {
+        restoreLocaleOverride();
         printUsage();
         return 0;
     }
     if (args[0] === "--help" || args[0] === "-h") {
+        restoreLocaleOverride();
         printUsage();
         return 0;
     }
     const [root, sub, ...rest] = args;
     if (root !== "auth") {
+        restoreLocaleOverride();
         printUsage();
         return 1;
     }
     const command = sub ?? "login";
     if (command === "--help" || command === "-h") {
+        restoreLocaleOverride();
         printUsage();
         return 0;
     }
     const handler = CLI_COMMAND_HANDLERS.get(command);
     if (handler) {
-        return handler(rest);
+        try {
+            return await handler(rest);
+        }
+        finally {
+            restoreLocaleOverride();
+        }
     }
+    restoreLocaleOverride();
     console.error(`Unknown command: ${command}`);
     printUsage();
     return 1;

package/dist/lib/config.js

@@ -1,6 +1,7 @@
 import { existsSync, promises as fs, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { parseBooleanEnv } from "./env-parsing.js";
+import { normalizeOutputLocaleSetting } from "./locale.js";
 import { stripModelEffortSuffix } from "./constants.js";
 import { withRetry, withRetrySync } from "./fs-retry.js";
 import { logWarn } from "./logger.js";
@@ -113,6 +114,7 @@ function resolvePluginConfigPath() {
  * CODEX_MODE is enabled by default for better Codex CLI parity
  */
 export const DEFAULT_PLUGIN_CONFIG = {
+    locale: "auto",
     codexMode: true,
     codexRuntimeRotationProxy: true,
     codexTuiV2: true,
@@ -1275,6 +1277,7 @@ function normalizeConfigExplainValue(value) {
     return value;
 }
 const CONFIG_EXPLAIN_ENTRIES = [
+    { key: "locale", envNames: ["CODEX_MULTI_AUTH_LOCALE"], getValue: config => normalizeOutputLocaleSetting(process.env.CODEX_MULTI_AUTH_LOCALE?.trim() || config.locale || "auto") ?? "auto" },
     { key: "codexMode", envNames: ["CODEX_MODE"], getValue: getCodexMode },
     {
         key: "codexRuntimeRotationProxy",

package/dist/lib/constants.d.ts

@@ -48,6 +48,7 @@ export declare const URL_PATHS: {
     readonly MODELS: "/models";
     readonly RESPONSES: "/responses";
     readonly CODEX_RESPONSES: "/codex/responses";
+    readonly TRANSCRIBE: "/transcribe";
 };
 /** JWT claim path for ChatGPT account ID */
 export declare const JWT_CLAIM_PATH: "https://api.openai.com/auth";

package/dist/lib/constants.js

@@ -48,6 +48,7 @@ export const URL_PATHS = {
     MODELS: "/models",
     RESPONSES: "/responses",
     CODEX_RESPONSES: "/codex/responses",
+    TRANSCRIBE: "/transcribe",
 };
 /** JWT claim path for ChatGPT account ID */
 export const JWT_CLAIM_PATH = "https://api.openai.com/auth";

package/dist/lib/locale.d.ts

@@ -0,0 +1,7 @@
+export type OutputLocale = "en" | "zh";
+export type OutputLocaleSetting = OutputLocale | "auto";
+/** Resolve an explicit locale, environment override, or system language. */
+export declare function resolveOutputLocale(requested?: string | null, env?: NodeJS.ProcessEnv): OutputLocale;
+export declare function normalizeOutputLocaleSetting(value: string): OutputLocaleSetting | null;
+export declare function localized(locale: OutputLocale, en: string, zh: string): string;
+export declare function localeName(locale: OutputLocale): string;

