codex-multi-auth 2.3.0-beta.1 → 2.3.0-beta.2

package/dist/lib/codex-manager/login-oauth.js

@@ -0,0 +1,345 @@
+import { stdin as input, stdout as output } from "node:process";
+import { createInterface } from "node:readline/promises";
+import { extractAccountEmail, extractAccountId, getAccountIdCandidates, resolveRequestAccountId, sanitizeEmail, selectBestAccountCandidate, } from "../accounts.js";
+import { createAuthorizationFlow, exchangeAuthorizationCode, redactOAuthUrlForLog, REDIRECT_URI, } from "../auth/auth.js";
+import { copyTextToClipboard, openBrowserUrl, } from "../auth/browser.js";
+import { runDeviceAuthFlow } from "../auth/device-auth.js";
+import { resolveOrgOverride } from "../auth/org-override.js";
+import { startLocalOAuthServer } from "../auth/server.js";
+import { setCodexCliActiveSelection } from "../codex-cli/writer.js";
+import { createLogger } from "../logger.js";
+import { MODEL_FAMILIES } from "../prompts/codex.js";
+import { findMatchingAccountIndex, withAccountStorageTransaction, } from "../storage.js";
+import { UI_COPY } from "../ui/ui-copy.js";
+import { applyAccountPoolResults, } from "./account-pool-write.js";
+import { stylePromptText } from "./formatters/index.js";
+import { classifyManualCallbackInput, } from "./manual-callback.js";
+const log = createLogger("codex-manager");
+/** @internal */
+export function isOAuthCancellation(result) {
+    const message = (result.message ?? result.reason ?? "").trim().toLowerCase();
+    return message.includes("cancelled") || message.includes("canceled");
+}
+/** @internal */
+export function isAbortError(error) {
+    if (!(error instanceof Error))
+        return false;
+    const maybe = error;
+    return maybe.name === "AbortError" || maybe.code === "ABORT_ERR";
+}
+/**
+ * Resolve the account-id selection for freshly-minted tokens.
+ *
+ * The org-override precedence (explicit `login --org` wins over the ambient
+ * CODEX_AUTH_ACCOUNT_ID env, for this call only) lives in the internal
+ * lib/auth/org-override.ts module so it can be unit-tested without exporting this
+ * CLI-internal function. Threading the org as a parameter avoids mutating
+ * process.env for the duration of a login, which raced on concurrent re-entry.
+ *
+ * @internal
+ */
+export function resolveAccountSelection(tokens, orgOverride) {
+    const candidates = getAccountIdCandidates(tokens.access, tokens.idToken);
+    // Surface every workspace/organization exposed by the token so the saved
+    // account can track them (issue #491/#512). Without this, same-email
+    // multi-workspace logins persisted rows with `workspaces: null` and
+    // `workspace <account>` was unusable. Built before the `--org` override
+    // branch so the explicit-binding flow persists workspaces too (#512).
+    const workspaces = candidates.length > 0
+        ? candidates.map((candidate) => ({
+            id: candidate.accountId,
+            name: candidate.label,
+            enabled: true,
+            isDefault: candidate.isDefault,
+        }))
+        : undefined;
+    const override = resolveOrgOverride(orgOverride);
+    if (override) {
+        // Prefer the token candidate's human label for the chosen org so the
+        // saved row is identifiable, falling back to a bare manual binding.
+        const matched = candidates.find((candidate) => candidate.accountId === override);
+        return {
+            ...tokens,
+            accountIdOverride: override,
+            accountIdSource: "manual",
+            accountLabel: matched?.label,
+            workspaces,
+        };
+    }
+    if (candidates.length === 0) {
+        return tokens;
+    }
+    if (candidates.length === 1) {
+        const [candidate] = candidates;
+        if (candidate) {
+            return {
+                ...tokens,
+                accountIdOverride: candidate.accountId,
+                accountIdSource: candidate.source,
+                accountLabel: candidate.label,
+                workspaces,
+            };
+        }
+    }
+    const best = selectBestAccountCandidate(candidates);
+    if (!best) {
+        return tokens;
+    }
+    return {
+        ...tokens,
+        accountIdOverride: best.accountId,
+        accountIdSource: best.source ?? "token",
+        accountLabel: best.label,
+        workspaces,
+    };
+}
+async function promptManualCallback(state, options = {}) {
+    const useInteractivePrompt = input.isTTY && output.isTTY;
+    if (!useInteractivePrompt && !options.allowNonTty) {
+        return { type: "cancelled" };
+    }
+    const rl = createInterface({ input, output });
+    try {
+        if (useInteractivePrompt) {
+            console.log("");
+            console.log(stylePromptText(UI_COPY.oauth.pastePrompt, "accent"));
+        }
+        const answer = useInteractivePrompt
+            ? await rl.question("◆  ")
