codex-multi-auth 2.5.0 → 2.6.1

package/.codex-plugin/plugin.json

@@ -1,9 +1,9 @@
-{
-  "name": "codex-multi-auth",
-  "version": "2.5.0",
-  "description": "Install and operate codex-multi-auth for the official @openai/codex CLI with multi-account OAuth rotation, switching, health checks, and recovery tools.",
-  "interface": {
-    "composerIcon": "./assets/codex-multi-auth-icon.svg"
-  },
-  "skills": "./skills/"
-}
+{
+  "name": "codex-multi-auth",
+  "version": "2.6.1",
+  "description": "Install and operate codex-multi-auth for the official @openai/codex CLI with multi-account OAuth rotation, switching, health checks, and recovery tools.",
+  "interface": {
+    "composerIcon": "./assets/codex-multi-auth-icon.svg"
+  },
+  "skills": "./skills/"
+}

package/README.md

@@ -342,6 +342,7 @@ codex-multi-auth login
 - Requests fail fast after repeated upstream 5xx errors: inspect `codex-multi-auth report --json` for runtime traffic and cooldown details
 - Storage cleanup fails with `EBUSY` / `EPERM` (Windows): run `codex-multi-auth doctor --fix` to retry, or manually remove `~/.codex/multi-auth/<project-key>/` and re-login
 - OAuth callback on port `1455` fails: free the port and re-run `codex-multi-auth login`
+- Login hangs in WSL, or installing in WSL breaks a working Windows install: Windows and WSL contend for callback port `1455`, and the browser opens on the Windows host either way — see [Windows and WSL side by side](docs/troubleshooting.md#windows-and-wsl-side-by-side), or use `codex-multi-auth login --device-auth`, which needs no callback port
 - Browser launch is blocked or you are in a headless shell: prefer `codex-multi-auth login --device-auth`; use `codex-multi-auth login --manual` or `CODEX_AUTH_NO_BROWSER=1` only when you need the callback-paste fallback
 - `missing field id_token` / `token_expired` / `refresh_token_reused`: re-login affected account
 
@@ -384,7 +385,9 @@ codex-multi-auth doctor --json
 
 ## Release Notes
 
-- Current stable: [docs/releases/v2.4.0.md](docs/releases/v2.4.0.md) — install via `npm i -g codex-multi-auth`
+- Current stable: [docs/releases/v2.6.1.md](docs/releases/v2.6.1.md) — install via `npm i -g codex-multi-auth`
+- Previous stable: [docs/releases/v2.5.0.md](docs/releases/v2.5.0.md)
+- Previous stable: [docs/releases/v2.4.0.md](docs/releases/v2.4.0.md)
 - Previous stable: [docs/releases/v2.3.3.md](docs/releases/v2.3.3.md)
 - Previous stable: [docs/releases/v2.3.2.md](docs/releases/v2.3.2.md)
 - Previous stable: [docs/releases/v2.3.1.md](docs/releases/v2.3.1.md)

