codex-multi-auth 2.7.1 → 2.8.1

package/scripts/codex.js

@@ -74,6 +74,10 @@ const APP_RUNTIME_HELPER_OWNER_PID_ENV =
 	"CODEX_MULTI_AUTH_APP_ROTATION_OWNER_PID";
 const APP_RUNTIME_HELPER_REAL_CODEX_HOME_ENV =
 	"CODEX_MULTI_AUTH_REAL_CODEX_HOME";
+const APP_RUNTIME_HELPER_USE_CANONICAL_HOME_ENV =
+	"CODEX_MULTI_AUTH_APP_ROTATION_USE_CANONICAL_HOME";
+const APP_SERVER_CONFIG_ARGS_ENV =
+	"CODEX_MULTI_AUTH_APP_SERVER_CONFIG_ARGS_JSON";
 const APP_RUNTIME_HELPER_STATUS_FILE =
 	RUNTIME_CONSTANTS.APP_RUNTIME_HELPER_STATUS_FILE;
 const DEFAULT_APP_RUNTIME_HELPER_IDLE_MS = 12 * 60 * 60 * 1000;
@@ -1083,6 +1087,34 @@ async function loadRuntimeConfigTomlModule() {
 	}
 }
 
+// Reconciles the persisted `cli_auth_credentials_store` in ~/.codex/config.toml
+// to "file" before forwarding.
+//
+// `buildForwardArgs` already appends `-c cli_auth_credentials_store="file"`, but
+// that only covers the process this wrapper spawns. Third-party front-ends
+// (CodexBar and friends) exec the official binary directly and read config.toml
+// instead, so a config still pointing at "keychain" keeps producing macOS login
+// keychain prompts (issue #641). Running the reconcile here self-heals a config
+// that something else flipped back — e.g. a fresh official `codex login`.
+//
+// Idempotent: the lib helper returns without writing when the value is already
+// "file", so this adds no write amplification on the common path.
+async function ensurePersistedCodexFileAuthStore() {
+	const forceFileAuthStore = (process.env.CODEX_MULTI_AUTH_FORCE_FILE_AUTH_STORE ?? "1").trim() !== "0";
+	if (!forceFileAuthStore) return;
+
+	try {
+		const mod = await import("../dist/lib/codex-cli/writer.js");
+		if (typeof mod.ensureCodexCliFileAuthStore !== "function") return;
+		await mod.ensureCodexCliFileAuthStore();
+	} catch (error) {
+		if (isModuleNotFoundError(error)) return;
+		// Best effort only. A read-only or locked config.toml (Windows
+		// EPERM/EBUSY) must never block the wrapped command: the per-invocation
+		// `-c` override still protects this run.
+	}
+}
+
 async function autoSyncManagerActiveSelectionIfEnabled() {
 	const enabled = (process.env.CODEX_MULTI_AUTH_AUTO_SYNC_ON_STARTUP ?? "1").trim() !== "0";
 	if (!enabled) return;
@@ -3490,6 +3522,38 @@ function createRuntimeRotationProxyCodexHome(
 	};
 }
 