+            : await new Promise((resolve, reject) => {
+                if (input.readableEnded || input.destroyed) {
+                    resolve(null);
+                    return;
+                }
+                let settled = false;
+                const handleInputClosed = () => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    input.off("end", handleInputClosed);
+                    input.off("close", handleInputClosed);
+                    resolve(null);
+                };
+                const finish = (value) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    input.off("end", handleInputClosed);
+                    input.off("close", handleInputClosed);
+                    resolve(value);
+                };
+                const fail = (error) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    input.off("end", handleInputClosed);
+                    input.off("close", handleInputClosed);
+                    reject(error);
+                };
+                rl.question("")
+                    .then((value) => finish(value))
+                    .catch((error) => {
+                    if (isAbortError(error) || isReadlineClosedError(error)) {
+                        handleInputClosed();
+                        return;
+                    }
+                    fail(error);
+                });
+                input.once("end", handleInputClosed);
+                input.once("close", handleInputClosed);
+            });
+        return classifyManualCallbackInput(answer, state);
+    }
+    catch (error) {
+        if (isAbortError(error) || isReadlineClosedError(error)) {
+            return { type: "cancelled" };
+        }
+        throw error;
+    }
+    finally {
+        rl.close();
+    }
+}
+function isReadlineClosedError(error) {
+    if (!(error instanceof Error)) {
+        return false;
+    }
+    const errorCode = typeof error === "object" && error !== null && "code" in error
+        ? String(error.code)
+        : "";
+    return (errorCode === "ERR_USE_AFTER_CLOSE" ||
+        /readline was closed/i.test(error.message));
+}
+/** @internal */
+export async function runOAuthFlow(forceNewLogin, signInMode) {
+    const { pkce, state, url } = await createAuthorizationFlow({ forceNewLogin });
+    let code = null;
+    let oauthServer = null;
+    try {
+        if (signInMode === "browser") {
+            try {
+                oauthServer = await startLocalOAuthServer({ state });
+            }
+            catch (serverError) {
+                log.warn("Local OAuth callback server unavailable; falling back to manual callback entry.", serverError instanceof Error
+                    ? {
+                        message: serverError.message,
+                        stack: serverError.stack,
+                        code: typeof serverError === "object" &&
+                            serverError !== null &&
+                            "code" in serverError
+                            ? String(serverError.code)
+                            : undefined,
+                    }
+                    : { error: String(serverError) });
+                oauthServer = null;
+            }
+        }
+        // Display the OAuth URL with sensitive query parameters (state,
+        // code, code_challenge, code_verifier) redacted so they do not leak
+        // into shell history, screen captures, CI transcripts, or clipboard
+        // managers. The full URL is still handed to the browser opener and
+        // the clipboard so sign-in continues to work end-to-end.
+        const displayUrl = redactOAuthUrlForLog(url);
+        if (signInMode === "browser") {
+            const opened = openBrowserUrl(url);
+            if (opened) {
+                console.log(stylePromptText(UI_COPY.oauth.browserOpened, "success"));
+            }
+            else {
+                console.log(stylePromptText(UI_COPY.oauth.browserOpenFail, "warning"));
+                console.log(`${stylePromptText(UI_COPY.oauth.goTo, "accent")} ${displayUrl}`);
+                const copied = copyTextToClipboard(url);
+                console.log(stylePromptText(copied ? UI_COPY.oauth.copyOk : UI_COPY.oauth.copyFail, copied ? "success" : "warning"));
+            }
+        }
+        else {
+            console.log(`${stylePromptText(UI_COPY.oauth.goTo, "accent")} ${displayUrl}`);
+            const copied = copyTextToClipboard(url);
+            console.log(stylePromptText(copied ? UI_COPY.oauth.copyOk : UI_COPY.oauth.copyFail, copied ? "success" : "warning"));
+        }
+        const waitingForCallback = signInMode === "browser" && oauthServer?.ready === true;
+        if (waitingForCallback && oauthServer) {
+            console.log(stylePromptText(UI_COPY.oauth.waitingCallback, "muted"));
+            const callbackResult = await oauthServer.waitForCode(state);
+            code = callbackResult?.code ?? null;