package/dist/lib/locale.js

@@ -0,0 +1,35 @@
+const SUPPORTED_LOCALES = new Set(["auto", "en", "zh"]);
+/** Resolve an explicit locale, environment override, or system language. */
+export function resolveOutputLocale(requested, env = process.env) {
+    const configured = requested?.trim().toLowerCase();
+    const value = (env.CODEX_MULTI_AUTH_LOCALE?.trim() || configured || "auto")
+        .trim()
+        .toLowerCase();
+    if (value === "en" || value.startsWith("en-"))
+        return "en";
+    if (value === "zh" || value.startsWith("zh-"))
+        return "zh";
+    if (value !== "" && value !== "auto" && SUPPORTED_LOCALES.has(value)) {
+        return value === "zh" ? "zh" : "en";
+    }
+    const system = [env.LC_ALL, env.LC_MESSAGES, env.LANG]
+        .find((candidate) => typeof candidate === "string" && candidate.trim())
+        ?.toLowerCase() ?? "";
+    return system.startsWith("zh") ? "zh" : "en";
+}
+export function normalizeOutputLocaleSetting(value) {
+    const normalized = value.trim().toLowerCase();
+    if (normalized === "auto")
+        return "auto";
+    if (normalized === "en" || normalized.startsWith("en-"))
+        return "en";
+    if (normalized === "zh" || normalized.startsWith("zh-"))
+        return "zh";
+    return null;
+}
+export function localized(locale, en, zh) {
+    return locale === "zh" ? zh : en;
+}
+export function localeName(locale) {
+    return locale === "zh" ? "中文" : "English";
+}

package/dist/lib/model-route-policy.d.ts

@@ -38,6 +38,7 @@ export declare function buildVisibleModelUnion(catalogs: RouteCatalog[]): RouteM
 /** Whitelist capability metadata; never persist model instructions or arbitrary fields. */
 export declare function modelEntitlements(model: RouteModel): {
     model: string;
+    programCheckedAt?: number | undefined;
     checkedAt?: number | undefined;
     probes?: {
         [k: string]: "downgraded" | "unsupported" | "unverified" | "verified";

package/dist/lib/model-route-policy.js

@@ -129,12 +129,13 @@ export function modelEntitlements(model) {
     const safe = (v) => typeof v === "string" && /^[A-Za-z0-9._-]{1,80}$/.test(v);
     return {
         model: model.slug,
+        ...(typeof model.program_checked_at === "number" && Number.isFinite(model.program_checked_at) && model.program_checked_at >= 0 && model.program_checked_at <= 8.64e15 ? { programCheckedAt: model.program_checked_at } : {}),
         ...(typeof model.capability_checked_at === "number"
             ? { checkedAt: model.capability_checked_at }
             : {}),
         ...(isRecord(model.capability_probe_status)
             ? {
-                probes: Object.fromEntries(Object.entries(model.capability_probe_status).filter((entry) => /^(responses|fast|ultrafast|effort:(none|minimal|low|medium|high|xhigh|max|ultra))$/.test(entry[0]) &&
+                probes: Object.fromEntries(Object.entries(model.capability_probe_status).filter((entry) => /^(responses|fast|ultrafast|effort:(none|minimal|low|medium|high|xhigh|max|ultra)|program:cyber:(standard|daybreak_blue|daybreak_red))$/.test(entry[0]) &&
                     [
                         "verified",
                         "unsupported",

package/dist/lib/quota-probe.js

@@ -1,4 +1,5 @@
 import { CODEX_BASE_URL, MAX_RATE_LIMIT_DELAY_MS } from "./constants.js";
+import { fetchWithProxy } from "./request/proxy-fetch.js";
 import { createCodexHeaders, getUnsupportedCodexModelInfo } from "./request/fetch-helpers.js";
 import { QUOTA_PROBE_MODEL_CHAIN, resolveProbeReasoningEffort, } from "./request/helpers/model-map.js";
 import { CodexUnavailableError, isCodexUnavailableError } from "./errors.js";
@@ -367,7 +368,7 @@ export async function fetchCodexQuotaSnapshot(options) {
                     snapshot.diagnosticProbeRequests += 1;
                     snapshot.runtimeMetrics.diagnosticProbeRequests += 1;
                 });
-                response = await fetch(`${CODEX_BASE_URL}/codex/responses`, {
+                response = await fetchWithProxy(`${CODEX_BASE_URL}/codex/responses`, {
                     method: "POST",
                     headers,
                     body: JSON.stringify(probeBody),