+function createRuntimeRotationProxyCanonicalCodexHome(
+	baseEnv,
+	proxyBaseUrl,
+	clientApiKey,
+	configTomlModule,
+) {
+	const originalCodexHome = resolveRuntimeRotationProxyOriginalCodexHome(baseEnv);
+	const providerTable = `model_providers.${RUNTIME_ROTATION_PROXY_PROVIDER_ID}`;
+	const configArgs = [
+		`${providerTable}.name=${configTomlModule.tomlStringLiteral(APP_SERVER_ACCOUNT_DISPLAY_NAME)}`,
+		`${providerTable}.base_url=${configTomlModule.tomlStringLiteral(proxyBaseUrl)}`,
+		`${providerTable}.env_key=${configTomlModule.tomlStringLiteral("OPENAI_API_KEY")}`,
+		`${providerTable}.requires_openai_auth=false`,
+		`${providerTable}.wire_api=${configTomlModule.tomlStringLiteral("responses")}`,
+		"disable_response_storage=false",
+	].flatMap((assignment) => ["-c", assignment]);
+
+	return {
+		args: configArgs,
+		env: {
+			...baseEnv,
+			CODEX_HOME: originalCodexHome,
+			OPENAI_API_KEY: clientApiKey,
+			CODEX_MULTI_AUTH_DIR: resolveRuntimeRotationOriginalMultiAuthDir(
+				originalCodexHome,
+				baseEnv,
+			),
+		},
+		cleanup: () => {},
+	};
+}
+
 function appendNodeImportOption(nodeOptions, preloadPath) {
 	const importOption = `--import=${pathToFileURL(preloadPath).href}`;
 	const trimmed = (nodeOptions ?? "").trim();
@@ -3504,15 +3568,26 @@ function createRuntimeRotationAppServerPreloadSource(wrapperScriptPath) {
 		"",
 		`const wrapperScriptPath = ${JSON.stringify(wrapperScriptPath)};`,
 		`const accountLabelEnv = ${JSON.stringify(APP_SERVER_ACCOUNT_LABEL_ENV)};`,
+		`const configArgsEnv = ${JSON.stringify(APP_SERVER_CONFIG_ARGS_ENV)};`,
+		"let configArgs = [];",
+		"try {",
+		'  const parsed = JSON.parse(process.env[configArgsEnv] ?? "[]");',
+		"  if (Array.isArray(parsed)) {",
+		'    configArgs = parsed.filter((arg) => typeof arg === "string");',
+		"  }",
+		"} catch {",
+		"  // Ignore malformed internal metadata and preserve app-server startup.",
+		"}",
 		"const rawArgs = process.argv.slice(1);",
 		"const firstArg = rawArgs[0] ?? \"\";",
 		'if (basename(firstArg).toLowerCase() === "app-server") {',
-		'  const args = ["app-server", ...rawArgs.slice(1)];',
+		'  const args = ["app-server", ...rawArgs.slice(1), ...configArgs];',
 		"  const env = {",
 		"    ...process.env,",
 		'    CODEX_MULTI_AUTH_RUNTIME_ROTATION_PROXY: "0",',
 		"    [accountLabelEnv]: \"1\",",
 		"  };",
+		"  delete env[configArgsEnv];",
 		"  const child = spawn(process.execPath, [wrapperScriptPath, ...args], {",
 		"    stdio: \"inherit\",",
 		"    env,",
@@ -3558,7 +3633,7 @@ function sweepStaleRuntimeRotationAppServerShimDirs(shimRootDir) {
 	}
 }
 
-function installRuntimeRotationAppServerCliShim(forwardedEnv) {
+function installRuntimeRotationAppServerCliShim(forwardedEnv, configArgs = []) {
 	const shadowCodexHome = forwardedEnv.CODEX_HOME;
 	if (!shadowCodexHome) {
 		throw new Error("runtime app-server shim requires CODEX_HOME");
@@ -3615,6 +3690,11 @@ function installRuntimeRotationAppServerCliShim(forwardedEnv) {
 	);
 	forwardedEnv.CODEX_MULTI_AUTH_RUNTIME_ROTATION_PROXY = "0";
 	forwardedEnv[APP_SERVER_ACCOUNT_LABEL_ENV] = "1";
+	if (configArgs.length > 0) {
+		forwardedEnv[APP_SERVER_CONFIG_ARGS_ENV] = JSON.stringify(configArgs);
+	} else {
+		delete forwardedEnv[APP_SERVER_CONFIG_ARGS_ENV];
+	}
 	return shimDir;
 }
 
@@ -3715,6 +3795,7 @@ function pickRuntimeRotationAppHelperEnv(env) {
 		"CODEX_MULTI_AUTH_REAL_CODEX_BIN",
 		"CODEX_MULTI_AUTH_RUNTIME_ROTATION_PROXY",
 		APP_SERVER_ACCOUNT_LABEL_ENV,
+		APP_SERVER_CONFIG_ARGS_ENV,
 	]) {
 		if (env[name]) {
 			picked[name] = env[name];
@@ -3776,7 +3857,7 @@ function createRuntimeRotationAppHelperStatus({
 