+        }
+        if (!code) {
+            console.log(stylePromptText(waitingForCallback
+                ? UI_COPY.oauth.callbackMissed
+                : signInMode === "manual"
+                    ? UI_COPY.oauth.callbackBypassed
+                    : UI_COPY.oauth.callbackUnavailable, "warning"));
+            const manualResult = await promptManualCallback(state, {
+                allowNonTty: signInMode === "manual",
+            });
+            // A parse/state failure must surface its own validation error instead
+            // of being reported as `Cancelled.` like a genuine user abort
+            // (issue #512 follow-up). Only an actual cancellation falls through to
+            // the cancelled path below.
+            if (manualResult.type === "invalid") {
+                return {
+                    type: "failed",
+                    reason: "invalid_response",
+                    message: UI_COPY.oauth.callbackInvalid,
+                };
+            }
+            if (manualResult.type === "state-mismatch") {
+                return {
+                    type: "failed",
+                    reason: "invalid_response",
+                    message: UI_COPY.oauth.callbackStateMismatch,
+                };
+            }
+            code = manualResult.type === "code" ? manualResult.code : null;
+        }
+    }
+    finally {
+        oauthServer?.close();
+    }
+    if (!code) {
+        return {
+            type: "failed",
+            reason: "unknown",
+            message: UI_COPY.oauth.cancelled,
+        };
+    }
+    return exchangeAuthorizationCode(code, pkce.verifier, REDIRECT_URI);
+}
+/** @internal */
+export async function runSignInFlow(forceNewLogin, signInMode, options = {}) {
+    if (signInMode === "device") {
+        // OpenAI owns the device-code account picker; there is no force-new-login
+        // equivalent to pass through for this mode.
+        // TODO: Thread a manager-level AbortSignal when login cancellation exists.
+        return runDeviceAuthFlow({
+            log: console.log,
+            timeoutMs: options.timeoutMs,
+            // CLI invocations rely on top-level await in scripts/codex-multi-auth.js;
+            // without keepAlive the polling timers unref and Node exits before the
+            // user can complete the browser step (issue #477).
+            keepAlive: true,
+        });
+    }
+    return runOAuthFlow(forceNewLogin, signInMode);
+}
+/** @internal */
+export async function persistAccountPool(results, replaceAll) {
+    if (results.length === 0)
+        return null;
+    return await withAccountStorageTransaction(async (loadedStorage, persist) => {
+        const stored = replaceAll ? null : loadedStorage;
+        const now = Date.now();
+        const existing = stored?.accounts ? [...stored.accounts] : [];
+        const writes = results.map((result) => {
+            const tokenAccountId = extractAccountId(result.access);
+            const accountId = resolveRequestAccountId(result.accountIdOverride, result.accountIdSource, tokenAccountId);
+            const accountIdSource = accountId
+                ? (result.accountIdSource ??
+                    (result.accountIdOverride ? "manual" : "token"))
+                : undefined;
+            return {
+                accountId,
+                accountIdSource,
+                accountLabel: result.accountLabel,
+                email: sanitizeEmail(extractAccountEmail(result.access, result.idToken)),
+                refreshToken: result.refresh,
+                accessToken: result.access,
+                expiresAt: result.expires,
+                workspaces: result.workspaces,
+                now,
+            };
+        });
+        const { accounts, activeIndex, outcome } = applyAccountPoolResults({
+            existing,
+            writes,
+            priorActiveIndex: stored?.activeIndex,
+            findMatchingAccountIndex,
+        });
+        const activeIndexByFamily = {};
+        for (const family of MODEL_FAMILIES) {
+            activeIndexByFamily[family] = activeIndex;
+        }
+        await persist({
+            version: 3,
+            accounts,
+            activeIndex,
+            activeIndexByFamily,
+        });
+        return outcome;
+    });
+}
+/** @internal */
+export async function syncSelectionToCodex(tokens) {
+    const tokenAccountId = extractAccountId(tokens.access);
+    const accountId = resolveRequestAccountId(tokens.accountIdOverride, tokens.accountIdSource, tokenAccountId);
+    const email = sanitizeEmail(extractAccountEmail(tokens.access, tokens.idToken));
+    await setCodexCliActiveSelection({
+        accountId,
+        email,
+        accessToken: tokens.access,
+        refreshToken: tokens.refresh,
+        expiresAt: tokens.expires,
+        idToken: tokens.idToken,
+    });
+}