package/config/codex-legacy.json

@@ -15,6 +15,431 @@
         "store": false
       },
       "models": {
+        "gpt-5.6-sol-low": {
+          "name": "GPT 5.6 Sol Low (OAuth)",
+          "limit": {
+            "context": 372000,
+            "output": 128000
+          },
+          "modalities": {
+            "input": [
+              "text",
+              "image"
+            ],
+            "output": [
+              "text"
+            ]
+          },
+          "options": {
+            "reasoningEffort": "low",
+            "reasoningSummary": "auto",
+            "textVerbosity": "medium",
+            "include": [
+              "reasoning.encrypted_content"
+            ],
+            "store": false
+          }
+        },
+        "gpt-5.6-sol-medium": {
+          "name": "GPT 5.6 Sol Medium (OAuth)",
+          "limit": {
+            "context": 372000,
+            "output": 128000
+          },
+          "modalities": {
+            "input": [
+              "text",
+              "image"
+            ],
+            "output": [
+              "text"
+            ]
+          },
+          "options": {
+            "reasoningEffort": "medium",
+            "reasoningSummary": "auto",
+            "textVerbosity": "medium",
+            "include": [
+              "reasoning.encrypted_content"
+            ],
+            "store": false
+          }
+        },
+        "gpt-5.6-sol-high": {
+          "name": "GPT 5.6 Sol High (OAuth)",
+          "limit": {
+            "context": 372000,
+            "output": 128000
+          },
+          "modalities": {
+            "input": [
+              "text",
+              "image"
+            ],
+            "output": [
+              "text"
+            ]
+          },
+          "options": {
+            "reasoningEffort": "high",
+            "reasoningSummary": "detailed",
+            "textVerbosity": "medium",
+            "include": [
+              "reasoning.encrypted_content"
+            ],
+            "store": false
+          }
+        },
+        "gpt-5.6-sol-xhigh": {
+          "name": "GPT 5.6 Sol Extra High (OAuth)",
+          "limit": {
+            "context": 372000,
+            "output": 128000
+          },
+          "modalities": {
+            "input": [
+              "text",
+              "image"
+            ],
+            "output": [
+              "text"
+            ]
+          },
+          "options": {
+            "reasoningEffort": "xhigh",
+            "reasoningSummary": "detailed",
+            "textVerbosity": "medium",
+            "include": [
+              "reasoning.encrypted_content"
+            ],
+            "store": false
+          }
+        },
+        "gpt-5.6-sol-max": {
+          "name": "GPT 5.6 Sol Max (OAuth)",
+          "limit": {
+            "context": 372000,
+            "output": 128000
+          },
+          "modalities": {
+            "input": [
+              "text",
+              "image"
+            ],
+            "output": [
+              "text"
+            ]
+          },
+          "options": {
+            "reasoningEffort": "max",
+            "reasoningSummary": "detailed",
+            "textVerbosity": "medium",
+            "include": [
+              "reasoning.encrypted_content"
+            ],
+            "store": false
+          }
+        },
+        "gpt-5.6-sol-ultra": {
+          "name": "GPT 5.6 Sol Ultra (OAuth)",
+          "limit": {
+            "context": 372000,
+            "output": 128000
+          },
+          "modalities": {
+            "input": [
+              "text",
+              "image"
+            ],
+            "output": [
+              "text"
+            ]
+          },
+          "options": {
+            "reasoningEffort": "ultra",
+            "reasoningSummary": "detailed",
+            "textVerbosity": "medium",
+            "include": [
+              "reasoning.encrypted_content"
+            ],
+            "store": false
+          }
+        },
+        "gpt-5.6-terra-low": {
+          "name": "GPT 5.6 Terra Low (OAuth)",
+          "limit": {
+            "context": 372000,
+            "output": 128000
+          },
+          "modalities": {
+            "input": [
+              "text",
+              "image"
+            ],
+            "output": [
+              "text"
+            ]
+          },
+          "options": {
+            "reasoningEffort": "low",
+            "reasoningSummary": "auto",
+            "textVerbosity": "medium",
+            "include": [
+              "reasoning.encrypted_content"
+            ],
+            "store": false
+          }
+        },
+        "gpt-5.6-terra-medium": {
+          "name": "GPT 5.6 Terra Medium (OAuth)",
+          "limit": {
+            "context": 372000,
+            "output": 128000
+          },
+          "modalities": {
+            "input": [
+              "text",
+              "image"
+            ],
+            "output": [
+              "text"
+            ]
+          },
+          "options": {
+            "reasoningEffort": "medium",
+            "reasoningSummary": "auto",
+            "textVerbosity": "medium",
+            "include": [
+              "reasoning.encrypted_content"
+            ],
+            "store": false
+          }
+        },
+        "gpt-5.6-terra-high": {
+          "name": "GPT 5.6 Terra High (OAuth)",
+          "limit": {
+            "context": 372000,
+            "output": 128000
+          },
+          "modalities": {
+            "input": [
+              "text",
+              "image"
+            ],
+            "output": [
+              "text"