package/dist/lib/request/proxy-fetch.d.ts

@@ -0,0 +1,5 @@
+type FetchInput = Parameters<typeof globalThis.fetch>[0];
+type FetchInit = Parameters<typeof globalThis.fetch>[1];
+export declare function setProxyFetchImpl(impl: typeof globalThis.fetch | null): void;
+export declare function fetchWithProxy(input: FetchInput, init?: FetchInit): ReturnType<typeof globalThis.fetch>;
+export {};

package/dist/lib/request/proxy-fetch.js

@@ -0,0 +1,37 @@
+import { fetch as undiciFetch } from "undici";
+import { applyProxyCompatibleInit, extractRequestUrl, } from "./url-rewriting.js";
+// Transport selection contract, in precedence order:
+//   1. An implementation registered via setProxyFetchImpl (embedding contract;
+//    works regardless of when the host installs it).
+//   2. A global fetch replaced after this module loaded, or a test double.
+//   3. A global fetch installed before module load — honored when it is
+//    distinguishable from the platform fetch (Node's built-in is named
+//    "fetch"); hosts needing guaranteed interception use setProxyFetchImpl.
+//   4. The package's Undici fetch, but only when the request carries a proxy
+//    dispatcher: Node 22's built-in fetch rejects the Undici 8 handler
+//    contract, so a proxied call needs the matching implementation.
+//   5. The ambient global fetch for ordinary direct requests.
+const initialGlobalFetch = globalThis.fetch;
+let overrideFetch = null;
+export function setProxyFetchImpl(impl) {
+    overrideFetch = impl;
+}
+function isTestDouble(fetchImpl) {
+    const candidate = fetchImpl;
+    return candidate._isMockFunction === true || candidate.mock !== undefined;
+}
+function isPlatformFetch(fetchImpl) {
+    return fetchImpl.name === "fetch" && !isTestDouble(fetchImpl);
+}
+export function fetchWithProxy(input, init) {
+    const url = extractRequestUrl(input);
+    const proxiedInit = applyProxyCompatibleInit(url, init);
+    const currentGlobalFetch = globalThis.fetch;
+    const baseFetch = overrideFetch ??
+        (currentGlobalFetch !== initialGlobalFetch || !isPlatformFetch(currentGlobalFetch)
+            ? currentGlobalFetch
+            : proxiedInit.dispatcher
+                ? undiciFetch
+                : currentGlobalFetch);
+    return baseFetch(input, proxiedInit);
+}

package/dist/lib/request/url-rewriting.js

@@ -98,11 +98,28 @@ function shouldBypassProxyForUrl(url, noProxyValue) {
     }
     return false;
 }
+/**
+ * Loopback destinations never traverse a configured proxy: routing them through
+ * HTTP_PROXY would leak managed bearer tokens to the proxy and break the
+ * loopback-only runtime proxy contract. This bypass applies even when NO_PROXY
+ * is unset, matching curl/git proxy conventions.
+ */
+function isLoopbackRequestHost(url) {
+    const hostname = url.hostname.replace(/^\[|\]$/g, "").toLowerCase();
+    return (hostname === "localhost" ||
+        hostname.endsWith(".localhost") ||
+        hostname === "::1" ||
+        hostname.startsWith("127.") ||
+        hostname.startsWith("::ffff:127."));
+}
 export function resolveProxyUrlForRequest(url, env = process.env) {
     const parsed = new URL(url);
     if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
         return undefined;
     }
+    if (isLoopbackRequestHost(parsed)) {
+        return undefined;
+    }
     const httpProxy = resolveProxyEnvValue(env, "http_proxy", "HTTP_PROXY");
     const httpsProxy = resolveProxyEnvValue(env, "https_proxy", "HTTPS_PROXY");
     if (!httpProxy && !httpsProxy) {