package/dist/lib/codex-manager/manual-callback.js

@@ -28,4 +28,3 @@ export function classifyManualCallbackInput(answer, expectedState) {
     }
     return { type: "code", code: parsed.code };
 }
-//# sourceMappingURL=manual-callback.js.map

package/dist/lib/codex-manager/persist-selected-account.d.ts

@@ -0,0 +1,24 @@
+import type { PersistedSwitchReason } from "../schemas.js";
+import { type AccountStorageV3 } from "../storage.js";
+/**
+ * Persist an explicit account selection and sync it to the Codex CLI state.
+ *
+ * Shared by the `switch` and `best` commands (injected via their deps objects)
+ * and by the login dashboard's backup-restore flow. Moved verbatim out of
+ * lib/codex-manager.ts (audit roadmap §4.1.1 phase 3).
+ */
+export declare function persistAndSyncSelectedAccount({ storage, targetIndex, parsed, switchReason, initialSyncIdToken, preserveActiveIndexByFamily, setPin, clearPin, bumpAffinityGeneration, }: {
+    storage: AccountStorageV3;
+    targetIndex: number;
+    parsed: number;
+    switchReason: PersistedSwitchReason;
+    initialSyncIdToken?: string;
+    preserveActiveIndexByFamily?: boolean;
+    setPin?: boolean;
+    clearPin?: boolean;
+    bumpAffinityGeneration?: boolean;
+}): Promise<{
+    synced: boolean;
+    wasDisabled: boolean;
+}>;
+//# sourceMappingURL=persist-selected-account.d.ts.map

package/dist/lib/codex-manager/persist-selected-account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"persist-selected-account.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/persist-selected-account.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EACN,KAAK,gBAAgB,EAIrB,MAAM,eAAe,CAAC;AAQvB;;;;;;GAMG;AACH,wBAAsB,6BAA6B,CAAC,EACnD,OAAO,EACP,WAAW,EACX,MAAM,EACN,YAAY,EACZ,kBAAkB,EAClB,2BAAmC,EACnC,MAAc,EACd,QAAgB,EAChB,sBAA8B,GAC9B,EAAE;IACF,OAAO,EAAE,gBAAgB,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,qBAAqB,CAAC;IACpC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,sBAAsB,CAAC,EAAE,OAAO,CAAC;CACjC,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,CAAC,CAqGrD"}