+            ]
+          },
+          "options": {
+            "reasoningEffort": "high",
+            "reasoningSummary": "detailed",
+            "textVerbosity": "medium",
+            "include": [
+              "reasoning.encrypted_content"
+            ],
+            "store": false
+          }
+        },
+        "gpt-5.6-terra-xhigh": {
+          "name": "GPT 5.6 Terra Extra High (OAuth)",
+          "limit": {
+            "context": 372000,
+            "output": 128000
+          },
+          "modalities": {
+            "input": [
+              "text",
+              "image"
+            ],
+            "output": [
+              "text"
+            ]
+          },
+          "options": {
+            "reasoningEffort": "xhigh",
+            "reasoningSummary": "detailed",
+            "textVerbosity": "medium",
+            "include": [
+              "reasoning.encrypted_content"
+            ],
+            "store": false
+          }
+        },
+        "gpt-5.6-terra-max": {
+          "name": "GPT 5.6 Terra Max (OAuth)",
+          "limit": {
+            "context": 372000,
+            "output": 128000
+          },
+          "modalities": {
+            "input": [
+              "text",
+              "image"
+            ],
+            "output": [
+              "text"
+            ]
+          },
+          "options": {
+            "reasoningEffort": "max",
+            "reasoningSummary": "detailed",
+            "textVerbosity": "medium",
+            "include": [
+              "reasoning.encrypted_content"
+            ],
+            "store": false
+          }
+        },
+        "gpt-5.6-terra-ultra": {
+          "name": "GPT 5.6 Terra Ultra (OAuth)",
+          "limit": {
+            "context": 372000,
+            "output": 128000
+          },
+          "modalities": {
+            "input": [
+              "text",
+              "image"
+            ],
+            "output": [
+              "text"
+            ]
+          },
+          "options": {
+            "reasoningEffort": "ultra",
+            "reasoningSummary": "detailed",
+            "textVerbosity": "medium",
+            "include": [
+              "reasoning.encrypted_content"
+            ],
+            "store": false
+          }
+        },
+        "gpt-5.6-luna-low": {
+          "name": "GPT 5.6 Luna Low (OAuth)",
+          "limit": {
+            "context": 372000,
+            "output": 128000
+          },
+          "modalities": {
+            "input": [
+              "text",
+              "image"
+            ],
+            "output": [
+              "text"
+            ]
+          },
+          "options": {
+            "reasoningEffort": "low",
+            "reasoningSummary": "auto",
+            "textVerbosity": "medium",
+            "include": [
+              "reasoning.encrypted_content"
+            ],
+            "store": false
+          }
+        },
+        "gpt-5.6-luna-medium": {
+          "name": "GPT 5.6 Luna Medium (OAuth)",
+          "limit": {
+            "context": 372000,
+            "output": 128000
+          },
+          "modalities": {
+            "input": [
+              "text",
+              "image"
+            ],
+            "output": [
+              "text"
+            ]
+          },
+          "options": {
+            "reasoningEffort": "medium",
+            "reasoningSummary": "auto",
+            "textVerbosity": "medium",
+            "include": [
+              "reasoning.encrypted_content"
+            ],
+            "store": false
+          }
+        },
+        "gpt-5.6-luna-high": {
+          "name": "GPT 5.6 Luna High (OAuth)",
+          "limit": {
+            "context": 372000,
+            "output": 128000
+          },
+          "modalities": {
+            "input": [
+              "text",
+              "image"
+            ],
+            "output": [
+              "text"
+            ]
+          },
+          "options": {
+            "reasoningEffort": "high",
+            "reasoningSummary": "detailed",
+            "textVerbosity": "medium",
+            "include": [
+              "reasoning.encrypted_content"
+            ],
+            "store": false
+          }
+        },
+        "gpt-5.6-luna-xhigh": {
+          "name": "GPT 5.6 Luna Extra High (OAuth)",
+          "limit": {
+            "context": 372000,
+            "output": 128000
+          },
+          "modalities": {
+            "input": [
+              "text",
+              "image"
+            ],
+            "output": [
+              "text"
+            ]
+          },
+          "options": {
+            "reasoningEffort": "xhigh",
+            "reasoningSummary": "detailed",
+            "textVerbosity": "medium",
+            "include": [
+              "reasoning.encrypted_content"
+            ],
+            "store": false
+          }
+        },
+        "gpt-5.6-luna-max": {
+          "name": "GPT 5.6 Luna Max (OAuth)",
+          "limit": {
+            "context": 372000,
+            "output": 128000
+          },
+          "modalities": {
+            "input": [
+              "text",
+              "image"
+            ],
+            "output": [
+              "text"
+            ]
+          },
+          "options": {
+            "reasoningEffort": "max",
+            "reasoningSummary": "detailed",
+            "textVerbosity": "medium",
+            "include": [
+              "reasoning.encrypted_content"
+            ],
+            "store": false
+          }
+        },
         "gpt-5.5-none": {
           "name": "GPT 5.5 None (OAuth)",
           "limit": {