package/dist/lib/runtime/account-model-catalog.d.ts

@@ -23,6 +23,8 @@ export declare class AccountModelCatalog {
     private readonly pending;
     constructor(fetchCatalog: (accountKey: string) => Promise<unknown>, now?: () => number, ttlMs?: number);
     private read;
+    /** Includes successful empty catalogs; stale or failed discovery remains unknown. */
+    hasUsablePickerSnapshot(key: string): boolean;
     /** Picker-only stale-while-refresh view; routing still awaits fresh discovery. */
     cachedList(accountKeys: string[]): CatalogModel[];
     invalidate(): void;
@@ -47,6 +49,7 @@ export declare class AccountModelCatalog {
         models: string[];
         entitlements: {
             model: string;
+            programCheckedAt?: number | undefined;
             checkedAt?: number | undefined;
             probes?: {
                 [k: string]: "downgraded" | "unsupported" | "unverified" | "verified";

package/dist/lib/runtime/account-model-catalog.js

@@ -83,12 +83,17 @@ export class AccountModelCatalog {
             this.pending.delete(key);
         }
     }
+    /** Includes successful empty catalogs; stale or failed discovery remains unknown. */
+    hasUsablePickerSnapshot(key) {
+        const entry = this.cache.get(key);
+        return Boolean(entry && !entry.error && entry.checkedAt <= this.now() && this.now() - entry.checkedAt < 15 * 60_000);
+    }
     /** Picker-only stale-while-refresh view; routing still awaits fresh discovery. */
     cachedList(accountKeys) {
         return buildVisibleModelUnion(accountKeys.map((key, index) => {
             const entry = this.cache.get(key);
-            const usable = entry && !entry.error && entry.checkedAt <= this.now() && this.now() - entry.checkedAt < 15 * 60_000;
-            return { id: key, kind: "oauth", priority: index, enabled: true, models: usable ? entry.models ?? [] : [], visibleModels: null };
+            const usable = this.hasUsablePickerSnapshot(key);
+            return { id: key, kind: "oauth", priority: index, enabled: true, models: usable ? entry?.models ?? [] : [], visibleModels: null };
         }));
     }
     invalidate() { this.cache.clear(); }

package/dist/lib/runtime/api-model-capabilities.d.ts

@@ -3,6 +3,9 @@ import { type RouteModel } from "../model-route-policy.js";
 /** Read the explicit model-specific statement, never surrounding examples or another model's settings. */
 export declare function parseApiReasoningDocumentation(id: string, text: string): string[];
 export type ProbeResult = {
+    ownerEpoch?: string;
+    programCheckedAt?: number;
+    programRetry?: boolean;
     at: number;
     levels: string[];
     tiers: string[];
@@ -11,19 +14,25 @@ export type ProbeResult = {
 export declare class ApiModelCapabilities {
     private readonly fetchImpl;
     private readonly now;
+    private readonly probeSlot?;
+    private readonly documentationSource?;
+    private readonly programRefreshBefore?;
     private activeProbes;
     private readonly probeWaiters;
     private withProbeSlot;
     private readonly inFlight;
     private readonly probes;
     private readonly cache;
-    constructor(fetchImpl?: typeof fetch, now?: () => number);
+    constructor(fetchImpl?: typeof fetch, now?: () => number, probeSlot?: (<T>(operation: () => Promise<T>) => Promise<T>) | undefined, documentationSource?: ApiModelCapabilities | undefined, programRefreshBefore?: number | undefined);
     /** Probe results keyed by an opaque hash, for a fresh CLI process to honour the 15-minute cache. */
     exportProbes(): Array<[string, ProbeResult]>;
     importProbes(entries: Array<[string, ProbeResult]>): void;
     reasoning(id: string, refresh?: boolean): Promise<string[]>;
     private documentation;
+    private programsCoverCheck;
+    private freshProbe;
+    private reconcileReasoning;
     private probe;
     private runProbe;
-    enrich(models: RouteModel[], refresh?: boolean, route?: ApiRouteCredential, forceProbes?: boolean): Promise<RouteModel[]>;
+    enrich(models: RouteModel[], refresh?: boolean, route?: ApiRouteCredential, forceProbes?: boolean, cachedProbesOnly?: Array<[string, ProbeResult]>): Promise<RouteModel[]>;
 }