package/dist/lib/codex-manager/persist-selected-account.js

@@ -0,0 +1,107 @@
+import { extractAccountEmail, extractAccountId, sanitizeEmail, } from "../accounts.js";
+import { setCodexCliActiveSelection } from "../codex-cli/writer.js";
+import { MODEL_FAMILIES } from "../prompts/codex.js";
+import { queuedRefresh } from "../refresh-queue.js";
+import { getStoragePath, readAffinityGenerationFromDisk, saveAccounts, } from "../storage.js";
+import { applyTokenAccountIdentity, hasUsableAccessToken, } from "./account-credentials.js";
+import { normalizeFailureDetail } from "./formatters/index.js";
+import { saveAccountsWithRetry } from "./forecast-report-shared.js";
+/**
+ * Persist an explicit account selection and sync it to the Codex CLI state.
+ *
+ * Shared by the `switch` and `best` commands (injected via their deps objects)
+ * and by the login dashboard's backup-restore flow. Moved verbatim out of
+ * lib/codex-manager.ts (audit roadmap §4.1.1 phase 3).
+ */
+export async function persistAndSyncSelectedAccount({ storage, targetIndex, parsed, switchReason, initialSyncIdToken, preserveActiveIndexByFamily = false, setPin = false, clearPin = false, bumpAffinityGeneration = false, }) {
+    const account = storage.accounts[targetIndex];
+    if (!account) {
+        throw new Error(`Account ${parsed} not found.`);
+    }
+    const shouldPreserveActiveIndexByFamily = preserveActiveIndexByFamily &&
+        !!storage.activeIndexByFamily &&
+        targetIndex === storage.activeIndex;
+    storage.activeIndex = targetIndex;
+    storage.activeIndexByFamily = storage.activeIndexByFamily ?? {};
+    if (shouldPreserveActiveIndexByFamily) {
+        const maxIndex = Math.max(0, storage.accounts.length - 1);
+        for (const family of MODEL_FAMILIES) {
+            const raw = storage.activeIndexByFamily[family];
+            const candidate = typeof raw === "number" && Number.isFinite(raw) ? raw : targetIndex;
+            storage.activeIndexByFamily[family] = Math.max(0, Math.min(candidate, maxIndex));
+        }
+    }
+    else {
+        storage.activeIndexByFamily = storage.activeIndexByFamily ?? {};
+        for (const family of MODEL_FAMILIES) {
+            storage.activeIndexByFamily[family] = targetIndex;
+        }
+    }
+    const wasDisabled = account.enabled === false;
+    if (wasDisabled) {
+        account.enabled = true;
+    }
+    const switchNow = Date.now();
+    let syncAccessToken = account.accessToken;
+    let syncRefreshToken = account.refreshToken;
+    let syncExpiresAt = account.expiresAt;
+    let syncIdToken = initialSyncIdToken;
+    if (!hasUsableAccessToken(account, switchNow)) {
+        const refreshResult = await queuedRefresh(account.refreshToken);
+        if (refreshResult.type === "success") {
+            const tokenAccountId = extractAccountId(refreshResult.access);
+            const nextEmail = sanitizeEmail(extractAccountEmail(refreshResult.access, refreshResult.idToken));
+            if (account.refreshToken !== refreshResult.refresh) {
+                account.refreshToken = refreshResult.refresh;
+            }
+            if (account.accessToken !== refreshResult.access) {
+                account.accessToken = refreshResult.access;
+            }
+            if (account.expiresAt !== refreshResult.expires) {
+                account.expiresAt = refreshResult.expires;
+            }
+            if (nextEmail && nextEmail !== account.email) {
+                account.email = nextEmail;
+            }
+            applyTokenAccountIdentity(account, tokenAccountId);
+            syncAccessToken = refreshResult.access;
+            syncRefreshToken = refreshResult.refresh;
+            syncExpiresAt = refreshResult.expires;
+            syncIdToken = refreshResult.idToken;
+        }
+        else {
+            console.warn(`Switch validation refresh failed for account ${parsed}: ${normalizeFailureDetail(refreshResult.message, refreshResult.reason)}.`);
+        }
+    }
+    account.lastUsed = switchNow;
+    account.lastSwitchReason = switchReason;
+    if (setPin) {
+        storage.pinnedAccountIndex = targetIndex;
+    }
+    else if (clearPin) {
+        delete storage.pinnedAccountIndex;
+    }
+    if (bumpAffinityGeneration) {
+        // Re-read the on-disk generation right before saving so concurrent CLI
+        // processes don't lose increments via lost-update on the load+mutate
+        // pair. Math.max keeps the counter monotonically increasing — extra
+        // bumps are harmless (just an additional affinity invalidation), but a
+        // missed bump can let the proxy cling to the wrong account. The save
+        // itself is serialized by withStorageLock; this only narrows the
+        // lost-update window. See issue #474.
+        const diskGeneration = readAffinityGenerationFromDisk(getStoragePath());
+        const inMemoryGeneration = storage.affinityGeneration ?? 0;
+        storage.affinityGeneration =
+            Math.max(inMemoryGeneration, diskGeneration) + 1;
+    }
+    await saveAccountsWithRetry(storage, saveAccounts);
+    const synced = await setCodexCliActiveSelection({
+        accountId: account.accountId,
+        email: account.email,
+        accessToken: syncAccessToken,
+        refreshToken: syncRefreshToken,
+        expiresAt: syncExpiresAt,
+        ...(syncIdToken ? { idToken: syncIdToken } : {}),
+    });
+    return { synced, wasDisabled };
+}