package/dist/lib/auth/browser.d.ts

@@ -17,6 +17,10 @@ export declare function isBrowserLaunchSuppressed(): boolean;
  * OAuth codes) from `url` before calling. Invocations are not atomic—concurrent calls may race but are
  * safe to perform.
  *
+ * Under WSL the browser lives on the Windows host, so `xdg-open` is the wrong tool and is usually not
+ * even installed. Prefer `wslview` (wslu), then Windows PowerShell via interop, before falling back to
+ * the Linux opener.
+ *
  * @param url - The URL to open; redact sensitive tokens (e.g., OAuth codes) before passing.
  * @returns `true` if a browser launch was attempted, `false` if no suitable opener was available or an exception occurred.
  */

package/dist/lib/auth/browser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../../lib/auth/browser.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAUH;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAKzC;AAED,wBAAgB,yBAAyB,IAAI,OAAO,CAQnD;AA6DD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAwCnD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAmDzD"}
+{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../../lib/auth/browser.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAWH;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAKzC;AAED,wBAAgB,yBAAyB,IAAI,OAAO,CAQnD;AAqGD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAyCnD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CA8DzD"}

package/dist/lib/auth/browser.js

@@ -6,6 +6,7 @@ import { spawn } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 import { PLATFORM_OPENERS } from "../constants.js";
+import { isWsl } from "../wsl.js";
 const BROWSER_DISABLED_VALUES = new Set(["0", "false", "no", "off", "none"]);
 const NO_BROWSER_TRUTHY_VALUES = new Set(["1", "true", "yes", "on"]);
 /**
@@ -89,6 +90,40 @@ function commandExists(command) {
     }
     return false;
 }
+/**
+ * Escape a value for safe interpolation into a double-quoted PowerShell string.
+ *
+ * Neutralizes backticks, `$` sub-expression injection, and embedded double quotes.
+ */
+function escapeForPowerShell(value) {
+    return value.replace(/`/g, "``").replace(/\$/g, "`$").replace(/"/g, '""');
+}
+/**
+ * Run a PowerShell command, fire-and-forget.
+ *
+ * Reachable from Windows and from WSL, where `powershell.exe` resolves through
+ * Windows/Linux PATH interop.
+ *
+ * @param command - A PowerShell command string; interpolated values must already be escaped.
+ * @param stdinText - Optional text piped to the command's stdin.
+ * @returns `true` if the spawn was attempted, `false` if PowerShell is unavailable.
+ */
+function spawnPowerShell(command, stdinText) {
+    if (!commandExists("powershell.exe")) {
+        return false;
+    }
+    const child = spawn("powershell.exe", ["-NoLogo", "-NoProfile", "-Command", command], {
+        stdio: stdinText === undefined ? "ignore" : ["pipe", "ignore", "ignore"],
+    });
+    child.on("error", () => { });
+    if (stdinText !== undefined) {
+        // A child that dies before draining stdin emits EPIPE on the stream, not
+        // on the child. Unhandled, that is an async throw no try/catch can catch.
+        child.stdin?.on("error", () => { });
+        child.stdin?.end(stdinText);
+    }
+    return true;
+}
 /**
  * Launches the user's default browser to open the provided URL using a platform-appropriate command.
  *
@@ -98,6 +133,10 @@ function commandExists(command) {
  * OAuth codes) from `url` before calling. Invocations are not atomic—concurrent calls may race but are
  * safe to perform.
  *
+ * Under WSL the browser lives on the Windows host, so `xdg-open` is the wrong tool and is usually not
+ * even installed. Prefer `wslview` (wslu), then Windows PowerShell via interop, before falling back to
+ * the Linux opener.
+ *
  * @param url - The URL to open; redact sensitive tokens (e.g., OAuth codes) before passing.
  * @returns `true` if a browser launch was attempted, `false` if no suitable opener was available or an exception occurred.
  */
@@ -108,17 +147,22 @@ export function openBrowserUrl(url) {
         }
         // Windows: use PowerShell Start-Process to avoid cmd/start quirks with URLs containing '&' or ':'
         if (process.platform === "win32") {
-            if (!commandExists("powershell.exe")) {
-                return false;
+            return spawnPowerShell(`Start-Process "${escapeForPowerShell(url)}"`);
+        }
+        if (isWsl()) {
+            // wslu's browser shim: hands the URL to the Windows default browser.
+            if (commandExists("wslview")) {
+                const child = spawn("wslview", [url], {
+                    stdio: "ignore",
+                    shell: false,
+                });
+                child.on("error", () => { });
+                return true;
             }
-            // Escape PowerShell special characters: backticks, double quotes, and $ (sub-expression injection)
-            const psUrl = url
-                .replace(/`/g, "``")
-                .replace(/\$/g, "`$")
-                .replace(/"/g, '""');
-            const child = spawn("powershell.exe", ["-NoLogo", "-NoProfile", "-Command", `Start-Process "${psUrl}"`], { stdio: "ignore" });
-            child.on("error", () => { });
-            return true;
+            if (spawnPowerShell(`Start-Process "${escapeForPowerShell(url)}"`)) {
+                return true;
+            }
+            // Fall through: an X/Wayland browser inside the distro is still possible.
         }
         const opener = getBrowserOpener();
         if (!commandExists(opener)) {
@@ -151,16 +195,24 @@ export function copyTextToClipboard(text) {
         if (!text)
             return false;
         if (process.platform === "win32") {
-            if (!commandExists("powershell.exe")) {
-                return false;
+            return spawnPowerShell(`Set-Clipboard -Value "${escapeForPowerShell(text)}"`);
+        }
+        if (isWsl()) {
+            // The clipboard the user pastes from is the Windows one, not the distro's.
+            if (commandExists("clip.exe")) {
+                const child = spawn("clip.exe", [], {
+                    stdio: ["pipe", "ignore", "ignore"],
+                    shell: false,
+                });
+                child.on("error", () => { });
+                child.stdin?.on("error", () => { });
+                child.stdin?.end(text);
+                return true;
             }
-            const psText = text
-                .replace(/`/g, "``")
-                .replace(/\$/g, "`$")
-                .replace(/"/g, '""');
-            const child = spawn("powershell.exe", ["-NoLogo", "-NoProfile", "-Command", `Set-Clipboard -Value "${psText}"`], { stdio: "ignore" });
-            child.on("error", () => { });
-            return true;
+            if (spawnPowerShell(`Set-Clipboard -Value "${escapeForPowerShell(text)}"`)) {
+                return true;
+            }
+            // Fall through to the Linux clipboard tools.
         }
         if (process.platform === "darwin") {
             if (!commandExists("pbcopy"))
@@ -170,6 +222,7 @@ export function copyTextToClipboard(text) {
                 shell: false,
             });
             child.on("error", () => { });
+            child.stdin?.on("error", () => { });
             child.stdin?.end(text);
             return true;
         }
@@ -186,6 +239,7 @@ export function copyTextToClipboard(text) {
                 shell: false,
             });
             child.on("error", () => { });
+            child.stdin?.on("error", () => { });
             child.stdin?.end(text);
             return true;
         }