 async function runRuntimeRotationAppHelper() {
 	let proxyServer = null;
-	let shadowContext = null;
+	let runtimeContext = null;
 	let appServerShimDir = null;
 	let statusTimer = null;
 	let closing = false;
@@ -3813,7 +3894,7 @@ async function runRuntimeRotationAppHelper() {
 				}
 				appServerShimDir = null;
 			}
-			shadowContext?.cleanup?.();
+			runtimeContext?.cleanup?.();
 		} finally {
 			try {
 				await proxyServer?.close?.();
@@ -3844,13 +3925,33 @@ async function runRuntimeRotationAppHelper() {
 		}
 		const clientApiKey = createRuntimeRotationProxyClientApiKey();
 		proxyServer = await proxyModule.startRuntimeRotationProxy({ clientApiKey });
-		shadowContext = createRuntimeRotationProxyCodexHome(
-			process.env,
-			proxyServer.baseUrl,
-			clientApiKey,
-			configTomlModule,
+		const useCanonicalHome =
+			(process.env[APP_RUNTIME_HELPER_USE_CANONICAL_HOME_ENV] ?? "").trim() ===
+			"1";
+		runtimeContext = useCanonicalHome
+			? createRuntimeRotationProxyCanonicalCodexHome(
+					process.env,
+					proxyServer.baseUrl,
+					clientApiKey,
+					configTomlModule,
+				)
+			: createRuntimeRotationProxyCodexHome(
+					process.env,
+					proxyServer.baseUrl,
+					clientApiKey,
+					configTomlModule,
+				);
+		const appServerConfigArgs = useCanonicalHome
+			? [
+					...(runtimeContext.args ?? []),
+					"-c",
+					`model_provider=${configTomlModule.tomlStringLiteral(RUNTIME_ROTATION_PROXY_PROVIDER_ID)}`,
+				]
+			: [];
+		appServerShimDir = installRuntimeRotationAppServerCliShim(
+			runtimeContext.env,
+			appServerConfigArgs,
 		);
-		appServerShimDir = installRuntimeRotationAppServerCliShim(shadowContext.env);
 		lastRequestCount = proxyServer.getStatus?.().totalRequests ?? 0;
 		publishStatus("running");
 		process.stdout.write(
@@ -3859,7 +3960,8 @@ async function runRuntimeRotationAppHelper() {
 				pid: process.pid,
 				baseUrl: proxyServer.baseUrl,
 				statusPath: resolveRuntimeRotationAppHelperStatusPath(),
-				env: pickRuntimeRotationAppHelperEnv(shadowContext.env),
+				args: runtimeContext.args ?? [],
+				env: pickRuntimeRotationAppHelperEnv(runtimeContext.env),
 			})}\n`,
 		);
 
@@ -3901,6 +4003,9 @@ function waitForRuntimeRotationAppHelperExit(helper, timeoutMs = 2_000) {
 			if (settled) return;
 			settled = true;
 			if (timer) clearTimeout(timer);
+			// Drop the listener when the timeout wins, so a helper that outlives the
+			// graceful window does not keep a live reference back into this process.
+			helper.off?.("close", finish);
 			resolve();
 		};
 		timer = setTimeout(finish, timeoutMs);
@@ -3908,19 +4013,52 @@ function waitForRuntimeRotationAppHelperExit(helper, timeoutMs = 2_000) {
 	});
 }
 
-function stopRuntimeRotationAppHelper(helper) {
-	if (!helper || helper.killed) {
-		return Promise.resolve();
-	}
+function hasRuntimeRotationAppHelperExited(helper) {
+	return helper.exitCode !== null || helper.signalCode !== null;
+}
+
+// Releases every handle the helper still holds in this process. The helper is
+// spawned with piped stdio, so those pipes keep the parent event loop alive on
+// their own — destroying and unref-ing them is what actually lets `mcodex` return
+// to the shell when the child ignores or outlives SIGTERM (#647).
+function releaseRuntimeRotationAppHelperResources(helper) {
+	helper.stdout?.destroy();
+	helper.stderr?.destroy();
 	try {
-		helper.kill("SIGTERM");
+		helper.unref();
 	} catch {
-		return Promise.resolve();
+		// Best-effort only.
+	}
+}
+
+async function stopRuntimeRotationAppHelper(helper) {
+	if (!helper) {
+		return;
+	}
+	if (hasRuntimeRotationAppHelperExited(helper)) {
+		releaseRuntimeRotationAppHelperResources(helper);
+		return;
+	}
+	if (!helper.killed) {
+		try {
+			helper.kill("SIGTERM");
+		} catch {
+			releaseRuntimeRotationAppHelperResources(helper);
+			return;
+		}
+	}
+	await waitForRuntimeRotationAppHelperExit(helper);
+	if (!hasRuntimeRotationAppHelperExited(helper)) {
+		try {
+			helper.kill("SIGKILL");
+		} catch {
+			// Best-effort force-stop once the graceful shutdown window has elapsed.
+		}
 	}
-	return waitForRuntimeRotationAppHelperExit(helper);
+	releaseRuntimeRotationAppHelperResources(helper);
 }
 