package/dist/lib/codex-manager/quota-cache-helpers.d.ts

@@ -0,0 +1,18 @@
+import { type QuotaCacheData, type QuotaCacheEntry } from "../quota-cache.js";
+import type { CodexQuotaSnapshot } from "../quota-probe.js";
+import type { AccountMetadataV3 } from "../storage.js";
+/**
+ * Quota-cache lookup/update helpers shared by the manager CLI commands (audit
+ * roadmap §4.1.1 phase 3). These previously lived as module-private helpers in
+ * lib/codex-manager.ts and were closure-captured by the health check, the
+ * forecast/repair dependency factories, and the login dashboard menu. Moved
+ * verbatim so every consumer injects or imports the same single
+ * implementation.
+ */
+/** Default model used for live quota probes across manager commands. */
+export declare const DEFAULT_LIVE_PROBE_MODEL = "gpt-5.5";
+export declare function getPersistedQuotaViewForAccount(cache: QuotaCacheData | null, account: Pick<AccountMetadataV3, "accountId" | "email" | "rateLimitResetTimes">, accounts: readonly Pick<AccountMetadataV3, "accountId" | "email">[], now: number, emailFallbackState?: ReadonlyMap<string, import("../quota-readiness.js").QuotaEmailFallbackState>): QuotaCacheEntry | null;
+export declare function updateQuotaCacheForAccount(cache: QuotaCacheData, account: Pick<AccountMetadataV3, "accountId" | "email">, snapshot: CodexQuotaSnapshot, accounts: readonly Pick<AccountMetadataV3, "accountId" | "email">[], emailFallbackState?: ReadonlyMap<string, import("../quota-readiness.js").QuotaEmailFallbackState>): boolean;
+export declare function cloneQuotaCacheData(cache: QuotaCacheData): QuotaCacheData;
+export declare function pruneUnsafeQuotaEmailCacheEntry(cache: QuotaCacheData, email: string | undefined, accounts: readonly Pick<AccountMetadataV3, "accountId" | "email">[], emailFallbackState?: ReadonlyMap<string, import("../quota-readiness.js").QuotaEmailFallbackState>): boolean;
+//# sourceMappingURL=quota-cache-helpers.d.ts.map

package/dist/lib/codex-manager/quota-cache-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quota-cache-helpers.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/quota-cache-helpers.ts"],"names":[],"mappings":"AAOA,OAAO,EACN,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAG5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEvD;;;;;;;GAOG;AAEH,wEAAwE;AACxE,eAAO,MAAM,wBAAwB,YAAgB,CAAC;AA2BtD,wBAAgB,+BAA+B,CAC9C,KAAK,EAAE,cAAc,GAAG,IAAI,EAC5B,OAAO,EAAE,IAAI,CACZ,iBAAiB,EACjB,WAAW,GAAG,OAAO,GAAG,qBAAqB,CAC7C,EACD,QAAQ,EAAE,SAAS,IAAI,CAAC,iBAAiB,EAAE,WAAW,GAAG,OAAO,CAAC,EAAE,EACnE,GAAG,EAAE,MAAM,EACX,kBAAkB,+EAAyC,GACzD,eAAe,GAAG,IAAI,CA+BxB;AAED,wBAAgB,0BAA0B,CACzC,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,WAAW,GAAG,OAAO,CAAC,EACvD,QAAQ,EAAE,kBAAkB,EAC5B,QAAQ,EAAE,SAAS,IAAI,CAAC,iBAAiB,EAAE,WAAW,GAAG,OAAO,CAAC,EAAE,EACnE,kBAAkB,+EAAyC,GACzD,OAAO,CAuCT;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,cAAc,GAAG,cAAc,CAOzE;AAED,wBAAgB,+BAA+B,CAC9C,KAAK,EAAE,cAAc,EACrB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,QAAQ,EAAE,SAAS,IAAI,CAAC,iBAAiB,EAAE,WAAW,GAAG,OAAO,CAAC,EAAE,EACnE,kBAAkB,+EAAyC,GACzD,OAAO,CAeT"}