package/dist/lib/auth/callback-guidance.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Operator-facing guidance for OAuth callback failures on the fixed callback port.
+ *
+ * The redirect URI is registered with the provider, so the port cannot be
+ * negotiated away when it is contended. The best the CLI can do is name the
+ * likely conflict and point at a flow that does not need the port at all.
+ *
+ * Windows and WSL contend for that port as far as a browser running on the
+ * Windows host is concerned, so a listener on either side can swallow a callback
+ * intended for the other. From inside the distro this is invisible: the WSL
+ * listener binds cleanly and simply never receives the redirect.
+ */
+/**
+ * Why the browser callback did not produce an authorization code.
+ *
+ * - `bind-failed`: the local listener could not take the callback port at all.
+ * - `callback-timeout`: the listener bound, but no redirect ever arrived.
+ */
+export type CallbackFailureReason = "bind-failed" | "callback-timeout";
+/** @internal */
+export type CallbackFailureContext = {
+    /** `errno` code from a failed listen, when one is known. */
+    bindErrorCode?: string;
+};
+/**
+ * Build the lines shown to the user when a browser OAuth callback fails.
+ *
+ * Contention is only *asserted* when it was actually observed — that is, the
+ * listen failed with `EADDRINUSE`. A callback that never arrives is far more
+ * often a cancelled or abandoned sign-in than a stolen redirect, so that case
+ * is phrased as a conditional ("if you completed sign-in and still landed
+ * here") rather than a diagnosis.
+ *
+ * @param reason - Which half of the callback flow broke.
+ * @param context - Extra detail from the failed bind, when available.
+ * @returns Guidance lines. Empty strings are intentional blank separators.
+ */
+export declare function describeCallbackFailure(reason: CallbackFailureReason, context?: CallbackFailureContext): string[];
+//# sourceMappingURL=callback-guidance.d.ts.map

package/dist/lib/auth/callback-guidance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback-guidance.d.ts","sourceRoot":"","sources":["../../../lib/auth/callback-guidance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAAG,aAAa,GAAG,kBAAkB,CAAC;AAEvE,gBAAgB;AAChB,MAAM,MAAM,sBAAsB,GAAG;IACpC,4DAA4D;IAC5D,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AA4CF;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACtC,MAAM,EAAE,qBAAqB,EAC7B,OAAO,GAAE,sBAA2B,GAClC,MAAM,EAAE,CA0CV"}