-function startRuntimeRotationAppHelper(baseContext) {
+function startRuntimeRotationAppHelper(baseContext, options = {}) {
 	const realCodexHome =
 		baseContext.originalCodexHome ??
 		resolveRuntimeRotationProxyOriginalCodexHome(baseContext.env);
@@ -3940,6 +4078,8 @@ function startRuntimeRotationAppHelper(baseContext) {
 					),
 					[APP_RUNTIME_HELPER_OWNER_PID_ENV]: String(process.pid),
 					[APP_RUNTIME_HELPER_REAL_CODEX_HOME_ENV]: realCodexHome,
+					[APP_RUNTIME_HELPER_USE_CANONICAL_HOME_ENV]:
+						options.useCanonicalHome === true ? "1" : "0",
 				},
 				stdio: ["ignore", "pipe", "pipe"],
 				detached: true,
@@ -4005,8 +4145,14 @@ async function createRuntimeRotationAppHelperContext(
 	options = {},
 ) {
 	const startedAt = Date.now();
-	const { helper, message } = await startRuntimeRotationAppHelper(baseContext);
+	const { helper, message } = await startRuntimeRotationAppHelper(
+		baseContext,
+		options,
+	);
 	const helperEnv = message.env ?? {};
+	const helperArgs = Array.isArray(message.args)
+		? message.args.filter((arg) => typeof arg === "string")
+		: [];
 	const detachGraceMs = resolveRuntimeRotationAppHelperDetachGraceMs(baseContext.env);
 
 	const cleanup = async ({ exitCode } = {}) => {
@@ -4023,6 +4169,7 @@ async function createRuntimeRotationAppHelperContext(
 	return {
 		args: [
 			...baseContext.args,
+			...helperArgs,
 			"-c",
 			`model_provider=${configTomlModule.tomlStringLiteral(RUNTIME_ROTATION_PROXY_PROVIDER_ID)}`,
 		],
@@ -4060,9 +4207,13 @@ async function createRuntimeRotationProxyContextIfEnabled(
 	if (isCodexAppCommand(rawArgs)) {
 		return createRuntimeRotationAppHelperContext(baseContext, configTomlModule);
 	}
-	if (isCodexInteractiveTuiCommand(rawArgs)) {
+	if (
+		isCodexInteractiveTuiCommand(rawArgs) ||
+		isCodexInteractiveResumeCommand(rawArgs)
+	) {
 		return createRuntimeRotationAppHelperContext(baseContext, configTomlModule, {
 			detachOnExit: true,
+			useCanonicalHome: true,
 		});
 	}
 
@@ -4263,6 +4414,17 @@ function isCodexInteractiveTuiCommand(rawArgs) {
 	return findForwardedCommand(rawArgs) === null;
 }
 
+// `resume` and `fork` are interactive TUI entry points that happen to carry a
+// forwarded subcommand, so the bare-invocation predicate above misses them. They
+// must not take the shadow-home transport: the shadow mirror deliberately omits the
+// runtime SQLite state (`isRuntimeRotationShadowHomeOmittedEntry`), so the requested
+// thread is absent from the shadow session index and the resumed TUI hangs on a
+// blank screen (#647).
+function isCodexInteractiveResumeCommand(rawArgs) {
+	const command = findForwardedCommand(rawArgs)?.command;
+	return command === "resume" || command === "fork";
+}
+
 function shouldUseRuntimeRoutingForForwardedArgs(rawArgs) {
 	if (!Array.isArray(rawArgs) || rawArgs.length === 0) {
 		return true;
@@ -4302,7 +4464,17 @@ function shouldUseRuntimeRoutingForForwardedArgs(rawArgs) {
 		);
 	}
 
-	if (command.command === "app" && hasHelpFlagAfterCommand(rawArgs, command.index)) {
+	// Request commands still print their help without making a single model
+	// request, so the help form skips the transport entirely: no proxy, no shadow
+	// home, no detached helper. This matters most for the interactive commands,
+	// which detach their helper on a clean exit — help always exits clean, so
+	// `resume --help` would otherwise strand a helper until its idle timeout. It is
+	// keyed off the help flag rather than the command, so a real run still routes
+	// through rotation, and it matches how `app-server` help is handled above (#647).
+	if (
+		requestCommands.has(command.command) &&
+		hasHelpFlagAfterCommand(rawArgs, command.index)
+	) {
 		return false;
 	}
 	if (requestCommands.has(command.command)) {
@@ -5045,6 +5217,7 @@ async function main() {
 	}
 	const forwardArgs = forcedAccount.forwardArgs;
 
+	await ensurePersistedCodexFileAuthStore();
 	await autoSyncManagerActiveSelectionIfEnabled();
 	await maybePrintForwardStatusLine(forwardArgs);
 	maybeRefreshQuotaCacheInBackground();