package/dist/lib/codex-manager/quota-cache-helpers.js

@@ -0,0 +1,112 @@
+import { buildQuotaEmailFallbackState, hasSafeQuotaEmailFallback, hasUniqueQuotaAccountId, normalizeQuotaAccountId, normalizeQuotaEmail, } from "../quota-readiness.js";
+import { DEFAULT_MODEL } from "../request/helpers/model-map.js";
+import { getRateLimitResetTimeForFamily } from "../runtime/account-status.js";
+/**
+ * Quota-cache lookup/update helpers shared by the manager CLI commands (audit
+ * roadmap §4.1.1 phase 3). These previously lived as module-private helpers in
+ * lib/codex-manager.ts and were closure-captured by the health check, the
+ * forecast/repair dependency factories, and the login dashboard menu. Moved
+ * verbatim so every consumer injects or imports the same single
+ * implementation.
+ */
+/** Default model used for live quota probes across manager commands. */
+export const DEFAULT_LIVE_PROBE_MODEL = DEFAULT_MODEL;
+function getQuotaCacheEntryForAccount(cache, account, accounts, emailFallbackState = buildQuotaEmailFallbackState(accounts)) {
+    const accountId = normalizeQuotaAccountId(account.accountId);
+    if (accountId &&
+        hasUniqueQuotaAccountId(accounts, account) &&
+        cache.byAccountId[accountId]) {
+        return cache.byAccountId[accountId] ?? null;
+    }
+    const email = normalizeQuotaEmail(account.email);
+    if (email &&
+        hasSafeQuotaEmailFallback(emailFallbackState, account) &&
+        cache.byEmail[email]) {
+        return cache.byEmail[email] ?? null;
+    }
+    return null;
+}
+export function getPersistedQuotaViewForAccount(cache, account, accounts, now, emailFallbackState = buildQuotaEmailFallbackState(accounts)) {
+    const cachedEntry = cache
+        ? getQuotaCacheEntryForAccount(cache, account, accounts, emailFallbackState)
+        : null;
+    const persistedResetAt = getRateLimitResetTimeForFamily(account, now, "codex");
+    if (typeof persistedResetAt !== "number") {
+        return cachedEntry;
+    }
+    const cachedPrimaryResetAt = cachedEntry?.primary.resetAtMs ?? 0;
+    const cachedSecondaryResetAt = cachedEntry?.secondary.resetAtMs ?? 0;
+    if (cachedEntry?.status === 429 &&
+        Math.max(cachedPrimaryResetAt, cachedSecondaryResetAt) >= persistedResetAt) {
+        return cachedEntry;
+    }
+    return {
+        updatedAt: cachedEntry?.updatedAt ?? now,
+        status: 429,
+        model: cachedEntry?.model ?? DEFAULT_MODEL,
+        planType: cachedEntry?.planType,
+        primary: {
+            ...cachedEntry?.primary,
+            resetAtMs: Math.max(cachedPrimaryResetAt, persistedResetAt),
+        },
+        secondary: cachedEntry?.secondary ?? {},
+    };
+}
+export function updateQuotaCacheForAccount(cache, account, snapshot, accounts, emailFallbackState = buildQuotaEmailFallbackState(accounts)) {
+    const nextEntry = {
+        updatedAt: Date.now(),
+        status: snapshot.status,
+        model: snapshot.model,
+        planType: snapshot.planType,
+        primary: {
+            usedPercent: snapshot.primary.usedPercent,
+            windowMinutes: snapshot.primary.windowMinutes,
+            resetAtMs: snapshot.primary.resetAtMs,
+        },
+        secondary: {
+            usedPercent: snapshot.secondary.usedPercent,
+            windowMinutes: snapshot.secondary.windowMinutes,
+            resetAtMs: snapshot.secondary.resetAtMs,
+        },
+    };
+    let changed = false;
+    const accountId = normalizeQuotaAccountId(account.accountId);
+    const hasUniqueAccountId = accountId !== null && hasUniqueQuotaAccountId(accounts, account);
+    if (hasUniqueAccountId) {
+        cache.byAccountId[accountId] = nextEntry;
+        changed = true;
+    }
+    const email = normalizeQuotaEmail(account.email);
+    if (email &&
+        hasSafeQuotaEmailFallback(emailFallbackState, account) &&
+        !hasUniqueAccountId) {
+        cache.byEmail[email] = nextEntry;
+        changed = true;
+    }
+    else if (email && cache.byEmail[email]) {
+        delete cache.byEmail[email];
+        changed = true;
+    }
+    return changed;
+}
+export function cloneQuotaCacheData(cache) {
+    // Shallow spreading is safe because quota cache entries are always replaced,
+    // never mutated in-place.
+    return {
+        byAccountId: { ...cache.byAccountId },
+        byEmail: { ...cache.byEmail },
+    };
+}
+export function pruneUnsafeQuotaEmailCacheEntry(cache, email, accounts, emailFallbackState = buildQuotaEmailFallbackState(accounts)) {
+    const normalizedEmail = normalizeQuotaEmail(email);
+    if (!normalizedEmail || !cache.byEmail[normalizedEmail]) {
+        return false;
+    }
+    const hasSafeFallbackAccount = accounts.some((account) => normalizeQuotaEmail(account.email) === normalizedEmail &&
+        hasSafeQuotaEmailFallback(emailFallbackState, account));
+    if (hasSafeFallbackAccount) {
+        return false;
+    }
+    delete cache.byEmail[normalizedEmail];
+    return true;
+}

package/dist/lib/codex-manager/rate-limit-markers.js

@@ -1,4 +1,3 @@
 export function isRateLimitedMarker(marker) {
     return marker === "rate-limited" || marker.startsWith("rate-limited:");
 }
-//# sourceMappingURL=rate-limit-markers.js.map

package/dist/lib/codex-manager/repair-commands.js

@@ -1733,4 +1733,3 @@ export async function runDoctor(args, deps) {
     }
     return summary.error > 0 ? 1 : 0;
 }
-//# sourceMappingURL=repair-commands.js.map

package/dist/lib/codex-manager/settings-hub/backend.js

@@ -1,5 +1,5 @@
 import { loadPluginConfig } from "../../config.js";
-import { UI_COPY } from "../../ui/copy.js";
+import { UI_COPY } from "../../ui/ui-copy.js";
 import { getUiRuntimeOptions } from "../../ui/runtime.js";
 import { select } from "../../ui/select.js";
 import { promptBackendCategorySettingsEntry } from "../backend-category-entry.js";
@@ -76,4 +76,3 @@ export async function configureBackendSettings(currentConfig) {
     });
 }
 /* c8 ignore stop */
-//# sourceMappingURL=backend.js.map

package/dist/lib/codex-manager/settings-hub/dashboard.js

@@ -1,5 +1,5 @@
 import { DEFAULT_DASHBOARD_DISPLAY_SETTINGS, getDashboardSettingsPath, loadDashboardDisplaySettings, } from "../../dashboard-settings.js";
-import { UI_COPY } from "../../ui/copy.js";
+import { UI_COPY } from "../../ui/ui-copy.js";
 import { getUiRuntimeOptions, setUiRuntimeOptions } from "../../ui/runtime.js";
 import { promptBehaviorSettingsPanel } from "../behavior-settings-panel.js";
 import { promptDashboardDisplayPanel, } from "../dashboard-display-panel.js";
@@ -220,4 +220,3 @@ export async function promptThemeSettings(initial) {
     });
 }
 /* c8 ignore stop */
-//# sourceMappingURL=dashboard.js.map